@indigoai-us/hq-cli 5.345.116 → 5.345.118

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.345.118] — 2026-10-13
+- `hq integrations call` and `hq integrations tools` now work for the
+  built-in Google Workspace, Linear and Slack connections. Calls use the
+  tool's own name (for example `google.drive.picked.list`), and `tools`
+  lists only the selected connection's tools. `--args` may not set
+  `companyUid`, `connectionId` or `idempotencyKey`; hq fills those in from
+  the selected connection.
+
+## [5.345.117] — 2026-10-13
+- `hq lanes monitor-check` answers a session that owns no active lane from the lane-record directory alone, without loading the command graph. The Claude Stop hook runs it after every turn in every session; per-call CPU drops from about 545 ms to about 60 ms. Sessions with an active lane, corrupt records, or conflict sidecars still use the full command.
+
 ## [5.345.116] — 2026-10-13
 
 ## [5.345.115] — 2026-10-13

package/dist/commands/integrations-core.d.ts

@@ -257,6 +257,12 @@ export interface UsableAppsResult {
     viewerAccessKnown: boolean;
     apps: UsableApp[];
 }
+/**
+ * Built-in providers expose their tools under their own names
+ * (`google.drive.picked.list`), not through the factory passthrough
+ * `<prefix>.mcp.tools.call`, which the gateway never registers for them.
+ */
+export declare function isBuiltInGatewayProvider(provider: string): boolean;
 /**
  * The apps the caller may use, from `GET /v1/integrations/admin?view=summary`.
  * A row counts only when all of these hold, mirroring the gateway's checks:
@@ -296,7 +302,7 @@ export declare function resolveConnection(token: string, companyUid: string, app
 }, recoveryOpts?: {
     allowSingleRevoked?: boolean;
 }): Promise<AdminConnection>;
-export declare function callGateway(token: string, params: Record<string, unknown>, idempotencyKey?: string): Promise<GatewayMessage>;
+export declare function callGateway(token: string, params: Record<string, unknown>, idempotencyKey?: string, method?: "tools/call" | "tools/list"): Promise<GatewayMessage>;
 /**
  * Gateway results arrive MCP-style: `{ content: [{ type: "text", text }] }`
  * where `text` is the provider's JSON. Unwrap to the inner payload; fall back

package/dist/commands/integrations-core.js

@@ -368,6 +368,14 @@ const GATEWAY_SERVED_STATUSES = new Set(["connected", "needs-attention"]);
  * gateway as `ProviderUnsupported`.
  */
 const STATIC_GATEWAY_PROVIDERS = new Set(["google-workspace", "linear", "slack"]);
+/**
+ * Built-in providers expose their tools under their own names
+ * (`google.drive.picked.list`), not through the factory passthrough
+ * `<prefix>.mcp.tools.call`, which the gateway never registers for them.
+ */
+export function isBuiltInGatewayProvider(provider) {
+    return STATIC_GATEWAY_PROVIDERS.has(provider);
+}
 const MAX_APP_NAME_LENGTH = 60;
 /**
  * Display names are set by whoever installed the app and end up in agent
@@ -561,7 +569,9 @@ export async function resolveConnection(token, companyUid, app, opts, recoveryOp
     }
     return selectConnection(connections, opts);
 }
-function gatewaySubcommandFor(params) {
+function gatewaySubcommandFor(params, method) {
+    if (method === "tools/list")
+        return "tools_list";
     const name = params.name;
     if (typeof name !== "string")
         return "other";
@@ -569,10 +579,13 @@ function gatewaySubcommandFor(params) {
         return "tools_list";
     if (name.endsWith(".mcp.tools.call"))
         return "tools_call";
+    // Built-in providers are called by the tool's own name, with no passthrough.
+    if (!name.includes(".mcp."))
+        return "tools_call";
     return "other";
 }
-export async function callGateway(token, params, idempotencyKey) {
-    const gatewaySubcommand = gatewaySubcommandFor(params);
+export async function callGateway(token, params, idempotencyKey, method = "tools/call") {
+    const gatewaySubcommand = gatewaySubcommandFor(params, method);
     const deadline = Date.now() + ASYNC_GATEWAY_DEADLINE_MS;
     const res = await vaultApiFetch({
         token,
@@ -581,7 +594,7 @@ export async function callGateway(token, params, idempotencyKey) {
         body: {
             jsonrpc: "2.0",
             id: `hq-cli-${randomUUID()}`,
-            method: "tools/call",
+            method,
             params,
         },
     });

package/dist/commands/integrations.js

@@ -54,12 +54,39 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { registerSlackCommands } from "./integrations-slack.js";
 import { fetchPendingApprovals } from "./integrations-api.js";
+/** Routing ids hq sets on a built-in tool call; never accepted from --args. */
+const BUILT_IN_ROUTING_ARGS = ["companyUid", "connectionId", "idempotencyKey"];
+/**
+ * hq sets the routing ids on every built-in call and refuses them in --args,
+ * so discovery must not list them as inputs the caller provides.
+ */
+function withoutRoutingArgs(tool) {
+    const schema = tool.inputSchema;
+    if (!schema || typeof schema !== "object" || Array.isArray(schema))
+        return tool;
+    const { properties, required, ...rest } = schema;
+    const routing = new Set(BUILT_IN_ROUTING_ARGS);
+    const next = { ...rest };
+    if (properties && typeof properties === "object" && !Array.isArray(properties)) {
+        next.properties = Object.fromEntries(Object.entries(properties).filter(([key]) => !routing.has(key)));
+    }
+    else if (properties !== undefined) {
+        next.properties = properties;
+    }
+    if (Array.isArray(required)) {
+        next.required = required.filter((key) => !(typeof key === "string" && routing.has(key)));
+    }
+    else if (required !== undefined) {
+        next.required = required;
+    }
+    return { ...tool, inputSchema: next };
+}
 export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 /**
  * Gateway metadata is additive and may be absent when talking to an older
@@ -285,16 +312,33 @@ export function registerIntegrationsCommand(program) {
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        const connections = await fetchConnections(token, companyUid);
+        const connection = selectConnection(connections, opts);
         if (reportRevokedConnection(connection, opts))
             return;
-        const prefix = toolPrefixForProvider(connection.provider);
-        const message = await callGateway(token, {
-            companyUid,
-            name: `${prefix}.mcp.tools.list`,
-            arguments: { companyUid, connectionId: connection.id },
-        });
-        const payload = unwrapGatewayResult(message.result);
+        let payload;
+        const builtIn = isBuiltInGatewayProvider(connection.provider);
+        if (builtIn) {
+            // Built-in providers answer the gateway's own tools/list, which spans
+            // every connection in the company; keep only this connection's tools.
+            const message = await callGateway(token, { companyUid }, undefined, "tools/list");
+            const listed = unwrapGatewayResult(message.result);
+            payload = {
+                ...listed,
+                tools: (listed?.tools ?? [])
+                    .filter((tool) => tool.annotations?.connectionId === connection.id)
+                    .map(withoutRoutingArgs),
+            };
+        }
+        else {
+            const prefix = toolPrefixForProvider(connection.provider);
+            const message = await callGateway(token, {
+                companyUid,
+                name: `${prefix}.mcp.tools.list`,
+                arguments: { companyUid, connectionId: connection.id },
+            });
+            payload = unwrapGatewayResult(message.result);
+        }
         const tools = payload?.tools ?? [];
         if (tools.length === 0) {
             if (opts.json) {
@@ -331,7 +375,14 @@ export function registerIntegrationsCommand(program) {
             const badge = formatToolBadge(tool);
             console.log(`${chalk.bold(tool.name)}${badge ? `  ${badge}` : ""}${label}${required ? `  ${chalk.dim(required)}` : ""}`);
         }
-        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools --provider ${bareProvider(connection.provider)} --describe <tool>\nCall one with: hq integrations call <tool> --provider ${bareProvider(connection.provider)} --args '<json>'`));
+        // `--provider` resolves to the first matching connection, so when
+        // several connections share this provider the hint must name this one.
+        const sharedProvider = builtIn &&
+            connections.some((c) => c.id !== connection.id && c.status !== "revoked" && c.provider === connection.provider);
+        const selector = sharedProvider
+            ? `--connection ${connection.id}`
+            : `--provider ${bareProvider(connection.provider)}`;
+        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools ${selector} --describe <tool>\nCall one with: hq integrations call <tool> ${selector} --args '<json>'`));
     });
     integrations
         .command("call <tool>")
@@ -359,20 +410,38 @@ export function registerIntegrationsCommand(program) {
         const connection = selectConnection(await fetchConnections(token, companyUid), opts);
         if (reportRevokedConnection(connection, { ...opts, fail: true }))
             return;
-        const prefix = toolPrefixForProvider(connection.provider);
         const idempotencyKey = opts.idempotencyKey ?? `hq-cli-${randomUUID()}`;
-        const message = await callGateway(token, {
-            companyUid,
-            acceptAsync: true,
-            name: `${prefix}.mcp.tools.call`,
-            arguments: {
+        let gatewayParams;
+        if (isBuiltInGatewayProvider(connection.provider)) {
+            // Built-in tools take their args flat beside the routing ids, so an
+            // arg with a routing name would redirect the call; refuse it.
+            const reserved = BUILT_IN_ROUTING_ARGS.filter((key) => key in parsedArgs);
+            if (reserved.length) {
+                throw new IntegrationsCliError(`--args cannot include ${reserved.join(", ")}: it is set by hq from the selected connection.`, { expected: true });
+            }
+            gatewayParams = {
+                companyUid,
+                acceptAsync: true,
+                name: tool,
+                arguments: { ...parsedArgs, companyUid, connectionId: connection.id, idempotencyKey },
+            };
+        }
+        else {
+            const prefix = toolPrefixForProvider(connection.provider);
+            gatewayParams = {
                 companyUid,
-                connectionId: connection.id,
-                toolName: tool,
-                arguments: parsedArgs,
-                idempotencyKey,
-            },
-        }, idempotencyKey);
+                acceptAsync: true,
+                name: `${prefix}.mcp.tools.call`,
+                arguments: {
+                    companyUid,
+                    connectionId: connection.id,
+                    toolName: tool,
+                    arguments: parsedArgs,
+                    idempotencyKey,
+                },
+            };
+        }
+        const message = await callGateway(token, gatewayParams, idempotencyKey);
         const payload = unwrapGatewayResult(message.result);
         const queued = queuedOutcome(payload);
         if (queued) {

package/dist/index.js

@@ -13,6 +13,7 @@ import { CLI_COMMAND_HELP_CATALOG_FLAG } from "./lib/cli-flag-keys.js";
 import { installProcessRejectionBoundary } from "./unhandled-rejection-boundary.js";
 import { installFastPathStreamErrorHandlers } from "./utils/fast-stream-errors.js";
 import { fileURLToPath } from "node:url";
+import { parseMonitorCheckFastRequest } from "./lanes-monitor-check-argv.js";
 import { createRequire } from "node:module";
 function cygpathMixedPath(value) {
     // Require only a Node builtin: the package supports Node releases before
@@ -143,6 +144,16 @@ async function runNativeFastRouteWithRecovery(parsed) {
         await runMainWithInstallTreeRecovery();
     }
 }
+async function runMonitorCheckFastWithRecovery(request) {
+    const loaded = await recoverFastImport(() => import("./lanes-monitor-check-fast.js"));
+    if (loaded.reexecStatus !== undefined) {
+        process.exitCode = loaded.reexecStatus;
+        return;
+    }
+    if (loaded.module?.runMonitorCheckFast(request))
+        return;
+    await runMainWithInstallTreeRecovery();
+}
 function dispatchCliEntry() {
     if (process.platform === "win32" && coreCommandHasPathOperands(process.argv)) {
         // Keep cygpath off non-Windows and non-path command routes.
@@ -181,6 +192,12 @@ function dispatchCliEntry() {
             await runMainWithInstallTreeRecovery();
         });
     }
+    else if (parseMonitorCheckFastRequest(process.argv)) {
+        // The Stop hook runs this every turn in every session. Answer the common
+        // no-active-lane case from the lane-record directory alone; anything the
+        // fast route cannot prove falls back to the full command graph.
+        void runMonitorCheckFastWithRecovery(parseMonitorCheckFastRequest(process.argv));
+    }
     else if (parsedFastCore?.entry.kind === "native" &&
         (process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "true" ||
             process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "1")) {

package/dist/lanes-monitor-check-argv.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Dependency-free argv matcher for the `hq lanes monitor-check` fast route.
+ * Imported statically by src/index.ts, so it must not import anything.
+ */
+export interface MonitorCheckFastRequest {
+    sessionId: string;
+    engine?: string;
+    json: boolean;
+}
+/** Exactly `hq lanes monitor-check --session <id> [--engine <e>] [--json]`. */
+export declare function parseMonitorCheckFastRequest(argv: readonly string[]): MonitorCheckFastRequest | null;
+//# sourceMappingURL=lanes-monitor-check-argv.d.ts.map

package/dist/lanes-monitor-check-argv.js

@@ -0,0 +1,54 @@
+/**
+ * Dependency-free argv matcher for the `hq lanes monitor-check` fast route.
+ * Imported statically by src/index.ts, so it must not import anything.
+ */
+const SAFE_SESSION_ID = /^[A-Za-z0-9._:-]{1,200}$/u;
+/** Exactly `hq lanes monitor-check --session <id> [--engine <e>] [--json]`. */
+export function parseMonitorCheckFastRequest(argv) {
+    if (argv[2] !== "lanes" || argv[3] !== "monitor-check")
+        return null;
+    let sessionId;
+    let engine;
+    let json = false;
+    const args = argv.slice(4);
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        let name = arg;
+        let value;
+        const eq = arg.indexOf("=");
+        if (arg.startsWith("--") && eq > 0) {
+            name = arg.slice(0, eq);
+            value = arg.slice(eq + 1);
+        }
+        if (name === "--json" && value === undefined) {
+            if (json)
+                return null;
+            json = true;
+        }
+        else if (name === "--session" || name === "--engine") {
+            if (value === undefined) {
+                value = args[++i];
+                if (value === undefined || value.startsWith("-"))
+                    return null;
+            }
+            if (name === "--session") {
+                if (sessionId !== undefined)
+                    return null;
+                sessionId = value;
+            }
+            else {
+                if (engine !== undefined)
+                    return null;
+                engine = value;
+            }
+        }
+        else {
+            return null;
+        }
+    }
+    const trimmed = sessionId?.trim();
+    if (!trimmed || !SAFE_SESSION_ID.test(trimmed))
+        return null;
+    return { sessionId: trimmed, engine, json };
+}
+//# sourceMappingURL=lanes-monitor-check-argv.js.map

package/dist/lanes-monitor-check-fast.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Startup fast route for `hq lanes monitor-check`.
+ *
+ * The Claude Stop hook (`lanes-senior-monitor-stop-gate.sh`) runs this command
+ * at the end of every assistant turn in every HQ session, and the
+ * SessionStart/UserPromptSubmit shim runs it too. Through the full command
+ * graph each call cost ~0.6-0.9 s of CPU, almost all of it module loading
+ * (Commander graph, Sentry, undici, the flag-registry worker). With several
+ * sessions open that kept one core busy continuously.
+ *
+ * Nearly every call is for a session that owns no active lane, so the answer
+ * is an empty result that needs only the lane-record directory. This module
+ * answers that case with `fs` alone. It returns `false` (caller falls back to
+ * the full command) whenever the answer could differ from the full path:
+ * unusual argv, an unresolvable root, an unreadable store, a conflict sidecar,
+ * a record that does not parse, or any record that may name this session as an
+ * active senior. The Monitor evidence scan never runs here.
+ */
+import type { MonitorCheckFastRequest } from "./lanes-monitor-check-argv.js";
+export { parseMonitorCheckFastRequest } from "./lanes-monitor-check-argv.js";
+export type { MonitorCheckFastRequest } from "./lanes-monitor-check-argv.js";
+export interface MonitorCheckFastDeps {
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    readdirSync?: (dir: string) => string[];
+    readFileSync?: (file: string) => string;
+    write?: (text: string) => void;
+}
+export interface MonitorCheckFastResult {
+    ok: true;
+    action: "monitor-check";
+    session_id: string;
+    engine: string;
+    active_lane_ids: string[];
+    covered_lane_ids: string[];
+    uncovered_lane_ids: string[];
+    skipped?: "engine_has_no_claude_monitor";
+}
+/**
+ * Compute the result without the command graph, or `null` when the full
+ * command must decide. Exposed for tests that count filesystem calls.
+ */
+export declare function computeMonitorCheckFast(request: MonitorCheckFastRequest, deps?: MonitorCheckFastDeps): MonitorCheckFastResult | null;
+/** Returns true when the fast route answered; false means run the full CLI. */
+export declare function runMonitorCheckFast(request: MonitorCheckFastRequest, deps?: MonitorCheckFastDeps): boolean;
+//# sourceMappingURL=lanes-monitor-check-fast.d.ts.map

