@indigoai-us/hq-cli 5.345.117 → 5.345.119

package/dist/commands/core-pipeline-driver-process.d.ts

@@ -0,0 +1,4 @@
+export declare function extractWindowsDriverIdentityFunction(source: string): string;
+/** Preserve the pinned driver's liveness-then-identity lock check. */
+export declare function isPipelineDriverProcess(pid: number, platform?: NodeJS.Platform): boolean;
+//# sourceMappingURL=core-pipeline-driver-process.d.ts.map

package/dist/commands/core-pipeline-driver-process.js

@@ -0,0 +1,68 @@
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { BUNDLED_ASSET_DIR, packageRoot } from "../utils/hq-roots.js";
+import { resolveWindowsBash } from "../utils/run-bundled-script.js";
+const DRIVER_MARKER = "pipeline-driver";
+const WINDOWS_DRIVER_IDENTITY_SIGNATURE = "is_driver() { # pid -> 0 when that pid is alive and is a pipeline-driver";
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function extractWindowsDriverIdentityFunction(source) {
+    const escapedSignature = WINDOWS_DRIVER_IDENTITY_SIGNATURE.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    const functionSource = source.match(new RegExp(`^${escapedSignature}\\n[\\s\\S]*?^\\}`, "mu"))?.[0];
+    if (!functionSource)
+        throw new Error(`Bundled pipeline-driver.sh must define '${WINDOWS_DRIVER_IDENTITY_SIGNATURE}'`);
+    return functionSource;
+}
+function isWindowsPipelineDriverProcess(pid) {
+    const bash = resolveWindowsBash(process.env).executable;
+    if (!bash)
+        return false;
+    const scriptPath = path.join(packageRoot(), BUNDLED_ASSET_DIR, "core", "scripts", "pipeline-driver.sh");
+    const source = fs.readFileSync(scriptPath, "utf8");
+    const functionSource = extractWindowsDriverIdentityFunction(source);
+    // Windows intentionally runs the pinned Git Bash implementation because its
+    // lock format uses both MSYS and Win32 PIDs. This keeps native checks aligned
+    // with the shell's liveness-then-identity order and process-table lookup.
+    const result = spawnSync(bash, ["-c", `${functionSource}\nis_driver "$1"`, "pipeline-driver-lock-check", String(pid)], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
+    });
+    if (result.error)
+        throw result.error;
+    return result.status === 0;
+}
+/** Preserve the pinned driver's liveness-then-identity lock check. */
+export function isPipelineDriverProcess(pid, platform = process.platform) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    if (platform === "win32")
+        return isWindowsPipelineDriverProcess(pid);
+    if (!isAlive(pid))
+        return false;
+    if (platform === "linux") {
+        try {
+            return fs.readFileSync(`/proc/${pid}/cmdline`).toString("utf8").includes(DRIVER_MARKER);
+        }
+        catch {
+            return false;
+        }
+    }
+    const args = platform === "darwin"
+        ? ["-ww", "-o", "args=", "-p", String(pid)]
+        : ["-p", String(pid), "-o", "args="];
+    const result = spawnSync("ps", args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    return result.status === 0 && String(result.stdout ?? "").includes(DRIVER_MARKER);
+}
+//# sourceMappingURL=core-pipeline-driver-process.js.map

package/dist/commands/core-pipeline-envelope-native.d.ts

@@ -0,0 +1,4 @@
+type EnvelopeKind = "envelope" | "handoff";
+export declare function validatePipelinePhaseFile(filePath: string, kind: EnvelopeKind): [boolean, string];
+export {};
+//# sourceMappingURL=core-pipeline-envelope-native.d.ts.map

