@indigoai-us/hq-cli 5.342.14 → 5.342.16

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.342.16] — 2026-10-04
+- Keep resident command leases until monitor, agent, OAuth, bot, daemon and lane-watch runtime modules and their transitive Cognito, first-sync, hq-cloud and local-file dependencies are preloaded.
+- CI now runs the core utility parity assertions on Ubuntu, macOS, and Windows.
+- Retry permission-denied flag snapshot cache writes and reads in a uid-owned private fallback, while preserving captures with bounded fallback tags when recovery is unsafe or fails.
+
+## [5.342.15] — 2026-10-04
+- Preserve bounded integration subcommand and RPC error context on asynchronous gateway failures, and retain diagnostics for malformed HTTP 200 gateway errors (HQ-CLI-C8/C9).
+- Claude admission can prioritize lanes that are seniors of live lanes and keep configurable per-host capacity reserved for them when `lanes.lead-admission-priority` is enabled.
+
 ## [5.342.14] — 2026-10-04
 - Fixed native HQ subprocess launching and job-lock command resolution on Windows.
 - Fixed Windows delegate/job shell parity while preserving embedded carriage returns and POSIX command/path bytes.

package/dist/commands/agents.d.ts

@@ -28,6 +28,7 @@
  * the caller's single active membership (same as `members.ts`).
  */
 import { Command } from "commander";
+import { type ResidentCommandLeaseOptions } from "../utils/resident-package-preload.js";
 import { type TerminalSessionPayload } from "@indigoai-us/hq-cloud/outposts/node";
 import { type AgentModelProvider, type AgentModelCatalog } from "../lib/agents/model-catalog.js";
 import { type BillingErrorPayload } from "../utils/billing-gate.js";
@@ -403,6 +404,7 @@ export declare function sendAgentDm(token: string, agentUid: string, message: st
 export declare function readAgentThread(token: string, agentUid: string, limit?: number): Promise<DmThreadMessage[]>;
 /** Render one thread message as a labeled line for the terminal. */
 export declare function formatThreadMessage(m: DmThreadMessage, agentLabel: string): string;
+export declare function waitForAgentMessageWithPackageLease<T>(waitForReply: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
 export interface EnrollmentIssue {
     code: string;
     expiresAt: string;

package/dist/commands/agents.js

@@ -27,6 +27,8 @@
  * (`hq agents list --company acme`); when omitted, resolution falls back to
  * the caller's single active membership (same as `members.ts`).
  */
+import { runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
+import { waitForAgentTerminalSession } from "../lib/agents/terminal-wait.js";
 import chalk from "chalk";
 import { randomUUID } from "node:crypto";
 import * as readline from "node:readline";
@@ -37,7 +39,7 @@ import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, } from "../utils/cli-telemetry.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { consoleOrigin } from "./integrations-connect.js";
-import { launchSessionManagerPlugin, SessionManagerPluginLaunchError, TerminalSessionTimeoutError, waitForTerminalSession, } from "@indigoai-us/hq-cloud/outposts/node";
+import { launchSessionManagerPlugin, SessionManagerPluginLaunchError, TerminalSessionTimeoutError, } from "@indigoai-us/hq-cloud/outposts/node";
 import { peekIdToken } from "../utils/id-token.js";
 import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, } from "../utils/plan-gate-error.js";
 import { AGENT_UID_PATTERN, isAgentUid } from "../lib/notify-recipient.js";
@@ -1114,6 +1116,9 @@ function shortTime(iso) {
     const m = iso.match(/^(\d{4})-(\d{2})-(\d{2})T(\d{2}:\d{2})/);
     return m ? `${m[2]}-${m[3]} ${m[4]}` : iso;
 }
+export function waitForAgentMessageWithPackageLease(waitForReply, leaseOptions = {}) {
+    return runResidentCommandWithPackageLease("agents-message-wait", waitForReply, leaseOptions);
+}
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -1307,14 +1312,17 @@ export function registerAgentsCommand(program) {
             const deadline = Date.now() + timeoutMs;
             if (!opts.json)
                 console.log(chalk.dim(`Sent — waiting for ${agent} to reply…`));
-            let reply;
-            while (Date.now() < deadline) {
-                await sleep(3000);
-                const msgs = await readAgentThread(token, agentUid, 10);
-                reply = msgs.find((m) => m.direction === "in" && m.createdAt > lastBeforeAt);
-                if (reply)
-                    break;
-            }
+            const reply = await waitForAgentMessageWithPackageLease(async () => {
+                let received;
+                while (Date.now() < deadline) {
+                    await sleep(3000);
+                    const msgs = await readAgentThread(token, agentUid, 10);
+                    received = msgs.find((m) => m.direction === "in" && m.createdAt > lastBeforeAt);
+                    if (received)
+                        break;
+                }
+                return received;
+            });
             if (opts.json) {
                 process.stdout.write(JSON.stringify({ agentUid, sent: message, reply: reply ?? null }, null, 2) + "\n");
                 return;
@@ -1391,7 +1399,7 @@ export function registerAgentsCommand(program) {
             // registration after a cold start takes ~30-90s. Status lines go to
             // stderr (once per state) so stdout stays the session's.
             let lastState;
-            const session = await waitForTerminalSession(async () => {
+            const session = await runResidentCommandWithPackageLease("agents-terminal", () => waitForAgentTerminalSession(async () => {
                 const result = await openAgentTerminal(token, agentUid, body);
                 if (result.ok)
                     return { kind: "ready", session: result };
@@ -1411,7 +1419,7 @@ export function registerAgentsCommand(program) {
                         ? `${agent}'s box is starting — waiting for it to come online (Ctrl-C to cancel)…`
                         : `${agent}'s box is up — waiting for its agent to register (Ctrl-C to cancel)…`));
                 },
-            });
+            }));
             console.error(chalk.dim(forwardPort !== undefined
                 ? `Forwarding box port ${forwardPort} to localhost:${localPort ?? forwardPort} — Ctrl-C to end.`
                 : `Connected to ${agent}'s box — type 'exit' or Ctrl-D to leave.`));

package/dist/commands/bot.js

@@ -27,7 +27,8 @@ import { hasPromotionHold, promotionHoldSummary } from "../lib/bot/promotion-hol
  */
 import { promoteLocalBot } from "../lib/bot/promote.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
-import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
+import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
+import { followLogFile } from "../lib/log-follow.js";
 import { CLI_UPDATE_DISABLE_ENV, createCliUpdateWatcher, handOffToUpdatedCli } from "../lib/bot/cli-update.js";
 import { createVaultObjectDownloader } from "../lib/agent-kit/attachment-download.js";
 import { addBotToCompanies, describeCompanyFailures, removeBotFromCompanies } from "./bot-companies.js";
@@ -1011,21 +1012,8 @@ async function runBotLogs(nameArg, opts) {
         console.log(line);
     if (!opts.follow)
         return;
-    let size = fs.statSync(file).size;
-    await new Promise(() => {
-        fs.watchFile(file, { interval: 500 }, (curr) => {
-            if (curr.size < size)
-                size = 0;
-            if (curr.size > size) {
-                const fd = fs.openSync(file, "r");
-                const buf = Buffer.alloc(curr.size - size);
-                fs.readSync(fd, buf, 0, buf.length, size);
-                fs.closeSync(fd);
-                process.stdout.write(buf.toString());
-                size = curr.size;
-            }
-        });
-    });
+    const size = fs.statSync(file).size;
+    await runResidentCommandWithPackageLease("bot-logs-follow", () => followLogFile(file, size, (chunk) => process.stdout.write(chunk)));
 }
 // ── rm ───────────────────────────────────────────────────────────────────────
 async function confirm(question) {

package/dist/commands/daemon.d.ts

@@ -64,6 +64,10 @@ export declare function resolveDaemonHqRoot(flag: string | undefined, where: {
     cwd: string;
     home: string;
 }): string | undefined;
+export declare function runLogs(d: DaemonCommandDeps, unit: string | undefined, opts: {
+    follow?: boolean;
+    lines?: string;
+}): Promise<void>;
 export declare function registerDaemonCommand(program: Command, over?: Partial<DaemonCommandDeps>): Command;
 export {};
 //# sourceMappingURL=daemon.d.ts.map