package/dist/lanes-monitor-check-fast.js

@@ -0,0 +1,121 @@
+/**
+ * Startup fast route for `hq lanes monitor-check`.
+ *
+ * The Claude Stop hook (`lanes-senior-monitor-stop-gate.sh`) runs this command
+ * at the end of every assistant turn in every HQ session, and the
+ * SessionStart/UserPromptSubmit shim runs it too. Through the full command
+ * graph each call cost ~0.6-0.9 s of CPU, almost all of it module loading
+ * (Commander graph, Sentry, undici, the flag-registry worker). With several
+ * sessions open that kept one core busy continuously.
+ *
+ * Nearly every call is for a session that owns no active lane, so the answer
+ * is an empty result that needs only the lane-record directory. This module
+ * answers that case with `fs` alone. It returns `false` (caller falls back to
+ * the full command) whenever the answer could differ from the full path:
+ * unusual argv, an unresolvable root, an unreadable store, a conflict sidecar,
+ * a record that does not parse, or any record that may name this session as an
+ * active senior. The Monitor evidence scan never runs here.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { resolveLiveRoot } from "./utils/hq-roots-core.js";
+export { parseMonitorCheckFastRequest } from "./lanes-monitor-check-argv.js";
+const ENGINES = new Set(["claude", "codex", "grok"]);
+const ACTIVE_STATES = new Set(["running", "queued", "awaiting_input", "blocked"]);
+/**
+ * Compute the result without the command graph, or `null` when the full
+ * command must decide. Exposed for tests that count filesystem calls.
+ */
+export function computeMonitorCheckFast(request, deps = {}) {
+    const env = deps.env ?? process.env;
+    const readdirSync = deps.readdirSync ?? ((dir) => fs.readdirSync(dir));
+    const readFileSync = deps.readFileSync ?? ((file) => fs.readFileSync(file, "utf8"));
+    const engine = request.engine?.trim().toLowerCase() ||
+        env.HQ_LANE_ENGINE?.trim().toLowerCase() ||
+        env.HQ_CONDUCT_ENGINE?.trim().toLowerCase() ||
+        "claude";
+    if (!ENGINES.has(engine))
+        return null;
+    let root;
+    try {
+        root = resolveLiveRoot({ env, cwd: deps.cwd });
+    }
+    catch {
+        return null;
+    }
+    const laneDir = path.join(root, "workspace", "lanes", "lanes");
+    let names;
+    try {
+        names = readdirSync(laneDir);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            return null;
+        names = [];
+    }
+    const needle = JSON.stringify(request.sessionId);
+    const activeLaneIds = [];
+    for (const name of names) {
+        if (typeof name !== "string" || name.startsWith("."))
+            continue;
+        // Sidecars are merged by the full reader; let it decide.
+        if (name.includes(".conflict-"))
+            return null;
+        if (!name.endsWith(".json"))
+            continue;
+        let text;
+        let record;
+        try {
+            text = readFileSync(path.join(laneDir, name));
+            record = JSON.parse(text);
+        }
+        catch {
+            return null;
+        }
+        if (!record || typeof record !== "object" || Array.isArray(record))
+            return null;
+        // A record that never mentions the session id cannot belong to it.
+        if (!text.includes(needle))
+            continue;
+        const lane = record;
+        const senior = lane.senior;
+        if (!senior ||
+            typeof senior !== "object" ||
+            typeof senior.kind !== "string" ||
+            typeof senior.id !== "string" ||
+            typeof lane.state !== "string" ||
+            typeof lane.lane_id !== "string") {
+            return null;
+        }
+        if (senior.kind === "session" && senior.id === request.sessionId && ACTIVE_STATES.has(lane.state)) {
+            // Claude needs the Monitor evidence reader; leave it to the full path.
+            if (engine === "claude")
+                return null;
+            activeLaneIds.push(lane.lane_id);
+        }
+    }
+    const result = {
+        ok: true,
+        action: "monitor-check",
+        session_id: request.sessionId,
+        engine,
+        active_lane_ids: activeLaneIds,
+        covered_lane_ids: [],
+        uncovered_lane_ids: [],
+    };
+    if (engine !== "claude")
+        result.skipped = "engine_has_no_claude_monitor";
+    return result;
+}
+/** Returns true when the fast route answered; false means run the full CLI. */
+export function runMonitorCheckFast(request, deps = {}) {
+    const result = computeMonitorCheckFast(request, deps);
+    if (!result)
+        return false;
+    if (request.json) {
+        const write = deps.write ?? ((text) => process.stdout.write(text));
+        write(`${JSON.stringify(result, null, 2)}\n`);
+    }
+    return true;
+}
+//# sourceMappingURL=lanes-monitor-check-fast.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.116",
+  "version": "5.345.118",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {