@indigoai-us/hq-cli 5.342.6 → 5.342.8

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.342.8] — 2026-10-04
+- Keep blocker escalation failures visible on the lane and stop retrying the same failed fallback every watcher turn.
+- Release the daemon's hq-cli package-use lease after all reachable lazy runtime modules preload successfully, allowing CLI updates while preserving the existing restart-on-update path.
+
+## [5.342.7] — 2026-10-04
+- Batch policy frontmatter reads into one `hq core policy frontmatter` invocation while preserving single-file output.
+
 ## [5.342.6] — 2026-10-04
 - Add `hq mesh project member add` to add an active company member to a project.
 

package/assets/scaffold/core/scripts/read-policy-frontmatter.sh

@@ -2,6 +2,7 @@
 # read-policy-frontmatter.sh — Extract YAML frontmatter from a policy file
 #
 # Usage: bash core/scripts/read-policy-frontmatter.sh <policy-file>
+#        bash core/scripts/read-policy-frontmatter.sh <policy-file> <policy-file> ...
 #
 # Returns only the YAML frontmatter block (between the first two --- markers),
 # skipping the policy body. Used by /startwork, /plan, /brainstorm, /run commands
@@ -20,13 +21,19 @@ if [ $# -lt 1 ]; then
   exit 1
 fi
 
-FILE="$1"
+INDEX=0
+for FILE in "$@"; do
+  if [ ! -r "$FILE" ]; then
+    echo "ERROR: File not readable: $FILE" >&2
+    exit 1
+  fi
 
-if [ ! -r "$FILE" ]; then
-  echo "ERROR: File not readable: $FILE" >&2
-  exit 1
-fi
+  if [ "$INDEX" -gt 0 ]; then
+    printf '\n# --- policy-file: %s ---\n' "$FILE"
+  fi
+  INDEX=$((INDEX + 1))
 
-# Extract frontmatter: lines between first two --- markers.
-# c counts --- markers; print lines only while inside the frontmatter (c==1).
-awk '/^---$/{c++; next} c==1' "$FILE"
+  # Extract frontmatter: lines between first two --- markers.
+  # c counts --- markers; print lines only while inside the frontmatter (c==1).
+  awk '/^---$/{c++; next} c==1' "$FILE"
+done

package/dist/commands/core-policy-frontmatter.js

@@ -2,37 +2,58 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { usesGnuAwk } from '../lib/core-utils/awk-diagnostics.js';
 const USAGE = Buffer.from('USAGE: read-policy-frontmatter.sh <policy-file>\n');
+const MULTI_FILE_SEPARATOR = (file) => Buffer.from(`\n# --- policy-file: ${file} ---\n`);
 /** Byte-preserving port of core/scripts/read-policy-frontmatter.sh. */
 export function runPolicyFrontmatter(args, cwd, pathValue = process.env.PATH, platform = process.platform) {
-    const first = args[0];
-    if (first === undefined)
+    if (args.length === 0)
         return { code: 1, stdout: Buffer.alloc(0), stderr: USAGE };
-    const filePath = path.isAbsolute(first) ? first : path.resolve(cwd, first);
-    let source;
-    try {
-        fs.accessSync(filePath, fs.constants.R_OK);
-        source = fs.readFileSync(filePath);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === 'EISDIR') {
-            return {
-                code: 0,
-                stdout: Buffer.alloc(0),
-                stderr: Buffer.from(usesGnuAwk(pathValue, platform)
-                    ? `awk: warning: command line argument \`${first}' is a directory: skipped\n`
-                    : ''),
-            };
+    const output = [];
+    const diagnostics = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const file = args[index];
+        const filePath = path.isAbsolute(file) ? file : path.resolve(cwd, file);
+        try {
+            fs.accessSync(filePath, fs.constants.R_OK);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {
+                return {
+                    code: 1,
+                    stdout: Buffer.concat(output),
+                    stderr: Buffer.concat([...diagnostics, Buffer.from(`ERROR: File not readable: ${file}\n`)]),
+                };
+            }
+            throw error;
         }
-        if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {
-            return {
-                code: 1,
-                stdout: Buffer.alloc(0),
-                stderr: Buffer.from(`ERROR: File not readable: ${first}\n`),
-            };
+        if (index > 0)
+            output.push(MULTI_FILE_SEPARATOR(file));
+        let source;
+        try {
+            source = fs.readFileSync(filePath);
         }
-        throw error;
+        catch (error) {
+            const code = error.code;
+            if (code === 'EISDIR') {
+                if (usesGnuAwk(pathValue, platform)) {
+                    diagnostics.push(Buffer.from(`awk: warning: command line argument \`${file}' is a directory: skipped\n`));
+                }
+                continue;
+            }
+            if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {
+                return {
+                    code: 1,
+                    stdout: Buffer.concat(output),
+                    stderr: Buffer.concat([...diagnostics, Buffer.from(`ERROR: File not readable: ${file}\n`)]),
+                };
+            }
+            throw error;
+        }
+        output.push(extractFrontmatter(source, platform));
     }
+    return { code: 0, stdout: Buffer.concat(output), stderr: Buffer.concat(diagnostics) };
+}
+function extractFrontmatter(source, platform) {
     const output = [];
     let markers = 0;
     let start = 0;
@@ -53,6 +74,6 @@ export function runPolicyFrontmatter(args, cwd, pathValue = process.env.PATH, pl
             break;
         start = end + 1;
     }
-    return { code: 0, stdout: Buffer.concat(output), stderr: Buffer.alloc(0) };
+    return Buffer.concat(output);
 }
 //# sourceMappingURL=core-policy-frontmatter.js.map

package/dist/commands/daemon.d.ts

@@ -19,8 +19,8 @@ import type { HostApp } from "../lib/daemon/supervisor.js";
 import { type SyncModeVaultClient } from "./sync-mode.js";
 import type { RunCommand } from "../lib/service-manager/launchd.js";
 type DaemonRunnerModule = typeof import("../lib/daemon/run.js");
-/** Load the daemon runtime without releasing its lease: it reads package files while resident. */
-export declare function loadDaemonRunner(_release?: () => void, load?: () => Promise<DaemonRunnerModule>): Promise<DaemonRunnerModule["runDaemon"]>;
+/** Load every lazy daemon runtime module before releasing its package-use lease. */
+export declare function loadDaemonRunner(release?: () => void, load?: () => Promise<DaemonRunnerModule>, preload?: () => Promise<void>, reportPreloadFailure?: (error: unknown) => void): Promise<DaemonRunnerModule["runDaemon"]>;
 export interface DaemonCommandDeps {
     env: NodeJS.ProcessEnv;
     home: string;

package/dist/commands/daemon.js

@@ -35,10 +35,23 @@ import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
 import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
 import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
-/** Load the daemon runtime without releasing its lease: it reads package files while resident. */
-export async function loadDaemonRunner(_release = () => undefined, load = () => import("../lib/daemon/run.js")) {
+import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
+import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
+/** Load every lazy daemon runtime module before releasing its package-use lease. */
+export async function loadDaemonRunner(release = releaseCurrentPackageUseLease, load = () => import("../lib/daemon/run.js"), preload = () => preloadResidentPackageModules("daemon"), reportPreloadFailure = reportResidentPackagePreloadFailure) {
     const { runDaemon } = await load();
-    return runDaemon;
+    let preloadComplete = false;
+    await releasePackageUseLeaseAfterResidentPreload(preload, reportPreloadFailure, () => {
+        preloadComplete = true;
+    });
+    return (options) => runDaemon({
+        ...options,
+        onStartupReadsComplete: () => {
+            options.onStartupReadsComplete?.();
+            if (preloadComplete)
+                release();
+        },
+    });
 }
 class DaemonCommandError extends Error {
 }

package/dist/lib/daemon/run.d.ts

@@ -34,6 +34,8 @@ export interface RunDaemonOptions {
     env?: NodeJS.ProcessEnv;
     nodeBinary: string;
     hqBinary: string;
+    /** Called after the initial supervisor plan has finished package-backed startup reads. */
+    onStartupReadsComplete?: () => void;
 }
 export declare function resolveSyncRunnerPath(): string | null;
 /** The hosted desktop app uses this env value when planning daemon services. */

package/dist/lib/daemon/run.js

@@ -830,6 +830,9 @@ export async function runDaemon(opts) {
             releaseDaemonLock(paths.lockPath);
             resolve(1);
         }
+        finally {
+            opts.onStartupReadsComplete?.();
+        }
     });
 }
 /** Report an hqd op crash to the CLI's existing Sentry integration, tagged with the failing op. */