package/dist/commands/daemon.js

@@ -36,7 +36,8 @@ import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protoco
 import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
-import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
+import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
+import { followLogFile } from "../lib/log-follow.js";
 /** Load every lazy daemon runtime module before releasing its package-use lease. */
 export async function loadDaemonRunner(release = releaseCurrentPackageUseLease, load = () => import("../lib/daemon/run.js"), preload = () => preloadResidentPackageModules("daemon"), reportPreloadFailure = reportResidentPackagePreloadFailure) {
     const { runDaemon } = await load();
@@ -401,7 +402,7 @@ function tailLines(file, lines) {
     const text = fs.readFileSync(file, "utf8");
     return text.split("\n").filter((l, i, all) => i < all.length - 1 || l !== "").slice(-lines);
 }
-async function runLogs(d, unit, opts) {
+export async function runLogs(d, unit, opts) {
     const { paths } = currentHost(d);
     const file = unit ? paths.unitLogPath(unit) : paths.supervisorLogPath;
     if (!fs.existsSync(file))
@@ -411,22 +412,8 @@ async function runLogs(d, unit, opts) {
         d.out(line);
     if (!opts.follow)
         return;
-    let offset = fs.statSync(file).size;
-    await new Promise(() => {
-        setInterval(() => {
-            const size = fs.statSync(file).size;
-            if (size < offset)
-                offset = 0;
-            if (size === offset)
-                return;
-            const fd = fs.openSync(file, "r");
-            const buf = Buffer.alloc(size - offset);
-            fs.readSync(fd, buf, 0, buf.length, offset);
-            fs.closeSync(fd);
-            offset = size;
-            process.stdout.write(buf.toString("utf8"));
-        }, 500);
-    });
+    const offset = fs.statSync(file).size;
+    await runResidentCommandWithPackageLease("daemon-logs-follow", () => followLogFile(file, offset, (chunk) => process.stdout.write(chunk)));
 }
 function queueRequest(d, request, what) {
     const host = currentHost(d);

package/dist/commands/integrations-connect.d.ts

@@ -17,6 +17,7 @@
  * "key" but is really OAuth-protected still connects on the first try.
  */
 import { Command } from "commander";
+import { type ResidentCommandLeaseOptions } from "../utils/resident-package-preload.js";
 import { consoleOrigin } from "../utils/console-origin.js";
 export { consoleOrigin };
 import type { AdminConnection } from "./integrations-core.js";
@@ -62,6 +63,17 @@ interface ConnectTarget {
     /** Human label for prompts and success lines. */
     label: string;
 }
+/**
+ * Run the browser sign-in and finish the install.
+ *
+ * The loopback listener is bound BEFORE `/oauth/start` because its port is
+ * part of the redirect URI hq-pro registers with the remote authorization
+ * server. If hq-pro refuses that URI (its loopback flag is off, or it predates
+ * the feature), the flow degrades to the console handoff rather than failing:
+ * `/oauth/start` is retried with no `redirectUri`, and the caller is told to
+ * finish in the browser where the console callback completes it.
+ */
+export declare function waitForIntegrationOAuthWithPackageLease<T>(waitForCode: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
 /**
  * The console's Integrations page for a company, the console root when the
  * caller never named one (a single-membership session resolves the company

package/dist/commands/integrations-connect.js

@@ -19,6 +19,7 @@
 import chalk from "chalk";
 import open from "open";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { consoleOrigin } from "../utils/console-origin.js";
 export { consoleOrigin };
 import { getCompanyUid } from "../utils/vault-api.js";
@@ -458,6 +459,9 @@ async function assertTargetResolvable(token, companyUid, target) {
  * `/oauth/start` is retried with no `redirectUri`, and the caller is told to
  * finish in the browser where the console callback completes it.
  */
+export function waitForIntegrationOAuthWithPackageLease(waitForCode, leaseOptions = {}) {
+    return runResidentCommandWithPackageLease("integrations-oauth-wait", waitForCode, leaseOptions);
+}
 async function connectViaOAuth(token, companyUid, target, opts) {
     const timeoutMs = opts.timeout ? Number(opts.timeout) * 1000 : undefined;
     if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
@@ -529,7 +533,7 @@ async function connectViaOAuth(token, companyUid, target, opts) {
         }
         let code;
         try {
-            code = await pendingCode;
+            code = await waitForIntegrationOAuthWithPackageLease(() => pendingCode);
         }
         catch (err) {
             if (err instanceof IntegrationsCliError &&

package/dist/commands/integrations-core.d.ts

@@ -110,11 +110,9 @@ export interface AdminSurface {
 }
 interface GatewayMessage {
     result?: unknown;
-    error?: {
-        code?: number;
-        message?: string;
-    };
+    error?: unknown;
 }
+export type GatewayErrorShape = "string_error" | "object_no_code" | "object_code" | "string_code" | "nested_code" | "empty" | "redacted_empty";
 export declare class IntegrationsCliError extends Error {
     /**
      * True when the error is the caller's request/state/permission (a client 4xx
@@ -152,6 +150,8 @@ export declare class IntegrationsCliError extends Error {
     readonly rpcCode?: number;
     /** Fixed vocabulary for the integrations subcommand that called the gateway. */
     readonly gatewaySubcommand?: "tools_list" | "tools_call" | "other";
+    /** Fixed vocabulary describing the shape of an upstream JSON-RPC error. */
+    readonly gatewayErrorShape?: GatewayErrorShape;
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
      * refused to register HQ automatically. The provider must register the exact
@@ -167,6 +167,7 @@ export declare class IntegrationsCliError extends Error {
         oauthProtected?: boolean;
         rpcCode?: number;
         gatewaySubcommand?: "tools_list" | "tools_call" | "other";
+        gatewayErrorShape?: GatewayErrorShape;
         redirectUri?: string;
     });
 }

package/dist/commands/integrations-core.js

@@ -57,6 +57,8 @@ export class IntegrationsCliError extends Error {
     rpcCode;
     /** Fixed vocabulary for the integrations subcommand that called the gateway. */
     gatewaySubcommand;
+    /** Fixed vocabulary describing the shape of an upstream JSON-RPC error. */
+    gatewayErrorShape;
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
      * refused to register HQ automatically. The provider must register the exact
@@ -79,6 +81,8 @@ export class IntegrationsCliError extends Error {
             this.rpcCode = opts.rpcCode;
         if (opts.gatewaySubcommand !== undefined)
             this.gatewaySubcommand = opts.gatewaySubcommand;
+        if (opts.gatewayErrorShape !== undefined)
+            this.gatewayErrorShape = opts.gatewayErrorShape;
         if (opts.redirectUri !== undefined) {
             Object.defineProperty(this, "redirectUri", {
                 value: opts.redirectUri,
@@ -191,6 +195,54 @@ function expectedGatewayErrorFallback(code) {
             return undefined;
     }
 }
+function recordValue(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function numericGatewayCode(value) {
+    if (typeof value === "number" && Number.isSafeInteger(value))
+        return value;
+    if (typeof value === "string" && /^-?\d+$/.test(value.trim())) {
+        const parsed = Number(value.trim());
+        if (Number.isSafeInteger(parsed))
+            return parsed;
+    }
+    return undefined;
+}
+/** Read the known JSON-RPC error fields without stringifying arbitrary payload data. */
+function gatewayErrorDetails(error) {
+    if (typeof error === "string") {
+        const message = redactErrorText(error);
+        return {
+            message,
+            shape: message ? "string_error" : "redacted_empty",
+        };
+    }
+    const record = recordValue(error);
+    if (!record)
+        return { message: "", shape: "empty" };
+    const data = recordValue(record.data);
+    const rawMessage = typeof record.message === "string" ? record.message : undefined;
+    const message = rawMessage === undefined ? "" : redactErrorText(rawMessage);
+    const directCode = record.code;
+    const nestedCode = data?.code;
+    const directRpcCode = numericGatewayCode(directCode);
+    const nestedRpcCode = numericGatewayCode(nestedCode);
+    const rpcCode = directRpcCode ?? nestedRpcCode;
+    const hasStringCode = typeof directCode === "string" || typeof nestedCode === "string";
+    const redactedEmptyMessage = rawMessage !== undefined && rawMessage.length > 0 && !message;
+    const shape = redactedEmptyMessage
+        ? "redacted_empty"
+        : nestedCode !== undefined
+            ? "nested_code"
+            : hasStringCode
+                ? "string_code"
+                : directCode !== undefined
+                    ? "object_code"
+                    : message ? "object_no_code" : "empty";
+    return { message, ...(rpcCode === undefined ? {} : { rpcCode }), shape };
+}
 // A 401 from ANY integration-gateway vault call means the caller's HQ session
 // is expired or missing — an expected auth state fixed by `hq login`, not an
 // hq-cli defect. Raise the same typed AuthError the vault company-resolution
@@ -446,16 +498,16 @@ export async function callGateway(token, params, idempotencyKey) {
         const accepted = message;
         const jobId = accepted && typeof accepted.jobId === "string" ? accepted.jobId : "";
         if (accepted?.status !== "pending" || !/^imj_[A-Za-z0-9_-]+$/.test(jobId)) {
-            throw new IntegrationsCliError(`Integration gateway returned an invalid async job response (job id: ${jobId || "missing"}).`, { expected: false, status: 202 });
+            throw new IntegrationsCliError(`Integration gateway returned an invalid async job response (job id: ${jobId || "missing"}).`, { expected: false, status: 202, gatewaySubcommand });
         }
         const companyUid = typeof params.companyUid === "string" ? params.companyUid : "";
         if (!companyUid) {
             throw new IntegrationsCliError(`Cannot poll integration job ${jobId}: the company id is missing.`, { expected: true });
         }
         if (!idempotencyKey) {
-            throw new IntegrationsCliError(`Integration gateway accepted async job ${jobId} without an idempotency key.`, { expected: false, status: 202 });
+            throw new IntegrationsCliError(`Integration gateway accepted async job ${jobId} without an idempotency key.`, { expected: false, status: 202, gatewaySubcommand });
         }
-        const terminal = await pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, deadline);
+        const terminal = await pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, deadline, gatewaySubcommand);
         terminalMessage = terminal.message;
         terminalStatus = terminal.status;
     }
@@ -470,6 +522,7 @@ export async function callGateway(token, params, idempotencyKey) {
         throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`, { expected: isClientError(res.status), status: res.status, gatewaySubcommand });
     }
     if (terminalMessage?.error) {
+        const gatewayError = gatewayErrorDetails(terminalMessage.error);
         // The gateway's error text is minted UPSTREAM (hq-pro, the integration
         // factory, and beyond it the third-party provider), so it is untrusted:
         // scrub credentials and bound the length here, at the throw site, because
@@ -478,21 +531,22 @@ export async function callGateway(token, params, idempotencyKey) {
         // The chain is idempotent, so the unexpected path scrubbing again is a
         // no-op. This preserves PR #298's user-visible diagnostic; it only makes
         // it safe on the newly-expected path.
-        throw new IntegrationsCliError(redactErrorText(terminalMessage.error.message ?? "") ||
-            expectedGatewayErrorFallback(terminalMessage.error.code) ||
+        throw new IntegrationsCliError(gatewayError.message ||
+            expectedGatewayErrorFallback(gatewayError.rpcCode) ||
             "Integration gateway returned an error.", {
-            expected: isExpectedGatewayError(terminalMessage.error.code),
+            expected: isExpectedGatewayError(gatewayError.rpcCode),
             status: terminalStatus,
             gatewaySubcommand,
+            gatewayErrorShape: gatewayError.shape,
             // Carry the protocol code to the capture site as a bounded grouping
             // discriminator (HQ-CLI collision, Sentry 7642756130). This does not
             // alter the `expected` decision above; it only labels the error.
-            ...(terminalMessage.error.code !== undefined ? { rpcCode: terminalMessage.error.code } : {}),
+            ...(gatewayError.rpcCode === undefined ? {} : { rpcCode: gatewayError.rpcCode }),
         });
     }
     return terminalMessage;
 }
-async function pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, deadline) {
+async function pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, deadline, gatewaySubcommand) {
     const jobPath = `/v1/integrations/mcp/jobs/${encodeURIComponent(jobId)}`;
     while (Date.now() < deadline) {
         const requestRemainingMs = deadline - Date.now();
@@ -526,7 +580,7 @@ async function pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, dea
             if (res.status === 404) {
                 throw new IntegrationsCliError(`Integration job ${jobId} was not found or is no longer available.`, { expected: true, status: 404 });
             }
-            throw new IntegrationsCliError(`Integration job ${jobId} polling failed (HTTP ${res.status}).`, { expected: isClientError(res.status), status: res.status });
+            throw new IntegrationsCliError(`Integration job ${jobId} polling failed (HTTP ${res.status}).`, { expected: isClientError(res.status), status: res.status, gatewaySubcommand });
         }
         if (!poll || typeof poll !== "object") {
             throw new IntegrationsCliError(`Integration job ${jobId} returned an invalid poll response.`, { expected: true });
@@ -549,7 +603,7 @@ async function pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, dea
                 hasResult !== hasError &&
                 (!hasError || validError);
             if (!hasJsonRpcOutcome) {
-                throw new IntegrationsCliError(`Integration job ${jobId} returned an invalid JSON-RPC response.`, { expected: false });
+                throw new IntegrationsCliError(`Integration job ${jobId} returned an invalid JSON-RPC response.`, { expected: false, gatewaySubcommand });
             }
             return { message: response, status: res.status };
         }

package/dist/commands/lanes-accounts.js

@@ -10,6 +10,7 @@ import { resolveLaneEffort } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { accountQuotaView, clearAccountQuota, loadQuotaState } from "../lib/lanes/quota.js";
 import { resolveLaneModel } from "../lib/lanes/spawn.js";
+import { leadLaneIds } from "../lib/lanes/admission.js";
 export function createLaneAccountsHandlers(deps) {
     const { automaticBalanceMoveHistoryReason, ensureDir, laneWithRecoveredProviderSession, loadClaudeBalanceHostSnapshots, parseRemoteJson, prepareAccountMove, printJson, reconcileHostFromCtx, resolveCallerPath } = deps;
     const VENDOR_LOGIN = {
@@ -269,6 +270,13 @@ export function createLaneAccountsHandlers(deps) {
             balance_gate_enabled: balanceGateEnabled,
             accounts,
             selections,
+            lead_reserve_per_host: config.lead_reserve_per_host,
+            queued_leads: loaded.snapshots.flatMap((host) => {
+                const leads = leadLaneIds(host.lanes);
+                return host.lanes
+                    .filter((lane) => lane.provider === "claude" && lane.state === "queued" && leads.has(lane.lane_id))
+                    .map((lane) => ({ lane_id: lane.lane_id, host: host.capacity.host, queued_reason: lane.queued_reason ?? null }));
+            }),
             unavailable_hosts: loaded.unavailableHosts,
             suggestions,
             ...(opts.apply ? { moved, skipped } : {}),

package/dist/commands/monitor.d.ts

@@ -40,6 +40,7 @@ export interface RunSupervisorDeps {
     reportPreloadFailure?: (error: unknown) => void;
     createLaneMessageApi?: typeof createMonitorLaneMessageApi;
 }
+/** Preload every monitor runtime; only lane targets need the in-process message API. */
 export declare function preloadMonitorLaneMessageApi(hqRoot: string, meta: MonitorMetadata, deps?: Pick<RunSupervisorDeps, "preloadResidentModules" | "releasePackageUseLease" | "reportPreloadFailure" | "createLaneMessageApi">): Promise<MonitorLaneMessageApi | undefined>;
 export declare function runSupervisor(id: string, deps?: RunSupervisorDeps): Promise<void>;
 interface MonitorHookResult {

package/dist/commands/monitor.js

@@ -575,13 +575,14 @@ function activeTargetMeta(hqRoot, targetKey) {
         return meta?.target_key === targetKey && state?.status === "running" && state.pid !== null && readMonitorPidLiveness(state.pid, state.starttime) ? [meta] : [];
     });
 }
+/** Preload every monitor runtime; only lane targets need the in-process message API. */
 export async function preloadMonitorLaneMessageApi(hqRoot, meta, deps = {}) {
-    if (meta.target.kind !== "lane")
-        return undefined;
     let laneMessageApi;
     await releasePackageUseLeaseAfterResidentPreload(async () => {
         await (deps.preloadResidentModules ?? (() => preloadResidentPackageModules("monitor-run")))();
-        laneMessageApi = (deps.createLaneMessageApi ?? createMonitorLaneMessageApi)(hqRoot, meta.cwd, process.env);
+        if (meta.target.kind === "lane") {
+            laneMessageApi = (deps.createLaneMessageApi ?? createMonitorLaneMessageApi)(hqRoot, meta.cwd, process.env);
+        }
     }, deps.reportPreloadFailure ?? reportResidentPackagePreloadFailure, deps.releasePackageUseLease ?? releaseCurrentPackageUseLease);
     return laneMessageApi;
 }

package/dist/lib/agents/terminal-wait.d.ts

@@ -0,0 +1,4 @@
+import type { TerminalSessionAttempt, TerminalSessionPayload, WaitForTerminalSessionOptions } from "@indigoai-us/hq-cloud/outposts/node";
+/** Keep the terminal poll loop behind a small, auditable resident preload root. */
+export declare function waitForAgentTerminalSession<T extends TerminalSessionPayload>(attempt: () => Promise<TerminalSessionAttempt<T>>, options?: WaitForTerminalSessionOptions): Promise<T>;
+//# sourceMappingURL=terminal-wait.d.ts.map

package/dist/lib/agents/terminal-wait.js

@@ -0,0 +1,6 @@
+import { waitForTerminalSession } from "@indigoai-us/hq-cloud/outposts/node";
+/** Keep the terminal poll loop behind a small, auditable resident preload root. */
+export function waitForAgentTerminalSession(attempt, options) {
+    return waitForTerminalSession(attempt, options);
+}
+//# sourceMappingURL=terminal-wait.js.map

package/dist/lib/flag-registry.js

@@ -11,7 +11,7 @@ import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 import { registerFlagRegistryRefreshWaiter } from "./flag-registry-refresh-wait.js";
-import { writeFlagSnapshotFile } from "./flag-snapshot-file.js";
+import { flagSnapshotWriteFailureTags, writeFlagSnapshotFile } from "./flag-snapshot-file.js";
 function captureFlagRegistryException(error, tags, sentry) {
     if (!sentry)
         return;
@@ -63,6 +63,7 @@ export async function waitForFlagRegistryRefresh(timeoutMs = 500, companyUid) {
             captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
                 component: "flag-snapshot-cache-write",
                 company_uid_present: "true",
+                ...flagSnapshotWriteFailureTags(error),
             }, refreshSentry);
         }
         refreshPendingSnapshot = null;
@@ -215,6 +216,7 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                         captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
                             component: "flag-snapshot-cache-write",
                             company_uid_present: "true",
+                            ...flagSnapshotWriteFailureTags(error),
                         }, sentry);
                     }
                     refreshPendingSnapshot = null;

package/dist/lib/flag-snapshot-file.d.ts

@@ -1,10 +1,13 @@
 /** Private, synchronous, offline snapshot used by the native CLI fast route. */
 export declare const FLAG_SNAPSHOT_MAX_AGE_MS: number;
+export type FlagSnapshotWriteStep = "mkdir" | "chmod_dir" | "open_tmp" | "write_tmp" | "rename" | "chmod_file";
+export declare function flagSnapshotWriteFailureTags(error: unknown): Record<string, string>;
 export interface PersistedFlagSnapshot {
     company_uid: string;
     fetched_at: string;
     flags: Record<string, boolean>;
 }
+export declare function _resetFlagSnapshotCacheForTests(): void;
 export declare function flagSnapshotPath(companyUid: string, env?: NodeJS.ProcessEnv): string | undefined;
 /** Write just the validated flag decisions and company scope, never auth data. */
 export declare function writeFlagSnapshotFile(companyUid: string, flags: Readonly<Record<string, unknown>>, options?: {