@indigoai-us/hq-cli 5.342.12 → 5.342.14

package/dist/lib/lanes/keep-alive-audit.d.ts

@@ -14,6 +14,8 @@ interface KeepAliveAuditRow {
     due_at: string;
     due_reason: "next_check_at" | "backoff";
     restart: KeepAliveAuditRestart | null;
+    blocked_outcome?: "woken" | "skipped";
+    blocked_outcome_reason?: string;
     verdict: KeepAliveAuditVerdict;
 }
 interface KeepAliveAuditSummary {
@@ -42,6 +44,7 @@ export interface KeepAliveAuditResult {
 export interface StopEnvelope {
     name: string;
     mtimeMs: number;
+    decision: "done" | "blocked";
     nextCheckAt?: string;
 }
 export declare function readStopEnvelopes(hqRoot: string, laneId: string): {

package/dist/lib/lanes/keep-alive-audit.js

@@ -1,11 +1,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS } from "./keep-alive.js";
+import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS } from "./keep-alive.js";
 import { LanesError } from "./errors.js";
 import { laneRunDir } from "./spawn.js";
 import { compareEnvelopeNames } from "./envelope-sequence.js";
 import { listQuestionIds, readAllLanes, tryReadQuestion } from "./store.js";
-function readDoneClassifications(hqRoot, laneId) {
+import { isIsoDateTime } from "./types.js";
+function readTerminalClassifications(hqRoot, laneId) {
     const root = fs.realpathSync(hqRoot);
     const watcherLog = path.join(laneRunDir(root, laneId), "logs", "watcher.out");
     if (!withinRoot(root, watcherLog)) {
@@ -28,23 +29,23 @@ function readDoneClassifications(hqRoot, laneId) {
             return [];
         throw err;
     }
-    const atTimes = [];
+    const classifications = [];
     for (const line of text.split(/\r?\n/)) {
         if (!line.includes('"classification"'))
             continue;
         try {
             const value = JSON.parse(line);
-            if (!isRecord(value) || value.state !== "done")
+            if (!isRecord(value) || (value.state !== "done" && value.state !== "blocked"))
                 continue;
             const at = parseTime(value.at);
             if (at !== undefined)
-                atTimes.push(at);
+                classifications.push({ at, state: value.state });
         }
         catch (err) {
             throw new LanesError("keep_alive_audit_event_invalid", `Cannot parse lane watcher classification in ${watcherLog}: ${err instanceof Error ? err.message : String(err)}`, { lane_id: laneId, path: watcherLog });
         }
     }
-    return atTimes.sort((a, b) => a - b);
+    return classifications.sort((a, b) => a.at - b.at);
 }
 const KEEP_ALIVE_ON_TIME_TOLERANCE_MS = 60_000;
 const KEEP_ALIVE_NOT_RESTARTED_GRACE_MS = 5 * 60_000;
@@ -161,11 +162,15 @@ export function readStopEnvelopes(hqRoot, laneId) {
         if (!isRecord(raw) || raw.schema_version !== "hq-lane-envelope.v1") {
             throw new LanesError("keep_alive_audit_envelope_invalid", `Lane envelope is not hq-lane-envelope.v1: ${file}`, { lane_id: laneId, path: file });
         }
-        if (raw.decision !== "done" || raw.story_complete !== false)
+        const doneStop = raw.decision === "done" && raw.story_complete === false;
+        const blockedStop = raw.decision === "blocked" && typeof raw.next_check_at === "string" &&
+            isIsoDateTime(raw.next_check_at) && Date.parse(raw.next_check_at) > stat.mtimeMs;
+        if (!doneStop && !blockedStop)
             continue;
         stops.push({
             name,
             mtimeMs: stat.mtimeMs,
+            decision: blockedStop ? "blocked" : "done",
             ...(typeof raw.next_check_at === "string" ? { nextCheckAt: raw.next_check_at } : {}),
         });
     }
@@ -227,11 +232,14 @@ function readKeepAliveResumeEvents(hqRoot, laneId) {
     return events.sort((a, b) => a.at - b.at);
 }
 function dueTime(stop, resumeEvents) {
+    const nextCheck = parseTime(stop.nextCheckAt);
+    if (stop.decision === "blocked" && nextCheck !== undefined && nextCheck > stop.mtimeMs) {
+        return { at: Math.min(nextCheck, stop.mtimeMs + LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS), reason: "next_check_at" };
+    }
     const previousResume = resumeEvents.filter((event) => event.at <= stop.mtimeMs).at(-1);
     const terminalPlusBackoff = stop.mtimeMs + LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS;
     let due = Math.max(terminalPlusBackoff, previousResume?.nextEligibleAt ?? 0);
     let reason = "backoff";
-    const nextCheck = parseTime(stop.nextCheckAt);
     if (nextCheck !== undefined && nextCheck > stop.mtimeMs) {
         due = Math.max(due, Math.min(nextCheck, stop.mtimeMs + MAX_NEXT_CHECK_DELAY_MS));
         reason = "next_check_at";
@@ -329,6 +337,38 @@ function laneWasKeepAliveOffAtStop(lane, stoppedAt) {
     const optedInAt = parseTime(lane.keep_alive_opted_in_at);
     return optedInAt === undefined || optedInAt > stoppedAt;
 }
+function blockedKeepAliveOutcome(lane, stop, nextEnvelopeMs) {
+    const terminalAt = lane.last_envelope?.ref === `envelopes/${stop.name}`
+        ? parseTime(lane.last_envelope.at)
+        : undefined;
+    const candidates = (lane.status_gate_history ?? []).flatMap((entry) => {
+        if (entry.event !== "keep_alive_blocked_resumed" && entry.event !== "keep_alive_blocked_skipped")
+            return [];
+        const at = parseTime(entry.at);
+        const terminal = parseTime(entry.terminal_at);
+        if (at === undefined || terminal === undefined)
+            return [];
+        if (nextEnvelopeMs !== undefined && at >= nextEnvelopeMs)
+            return [];
+        const sameStop = terminalAt !== undefined
+            ? terminal === terminalAt
+            : Math.abs(terminal - stop.mtimeMs) <= 10 * 60_000;
+        if (!sameStop)
+            return [];
+        if (entry.event === "keep_alive_blocked_skipped" && entry.reason !== "flag_off")
+            return [];
+        return [{
+                status: entry.event === "keep_alive_blocked_resumed" ? "woken" : "skipped",
+                ...(entry.reason === undefined ? {} : { reason: entry.reason }),
+                at: entry.at,
+                atMs: at,
+            }];
+    });
+    const latest = candidates.sort((left, right) => right.atMs - left.atMs)[0];
+    if (!latest)
+        return undefined;
+    return { status: latest.status, ...(latest.reason === undefined ? {} : { reason: latest.reason }), at: latest.at };
+}
 function firstRestartAfter(lane, stop, nextEnvelopeMs, workerResumeEvents) {
     const recordedWorkerResume = workerResumeEvents
         .filter((event) => event.at > stop.mtimeMs && (nextEnvelopeMs === undefined || event.at < nextEnvelopeMs))
@@ -449,15 +489,18 @@ export function buildKeepAliveAudit(input) {
             const { allMtimes, stops } = readStopEnvelopes(input.hqRoot, lane.lane_id);
             const keepAliveResumeEvents = readKeepAliveResumeEvents(input.hqRoot, lane.lane_id);
             const laneWorkerResumeEvents = readLaneWorkerResumeEvents(input.hqRoot, lane.lane_id);
-            const doneClassifications = readDoneClassifications(input.hqRoot, lane.lane_id);
+            const terminalClassifications = readTerminalClassifications(input.hqRoot, lane.lane_id);
             for (const stop of stops) {
                 if (stop.mtimeMs < sinceMs || stop.mtimeMs > nowMs)
                     continue;
-                if (!doneClassifications.some((at) => at >= stop.mtimeMs && at - stop.mtimeMs <= 10 * 60_000))
+                if (!terminalClassifications.some((classification) => classification.state === stop.decision && classification.at >= stop.mtimeMs && classification.at - stop.mtimeMs <= 10 * 60_000))
                     continue;
                 const nextEnvelopeMs = allMtimes.find((mtime) => mtime > stop.mtimeMs);
+                const blockedOutcome = stop.decision === "blocked" ? blockedKeepAliveOutcome(lane, stop, nextEnvelopeMs) : undefined;
                 const restart = firstRestartAfter(lane, stop, nextEnvelopeMs, laneWorkerResumeEvents);
                 const due = dueTime(stop, keepAliveResumeEvents);
+                const reportBlockedOutcome = blockedOutcome?.status === "woken" ||
+                    (blockedOutcome?.status === "skipped" && due.at <= nowMs);
                 rows.push({
                     lane: lane.lane_id,
                     project: lane.project_id,
@@ -467,6 +510,10 @@ export function buildKeepAliveAudit(input) {
                     due_at: iso(due.at),
                     due_reason: due.reason,
                     restart,
+                    ...(reportBlockedOutcome && blockedOutcome ? {
+                        blocked_outcome: blockedOutcome.status,
+                        ...(blockedOutcome.reason === undefined ? {} : { blocked_outcome_reason: blockedOutcome.reason }),
+                    } : {}),
                     verdict: classifyVerdict({ dueAt: due.at, stoppedAt: stop.mtimeMs, nextCheckAt: stop.nextCheckAt, restart, lane, nowMs, resumeEvents: keepAliveResumeEvents, ...(nextEnvelopeMs === undefined ? {} : { nextEnvelopeAt: nextEnvelopeMs }), hqRoot: input.hqRoot }),
                 });
             }
@@ -514,7 +561,7 @@ export function buildKeepAliveAudit(input) {
     };
 }
 export function formatKeepAliveAuditText(result) {
-    const headings = ["LANE", "PROJECT", "PROFILE", "STOPPED", "NEXT_CHECK", "DUE", "RESTART", "VERDICT"];
+    const headings = ["LANE", "PROJECT", "PROFILE", "STOPPED", "NEXT_CHECK", "DUE", "RESTART", "OUTCOME", "VERDICT"];
     const values = result.rows.map((row) => [
         row.lane,
         row.project,
@@ -523,6 +570,7 @@ export function formatKeepAliveAuditText(result) {
         row.next_check_at ?? "—",
         row.due_at,
         row.restart ? `${row.restart.at ?? "untimed"} ${row.restart.trigger}${row.restart.caller ? ` (${row.restart.caller})` : ""}` : "—",
+        row.blocked_outcome === "woken" ? "woken" : row.blocked_outcome === "skipped" ? `due, not woken: ${(row.blocked_outcome_reason ?? "unknown").replaceAll("_", " ")}` : "—",
         row.verdict,
     ]);
     const widths = headings.map((heading, index) => Math.max(heading.length, ...values.map((row) => row[index].length)));

package/dist/lib/lanes/reconcile.js

@@ -27,8 +27,9 @@ import { checkLaneDiskSpace, configuredCodexRolloutHomes, lowDiskGuardEnabledFor
 import { laneCompanyUidSource, resolveLaneCompany } from "./lane-company.js";
 import { appendDropboxMessage } from "./dropbox.js";
 import { DEFAULT_RUNAWAY_SEARCH_GUARD_CONFIG, listHostProcesses, runRunawayToolGuard, RUNAWAY_TOOL_GUARD_FLAG, } from "./runaway-tool-guard.js";
-import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, LEAD_LANE_KEEP_ALIVE_FIRST_RESUME_SETTLE_MS, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_GRACE_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_RESUME_TEXT, queueLaneTerminalResume, LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT, LEAD_LANE_KEEP_ALIVE_MAX_RESUMES, LEAD_LANE_KEEP_ALIVE_RESUME_TEXT, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveExclusion, loadRetiredLaneIds, leadLaneKeepAliveBackoffMs, undeliveredAnsweredQuestions, } from "./keep-alive.js";
+import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, LEAD_LANE_KEEP_ALIVE_FIRST_RESUME_SETTLE_MS, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_GRACE_MS, LEAD_LANE_KEEP_ALIVE_BLOCKED_RESUME_TEXT, queueLaneTerminalResume, LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT, LEAD_LANE_KEEP_ALIVE_MAX_RESUMES, LEAD_LANE_KEEP_ALIVE_RESUME_TEXT, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, loadRetiredLaneIds, leadLaneKeepAliveBackoffMs, undeliveredAnsweredQuestions, } from "./keep-alive.js";
 import { providerSupportsSessionResume } from "./delivery.js";
+import { isIsoDateTime } from "./types.js";
 import { applyDefaultQuotaHold, clearAccountQuotaAfterSuccessfulTurnBestEffort, readQuotaSignal, recordAccountQuota, } from "./quota.js";
 import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { SILENCE_MS, appendWatcherEvent, classifyLaneExit, isPidAlive, missingExpectedEnvelopeFile, readLatestEnvelopeFile, readLatestEnvelopeRecord, watcherEventsPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
@@ -2252,6 +2253,9 @@ async function resumeBlockedKeepAlive(hqRoot, lane, questions, summary, deps, no
     }
     const key = keepAliveCompanyKey(company);
     if (keepAliveFlags.get(key) !== true || blockedFlags.get(key) !== true) {
+        if (keepAliveFlags.get(key) === true && blockedFlags.get(key) !== true) {
+            recordBlockedKeepAliveFlagOff(hqRoot, lane, summary, deps);
+        }
         summary.skipped.push({ kind: "lane", id: lane.lane_id, why: "keep_alive_blocked" });
         return;
     }
@@ -2323,10 +2327,22 @@ async function resumeBlockedKeepAlive(hqRoot, lane, questions, summary, deps, no
         summary.skipped.push({ kind: "lane", id: lane.lane_id, why: "keep_alive_exhausted" });
         return;
     }
-    if (now.getTime() - terminalMs < LEAD_LANE_KEEP_ALIVE_BLOCKED_GRACE_MS) {
+    const blockedEnvelope = readLatestEnvelopeRecord(hqRoot, lane.lane_id)?.envelope;
+    const nextCheckValue = blockedEnvelope?.decision === "blocked" ? blockedEnvelope.next_check_at : undefined;
+    const nextCheckValid = typeof nextCheckValue === "string" && isIsoDateTime(nextCheckValue) &&
+        Date.parse(nextCheckValue) > terminalMs;
+    const nextCheckMs = nextCheckValid
+        ? keepAliveNextCheckAtMs(nextCheckValue, now.getTime(), terminalMs)
+        : undefined;
+    if (nextCheckMs !== undefined && nextCheckMs > now.getTime()) {
+        appendBlockedKeepAliveHistory(hqRoot, lane, terminalAt, now.toISOString(), "blocked_grace", deps);
+        return;
+    }
+    if (!nextCheckValid && now.getTime() - terminalMs < LEAD_LANE_KEEP_ALIVE_BLOCKED_GRACE_MS) {
         appendBlockedKeepAliveHistory(hqRoot, lane, terminalAt, now.toISOString(), "blocked_grace", deps);
         return;
     }
+    const resumeReason = nextCheckValid ? "next_check_at_due" : "backoff";
     const latest = deps.readKeepAliveRecheckLane?.(hqRoot, lane.lane_id) ?? readLane(hqRoot, lane.lane_id);
     if (latest.version !== lane.version || latest.state !== "blocked" || latest.last_envelope?.decision !== "blocked" || latest.last_envelope.at !== terminalAt)
         return;
@@ -2389,6 +2405,7 @@ async function resumeBlockedKeepAlive(hqRoot, lane, questions, summary, deps, no
             at: now.toISOString(),
             terminal_at: terminalAt,
             resume_queued: true,
+            reason: resumeReason,
         }),
     }), deps.dryRun);
     if (queued.changed) {
@@ -2399,7 +2416,7 @@ async function resumeBlockedKeepAlive(hqRoot, lane, questions, summary, deps, no
                 at: now.toISOString(),
                 attempt: (lane.keep_alive_resume_count ?? 0) + 1,
                 resumed_from: "blocked",
-                reason: "backoff",
+                reason: resumeReason,
                 ...(accountSelection !== undefined
                     ? { account_selection: keepAliveAccountSelectionEvidence(accountSelection) }
                     : {}),
@@ -2407,6 +2424,32 @@ async function resumeBlockedKeepAlive(hqRoot, lane, questions, summary, deps, no
         }
     }
 }
+function recordBlockedKeepAliveFlagOff(hqRoot, lane, summary, deps) {
+    const terminalAt = lane.last_envelope?.at;
+    if (deps.dryRun || lane.last_envelope?.decision !== "blocked" || terminalAt === undefined)
+        return;
+    const envelope = readLatestEnvelopeRecord(hqRoot, lane.lane_id)?.envelope;
+    const nextCheckAt = envelope?.decision === "blocked" ? envelope.next_check_at : undefined;
+    const terminalMs = Date.parse(lane.last_envelope.at);
+    if (typeof nextCheckAt !== "string" || !isIsoDateTime(nextCheckAt) || Date.parse(nextCheckAt) <= terminalMs)
+        return;
+    if (lane.status_gate_history?.some((entry) => entry.event === "keep_alive_blocked_skipped" && entry.terminal_at === terminalAt && entry.reason === "flag_off"))
+        return;
+    try {
+        casLaneIf(hqRoot, lane.lane_id, (current) => current.version === lane.version && current.state === "blocked" && current.last_envelope?.at === terminalAt, (current) => ({
+            ...current,
+            status_gate_history: appendCappedHistory(current.status_gate_history ?? [], {
+                event: "keep_alive_blocked_skipped",
+                at: deps.now().toISOString(),
+                terminal_at: terminalAt,
+                reason: "flag_off",
+            }),
+        }), false);
+    }
+    catch (err) {
+        markDirty(summary, { kind: "lane", id: lane.lane_id, why: `blocked keep-alive skip record failed: ${err instanceof Error ? err.message : String(err)}` });
+    }
+}
 function appendBlockedKeepAliveHistory(hqRoot, lane, terminalAt, at, reason, deps) {
     if (deps.dryRun || lane.status_gate_history?.some((entry) => entry.event === "keep_alive_blocked_grace" && entry.terminal_at === terminalAt && entry.resume_skipped_reason === reason))
         return;

package/dist/lib/lanes/types.d.ts

@@ -445,10 +445,11 @@ export interface KrFreshnessState {
     stalled_fingerprint?: string;
 }
 export interface KeepAliveBlockedHistoryEntry {
-    event: "keep_alive_blocked_grace" | "keep_alive_blocked_resumed" | "keep_alive_blocked_escalated";
+    event: "keep_alive_blocked_grace" | "keep_alive_blocked_resumed" | "keep_alive_blocked_escalated" | "keep_alive_blocked_skipped";
     at: string;
     terminal_at: string;
     resume_skipped_reason?: "open_question" | "blocked_grace";
+    reason?: "flag_off" | "backoff" | "next_check_at_due";
     resume_queued?: boolean;
 }
 export interface KeepAliveResumeHistoryEntry {

package/dist/utils/resident-package-preload.d.ts

@@ -1,4 +1,4 @@
-export type ResidentPackagePath = "auth-login" | "bot" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon";
+export type ResidentPackagePath = "agent-kit" | "agent-mcp" | "auth-login" | "bot" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon" | "mesh-daemon" | "lanes-watch" | "monitor-wait" | "monitor-run";
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export declare const RESIDENT_PACKAGE_MODULES: Record<ResidentPackagePath, readonly string[]>;
 export declare class ResidentPackagePreloadError extends Error {
@@ -10,4 +10,11 @@ export declare class ResidentPackagePreloadError extends Error {
 export declare function reportResidentPackagePreloadFailure(error: unknown): void;
 /** Resolve every lazy package module before a resident command releases its lease. */
 export declare function preloadResidentPackageModules(residentPath: ResidentPackagePath, load?: () => Promise<unknown>): Promise<void>;
+export interface ResidentCommandLeaseOptions {
+    preload?: () => Promise<void>;
+    reportFailure?: (error: unknown) => void;
+    release?: () => void;
+}
+/** Start a resident loop only after its declared lazy package imports are loaded. */
+export declare function runResidentCommandWithPackageLease<T>(residentPath: ResidentPackagePath, run: () => Promise<T>, options?: ResidentCommandLeaseOptions): Promise<T>;
 //# sourceMappingURL=resident-package-preload.d.ts.map

package/dist/utils/resident-package-preload.js

@@ -1,5 +1,8 @@
+import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload, } from "./package-use-lease.js";
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export const RESIDENT_PACKAGE_MODULES = {
+    "agent-kit": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "agent-mcp": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../commands/access.js", "open"],
     login: [
         "../lib/mesh/api.js",
         "../lib/work-context/config.js",
@@ -40,8 +43,31 @@ export const RESIDENT_PACKAGE_MODULES = {
         "../utils/staged-npm-install.js",
         "open",
     ],
+    "mesh-daemon": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "lanes-watch": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "monitor-wait": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open"],
+    "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "open"],
 };
 const LOADERS = {
+    "agent-kit": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "agent-mcp": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("../commands/access.js"),
+        () => import("open"),
+    ],
     login: [
         () => import("../lib/mesh/api.js"),
         () => import("../lib/work-context/config.js"),
@@ -101,6 +127,43 @@ const LOADERS = {
         () => import("../utils/staged-npm-install.js"),
         () => import("open"),
     ],
+    "mesh-daemon": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "lanes-watch": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "monitor-wait": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+    ],
+    "monitor-run": [
+        () => import("../commands/lanes.js"),
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("open"),
+    ],
 };
 export class ResidentPackagePreloadError extends Error {
     moduleSpecifier;
@@ -141,4 +204,9 @@ export async function preloadResidentPackageModules(residentPath, load) {
         }
     }));
 }
+/** Start a resident loop only after its declared lazy package imports are loaded. */
+export async function runResidentCommandWithPackageLease(residentPath, run, options = {}) {
+    await releasePackageUseLeaseAfterResidentPreload(options.preload ?? (() => preloadResidentPackageModules(residentPath)), options.reportFailure ?? reportResidentPackagePreloadFailure, options.release ?? releaseCurrentPackageUseLease);
+    return run();
+}
 //# sourceMappingURL=resident-package-preload.js.map

package/dist/utils/run-bundled-script.d.ts

@@ -57,6 +57,8 @@ export type RunBundledScriptOptions = {
     captureOutput?: boolean;
     /** Bytes supplied on stdin. With no value, stdin is inherited as before. */
     stdin?: string | Buffer;
+    /** Optional child-process deadline for callers that need bounded script execution. */
+    timeoutMs?: number;
 };
 export type RunBundledScriptResult = {
     /** The child's exit code, or 128+signal if it was terminated by one. */

package/dist/utils/run-bundled-script.js

@@ -189,6 +189,7 @@ export function runBundledScript(opts) {
             cwd: opts.cwd,
             env,
             stdio,
+            ...(opts.timeoutMs === undefined ? {} : { timeout: opts.timeoutMs }),
             ...(opts.captureOutput ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {}),
         });
     }

package/dist/utils/windows-spawn.d.ts

@@ -47,4 +47,6 @@ export declare function isWindowsBatchFile(command: string, platform?: NodeJS.Pl
  * passed through untouched.
  */
 export declare function planCommandSpawn(command: string, args: readonly string[], platform?: NodeJS.Platform): SpawnPlan;
+/** Spawn a resolved executable, routing only Windows batch shims through the escaped cmd.exe plan. */
+export declare function planResolvedCommandSpawn(command: string, args: readonly string[], env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SpawnPlan;
 //# sourceMappingURL=windows-spawn.d.ts.map

package/dist/utils/windows-spawn.js

@@ -108,4 +108,10 @@ export function planCommandSpawn(command, args, platform = process.platform) {
         return buildSpawnPlan(command, args, platform);
     return { cmd: command, args: [...args], shell: false };
 }
+/** Spawn a resolved executable, routing only Windows batch shims through the escaped cmd.exe plan. */
+export function planResolvedCommandSpawn(command, args, env = process.env, platform = process.platform) {
+    if (isWindowsBatchFile(command, platform))
+        return buildCmdExeSpawnPlan(command, args, env, platform);
+    return { cmd: command, args: [...args], shell: false };
+}
 //# sourceMappingURL=windows-spawn.js.map

package/docs/anywhere-runtime.md

@@ -73,7 +73,9 @@ the named-pipe transport without Unix mode or owner fields. Use `hq doctor
 --json` for the same fields as structured details. The hqd health operation is
 read-only and available while the runtime flag is off; it reports only the
 current directory's binding and never returns authentication tokens. A Unix
-socket that cannot be verified as user-only produces a warning. If an older
+socket that cannot be verified as user-only produces a warning. When a Unix
+socket is unreachable, doctor recommends installing the daemon service if it is
+absent or restarting it if it is installed. If an older
 resident daemon does not support the health operation, doctor falls back to
 `ping` for reachability, version and uptime, then warns that a restart is needed
 for full diagnostics.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.12",
+  "version": "5.342.14",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -59,7 +59,7 @@
     "js-yaml": "^4.1.0",
     "mqtt": "5.15.2",
     "open": "^10.1.0",
-    "semver": "^7.6.3",
+    "semver": "^7.8.5",
     "simple-git": "^3.27.0",
     "smol-toml": "1.6.1",
     "varlock": "1.21.1"
@@ -69,11 +69,11 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "@types/semver": "^7.5.8",
+    "@types/semver": "^7.8.0",
     "@vitest/coverage-v8": "4.1.6",
     "aedes": "1.1.2",
     "aws-sdk-client-mock": "^4.1.0",
-    "esbuild": "0.27.0",
+    "esbuild": "0.28.2",
     "eslint": "^10.5.0",
     "husky": "^9.1.7",
     "lint-staged": "^15.5.2",

package/dist/lib/db/remote-engine.d.ts

@@ -1,58 +0,0 @@
-/**
- * Pluggable remote vault DB engine interface (vault-databases US-007).
- *
- * Default shipped adapter id: aurora-dsql.
- * This module is interface + registry only — no production AWS provision here.
- */
-/** Connection material written only to secrets stores — never CLI stdout. */
-export interface RemoteConnectionSecretPayload {
-    /** Opaque secret body (e.g. JSON with host/user/password or IAM token recipe). */
-    payload: Record<string, unknown>;
-    /** Suggested vault/Secrets Manager key suffix (namespaced by company elsewhere). */
-    secretNameHint: string;
-}
-export interface RemoteProvisionRequest {
-    companyUid: string;
-    companySlug: string;
-    region?: string;
-    /** Engine-specific options (cluster params, etc.). */
-    options?: Record<string, unknown>;
-}
-export interface RemoteProvisionResult {
-    engineId: string;
-    resourceArn: string;
-    region: string;
-    status: "ready" | "provisioning" | "failed" | "existing";
-    /** Secret payload to store — callers must not print. */
-    connectionSecret: RemoteConnectionSecretPayload;
-}
-export interface RemoteHealth {
-    engineId: string;
-    resourceArn: string;
-    healthy: boolean;
-    status: string;
-    checkedAt: string;
-}
-/**
- * Remote Postgres-class engine adapter.
- * Implementations live in control plane (hq-pro) for real AWS; CLI may mock.
- */
-export interface RemoteDbEngine {
-    readonly id: string;
-    provision(req: RemoteProvisionRequest): Promise<RemoteProvisionResult>;
-    deprovision(companyUid: string, resourceArn: string): Promise<void>;
-    connectionSecretPayload(companyUid: string, resourceArn: string): Promise<RemoteConnectionSecretPayload>;
-    healthCheck(resourceArn: string): Promise<RemoteHealth>;
-}
-/** Default engine selection (PRD decision). */
-export declare const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
-export declare function registerRemoteEngine(engine: RemoteDbEngine): void;
-export declare function getRemoteEngine(id?: string): RemoteDbEngine;
-export declare function listRemoteEngineIds(): string[];
-/** Clear registry (tests only). */
-export declare function _resetRemoteEngineRegistryForTests(): void;
-/**
- * In-memory mock engine for unit tests — no AWS.
- */
-export declare function createMockRemoteEngine(id?: string): RemoteDbEngine;
-//# sourceMappingURL=remote-engine.d.ts.map

package/dist/lib/db/remote-engine.js

@@ -1,87 +0,0 @@
-/**
- * Pluggable remote vault DB engine interface (vault-databases US-007).
- *
- * Default shipped adapter id: aurora-dsql.
- * This module is interface + registry only — no production AWS provision here.
- */
-/** Default engine selection (PRD decision). */
-export const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
-const registry = new Map();
-export function registerRemoteEngine(engine) {
-    registry.set(engine.id, engine);
-}
-export function getRemoteEngine(id = DEFAULT_REMOTE_ENGINE_ID) {
-    const engine = registry.get(id);
-    if (!engine) {
-        throw new Error(`remote DB engine not registered: ${id} (available: ${[...registry.keys()].join(", ") || "none"})`);
-    }
-    return engine;
-}
-export function listRemoteEngineIds() {
-    return [...registry.keys()];
-}
-/** Clear registry (tests only). */
-export function _resetRemoteEngineRegistryForTests() {
-    registry.clear();
-}
-/**
- * In-memory mock engine for unit tests — no AWS.
- */
-export function createMockRemoteEngine(id = "mock") {
-    const resources = new Map();
-    return {
-        id,
-        async provision(req) {
-            const existing = [...resources.entries()].find(([, v]) => v.companyUid === req.companyUid);
-            if (existing) {
-                const [arn, meta] = existing;
-                return {
-                    engineId: id,
-                    resourceArn: arn,
-                    region: meta.region,
-                    status: "existing",
-                    connectionSecret: {
-                        payload: { mock: true, companyUid: req.companyUid },
-                        secretNameHint: `db/remote/${req.companySlug}`,
-                    },
-                };
-            }
-            const arn = `arn:mock:db:${req.companyUid}`;
-            const region = req.region ?? "us-east-1";
-            resources.set(arn, { companyUid: req.companyUid, region });
-            return {
-                engineId: id,
-                resourceArn: arn,
-                region,
-                status: "ready",
-                connectionSecret: {
-                    payload: { mock: true, companyUid: req.companyUid },
-                    secretNameHint: `db/remote/${req.companySlug}`,
-                },
-            };
-        },
-        async deprovision(companyUid, resourceArn) {
-            const meta = resources.get(resourceArn);
-            if (meta && meta.companyUid === companyUid) {
-                resources.delete(resourceArn);
-            }
-        },
-        async connectionSecretPayload(companyUid, resourceArn) {
-            return {
-                payload: { mock: true, companyUid, resourceArn },
-                secretNameHint: `db/remote/${companyUid}`,
-            };
-        },
-        async healthCheck(resourceArn) {
-            const ok = resources.has(resourceArn);
-            return {
-                engineId: id,
-                resourceArn,
-                healthy: ok,
-                status: ok ? "ready" : "missing",
-                checkedAt: new Date().toISOString(),
-            };
-        },
-    };
-}
-//# sourceMappingURL=remote-engine.js.map

package/dist/lib/db/remote-sql.d.ts

@@ -1,22 +0,0 @@
-/**
- * Remote SQL helper with injected credentials and executor (US-010).
- *
- * Connection string never appears in argv, logs, or stdout.
- * The CLI command does not currently wire this helper to a remote executor.
- */
-export interface RemoteSqlOptions {
-    company: string;
-    sql: string;
-    /** Injected secret material — never log. */
-    getConnectionConfig: () => Promise<Record<string, unknown>>;
-    /** Execute against remote; tests inject mock. */
-    execute?: (config: Record<string, unknown>, sql: string) => Promise<Record<string, unknown>[]>;
-}
-export interface RemoteSqlResult {
-    rows: Record<string, unknown>[];
-}
-/**
- * Run SQL on remote tier using vault-bound credentials.
- */
-export declare function runRemoteSql(opts: RemoteSqlOptions): Promise<RemoteSqlResult>;
-//# sourceMappingURL=remote-sql.d.ts.map