package/dist/lib/lanes/watcher.js

@@ -863,11 +863,6 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
             retryUndeliverable = true;
             escalationText = `Blocker freshness escalation for ${current.lane_id}: these blockers remain stale after consecutive turns: ${staleLabels.join(", ")}. Status file: ${resolution.statusPath}.`;
         }
-        else if (failedFallback !== undefined) {
-            deliverFallback = true;
-            undeliverableReason = failedFallback.reason ?? prior?.undeliverable_reason ?? "The session senior inbox is unavailable";
-            escalationText = `Blocker freshness escalation for ${current.lane_id}: these blockers remain stale after consecutive turns: ${staleLabels.join(", ")}. Status file: ${resolution.statusPath}.`;
-        }
         else if (prior !== undefined && blockerFreshnessFingerprint(prior.stale_keys.map((key, index) => ({ key, label: prior.stale_labels[index] ?? "" }))) !== fingerprint) {
             escalatedFingerprint = undefined;
         }
@@ -923,16 +918,18 @@ async function settleBlockerFreshness(hqRoot, lane, manifestTurnId, at, deps, me
             logDecision({ event: "blocker_stale_escalation_fallback_failed", at, turn_id: turnId, fingerprint, error: message });
             updated = retryUpdateLane(hqRoot, lane.lane_id, "watcher", (current) => {
                 const state = current.blocker_freshness_state;
-                const retryableState = state === undefined ? undefined : { ...state };
-                if (retryableState !== undefined) {
-                    delete retryableState.undeliverable_fingerprint;
-                    delete retryableState.undeliverable_reason;
-                }
+                const failureReason = `${undeliverableReason ?? `Session ${lane.senior.id ?? "unknown"} has no monitor-session inbox`}; lane inbox fallback failed: ${message}`;
                 return {
                     ...current,
-                    ...(retryableState !== undefined ? { blocker_freshness_state: retryableState } : {}),
+                    ...(state !== undefined ? {
+                        blocker_freshness_state: {
+                            ...state,
+                            undeliverable_fingerprint: fingerprint,
+                            undeliverable_reason: failureReason,
+                        },
+                    } : {}),
                     status_gate_history: (current.status_gate_history ?? []).map((entry) => entry.event === "blocker_stale_escalation_undeliverable" && entry.fingerprint === fingerprint
-                        ? { ...entry, delivery_failed: true }
+                        ? { ...entry, delivery_failed: true, reason: failureReason }
                         : entry),
                 };
             });
@@ -1083,12 +1080,12 @@ function findBlockerFreshnessSessionInbox(hqRoot, sessionId) {
             .filter((sessionDir) => fs.existsSync(sessionDir));
     }
     catch (error) {
-        return { reason: `Could not resolve the monitor inbox for session senior: ${error instanceof Error ? error.message : String(error)}` };
+        return { reason: `Could not resolve the monitor inbox for session ${sessionId}: ${error instanceof Error ? error.message : String(error)}` };
     }
     if (candidates.length !== 1) {
         return { reason: candidates.length === 0
-                ? "No monitor-session inbox is registered for the session senior"
-                : "The session senior matches more than one monitor-session inbox" };
+                ? `No monitor-session inbox is registered for session ${sessionId}`
+                : `Session ${sessionId} matches more than one monitor-session inbox` };
     }
     return { inbox: path.join(candidates[0], "dropbox") };
 }

package/dist/sentry.d.ts

@@ -1,5 +1,7 @@
 import type { ErrorEvent, EventHint, NodeOptions } from "@sentry/node";
 type SentryModule = typeof import("@sentry/node");
+/** Load the SDK through the same resolver used by the lazy Sentry facade. */
+export declare function preloadSentrySdk(): void;
 /**
  * The command graph touches the Sentry facade on normal startup for a
  * breadcrumb and a final flush. Keep those operations inert until the SDK

package/dist/sentry.js

@@ -24,6 +24,10 @@ function loadSentryModule() {
     sentryModule ??= requireSentry("@sentry/node");
     return sentryModule;
 }
+/** Load the SDK through the same resolver used by the lazy Sentry facade. */
+export function preloadSentrySdk() {
+    loadSentryModule();
+}
 /**
  * The command graph touches the Sentry facade on normal startup for a
  * breadcrumb and a final flush. Keep those operations inert until the SDK

package/dist/utils/resident-package-preload.d.ts

@@ -1,4 +1,4 @@
-export type ResidentPackagePath = "bot" | "mcp";
+export type ResidentPackagePath = "bot" | "mcp" | "daemon";
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export declare const RESIDENT_PACKAGE_MODULES: Record<ResidentPackagePath, readonly string[]>;
 export declare class ResidentPackagePreloadError extends Error {

package/dist/utils/resident-package-preload.js

@@ -2,18 +2,42 @@
 export const RESIDENT_PACKAGE_MODULES = {
     bot: ["../lib/flag-registry.js", "../commands/access.js", "../sentry.js", "open"],
     mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js"],
+    daemon: [
+        "../sentry.js",
+        "../utils/cognito-session.js",
+        "../lib/daemon/mcp-oauth.js",
+        "@modelcontextprotocol/sdk/client/index.js",
+        "@modelcontextprotocol/sdk/client/streamableHttp.js",
+        "../utils/staged-npm-install.js",
+        "open",
+    ],
 };
 const LOADERS = {
     bot: [
         () => import("../lib/flag-registry.js"),
         () => import("../commands/access.js"),
-        () => import("../sentry.js"),
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
         () => import("open"),
     ],
     mcp: [
         () => import("../lib/mcp/tools.js"),
         () => import("../lib/mcp/prompts.js"),
     ],
+    daemon: [
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("../utils/cognito-session.js"),
+        () => import("../lib/daemon/mcp-oauth.js"),
+        () => import("@modelcontextprotocol/sdk/client/index.js"),
+        () => import("@modelcontextprotocol/sdk/client/streamableHttp.js"),
+        () => import("../utils/staged-npm-install.js"),
+        () => import("open"),
+    ],
 };
 export class ResidentPackagePreloadError extends Error {
     moduleSpecifier;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.6",
+  "version": "5.342.8",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {