@indigoai-us/hq-cli 5.342.18 → 5.343.1

package/dist/utils/install-tree-torn.js

@@ -714,6 +714,28 @@ function updaterPidAlive(lockPath, fs, isPidAlive) {
         return "unknown";
     }
 }
+/** Whether the lock names a live process other than this CLI invocation. */
+function liveForeignUpdaterPid(lockPath, fs, isPidAlive) {
+    try {
+        const lock = JSON.parse(fs.readFileSync(lockPath, "utf-8"));
+        if (typeof lock.startedAt !== "string" ||
+            Number.isNaN(Date.parse(lock.startedAt)) ||
+            typeof lock.tool !== "string" ||
+            lock.tool.length === 0 ||
+            typeof lock.version !== "string" ||
+            lock.version.length === 0) {
+            return false;
+        }
+        return typeof lock.pid === "number" &&
+            Number.isSafeInteger(lock.pid) &&
+            lock.pid > 0 &&
+            lock.pid !== process.pid &&
+            isPidAlive(lock.pid);
+    }
+    catch {
+        return false;
+    }
+}
 /** Snapshot retired sibling trees so changes below their root stay observable. */
 function retiredSiblingActivitySignature(packageRoot, fs) {
     const { leaf } = cliNameParts();
@@ -917,7 +939,8 @@ const DEFAULT_INSTALL_TREE_STALE_PROBE_MS = 1_500;
 /**
  * Poll until the install tree has been continuously READY for `quietMs`, or the
  * wait exhausts its bounds. READY means: (i) no FRESH update lock held by another
- * pid, (ii) the missing target is present, and — when `packageRoot` is known —
+ * pid and no live recorded updater while the tree is in flight, (ii) the missing
+ * target is present, and — when `packageRoot` is known —
  * (iii) `<packageRoot>/package.json` parses with `name === CLI_NAME` and (iv) no
  * `.<leaf>-<rand>` retired sibling remains beside it. Every filesystem error makes
  * its condition "not ready" rather than throwing.
@@ -934,20 +957,22 @@ const DEFAULT_INSTALL_TREE_STALE_PROBE_MS = 1_500;
  *     any installer before attempting a repair. Any observed signature change
  *     keeps the ordinary settle deadline in force. `deadlineMs === 0` evaluates
  *     readiness once.
- *   - LOCKED time — wall time observed under a fresh foreign lock held by a live
- *     pid — is bounded SEPARATELY by `lockWaitMs` (default the lock contract's own
- *     10-minute staleness window) and does NOT consume the settle budget. When
- *     that ceiling is reached with the lock still held, the result is unsettled
- *     with `lockHeldAtEnd` true so the seam can report a distinct `lock-held`
- *     outcome and remedy rather than telling the user to reinstall over a live
- *     writer.
- * Each poll's REAL elapsed interval (now() deltas) is attributed to the locked or
- * unlocked bucket by whether a fresh foreign lock was held when the interval
- * began, so a starved event loop only makes the wait coarser, never unbounded. A
+ *   - WRITER time — wall time observed under a fresh foreign lock, or while a
+ *     recorded foreign updater pid is alive and the tree has an in-flight signal
+ *     — is bounded SEPARATELY by `lockWaitMs` (default the lock contract's own
+ *     10-minute staleness window) and does NOT consume the settle budget. This
+ *     also covers a still-running updater whose lock became stale by age. When
+ *     that ceiling is reached, the result is unsettled; `lockHeldAtEnd` remains
+ *     reserved for a fresh lock held at the end.
+ * Each poll's REAL elapsed interval (now() deltas) is attributed to the writer or
+ * unlocked bucket by whether a fresh lock or qualifying live updater was observed
+ * when the interval began, so a starved event loop only makes the wait coarser,
+ * never unbounded. A
  * stale lock (dead pid, older than the staleness window, unparseable) or our own
- * pid never extends anything. The whole wait is bounded (≤ `deadlineMs +
+ * pid never extends anything by itself. The whole wait is bounded (≤ `deadlineMs +
  * lockWaitMs`), and the unchanged-tree path normally returns after the much
- * shorter `staleProbeMs` observation window.
+ * shorter `staleProbeMs` observation window unless a live updater pid is still
+ * present with an in-flight tree signal.
  */
 export async function waitForInstallTreeSettled(args) {
     const now = args.now ?? Date.now;
@@ -967,17 +992,21 @@ export async function waitForInstallTreeSettled(args) {
     let sawLock = false;
     let sawRetired = false;
     let lockedMs = 0;
+    let writerMs = 0;
     let unlockedMs = 0;
     let lockTool = "";
     let prevT = start;
     let prevForeignLockHeld = false;
+    let prevWriterHeld = false;
     let lockExtendedFired = false;
     for (;;) {
         const t = now();
-        // Attribute the interval that just elapsed [prevT, t) to the bucket for the
-        // lock state that held when it BEGAN (real now() deltas, never nominal pollMs).
+        // Attribute the interval that just elapsed [prevT, t) using the state that
+        // held when it BEGAN (real now() deltas, never nominal pollMs).
         if (prevForeignLockHeld)
             lockedMs += t - prevT;
+        if (prevWriterHeld)
+            writerMs += t - prevT;
         else
             unlockedMs += t - prevT;
         const lock = freshForeignLock(args.lockPath, t, isPidAlive, fs);
@@ -1015,7 +1044,10 @@ export async function waitForInstallTreeSettled(args) {
                 retiredCheckFailed = true;
             }
         }
-        let ready = !foreignLockHeld && installTargetPresent(args.target, fs);
+        const inFlightTree = sawLock || sawRetired || sawTreeChange;
+        const updaterPidHeld = inFlightTree && liveForeignUpdaterPid(args.lockPath, fs, isPidAlive);
+        const writerHeld = foreignLockHeld || updaterPidHeld;
+        let ready = !writerHeld && installTargetPresent(args.target, fs);
         if (ready && args.packageRoot) {
             try {
                 if (!packageRootHealthy(args.packageRoot, fs))
@@ -1055,6 +1087,7 @@ export async function waitForInstallTreeSettled(args) {
         }
         if (!ready &&
             !foreignLockHeld &&
+            !updaterPidHeld &&
             !retiredCheckFailed &&
             !sawLock &&
             !sawTreeChange &&
@@ -1078,14 +1111,13 @@ export async function waitForInstallTreeSettled(args) {
             };
         }
         // Give up when the TREE has had a full unlocked budget with no writer visible,
-        // OR a writer is STILL holding the lock and has held it past its own staleness
-        // ceiling. The lock ceiling is gated on a lock being held RIGHT NOW so that a
-        // ceiling of 0 (HQ_INSTALL_SETTLE_LOCK_TIMEOUT_MS=0, "do not extend under a
-        // lock") disables only the extension and does not collapse the ordinary
-        // deadlineMs settle when no lock exists — `lockedMs` is 0 ≥ 0 on every poll.
+        // OR a qualifying writer has exceeded the shared writer ceiling. The writer
+        // ceiling only extends while a fresh lock or in-flight live PID is present, so
+        // a ceiling of 0 disables only that extension and does not collapse the normal
+        // deadlineMs settle when no writer exists.
         // `deadlineMs` 0 makes the unlocked test fire on the first poll (evaluate-once),
         // matching the pre-lock-aware contract; `lockHeldAtEnd` distinguishes the causes.
-        if (unlockedMs >= deadlineMs || (foreignLockHeld && lockedMs >= lockWaitMs)) {
+        if (unlockedMs >= deadlineMs || (writerHeld && writerMs >= lockWaitMs)) {
             return {
                 settled: false,
                 waitedMs,
@@ -1102,15 +1134,15 @@ export async function waitForInstallTreeSettled(args) {
                 updaterPidAlive: updaterPidAlive(args.lockPath, fs, isPidAlive),
             };
         }
-        // The first poll at which the wait has reached `deadlineMs` while a lock is
-        // still held is exactly where the pre-lock-aware wait gave up — announce the
-        // extension once, and only when we are genuinely going to keep waiting.
-        if (!lockExtendedFired && foreignLockHeld && waitedMs >= deadlineMs) {
+        // Announce once when the deadline has passed and a qualifying writer is why
+        // the bounded wait continues.
+        if (!lockExtendedFired && writerHeld && waitedMs >= deadlineMs) {
             lockExtendedFired = true;
             args.onLockExtended?.();
         }
         prevT = t;
         prevForeignLockHeld = foreignLockHeld;
+        prevWriterHeld = writerHeld;
         await sleep(pollMs);
     }
 }

package/dist/utils/resident-package-preload.d.ts

@@ -1,4 +1,4 @@
-export type ResidentPackagePath = "agent-kit" | "agent-mcp" | "auth-login" | "agents-terminal" | "bot" | "bot-logs-follow" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon" | "daemon-logs-follow" | "mesh-daemon" | "lanes-watch" | "monitor-wait" | "monitor-run" | "agents-message-wait" | "integrations-oauth-wait";
+export type ResidentPackagePath = "agent-kit" | "agent-mcp" | "auth-login" | "agents-terminal" | "bot" | "bot-logs-follow" | "childWrapper" | "coreJobRun" | "daemon-call" | "login" | "mcp" | "daemon" | "daemon-logs-follow" | "mesh-daemon" | "lanes-watch" | "monitor-wait" | "monitor-run" | "agents-message-wait" | "integrations-oauth-wait" | "outpost-wait" | "secrets-sandbox" | "pkg-update" | "pack-install";
 /** Runtime modules that resident commands may need after a wait starts. */
 export declare const RESIDENT_PACKAGE_MODULES: Record<ResidentPackagePath, readonly string[]>;
 export declare class ResidentPackagePreloadError extends Error {

package/dist/utils/resident-package-preload.js

@@ -43,6 +43,7 @@ export const RESIDENT_PACKAGE_MODULES = {
     mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js"],
     childWrapper: ["../main.js"],
     coreJobRun: ["../lib/flag-registry.js"],
+    "daemon-call": ["../lib/daemon/protocol.js"],
     daemon: [
         "../sentry.js",
         "../utils/cognito-session.js",
@@ -63,6 +64,24 @@ export const RESIDENT_PACKAGE_MODULES = {
     "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     "agents-message-wait": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     "integrations-oauth-wait": ["../sentry.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
+    "outpost-wait": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
+    "secrets-sandbox": [],
+    "pkg-update": ["../sentry.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud"],
+    "pack-install": [
+        "../sentry.js",
+        "../lib/plan-limit-nag.js",
+        "../utils/plan-gate-error.js",
+        "open",
+        "../commands/mcp-serve.js",
+        "../lib/daemon/mcp-oauth.js",
+        "../lib/mcp/tools.js",
+        "../lib/mcp/prompts.js",
+        "../utils/sandbox-runner-client.js",
+        "../utils/cli-telemetry.js",
+        "../utils/cognito-session.js",
+        "../lib/first-sync-next-step.js",
+        "@indigoai-us/hq-cloud",
+    ],
 };
 const LOADERS = {
     "agent-kit": [
@@ -158,6 +177,9 @@ const LOADERS = {
     coreJobRun: [
         () => import("../lib/flag-registry.js"),
     ],
+    "daemon-call": [
+        () => import("../lib/daemon/protocol.js"),
+    ],
     daemon: [
         async () => {
             const { preloadSentrySdk } = await import("../sentry.js");
@@ -248,6 +270,46 @@ const LOADERS = {
         () => import("../lib/first-sync-next-step.js"),
         () => import("@indigoai-us/hq-cloud"),
     ],
+    "outpost-wait": [
+        () => import("../commands/lanes.js"),
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("open"),
+        () => import("../utils/cognito-session.js"),
+        () => import("../lib/first-sync-next-step.js"),
+        () => import("@indigoai-us/hq-cloud"),
+    ],
+    "secrets-sandbox": [],
+    "pkg-update": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../utils/cognito-session.js"),
+        () => import("@indigoai-us/hq-cloud"),
+    ],
+    "pack-install": [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        () => import("open"),
+        () => import("../commands/mcp-serve.js"),
+        () => import("../lib/daemon/mcp-oauth.js"),
+        () => import("../lib/mcp/tools.js"),
+        () => import("../lib/mcp/prompts.js"),
+        () => import("../utils/sandbox-runner-client.js"),
+        () => import("../utils/cli-telemetry.js"),
+        () => import("../utils/cognito-session.js"),
+        () => import("../lib/first-sync-next-step.js"),
+        () => import("@indigoai-us/hq-cloud"),
+    ],
 };
 export class ResidentPackagePreloadError extends Error {
     moduleSpecifier;

package/dist/utils/secrets-sandbox-resident.d.ts

@@ -0,0 +1,5 @@
+import type { SandboxRunnerClient, SandboxRunnerJob, SandboxRunnerStartResponse } from "./sandbox-runner-client.js";
+import { type ResidentCommandLeaseOptions } from "./resident-package-preload.js";
+/** Poll a submitted remote job after loading local result and error-path modules. */
+export declare function runSandboxJobAfterSubmission(client: Pick<SandboxRunnerClient, "getJob" | "pollJob">, token: string, started: SandboxRunnerStartResponse, leaseOptions?: ResidentCommandLeaseOptions): Promise<SandboxRunnerJob>;
+//# sourceMappingURL=secrets-sandbox-resident.d.ts.map

package/dist/utils/secrets-sandbox-resident.js

@@ -0,0 +1,8 @@
+import { runResidentCommandWithPackageLease } from "./resident-package-preload.js";
+/** Poll a submitted remote job after loading local result and error-path modules. */
+export function runSandboxJobAfterSubmission(client, token, started, leaseOptions) {
+    return runResidentCommandWithPackageLease("secrets-sandbox", () => started.status === "succeeded" || started.status === "failed"
+        ? client.getJob(token, started.jobId)
+        : client.pollJob(token, started.jobId), leaseOptions);
+}
+//# sourceMappingURL=secrets-sandbox-resident.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.18",
+  "version": "5.343.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {