@indigoai-us/hq-cli 5.342.18 → 5.343.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [5.343.1] — 2026-10-04
+
+- Include the bounded hq-cli version in `cli_feature_used` telemetry so feature-use rows can be grouped by release.
+
+- Release the HQ CLI package-use lease before hq daemon call waits for its daemon response, after preloading the request protocol.
+- Release the package-use lease after Outpost lane message and resume requests are submitted and their result-wait imports are preloaded.
+- Preserve human, agent, and both audience tags when CLI tools and local bots post or reply in channels.
+- Wait for a live installer to finish before retrying a failed CLI import when the install tree is still in flight.
+- Preserve bounded master-hook slow-phase and per-phase timeout attribution in Sentry reports.
+
+## [5.343.0] — 2026-10-04
+- `hq company --company <slug> settings set --work-registry-enabled <true|false>` and `--work-mesh-live-enabled <true|false>` let a company owner turn work tracking on or off. Work tracking needs both switches; after either is set the command says whether work tracking is on and prints the exact command for the switch that is still off. `hq company --company <slug> settings get` now also shows both switches for an owner or admin.
+- `hq mesh context requeue` now also re-sends, by default, sessions that were refused while work tracking was off. `hq doctor` and `hq mesh daemon doctor` explain those refusals in plain words.
+- Release the hq-cli package-use lease before the secrets sandbox poll and bounded package downloads after preloading their lazy runtime imports.
+
 ## [5.342.18] — 2026-10-04
 - Preserve confirmed remote lane-message responses for in-process monitor delivery.
 - Use native TypeScript renderers for `hq core rebuild-index` commands.

package/dist/command-catalog.generated.d.ts

@@ -3204,7 +3204,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--audience <human|agent|both>";
-            readonly description: "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both (1:1 DMs only)";
+            readonly description: "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
@@ -5334,7 +5334,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [];
         readonly subcommands: readonly [{
             readonly name: "set";
-            readonly description: "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled.";
+            readonly description: "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled / --work-registry-enabled / --work-mesh-live-enabled.";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;
@@ -5358,11 +5358,19 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly flags: "--checkpoint-gate-enabled <true|false>";
                 readonly description: "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn";
                 readonly hidden: false;
+            }, {
+                readonly flags: "--work-registry-enabled <true|false>";
+                readonly description: "Turn work-session registration on or off for this company (default off). Work tracking needs this and --work-mesh-live-enabled";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--work-mesh-live-enabled <true|false>";
+                readonly description: "Turn live work tracking on or off for this company (default off). Work tracking needs this and --work-registry-enabled";
+                readonly hidden: false;
             }];
             readonly subcommands: readonly [];
         }, {
             readonly name: "get";
-            readonly description: "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it).";
+            readonly description: "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it) and, for an owner or admin, the two work tracking switches (GET /company-settings).";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;
@@ -9635,7 +9643,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }, {
             readonly name: "requeue";
-            readonly description: "Requeue quarantined outbox operations (default: only AUTH_DENIED — work-mesh-live gap 10 recovery)";
+            readonly description: "Requeue quarantined outbox operations (default: AUTH_DENIED - work-mesh-live gap 10 recovery - plus sessions refused while work tracking was off). Run once after the company owner turns work tracking on";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;

package/dist/command-catalog.generated.js

@@ -3874,7 +3874,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--audience <human|agent|both>",
-                        "description": "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both (1:1 DMs only)",
+                        "description": "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both",
                         "hidden": false
                     }
                 ],
@@ -6478,7 +6478,7 @@ export const COMMAND_CATALOG = [
                 "subcommands": [
                     {
                         "name": "set",
-                        "description": "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled.",
+                        "description": "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled / --work-registry-enabled / --work-mesh-live-enabled.",
                         "aliases": [],
                         "hidden": false,
                         "helpOption": true,
@@ -6506,13 +6506,23 @@ export const COMMAND_CATALOG = [
                                 "flags": "--checkpoint-gate-enabled <true|false>",
                                 "description": "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn",
                                 "hidden": false
+                            },
+                            {
+                                "flags": "--work-registry-enabled <true|false>",
+                                "description": "Turn work-session registration on or off for this company (default off). Work tracking needs this and --work-mesh-live-enabled",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--work-mesh-live-enabled <true|false>",
+                                "description": "Turn live work tracking on or off for this company (default off). Work tracking needs this and --work-registry-enabled",
+                                "hidden": false
                             }
                         ],
                         "subcommands": []
                     },
                     {
                         "name": "get",
-                        "description": "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it).",
+                        "description": "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it) and, for an owner or admin, the two work tracking switches (GET /company-settings).",
                         "aliases": [],
                         "hidden": false,
                         "helpOption": true,
@@ -11686,7 +11696,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "name": "requeue",
-                        "description": "Requeue quarantined outbox operations (default: only AUTH_DENIED — work-mesh-live gap 10 recovery)",
+                        "description": "Requeue quarantined outbox operations (default: AUTH_DENIED - work-mesh-live gap 10 recovery - plus sessions refused while work tracking was off). Run once after the company owner turns work tracking on",
                         "aliases": [],
                         "hidden": false,
                         "helpOption": true,

package/dist/commands/company.d.ts

@@ -1,3 +1,15 @@
 import { Command } from "commander";
+/**
+ * The two per-company switches that together turn work tracking on. The server
+ * refuses work-session registration unless both are true. `null` means the
+ * values could not be read.
+ */
+interface WorkTrackingSettings {
+    workRegistryEnabled: boolean;
+    workMeshLiveEnabled: boolean;
+}
+/** Plain next steps after a work tracking switch was set, from the effective settings. */
+export declare function workTrackingNextSteps(companySlug: string, settings: WorkTrackingSettings | null): string[];
 export declare function registerCompanyCommand(program: Command): void;
+export {};
 //# sourceMappingURL=company.d.ts.map

package/dist/commands/company.js

@@ -4,6 +4,64 @@ import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
 import { registerCompanyTransferCommand } from "./company-transfer.js";
 import { registerCompanyRenameCommand } from "./company-rename.js";
 import { describeRefreshOutcome, refreshCheckpointGateSetting, } from "./core-checkpoint-gate-setting.js";
+/** Both switches from a settings response body, or null unless both are booleans. */
+function workTrackingFromBody(body) {
+    const { workRegistryEnabled, workMeshLiveEnabled } = body;
+    return typeof workRegistryEnabled === "boolean" && typeof workMeshLiveEnabled === "boolean"
+        ? { workRegistryEnabled, workMeshLiveEnabled }
+        : null;
+}
+/**
+ * Read both switches from GET /company-settings (owner or admin only). The
+ * server returns effective values, so an absent field means the default (off).
+ * A refused or failed read returns null rather than a guess.
+ */
+async function readWorkTrackingSettings(token, companyUid) {
+    try {
+        const res = await vaultApiFetch({
+            token,
+            path: "/company-settings",
+            query: { companyUid },
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json().catch(() => ({})));
+        return {
+            workRegistryEnabled: body.workRegistryEnabled === true,
+            workMeshLiveEnabled: body.workMeshLiveEnabled === true,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Plain next steps after a work tracking switch was set, from the effective settings. */
+export function workTrackingNextSteps(companySlug, settings) {
+    const command = `hq company --company ${companySlug} settings`;
+    if (!settings) {
+        return [`Could not read the settings back. Check both switches with: ${command} get`];
+    }
+    if (settings.workRegistryEnabled && settings.workMeshLiveEnabled) {
+        return [
+            "Work tracking is on.",
+            "Sessions refused while it was off are held on each machine. " +
+                "Each person should run once: hq mesh context requeue",
+        ];
+    }
+    if (settings.workRegistryEnabled) {
+        return [
+            "Work tracking is not on yet. Sessions will still be refused until live tracking is also on. " +
+                `Run: ${command} set --work-mesh-live-enabled true`,
+        ];
+    }
+    if (settings.workMeshLiveEnabled) {
+        return [
+            "Work tracking is not on yet. Sessions will still be refused until the work registry is also on. " +
+                `Run: ${command} set --work-registry-enabled true`,
+        ];
+    }
+    return [`Work tracking is off for ${companySlug}.`];
+}
 /**
  * Parse a `--flag <true|false>` string into a boolean, or throw. Commander
  * passes the raw string; we validate strictly so a typo never silently writes
@@ -32,11 +90,14 @@ export function registerCompanyCommand(program) {
         .command("set")
         .description("Set per-company settings (PUT /company-settings). Require at least one " +
         "of --crm-enabled / --ontology-enabled / --accounting-enabled / " +
-        "--checkpoint-gate-enabled.")
+        "--checkpoint-gate-enabled / --work-registry-enabled / " +
+        "--work-mesh-live-enabled.")
         .option("--crm-enabled <true|false>", "Enable/disable the native CRM for this company")
         .option("--ontology-enabled <true|false>", "Enable/disable the ontology gardener for this company")
         .option("--accounting-enabled <true|false>", "Enable/disable the accounting pack for this company")
         .option("--checkpoint-gate-enabled <true|false>", "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn")
+        .option("--work-registry-enabled <true|false>", "Turn work-session registration on or off for this company (default off). Work tracking needs this and --work-mesh-live-enabled")
+        .option("--work-mesh-live-enabled <true|false>", "Turn live work tracking on or off for this company (default off). Work tracking needs this and --work-registry-enabled")
         .action(async (opts) => {
         try {
             const companySlug = company.opts().company;
@@ -47,8 +108,10 @@ export function registerCompanyCommand(program) {
             if (opts.crmEnabled === undefined &&
                 opts.ontologyEnabled === undefined &&
                 opts.accountingEnabled === undefined &&
-                opts.checkpointGateEnabled === undefined) {
-                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled."));
+                opts.checkpointGateEnabled === undefined &&
+                opts.workRegistryEnabled === undefined &&
+                opts.workMeshLiveEnabled === undefined) {
+                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled / --work-registry-enabled / --work-mesh-live-enabled."));
                 process.exit(1);
             }
             const body = {};
@@ -64,6 +127,14 @@ export function registerCompanyCommand(program) {
             if (opts.checkpointGateEnabled !== undefined) {
                 body.checkpointGateEnabled = parseBoolFlag(opts.checkpointGateEnabled, "--checkpoint-gate-enabled");
             }
+            if (opts.workRegistryEnabled !== undefined) {
+                body.workRegistryEnabled = parseBoolFlag(opts.workRegistryEnabled, "--work-registry-enabled");
+            }
+            if (opts.workMeshLiveEnabled !== undefined) {
+                body.workMeshLiveEnabled = parseBoolFlag(opts.workMeshLiveEnabled, "--work-mesh-live-enabled");
+            }
+            const setsWorkTracking = body.workRegistryEnabled !== undefined ||
+                body.workMeshLiveEnabled !== undefined;
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, { companySlug });
             body.companyUid = companyUid;
@@ -76,7 +147,9 @@ export function registerCompanyCommand(program) {
             if (!res.ok) {
                 const errBody = (await res.json().catch(() => ({})));
                 if (res.status === 403) {
-                    console.error(chalk.red("Requires owner role on this company to change its settings."));
+                    console.error(chalk.red(setsWorkTracking
+                        ? "Only the company owner can change this setting."
+                        : "Requires owner role on this company to change its settings."));
                     process.exit(1);
                 }
                 console.error(chalk.red(`Failed to update company settings: ${errBody.error ?? res.statusText}`));
@@ -98,6 +171,16 @@ export function registerCompanyCommand(program) {
                     // The setting is saved; the cache refreshes on the next Stop.
                 }
             }
+            if (setsWorkTracking) {
+                // Registration needs both switches, so report the effective pair:
+                // from the PUT response when it echoes both, otherwise from a GET.
+                const resBody = (await res.json().catch(() => ({})));
+                const effective = workTrackingFromBody(resBody) ??
+                    (await readWorkTrackingSettings(token, companyUid));
+                for (const line of workTrackingNextSteps(companySlug, effective)) {
+                    console.log(line);
+                }
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -107,7 +190,8 @@ export function registerCompanyCommand(program) {
     settings
         .command("get")
         .description("Show whether the checkpoint Stop gate is on for this company " +
-        "(GET /company-settings/checkpoint-gate; any member may read it).")
+        "(GET /company-settings/checkpoint-gate; any member may read it) and, " +
+        "for an owner or admin, the two work tracking switches (GET /company-settings).")
         .option("--json", "Print the result as JSON")
         .action(async (opts) => {
         try {
@@ -137,11 +221,24 @@ export function registerCompanyCommand(program) {
                 console.error(chalk.red("Failed to read company settings: no checkpointGateEnabled in the response."));
                 process.exit(1);
             }
+            // The work tracking switches are only on the owner/admin settings
+            // route. A refused or failed read is reported as unknown, not guessed.
+            const workTracking = await readWorkTrackingSettings(token, companyUid);
             if (opts.json) {
-                console.log(JSON.stringify({ company: companySlug, checkpointGateEnabled: enabled }));
+                console.log(JSON.stringify({
+                    company: companySlug,
+                    checkpointGateEnabled: enabled,
+                    workRegistryEnabled: workTracking?.workRegistryEnabled ?? null,
+                    workMeshLiveEnabled: workTracking?.workMeshLiveEnabled ?? null,
+                }));
             }
             else {
                 console.log(`checkpointGateEnabled=${enabled}`);
+                for (const key of ["workRegistryEnabled", "workMeshLiveEnabled"]) {
+                    console.log(workTracking
+                        ? `${key}=${workTracking[key]}`
+                        : `${key}=unknown (only the company owner or an admin can read this setting)`);
+                }
             }
         }
         catch (err) {

package/dist/commands/daemon.js

@@ -29,6 +29,7 @@ import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "..
 import { daemonPaths } from "../lib/daemon/paths.js";
 import { processCommandLine } from "../lib/daemon/lock.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
+import { runDaemonCall } from "../lib/daemon/command-call.js";
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
 import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
@@ -857,17 +858,7 @@ export function registerDaemonCommand(program, over = {}) {
         const timeoutMs = Number(opts.timeout ?? (op === "policy.check" ? "40000" : "20000"));
         if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
             throw new Error("--timeout must be a positive number of milliseconds");
-        const { hqdRequest, hqdSocketPath, HqdClientError } = await import("../lib/daemon/protocol.js");
-        try {
-            const result = await hqdRequest(op, args, { socketPath: hqdSocketPath(d.home, d.env), timeoutMs });
-            d.out(JSON.stringify(result, null, 2));
-        }
-        catch (err) {
-            if (!(err instanceof HqdClientError))
-                throw err;
-            d.out(JSON.stringify({ error: { code: err.code, message: err.message } }, null, 2));
-            process.exitCode = 1;
-        }
+        await runResidentCommandWithPackageLease("daemon-call", () => runDaemonCall(op, args, timeoutMs, d));
     }));
     daemon
         .command("status")

package/dist/commands/dm.js

@@ -614,11 +614,20 @@ async function runChannelSend(channelName, message, opts) {
         // Send the human-readable form: the quotes only existed for parsing.
         if (mentions.length > 0)
             body = stripMentionQuotes(body);
+        let audience;
+        if (opts.audience !== undefined && opts.audience !== "") {
+            if (!DM_AUDIENCE_VALUES.includes(opts.audience)) {
+                throw new Error(`Invalid --audience '${opts.audience}': must be human, agent, or both.`);
+            }
+            audience = opts.audience;
+        }
         const payload = { body };
         if (mentions.length > 0)
             payload.mentions = mentions;
         if (rootEventId)
             payload.rootEventId = rootEventId;
+        if (audience)
+            payload.audience = audience;
         const sendRes = await vaultApiFetch({
             token,
             path: `/v1/notify/channels/${encodeURIComponent(channel.channelId)}/messages`,
@@ -1327,7 +1336,7 @@ export function registerDmCommand(program) {
         .option("--details-file <path>", "Read the details from a file (1:1 DMs only)")
         .option("--at <iso>", "Schedule delivery at an ISO8601 time (store-and-forward; delivered within ~60s of the time; 1:1 DMs only)")
         .option("--in <duration>", "Schedule delivery after a relative delay: 30s, 10m, 2h, 1d (1:1 DMs only)")
-        .option("--audience <human|agent|both>", "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both (1:1 DMs only)")
+        .option("--audience <human|agent|both>", "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both")
         .action(async (recipient, message, opts) => {
         await runDmSend(recipient, message, opts);
     });

package/dist/commands/lanes-shared.d.ts

@@ -272,6 +272,7 @@ export interface Ctx {
         command: string;
         timeoutSeconds?: number;
         waitMs?: number;
+        beforeWait?: () => Promise<void>;
     }) => Promise<OutpostDispatchResult>;
     backfillOutpostIdentity: (expectedId: string) => "created" | "unchanged";
     fetchText: (url: string) => Promise<string>;

package/dist/commands/lanes.d.ts

@@ -86,6 +86,7 @@ export interface LanesCommandDeps {
         command: string;
         timeoutSeconds?: number;
         waitMs?: number;
+        beforeWait?: () => Promise<void>;
     }) => Promise<OutpostDispatchResult>;
     /** Test seam for the atomic, non-overwriting marker repair. */
     backfillOutpostIdentity?: (expectedId: string) => "created" | "unchanged";

package/dist/commands/lanes.js

@@ -4317,11 +4317,22 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
     let dispatched;
     let grantContextRejected = false;
     let failedResumeOptionRejected = false;
+    let outpostWaitLeasePreparationStarted = false;
     try {
         const dispatchCommand = (contexts) => ctx.dispatchOutpostExec({
             outpostId,
             timeoutSeconds: Math.ceil(waitMs / 1000),
             waitMs,
+            ...(action === "message" || action === "resume"
+                ? {
+                    beforeWait: async () => {
+                        if (outpostWaitLeasePreparationStarted)
+                            return;
+                        outpostWaitLeasePreparationStarted = true;
+                        await runResidentCommandWithPackageLease("outpost-wait", async () => undefined);
+                    },
+                }
+                : {}),
             command: buildOutpostLaneCommand({
                 action: action === "grant"
                     ? "grant-target"

package/dist/commands/mesh.js

@@ -1424,7 +1424,9 @@ async function runContextRequeue(opts) {
     }
     const scope = errorCode === null
         ? "all quarantine reasons"
-        : `lastErrorCode=${errorCode === undefined ? "AUTH_DENIED" : errorCode}`;
+        : errorCode === undefined
+            ? "lastErrorCode=AUTH_DENIED or refused while work tracking was off"
+            : `lastErrorCode=${errorCode}`;
     console.log(`Requeued ${requeued.length} quarantined outbox operation${requeued.length === 1 ? "" : "s"} (${scope}). The mesh daemon will retry them on its next replay.`);
 }
 async function runContextUntracked(sessionId, opts) {
@@ -2016,7 +2018,9 @@ export function registerMeshCommand(program) {
         .action((opts) => wrap(() => runContextCorrect(opts))());
     context
         .command("requeue")
-        .description("Requeue quarantined outbox operations (default: only AUTH_DENIED — work-mesh-live gap 10 recovery)")
+        .description("Requeue quarantined outbox operations (default: AUTH_DENIED - work-mesh-live gap 10 recovery - " +
+        "plus sessions refused while work tracking was off). " +
+        "Run once after the company owner turns work tracking on")
         .option("--all", "Requeue every quarantined op regardless of lastErrorCode")
         .option("--error-code <code>", "Requeue quarantined ops with this lastErrorCode")
         .option("--json", "Print machine-readable JSON")

package/dist/commands/pack-install.d.ts

@@ -34,6 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 import { type KeyObject } from 'node:crypto';
+import { type ResidentCommandLeaseOptions } from '../utils/resident-package-preload.js';
 import { type SecretResolver } from './mcp-registration.js';
 import type { PackManifest } from '../types.js';
 export interface ResolveLatestOptions {
@@ -447,6 +448,7 @@ export interface InstallPackOptions {
      */
     requireSignature?: boolean;
 }
+export declare function runPackInstallWithLease<T>(run: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
 export declare function installPack(source: string, opts?: InstallPackOptions): Promise<void>;
 export {};
 //# sourceMappingURL=pack-install.d.ts.map

package/dist/commands/pack-install.js

@@ -50,6 +50,7 @@ import { codexTargets } from '../lib/install/codex-targets.js';
 import { readHqVersion, routeContribution, listInstalledPacks, mcpServerNameForContribution } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
+import { runResidentCommandWithPackageLease } from '../utils/resident-package-preload.js';
 import { getCompanyUid, vaultApiFetch, vaultApiFetchPublic, } from '../utils/vault-api.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { formatApiKeyCapabilityDenial, peekHqApiKey, } from '../utils/resolve-vault-credential.js';
@@ -1677,7 +1678,13 @@ export function runScanPackages(hqRoot, opts = {}) {
         console.log(chalk.yellow('  scan-packages.sh exited non-zero; see output above.'));
     }
 }
+export function runPackInstallWithLease(run, leaseOptions) {
+    return runResidentCommandWithPackageLease("pack-install", run, leaseOptions);
+}
 export async function installPack(source, opts = {}) {
+    return runPackInstallWithLease(() => installPackWithoutLease(source, opts));
+}
+async function installPackWithoutLease(source, opts) {
     // NOTE: the HQ_API_KEY fail-closed gate is NOT enforced here. `installPack`
     // is a shared primitive called both by the top-level `hq install` CLI route
     // (where Cognito-only is the right gate — checked there instead) AND by

package/dist/commands/pkg-update.d.ts

@@ -5,5 +5,7 @@
  * If slug given: update only that package.
  */
 import { Command } from 'commander';
+import { type ResidentCommandLeaseOptions } from '../utils/resident-package-preload.js';
 export declare function registerPackageUpdateCommand(parent: Command): void;
+export declare function runPackageUpdateWithLease<T>(run: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
 //# sourceMappingURL=pkg-update.d.ts.map

package/dist/commands/pkg-update.js

@@ -9,6 +9,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { parseUserYaml } from '../utils/user-yaml-error.js';
 import { execSync } from 'child_process';
+import { runResidentCommandWithPackageLease } from '../utils/resident-package-preload.js';
 import chalk from 'chalk';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
@@ -21,7 +22,7 @@ export function registerPackageUpdateCommand(parent) {
         .description('Check for and apply package updates')
         .action(async (slug) => {
         try {
-            await updatePackages(slug);
+            await runPackageUpdateWithLease(() => updatePackages(slug));
         }
         catch (error) {
             console.error(chalk.red('Update failed:'), error instanceof Error ? error.message : 'Unknown error');
@@ -29,6 +30,9 @@ export function registerPackageUpdateCommand(parent) {
         }
     });
 }
+export function runPackageUpdateWithLease(run, leaseOptions) {
+    return runResidentCommandWithPackageLease("pkg-update", run, leaseOptions);
+}
 async function updatePackages(slug) {
     const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
     const entries = readRegistry(hqRoot);

package/dist/commands/secrets.js

@@ -10,6 +10,7 @@ import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_pattern
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
+import { runSandboxJobAfterSubmission } from "../utils/secrets-sandbox-resident.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
  * Mirrors `RESOURCE_SURFACES` in hq-pro
@@ -1061,9 +1062,7 @@ export function registerSecretsCommand(program) {
                 secretNames: keys,
                 command,
             });
-            const job = started.status === "succeeded" || started.status === "failed"
-                ? await client.getJob(token, started.jobId)
-                : await client.pollJob(token, started.jobId);
+            const job = await runSandboxJobAfterSubmission(client, token, started);
             renderSandboxJobResult(job, keys);
             const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
             if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {

package/dist/lib/agent-kit/mcp/tools.js

@@ -237,7 +237,7 @@ export function buildAgentMcpTools(clients) {
                     const token = await clients.getToken();
                     const res = await clients.apiJson(token, `/v1/notify/channels/${encodeURIComponent(to)}/messages`, {
                         method: "POST",
-                        body: { body: message },
+                        body: { body: message, ...(audience ? { audience } : {}) },
                     });
                     if (res.status < 200 || res.status >= 300) {
                         return errorResult(`Channel send failed (${res.status}): ${describeError(res.body)}`);

package/dist/lib/bot/api.d.ts

@@ -239,6 +239,7 @@ export declare class BotApi {
         channelId: string;
         body: string;
         rootEventId?: string;
+        audience?: "human" | "agent" | "both";
     }): Promise<{
         eventId?: string;
         createdAt?: string;

package/dist/lib/bot/api.js

@@ -195,6 +195,8 @@ export class BotApi {
         const payload = { body: input.body };
         if (input.rootEventId)
             payload.rootEventId = input.rootEventId;
+        if (input.audience)
+            payload.audience = input.audience;
         const { body } = await this.call(`/v1/notify/channels/${encodeURIComponent(input.channelId)}/messages`, { method: "POST", body: payload });
         return body;
     }

package/dist/lib/bot/progress.d.ts

@@ -28,13 +28,10 @@ export declare const PROGRESS_MIN_GAP_MS = 4000;
 export declare const WORKING_NOTICE_MS = 60000;
 export declare const WORKING_NOTICE_TEXT = "Working on it \u2014 I'll reply here when it's done.";
 export interface ProgressPosterOptions {
-    /** Post one message; resolve true when it was delivered. */
-    send: (body: string) => Promise<boolean>;
-    /**
-     * If provided, the final reply is sent through this instead of `send`.
-     * Use to tag the final reply differently from in-between progress messages.
-     */
-    sendFinal?: (body: string) => Promise<boolean>;
+    /** Post a live progress beat while the turn is still running. */
+    sendProgress: (body: string) => Promise<boolean>;
+    /** Post terminal content that the person needs to read. */
+    sendToPerson: (body: string) => Promise<boolean>;
     now?: () => number;
     setTimer?: (fn: () => void, ms: number) => unknown;
     clearTimer?: (handle: unknown) => void;
@@ -63,8 +60,8 @@ export declare function normalizeForCompare(text: string): string;
 /** Matches {"action":"no_reply"} anywhere in a model reply, with or without preamble text. */
 export declare function containsNoReplySentinel(text: string): boolean;
 export declare class ProgressPoster {
-    private readonly send;
-    private readonly sendFinalFn?;
+    private readonly sendProgress;
+    private readonly sendToPerson;
     private readonly now;
     private readonly setTimer;
     private readonly clearTimer;
@@ -95,6 +92,8 @@ export declare class ProgressPoster {
      * deliveries posted the placeholder right after a real message.
      */
     private queued;
+    /** Posts queued for the person, excluding agent-lane status beats. */
+    private personQueued;
     constructor(opts: ProgressPosterOptions);
     /** Arm the one-time "working on it" note. Call when the turn starts. */
     start(): void;
@@ -109,11 +108,9 @@ export declare class ProgressPoster {
     /** True once any message from the model was said this turn (not counting the notice). */
     get saidAnything(): boolean;
     /**
-     * The turn succeeded: post whatever is pending, then the final answer unless
-     * it repeats what was already said. Resolves once everything is sent.
-     *
-     * When `sendFinal` was provided, progress items flush through `send` and the
-     * final reply goes through `sendFinal` — keeping their audience tags distinct.
+     * The turn succeeded: post pending human-facing text, then a human-lane
+     * terminal message when the final adds something. Agent-lane status beats
+     * alone still receive a human-lane fallback before the turn closes.
      */
     finish(finalText: string): Promise<void>;
     /**
@@ -125,6 +122,7 @@ export declare class ProgressPoster {
     private scheduleFlush;
     private flushNow;
     private enqueue;
+    private enqueueToPerson;
     private enqueueWith;
     private cancelFlush;
     private cancelNotice;