@indigoai-us/hq-cli 5.342.12 → 5.342.14

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [5.342.14] — 2026-10-04
+- Fixed native HQ subprocess launching and job-lock command resolution on Windows.
+- Fixed Windows delegate/job shell parity while preserving embedded carriage returns and POSIX command/path bytes.
+
+## [5.342.13] — 2026-10-04
+- Run independent core migration differential cases with bounded parallel child processes while preserving per-case reports and failures.
+
+- Keep resident monitor lane delivery in-process and release the supervisor package lease after its lane-message modules preload.
+- Show `hq daemon install` or `hq daemon restart --daemon` in the runtime-health row when the Unix hqd socket is unreachable, based on whether its service is installed.
+- Run shared typecheck and lint once on pull requests while retaining the Node 20 build and test coverage leg.
+- Honor blocked lead `next_check_at` values behind the existing blocked-resume flag, and report due blocked checks in the keep-alive audit.
+- Release package-use leases for agent kit, agent MCP, mesh daemon, lanes watch and wait, and monitor hook wait only after each resident import graph loads.
+- Share one Node 22 CLI build artifact across the four e2e shards to reduce repeated build work.
+- Remove the unused remote vault database helpers. No command called them.
+- Updated semver and its type definitions, and pinned esbuild to 0.28.2.
+- Combine the live Windows pipe DACL and current-user SID inspection in one PowerShell process in the integration test.
+
 ## [5.342.12] — 2026-10-04
 
 - Record every lane worker resume with its launch time and trigger, and classify watcher, monitor-event, and pending-work wakes separately from keep-alive timer accuracy.

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -35,6 +35,15 @@ die()   { echo "hq-delegate-grant: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 MANIFEST="" YES=0
 while [ $# -gt 0 ]; do
   case "$1" in

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -40,6 +40,15 @@ die()   { echo "hq-delegate-send: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 MANIFEST="" SEND=0 HEADLINE="" NOTE=""
 while [ $# -gt 0 ]; do
   case "$1" in

package/assets/scaffold/core/scripts/hq-job-probe.sh

@@ -120,6 +120,15 @@ done
 command -v yq >/dev/null 2>&1 || die "yq is required (mikefarah/yq)"
 command -v jq >/dev/null 2>&1 || die "jq is required"
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 iso_now() {
   if [ -n "${HQ_JOB_PROBE_NOW:-}" ]; then
     printf '%s' "$HQ_JOB_PROBE_NOW"

package/assets/scaffold/core/scripts/jobs-validate.sh

@@ -40,6 +40,15 @@ command -v jq >/dev/null 2>&1 || {
   exit 2
 }
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 [ "$#" -ge 1 ] || die_usage
 
 collect_files() {

package/dist/commands/agent-kit.d.ts

@@ -24,6 +24,7 @@ import { type KitLogger } from "../lib/agent-kit/log.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import { type KitService } from "../lib/agent-kit/services.js";
 import { type CronRunner, type RebootCronResult, type DetachedSpawn, type KillFn } from "../lib/agent-kit/fallback.js";
+import { type ResidentCommandLeaseOptions } from "../utils/resident-package-preload.js";
 import { type ServiceHostPaths, type ServiceManagerDeps, type ServiceSetResult } from "../lib/service-manager/index.js";
 import type { HeartbeatCredsSource } from "../lib/heartbeat-identity.js";
 export declare class KitError extends Error {
@@ -83,5 +84,6 @@ export declare function runKitService(service: KitService, rt: KitRuntime): Prom
 /** `kit run all`: supervise the kit services as child processes with restart backoff. */
 export declare function runAllKitServices(rt: KitRuntime, host: ServiceHostPaths): Promise<void>;
 export declare function formatFallbackStatus(paths: AgentKitPaths, kill?: KillFn): string[] | null;
+export declare function runAgentKitWithPackageLease<T>(run: () => Promise<T>, options?: ResidentCommandLeaseOptions): Promise<T>;
 export declare function registerAgentKitCommand(agent: Command): void;
 //# sourceMappingURL=agent-kit.d.ts.map

package/dist/commands/agent-kit.js

@@ -33,6 +33,7 @@ import { runInboxLoop } from "../lib/agent-kit/run/inbox.js";
 import { superviseKitServices } from "../lib/agent-kit/run/supervisor.js";
 import { fallbackStatus, rebootCrontabLine, ensureRebootCrontab, shouldUseFallback, startFallback, stopFallback, } from "../lib/agent-kit/fallback.js";
 import { serviceLogPath } from "../lib/agent-kit/paths.js";
+import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { spawn } from "node:child_process";
 import { pendingInbox } from "../lib/agent-kit/inbox-state.js";
 import { buildWakeNotice, clearWakeConfig, currentWakeState, DEFAULT_WAKE_RETRY_MS, describeWake, fireWake, readWakeConfig, validateWakeUrl, writeWakeConfig, } from "../lib/agent-kit/wake.js";
@@ -242,6 +243,9 @@ function fail(err) {
     console.error(chalk.red(err instanceof Error ? err.message : String(err)));
     process.exit(1);
 }
+export function runAgentKitWithPackageLease(run, options) {
+    return runResidentCommandWithPackageLease("agent-kit", run, options);
+}
 export function registerAgentKitCommand(agent) {
     const kit = agent
         .command("kit")
@@ -453,28 +457,30 @@ export function registerAgentKitCommand(agent) {
         .command("run <service>")
         .description(`Run one kit service in the foreground (${KIT_SERVICES.join("|")}), or \`all\` to supervise every service in one process`)
         .action(async (service) => {
-        if (service === "all") {
+        if (service !== "all" && !isKitService(service)) {
+            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: all, ${KIT_SERVICES.join(", ")}`));
+            process.exit(1);
+        }
+        await runAgentKitWithPackageLease(async () => {
+            if (service === "all") {
+                try {
+                    const paths = agentKitPaths(os.homedir(), process.env);
+                    const rt = buildKitRuntime("all");
+                    await runAllKitServices(rt, resolveServiceHost(paths));
+                    process.exit(0);
+                }
+                catch (err) {
+                    fail(err);
+                }
+            }
             try {
-                const paths = agentKitPaths(os.homedir(), process.env);
-                const rt = buildKitRuntime("all");
-                await runAllKitServices(rt, resolveServiceHost(paths));
-                process.exit(0);
+                const rt = buildKitRuntime(service);
+                await runKitService(service, rt);
             }
             catch (err) {
                 fail(err);
             }
-        }
-        if (!isKitService(service)) {
-            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: all, ${KIT_SERVICES.join(", ")}`));
-            process.exit(1);
-        }
-        try {
-            const rt = buildKitRuntime(service);
-            await runKitService(service, rt);
-        }
-        catch (err) {
-            fail(err);
-        }
+        });
     });
 }
 //# sourceMappingURL=agent-kit.js.map

package/dist/commands/agent-mcp.d.ts

@@ -13,6 +13,7 @@ import { McpServer } from "../lib/agent-kit/mcp/jsonrpc.js";
 import { type HqRunResult, type McpToolClients } from "../lib/agent-kit/mcp/tools.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import type { ExternalMachineCreds } from "../lib/agent-kit/creds.js";
+import { type ResidentCommandLeaseOptions } from "../utils/resident-package-preload.js";
 export { readBounded } from "../lib/agent-kit/attachment-download.js";
 export declare const AGENT_MCP_SERVER_NAME = "hq-agent";
 export declare const AGENT_MCP_INSTRUCTIONS: string;
@@ -20,5 +21,6 @@ export declare const HQ_SUBPROCESS_TIMEOUT_MS = 120000;
 export declare function defaultRunHq(nodeBinary: string, hqBinary: string, env: NodeJS.ProcessEnv): (args: string[]) => Promise<HqRunResult>;
 export declare function defaultMcpClients(creds: ExternalMachineCreds, credsPath: string, paths?: Pick<AgentKitPaths, "inboxDir" | "attachmentsDir">): McpToolClients;
 export declare function createAgentMcpServer(clients: McpToolClients): McpServer;
+export declare function runAgentMcpWithPackageLease<T>(run: () => Promise<T>, options?: ResidentCommandLeaseOptions): Promise<T>;
 export declare function registerAgentMcpCommand(agent: Command): void;
 //# sourceMappingURL=agent-mcp.d.ts.map

package/dist/commands/agent-mcp.js

@@ -19,6 +19,7 @@ import { buildAgentMcpTools } from "../lib/agent-kit/mcp/tools.js";
 import { readKitConfig } from "../lib/agent-kit/kit-config.js";
 import { agentKitPaths } from "../lib/agent-kit/paths.js";
 import { requireExternalCreds } from "./agent-kit.js";
+import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 // Re-exported for callers that imported it from here before it moved.
 export { readBounded } from "../lib/agent-kit/attachment-download.js";
 export const AGENT_MCP_SERVER_NAME = "hq-agent";
@@ -102,26 +103,31 @@ export function createAgentMcpServer(clients) {
         tools: buildAgentMcpTools(clients),
     });
 }
+export function runAgentMcpWithPackageLease(run, options) {
+    return runResidentCommandWithPackageLease("agent-mcp", run, options);
+}
 export function registerAgentMcpCommand(agent) {
     agent
         .command("mcp")
         .description("Serve HQ as a stdio MCP server for the bot framework (whoami, search, files, secrets-exec, dm, inbox, work-mesh)")
         .action(async () => {
-        const paths = agentKitPaths(os.homedir(), process.env);
-        let creds;
-        try {
-            creds = requireExternalCreds(paths);
-        }
-        catch (err) {
-            process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
-            process.exit(1);
-        }
-        process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
-        process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
-        process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
-        const server = createAgentMcpServer(defaultMcpClients(creds, paths.machineCredsPath, paths));
-        process.stderr.write(`hq agent mcp: serving as ${creds.entityUid} (${creds.companySlug})\n`);
-        await server.serve(process.stdin, process.stdout);
+        await runAgentMcpWithPackageLease(async () => {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            let creds;
+            try {
+                creds = requireExternalCreds(paths);
+            }
+            catch (err) {
+                process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(1);
+            }
+            process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
+            process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
+            process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
+            const server = createAgentMcpServer(defaultMcpClients(creds, paths.machineCredsPath, paths));
+            process.stderr.write(`hq agent mcp: serving as ${creds.entityUid} (${creds.companySlug})\n`);
+            await server.serve(process.stdin, process.stdout);
+        });
     });
 }
 //# sourceMappingURL=agent-mcp.js.map

package/dist/commands/core-delegate-w1b.js

@@ -4,6 +4,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { commandExists, isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
@@ -171,12 +172,20 @@ function parseFlags(args, allowed) {
 }
 function usage(name) { return USAGE[name] ?? ""; }
 function usageFailure(name) { err(usage(name)); return 1; }
+function bashPath(value) {
+    if (process.platform !== "win32")
+        return value;
+    const normalized = value.replaceAll("\\", "/");
+    const drivePath = /^([A-Za-z]):\/(.*)$/u.exec(normalized);
+    return drivePath ? `/${drivePath[1].toLowerCase()}/${drivePath[2]}` : normalized;
+}
 function runShellFallback(name, args, context) {
+    const root = context.root ?? context.cwd;
     const result = runBundledScript({
         asset: ASSETS[name],
         args,
         cwd: context.cwd,
-        hqRoot: context.root ?? context.cwd,
+        hqRoot: bashPath(root),
         captureOutput: true,
     });
     if (result.stdout?.length)
@@ -392,16 +401,16 @@ function runGrant(args, context) {
     if (!manifestPath)
         return fail("grant", "--manifest is required");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("grant", `manifest not found: ${manifestPath}`);
+        return fail("grant", `manifest not found: ${shellDisplayPath(manifestPath)}`);
     let manifest;
     try {
         manifest = readJsonFile(manifestPath);
     }
     catch {
-        return fail("grant", `manifest is not valid JSON: ${manifestPath}`);
+        return fail("grant", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
     }
     if (manifest === null || manifest === false)
-        return fail("grant", `manifest is not valid JSON: ${manifestPath}`);
+        return fail("grant", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
     if (!isRecord(manifest))
         return fail("grant", "manifest has no company");
     const company = jqRawPath(manifest, "company");
@@ -778,13 +787,13 @@ function runSend(args, context) {
     if (!manifestPath)
         return fail("send", "--manifest is required");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("send", `manifest not found: ${manifestPath}`);
+        return fail("send", `manifest not found: ${shellDisplayPath(manifestPath)}`);
     const manifest = jsonFile(manifestPath);
     if (!manifest)
-        return fail("send", `manifest is not valid JSON: ${manifestPath}`);
+        return fail("send", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
     if (send) {
         const publishedPath = path.join(context.root ?? context.cwd, jqRawPath(manifest, "publication.manifestPath"));
-        if (fs.existsSync(publishedPath) && fs.statSync(publishedPath).isFile() && malformedJsonFile(publishedPath)) {
+        if (malformedJsonFile(publishedPath)) {
             return runShellFallback("send", args, context);
         }
     }
@@ -894,7 +903,7 @@ function runSend(args, context) {
         }
         moveFile(stagedPrompt, prompt);
         fs.rmSync(stage, { recursive: true, force: true });
-        out(`hq-delegate-send: pickup prompt written: ${prompt}\n`);
+        out(`hq-delegate-send: pickup prompt written: ${shellDisplayPath(prompt)}\n`);
         if (!send)
             return 0;
         if (jqRawPath(manifest, "status") !== "verified")
@@ -1035,12 +1044,12 @@ function runVerify(args, context) {
     if (!manifestPath)
         return fail("verify", "--manifest is required (or --dry-run with --company/--project/--to)");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("verify", `manifest not found: ${manifestPath}`);
+        return fail("verify", `manifest not found: ${shellDisplayPath(manifestPath)}`);
     if (malformedJsonFile(manifestPath))
         return runShellFallback("verify", args, context);
     const manifest = jsonFile(manifestPath);
     if (!manifest)
-        return fail("verify", `jq: error: ${manifestPath}: Invalid JSON`);
+        return fail("verify", `jq: error: ${shellDisplayPath(manifestPath)}: Invalid JSON`);
     const lock = `${manifestPath}.send-lock`;
     try {
         fs.mkdirSync(lock);

package/dist/commands/core-delegate.d.ts

@@ -1,5 +1,6 @@
 /** Native implementations of the five `hq core delegate` shell companions. */
 import { Command } from "commander";
+import { type SpawnPlan } from "../utils/windows-spawn.js";
 export declare const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
 export type DelegateContext = {
     cwd: string;
@@ -18,6 +19,7 @@ export type CommandExistsOptions = {
     existsSync?: (candidate: string) => boolean;
 };
 export declare function commandExists(name: string, cwd?: string, options?: CommandExistsOptions): boolean;
+export declare function delegateSubprocessSpawnPlan(command: string, args: readonly string[], env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SpawnPlan;
 export declare function subprocess(command: string, args: string[], cwd: string, options?: {
     input?: Buffer | string;
     stdinFd?: number;

package/dist/commands/core-delegate.js

@@ -4,7 +4,9 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { buildCmdExeSpawnPlan, isWindowsBatchFile } from "../utils/windows-spawn.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
@@ -86,13 +88,23 @@ function commandPath(name, cwd = process.cwd(), options = {}) {
 export function commandExists(name, cwd = process.cwd(), options = {}) {
     return commandPath(name, cwd, options) !== undefined;
 }
+export function delegateSubprocessSpawnPlan(command, args, env = process.env, platform = process.platform) {
+    return isWindowsBatchFile(command, platform)
+        ? buildCmdExeSpawnPlan(command, args, env, platform)
+        : { cmd: command, args: [...args], shell: false };
+}
 export function subprocess(command, args, cwd, options = {}) {
-    const result = spawnSync(command, args, {
+    const childEnv = { ...process.env, ...options.env };
+    const resolvedCommand = process.platform === "win32" ? commandPath(command, cwd, { env: childEnv }) : undefined;
+    const spawn = resolvedCommand ? delegateSubprocessSpawnPlan(resolvedCommand, args, childEnv) : { cmd: command, args, shell: false };
+    const result = spawnSync(spawn.cmd, spawn.args, {
         cwd,
-        env: { ...process.env, ...options.env },
+        env: childEnv,
         input: options.input,
         maxBuffer: options.maxBuffer,
         encoding: "buffer",
+        shell: spawn.shell,
+        ...(spawn.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
         stdio: [options.input === undefined ? options.stdinFd ?? "inherit" : "pipe", options.stdout === "inherit" ? "inherit" : options.stdout === "ignore" ? "ignore" : "pipe", options.stderr === "pipe" ? "pipe" : options.stderr ?? "inherit"],
     });
     if (result.error) {
@@ -563,11 +575,11 @@ function existingManifest(name, args, context) {
     }
     const file = path.resolve(context.cwd, manifestArg);
     if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
-        writeErr(`${prefix} manifest not found: ${manifestArg}\n`);
+        writeErr(`${prefix} manifest not found: ${shellDisplayPath(manifestArg)}\n`);
         return { code: 1, parsed };
     }
     if (!jqValid(file)) {
-        writeErr(`${prefix} manifest is not valid JSON: ${manifestArg}\n`);
+        writeErr(`${prefix} manifest is not valid JSON: ${shellDisplayPath(manifestArg)}\n`);
         return { code: 1, parsed };
     }
     return { file, parsed, document: readJsonFile(file) };

package/dist/commands/core-job-probe-native.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
 export declare const JOB_PROBE_ASSET = "core/scripts/hq-job-probe.sh";
+export declare function displayJobFile(value: string, platform?: NodeJS.Platform): string;
+export declare function displayShellPath(value: string, platform?: NodeJS.Platform): string;
 export declare const JOB_PROBE_USAGE: string;
 export type Checks = {
     runtime: string;
@@ -30,7 +32,7 @@ export type ProbeDeps = {
     isDirectory: (file: string) => boolean;
     realpath: (file: string) => string | undefined;
     readText: (file: string) => string;
-    writeState: (file: string, body: string) => void;
+    writeState: (file: string, body: string, mode: number) => void;
     writeStderr: (line: string) => void;
     listSecrets: (company?: string) => Promise<{
         code: number;
@@ -39,6 +41,7 @@ export type ProbeDeps = {
     commandExists: (name: string) => boolean;
     fetcher: (url: string, init: RequestInit) => Promise<Response>;
 };
+export declare function hasProbeCommand(name: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform, existsSync?: (candidate: string) => boolean): boolean;
 export declare function defaultProbeDeps(root: string, env?: Record<string, string | undefined>): ProbeDeps;
 export declare function runJobProbe(argv: string[], injected?: ProbeDeps): Promise<ProbeResult>;
 export declare function registerCoreJobProbeCommand(job: Command): void;

package/dist/commands/core-job-probe-native.js

@@ -8,7 +8,21 @@ import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { coreNativeJobsEnabled } from "./core-native-jobs-flag.js";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
 export const JOB_PROBE_ASSET = "core/scripts/hq-job-probe.sh";
+export function displayJobFile(value, platform = process.platform) {
+    if (platform !== "win32")
+        return value;
+    return path.win32.resolve(value).replaceAll("\\", "/");
+}
+export function displayShellPath(value, platform = process.platform) {
+    if (platform !== "win32")
+        return value;
+    const normalized = value.replaceAll("\\", "/");
+    const drivePath = /^([A-Za-z]):\/(.*)$/u.exec(normalized);
+    return drivePath ? `/${drivePath[1].toLowerCase()}/${drivePath[2]}` : normalized;
+}
 export const JOB_PROBE_USAGE = [
     "hq-job-probe.sh — Outpost requirements probe → hq-pro jobs status (US-008).", "",
     "On the Outpost, deterministically checks a job's requirements checklist and",
@@ -79,8 +93,8 @@ const realpath = (f) => { try {
 catch {
     return undefined;
 } };
-function writeState(file, body) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, `${body}\n`, { mode: 0o600 }); try {
-    fs.chmodSync(file, 0o600);
+function writeState(file, body, mode) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, `${body}\n`, { mode }); try {
+    fs.chmodSync(file, mode);
 }
 catch { /* legacy chmod is best-effort */ } }
 function hasCommand(name, env) {
@@ -97,10 +111,29 @@ function hasCommand(name, env) {
     }
     return false;
 }
+export function hasProbeCommand(name, env, platform = process.platform, existsSync = (candidate) => { try {
+    return fs.statSync(candidate).isFile();
+}
+catch {
+    return false;
+} }) {
+    return platform === "win32"
+        ? resolveWindowsExecutable(name, env, existsSync, process.cwd()) !== null
+        : hasCommand(name, env);
+}
 function listSecrets(company) {
     // Keep the `hq secrets list` subprocess: no in-process API produces the same names-only table.
     const args = company ? ["secrets", "list", "--company", company] : ["secrets", "list", "--personal"];
-    const r = spawnSync("hq", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const executable = process.platform === "win32"
+        ? resolveWindowsExecutable("hq", process.env, (candidate) => { try {
+            return fs.statSync(candidate).isFile();
+        }
+        catch {
+            return false;
+        } }, process.cwd()) ?? "hq"
+        : "hq";
+    const plan = planResolvedCommandSpawn(executable, args, process.env);
+    const r = spawnSync(plan.cmd, plan.args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], shell: plan.shell, ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}) });
     return Promise.resolve({ code: r.status ?? (r.error ? 127 : 1), stdout: r.stdout ?? "" });
 }
 export function defaultProbeDeps(root, env = process.env) {
@@ -111,7 +144,7 @@ export function defaultProbeDeps(root, env = process.env) {
         statSize, isFile, isDirectory, realpath, readText: (f) => fs.readFileSync(f, "utf8"), writeState,
         writeStderr: (line) => process.stderr.write(line),
         listSecrets: stubs ? async () => { throw new Error("HQ_JOB_TEST_STUB blocked real hq secrets list"); } : listSecrets,
-        commandExists: (name) => hasCommand(name, env),
+        commandExists: (name) => hasProbeCommand(name, env),
         fetcher: stubs ? async () => { throw new Error("HQ_JOB_TEST_STUB blocked real network fetch"); } : (url, init) => fetch(url, init) };
 }
 const isoNow = (d) => d.env.HQ_JOB_PROBE_NOW || d.now().toISOString().replace(/\.\d{3}Z$/, "Z");
@@ -148,9 +181,21 @@ function legacyYamlParseDiagnostics(file, d) {
     // The shell evaluates each field with yq before checking the now-empty id;
     // preserve the six parser diagnostics it emits on malformed input.
     const expressions = [".id // \"\"", ".name // \"\"", ".runtime // \"\"", ".requirements.runtime // \"\"", ".requirements.company // \"\"", ".requirements.cwd // .cwd // \"\""];
-    return expressions.map((expression) => spawnSync("yq", ["-r", expression, file], {
-        cwd: d.root, env: d.env, encoding: "utf8",
-    }).stderr ?? "").join("");
+    return expressions.map((expression) => {
+        const executable = process.platform === "win32"
+            ? resolveWindowsExecutable("yq", d.env, (candidate) => { try {
+                return fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            } }, d.root) ?? "yq"
+            : "yq";
+        const plan = planResolvedCommandSpawn(executable, ["-r", expression, file], d.env);
+        return spawnSync(plan.cmd, plan.args, {
+            cwd: d.root, env: d.env, encoding: "utf8", shell: plan.shell,
+            ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+        }).stderr ?? "";
+    }).join("");
 }
 function findById(id, d) {
     let found;
@@ -240,8 +285,8 @@ function auth(runtime, d) {
     const file = runtime === "claude" ? d.env.HQ_JOB_PROBE_CLAUDE_CRED || path.join(d.home, ".claude/.credentials.json") : d.env.HQ_JOB_PROBE_CODEX_AUTH || path.join(d.home, ".codex/auth.json");
     return (d.statSize(file) ?? 0) > 0 ? "ok" : "missing";
 }
-function writeAttempt(d, id, data) { d.writeState(path.join(d.env.HQ_JOB_PROBE_STATE_DIR || path.join(d.home, ".hq/jobs/probes"), id, "last-attempt.json"), compact(data)); }
-function writeCache(d, id, readiness, source) { d.writeState(path.join(d.env.HQ_JOB_STATUS_CACHE_DIR || path.join(d.home, ".hq/jobs/status-cache"), `${id}.json`), compact({ job_id: id, readiness, updated_at: isoNow(d), source })); }
+function writeAttempt(d, id, data) { d.writeState(path.join(d.env.HQ_JOB_PROBE_STATE_DIR || path.join(d.home, ".hq/jobs/probes"), id, "last-attempt.json"), compact(data), 0o600); }
+function writeCache(d, id, readiness, source) { d.writeState(path.join(d.env.HQ_JOB_STATUS_CACHE_DIR || path.join(d.home, ".hq/jobs/status-cache"), `${id}.json`), compact({ job_id: id, readiness, updated_at: isoNow(d), source }), 0o600); }
 function resolveCwd(root, cwd, d) {
     const canon = d.realpath(root) ?? path.resolve(root), candidate = path.resolve(root, cwd), file = d.realpath(candidate) ?? candidate;
     return { file, allowed: file === canon || file.startsWith(`${canon}${path.sep}`) };
@@ -293,13 +338,13 @@ async function probeFile(file, dry, d) {
     catch (e) {
         const rawStderr = legacyYamlParseDiagnostics(file, d);
         if (rawStderr)
-            throw new Fatal(`job missing id: ${file}`, 2, "hq-job-probe", rawStderr);
+            throw new Fatal(`job missing id: ${displayShellPath(file)}`, 2, "hq-job-probe", rawStderr);
         throw new Fatal(`invalid job YAML: ${file}${e instanceof Error ? `: ${e.message}` : ""}`);
     }
     const id = scalar(job.id), name = scalar(job.name), runtime = scalar(nested(job, "requirements", "runtime")) || scalar(job.runtime);
     const company = scalar(nested(job, "requirements", "company")), cwd = scalar(nested(job, "requirements", "cwd") ?? job.cwd);
     if (!id)
-        throw new Fatal(`job missing id: ${file}`);
+        throw new Fatal(`job missing id: ${displayShellPath(file)}`);
     if (!runtime)
         throw new Fatal(`job missing runtime: ${file}`);
     const at = isoNow(d), actions = [], authState = auth(runtime, d);
@@ -411,7 +456,7 @@ async function probeFile(file, dry, d) {
             }
         }
     }
-    return { code: ingestFailed ? 3 : blocked ? 1 : 0, value: { job_id: id, name, job_file: file, readiness: finalReadiness, probed_at: at, ingest, http, dry_run: dry, checks, next_actions: finalActions } };
+    return { code: ingestFailed ? 3 : blocked ? 1 : 0, value: { job_id: id, name, job_file: displayJobFile(file), readiness: finalReadiness, probed_at: at, ingest, http, dry_run: dry, checks, next_actions: finalActions } };
 }
 function parseArgs(argv) {
     const a = [...argv];
@@ -470,7 +515,7 @@ export async function runJobProbe(argv, injected) {
             return { code: 2, stdout: "", stderr: "hq-job-probe: --all does not take a job argument\n" };
         const files = allFiles(root);
         if (!files.length)
-            return { code: 2, stdout: "", stderr: `hq-job-probe: no job YAML found under personal/jobs or companies/*/jobs in ${root}\n` };
+            return { code: 2, stdout: "", stderr: `hq-job-probe: no job YAML found under personal/jobs or companies/*/jobs in ${displayShellPath(root)}\n` };
         let code = 0;
         try {
             for (const f of files) {
@@ -500,7 +545,10 @@ export async function runJobProbe(argv, injected) {
             // then emits the ordinary not-found error after the process substitution
             // closes. Preserve both stderr lines for byte parity.
             if (x instanceof Fatal && x.message.startsWith("duplicate job id '")) {
-                return { code: x.code, stdout: "", stderr: `${x.prefix}: ${x.message}\n${x.prefix}: job id not found in registry: ${opts.target}\n` };
+                const shellMessage = process.platform === "win32"
+                    ? x.message.replace(/([A-Za-z]):[\\/]/gu, (_match, drive) => "/" + drive.toLowerCase() + "/").replaceAll("\\", "/")
+                    : x.message;
+                return { code: x.code, stdout: "", stderr: `${x.prefix}: ${shellMessage}\n${x.prefix}: job id not found in registry: ${opts.target}\n` };
             }
             return failure(x);
         }

package/dist/commands/core-job-run-native.js

@@ -2,6 +2,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawn } from "node:child_process";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
 import { fileURLToPath } from "node:url";
 import { JSON_SCHEMA, load } from "js-yaml";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
@@ -256,14 +258,24 @@ export async function spawnProcess(request) {
 }
 /** Holds the same kernel flock(2) lock used by the shell companion. */
 export async function acquireFlock(file, env = process.env) {
-    const binary = env.HQ_JOB_FLOCK_BIN || pathExecutable("flock", env);
+    const binary = env.HQ_JOB_FLOCK_BIN || (process.platform === "win32"
+        ? resolveWindowsExecutable("flock", env, (candidate) => { try {
+            return fs.statSync(candidate).isFile();
+        }
+        catch {
+            return false;
+        } }, process.cwd())
+        : pathExecutable("flock", env));
     if (!binary)
         throw new Error("Outpost/Linux requires util-linux flock(1) for serialized job runs");
     fs.mkdirSync(path.dirname(file), { recursive: true });
     return await new Promise((resolve, reject) => {
-        const child = spawn(binary, ["-x", file, process.execPath, "-e", LOCK_HOLDER], {
+        const spawnPlan = planResolvedCommandSpawn(binary, ["-x", file, process.execPath, "-e", LOCK_HOLDER], env);
+        const child = spawn(spawnPlan.cmd, spawnPlan.args, {
             env,
             stdio: ["pipe", "pipe", "pipe"],
+            shell: spawnPlan.shell,
+            ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
         });
         let stdout = "";
         let stderr = "";

package/dist/commands/core-jobs-native.js

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import { JSON_SCHEMA, load, loadAll } from "js-yaml";
 import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
@@ -972,7 +973,7 @@ function systemdQuote(value) {
 }
 function serviceUnit(root, runner, id) {
     const pathValue = systemdQuote(`PATH=${servicePathValue()}`);
-    return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nEnvironment=HQ_ROOT=${root}\nEnvironment=${pathValue}\nExecStart=${runner} --hq-root ${root} --job-id ${id}\nNice=10\n\n[Install]\nWantedBy=default.target\n`;
+    return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nEnvironment=HQ_ROOT=${root}\nEnvironment=${pathValue}\nExecStart=${shellDisplayPath(runner)} --hq-root ${root} --job-id ${id}\nNice=10\n\n[Install]\nWantedBy=default.target\n`;
 }
 function timerUnit(id, onCalendar, randomize, root) {
     return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job timer: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\n\n[Timer]\nOnCalendar=${onCalendar}\nPersistent=true\nRandomizedDelaySec=${randomize}\nUnit=hq-job-${id}.service\n\n[Install]\nWantedBy=timers.target\n`;