package/dist/commands/core-pipeline-envelope-native.js

@@ -0,0 +1,87 @@
+import * as fs from "node:fs";
+export function validatePipelinePhaseFile(filePath, kind) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(filePath));
+        if (text.charCodeAt(0) === 0xfeff)
+            text = text.slice(1);
+        text = text.replace(/\r\n?/g, "\n");
+    }
+    catch (error) {
+        const message = error && typeof error === "object" && "message" in error ? String(error.message) : String(error);
+        return [false, "pipeline-envelope: cannot read input: " + message];
+    }
+    if (!text.trim())
+        return [false, "invalid: empty input"];
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return [false, "invalid: unparseable JSON (" + message + ")"];
+    }
+    if (!isObject(doc)) {
+        const typeName = doc === null ? "NoneType" : Array.isArray(doc) ? "list" : typeof doc === "string" ? "str"
+            : typeof doc === "boolean" ? "bool" : Number.isInteger(doc) ? "int" : "float";
+        return [false, "invalid: top level must be a JSON object, got " + typeName];
+    }
+    const problems = [];
+    const schemas = { envelope: "hq-phase-envelope/v1", handoff: "hq-phase-handoff/v1" };
+    if (Object.hasOwn(doc, "schema") && doc.schema !== schemas[kind])
+        problems.push("wrong type: schema (want " + schemas[kind] + ")");
+    else if (!Object.hasOwn(doc, "schema"))
+        problems.push("missing field: schema");
+    const isString = (value) => typeof value === "string";
+    const isNonEmpty = (value) => isString(value) && value !== "";
+    const stringList = (value) => Array.isArray(value) && value.every(isString);
+    const check = (name, predicate, want, required = true) => {
+        if (!Object.hasOwn(doc, name)) {
+            if (required)
+                problems.push("missing field: " + name);
+            return;
+        }
+        if (!predicate(doc[name]))
+            problems.push("wrong type: " + name + " (want " + want + ")");
+    };
+    if (kind === "envelope") {
+        for (const field of ["story_id", "phase", "worker_id"])
+            check(field, isNonEmpty, "non-empty string");
+        check("worktree", isNonEmpty, "string path");
+        check("incoming_handoff", (value) => value === null || isNonEmpty(value), "string path or null");
+        check("acceptance_criteria", stringList, "array of strings");
+        check("deadline", (value) => isString(value) && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]00:?00)\n?$/.test(value), "ISO8601 UTC string");
+        check("fresh_call", (value) => typeof value === "boolean", "boolean");
+        for (const field of ["project", "engine", "result_path", "story_title", "story_description", "reopen_note", "repo", "branch", "prior_handoff"])
+            check(field, isString, "string", false);
+        check("resumed_after_interrupt", (value) => typeof value === "boolean", "boolean", false);
+        check("constraints", stringList, "array of strings", false);
+    }
+    else {
+        for (const field of ["story_id", "phase", "worker_id"])
+            check(field, isNonEmpty, "non-empty string");
+        check("status", (value) => value === "passed" || value === "failed" || value === "blocked", "one of passed|failed|blocked");
+        check("summary", isString, "string");
+        check("files_changed", stringList, "array of strings");
+        check("commits", stringList, "array of strings");
+        if (!Object.hasOwn(doc, "back_pressure"))
+            problems.push("missing field: back_pressure");
+        else if (!isObject(doc.back_pressure))
+            problems.push("wrong type: back_pressure (want object)");
+        else
+            for (const group of ["tests", "lint", "typecheck", "build"]) {
+                if (!Object.hasOwn(doc.back_pressure, group))
+                    problems.push("missing field: back_pressure." + group);
+                else if (!["pass", "fail", "skip"].includes(String(doc.back_pressure[group])))
+                    problems.push("wrong type: back_pressure." + group + " (want one of pass|fail|skip)");
+            }
+        check("context_for_next", isString, "string");
+        for (const field of ["engine", "notes"])
+            check(field, isString, "string", false);
+    }
+    return problems.length ? [false, problems.join("\n")] : [true, "valid " + kind];
+}
+function isObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=core-pipeline-envelope-native.js.map

package/dist/commands/core-policy.js

@@ -772,6 +772,8 @@ function autoRetire(options, root, cwd, env, now) {
         reportText += `# Automatic policy retirement — ${today}\n\nMode: human on the loop. Each policy below was retired by \`policy-retire.sh --auto\` with the reason shown.\nReverse any wrong call with \`bash core/scripts/policy-retire.sh <slug> --restore\` and fix the rule that produced it.\n\n`;
     }
     reportText += `## Run ${now.toISOString().slice(11, 19)}Z — dirs: ${dirs.join(' ')}\n\n`;
+    // Match the shell's preflight: fail to create the report temp before any
+    // policy can be retired, then replace it with the complete run section.
     fs.writeFileSync(tempPath, reportText);
     let retired = 0;
     let failed = 0;
@@ -847,6 +849,7 @@ function autoRetire(options, root, cwd, env, now) {
         stdout += `policy-retire --auto: ${wouldRetire} of ${candidates.length} candidates would be retired (dry run)\n`;
     }
     else if (retired > 0 || failed > 0 || needfix > 0) {
+        fs.writeFileSync(tempPath, reportText);
         fs.appendFileSync(outputPath, fs.readFileSync(tempPath));
         fs.rmSync(tempPath, { force: true });
         stdout += `policy-retire --auto: ${retired} retired, ${failed} failed, ${needfix} need a fix; report ${displayPolicyPath(outputPath, root)}\n`;

package/dist/commands/core-worker-lint-native.d.ts

@@ -1,4 +1,3 @@
 import { type WorkerSkillDependencies, type WorkerSkillResult } from "./core-worker-skills-runtime.js";
-export declare const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
 export declare function runWorkerSkillLint(args: string[], dependencies: WorkerSkillDependencies): WorkerSkillResult;
 //# sourceMappingURL=core-worker-lint-native.d.ts.map

package/dist/commands/core-worker-lint-native.js

@@ -2,7 +2,6 @@
 import * as crypto from "node:crypto";
 import * as path from "node:path";
 import { errorCode, isDirectory, missingOrUnreadable, resolveWorkerCallerRoot, } from "./core-worker-skills-runtime.js";
-export const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
 const DEFAULT_ROOTS = ["core/workers", "core/packages"];
 const USAGE = "Usage: lint-shared-worker-skills.sh [root ...]\nDefault roots: core/workers core/packages\n";
 function joinFindPath(parent, child) {

package/dist/commands/core-worker-share-native.js

@@ -1,6 +1,6 @@
 /** Native port of share-worker-skill.sh. */
 import * as path from "node:path";
-import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { BUNDLED_ASSET_DIR, packageRoot } from "../utils/hq-roots.js";
 import { existsFollowingLinks, isDirectory, isSymlink, resolveWorkerCallerRoot, runGit, errorCode, } from "./core-worker-skills-runtime.js";
 export const WORKER_SKILL_SHARE_ASSET = "core/scripts/share-worker-skill.sh";
 const WORKER_SKILL_SHARE_USAGE = "usage: $0 [--apply] [--force] <scope-dir> <skill-name> <worker-skill-path>...\n";
@@ -88,7 +88,7 @@ function forceSymlink(target, filePath, fileSystem) {
     fileSystem.symlinkSync(target, filePath);
 }
 function runtimeScriptPath(dependencies) {
-    return dependencies.scriptPath ?? resolveBundledAsset(WORKER_SKILL_SHARE_ASSET);
+    return dependencies.scriptPath ?? path.join(packageRoot(), BUNDLED_ASSET_DIR, WORKER_SKILL_SHARE_ASSET);
 }
 export function runWorkerSkillShare(argv, dependencies) {
     let apply = false;

package/dist/commands/core-worker-skills-command.d.ts

@@ -3,6 +3,6 @@ export type WorkerSkillCommandContext = {
     cwd: string;
     hqRoot?: string;
 };
-/** Keep the shell rollback route byte-transparent while the family flag is off. */
+/** Run the native implementation for the worker-skills family. */
 export declare function runWorkerSkillCommand(name: WorkerSkillCommandName, args: string[], context: WorkerSkillCommandContext): Promise<number>;
 //# sourceMappingURL=core-worker-skills-command.d.ts.map

package/dist/commands/core-worker-skills-command.js

@@ -1,24 +1,7 @@
-import { runBundledScript } from "../utils/run-bundled-script.js";
-import { coreNativeWorkerSkillsEnabled } from "./core-native-worker-skills-flag.js";
-import { runWorkerSkillLint, WORKER_SKILL_LINT_ASSET } from "./core-worker-lint-native.js";
-import { runWorkerSkillShare, WORKER_SKILL_SHARE_ASSET } from "./core-worker-share-native.js";
-const assets = {
-    lint: WORKER_SKILL_LINT_ASSET,
-    share: WORKER_SKILL_SHARE_ASSET,
-};
-/** Keep the shell rollback route byte-transparent while the family flag is off. */
+import { runWorkerSkillLint } from "./core-worker-lint-native.js";
+import { runWorkerSkillShare } from "./core-worker-share-native.js";
+/** Run the native implementation for the worker-skills family. */
 export async function runWorkerSkillCommand(name, args, context) {
-    if (!(await coreNativeWorkerSkillsEnabled())) {
-        const result = runBundledScript({
-            asset: assets[name],
-            args,
-            cwd: context.cwd,
-            hqRoot: context.hqRoot,
-        });
-        if (result.code !== 0)
-            process.exit(result.code);
-        return result.code;
-    }
     const result = name === "lint"
         ? runWorkerSkillLint(args, { cwd: context.cwd })
         : runWorkerSkillShare(args, { cwd: context.cwd });

package/dist/commands/core.d.ts

@@ -75,9 +75,13 @@ export type RebuildIndexTarget = {
     /** One-line summary, shown in `hq core --help`. */
     summary: string;
 };
-export type WorkerSubcommand = ScaffoldAsset & {
+export type WorkerSubcommand = {
     /** Subcommand name under the `worker` group — `hq core worker <name>`. */
     name: string;
+    /** Caller-relative root used by the native command. */
+    root: "cwd";
+    /** One-line summary, shown in `hq core --help`. */
+    summary: string;
 };
 /**
  * Native commands that still claim a scaffold forwarder asset. The forwarder

package/dist/commands/core.js

@@ -51,6 +51,7 @@ import { DERIVE_TRIGGER_FACTS_ASSET } from "./core-derive-trigger-facts-native.j
 import { registerCoreHookStateHelpers } from "./core-hook-state-helpers-native.js";
 import { registerCoreHookBatchCommand } from "./core-hook-batch-command.js";
 import { registerCorePipelineWorkerTableCommand } from "./core-pipeline-workers-command.js";
+import { registerCorePipelineRuntimeCommands } from "./core-pipeline-conductor-command.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -132,13 +133,11 @@ export const NATIVE_SCAFFOLD_COMMANDS = [
 export const WORKER_SUBCOMMANDS = [
     {
         name: "lint",
-        asset: "core/scripts/lint-shared-worker-skills.sh",
         root: "cwd",
         summary: "Fail on worker-scoped skills duplicated by copy instead of single-sourced",
     },
     {
         name: "share",
-        asset: "core/scripts/share-worker-skill.sh",
         root: "cwd",
         summary: "Migrate duplicated worker skills onto one canonical file + relative symlinks",
     },
@@ -307,6 +306,10 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },
     { asset: "core/scripts/handoff-open-steps.sh", root: "live", summary: "Rollback shell for native handoff open-steps" },
     { asset: "core/scripts/qmd-reindex-bg.sh", root: "live", summary: "Rollback handoff reindex forwarder" },
+    // Pipeline rollback companions remain bundled until the family removal PR.
+    { asset: "core/scripts/pipeline-conductor.sh", root: "live", summary: "Rollback shell for native pipeline conductor" },
+    { asset: "core/scripts/pipeline-driver.sh", root: "live", summary: "Rollback shell for native pipeline driver" },
+    { asset: "core/scripts/pipeline-envelope.sh", root: "live", summary: "Validation helper for the pipeline shell rollback companions" },
     { asset: "core/scripts/lib/portable.sh", root: "live", summary: "Shared portable helpers sourced by bundled scripts" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
@@ -324,7 +327,6 @@ export const SCAFFOLD_ASSETS = [
     ...SCAFFOLD_COMMANDS,
     ...NATIVE_SCAFFOLD_COMMANDS,
     ...SCAFFOLD_ONLY_ASSETS,
-    ...WORKER_SUBCOMMANDS,
 ];
 /**
  * Resolve the tree an entry runs against, and the cwd to run it in.
@@ -404,6 +406,7 @@ export function registerCoreCommands(program) {
     registerCoreDeriveTriggerFactsCommand(core);
     registerCoreHookStateHelpers(core);
     registerCoreHookBatchCommand(core);
+    registerCorePipelineRuntimeCommands(core);
     const sessionHelperCommands = [
         {
             name: "session-journal", asset: "core/scripts/session-journal.sh", root: "live",
@@ -555,7 +558,7 @@ export function registerCoreCommands(program) {
         const command = worker
             .command(entry.name)
             .description(entry.summary)
-            // Pure passthrough: the wrapped script owns its own argument grammar.
+            // Pure passthrough: the native handler owns the worker command grammar.
             .allowUnknownOption()
             .allowExcessArguments()
             .helpOption(false)
@@ -565,11 +568,7 @@ export function registerCoreCommands(program) {
             const operands = cmd.args.length > 0 ? cmd.args : args;
             await runWorkerSkillCommand(entry.name, operands, resolveEntryRoot(entry, scope));
         });
-        describeCoreCommand(command, {
-            execution: interpreterFor(entry.asset) === "node" ? "bundled-node" : "bundled-shell",
-            asset: entry.asset,
-            root: entry.root,
-        });
+        describeCoreCommand(command, { execution: "native", root: entry.root });
     }
     const runCommand = (entry, args = [], cmd, target) => {
         const scope = core.opts();

package/dist/commands/integrations-core.d.ts

@@ -257,6 +257,12 @@ export interface UsableAppsResult {
     viewerAccessKnown: boolean;
     apps: UsableApp[];
 }
+/**
+ * Built-in providers expose their tools under their own names
+ * (`google.drive.picked.list`), not through the factory passthrough
+ * `<prefix>.mcp.tools.call`, which the gateway never registers for them.
+ */
+export declare function isBuiltInGatewayProvider(provider: string): boolean;
 /**
  * The apps the caller may use, from `GET /v1/integrations/admin?view=summary`.
  * A row counts only when all of these hold, mirroring the gateway's checks:
@@ -296,7 +302,7 @@ export declare function resolveConnection(token: string, companyUid: string, app
 }, recoveryOpts?: {
     allowSingleRevoked?: boolean;
 }): Promise<AdminConnection>;
-export declare function callGateway(token: string, params: Record<string, unknown>, idempotencyKey?: string): Promise<GatewayMessage>;
+export declare function callGateway(token: string, params: Record<string, unknown>, idempotencyKey?: string, method?: "tools/call" | "tools/list"): Promise<GatewayMessage>;
 /**
  * Gateway results arrive MCP-style: `{ content: [{ type: "text", text }] }`
  * where `text` is the provider's JSON. Unwrap to the inner payload; fall back

package/dist/commands/integrations-core.js

@@ -368,6 +368,14 @@ const GATEWAY_SERVED_STATUSES = new Set(["connected", "needs-attention"]);
  * gateway as `ProviderUnsupported`.
  */
 const STATIC_GATEWAY_PROVIDERS = new Set(["google-workspace", "linear", "slack"]);
+/**
+ * Built-in providers expose their tools under their own names
+ * (`google.drive.picked.list`), not through the factory passthrough
+ * `<prefix>.mcp.tools.call`, which the gateway never registers for them.
+ */
+export function isBuiltInGatewayProvider(provider) {
+    return STATIC_GATEWAY_PROVIDERS.has(provider);
+}
 const MAX_APP_NAME_LENGTH = 60;
 /**
  * Display names are set by whoever installed the app and end up in agent
@@ -561,7 +569,9 @@ export async function resolveConnection(token, companyUid, app, opts, recoveryOp
     }
     return selectConnection(connections, opts);
 }
-function gatewaySubcommandFor(params) {
+function gatewaySubcommandFor(params, method) {
+    if (method === "tools/list")
+        return "tools_list";
     const name = params.name;
     if (typeof name !== "string")
         return "other";
@@ -569,10 +579,13 @@ function gatewaySubcommandFor(params) {
         return "tools_list";
     if (name.endsWith(".mcp.tools.call"))
         return "tools_call";
+    // Built-in providers are called by the tool's own name, with no passthrough.
+    if (!name.includes(".mcp."))
+        return "tools_call";
     return "other";
 }
-export async function callGateway(token, params, idempotencyKey) {
-    const gatewaySubcommand = gatewaySubcommandFor(params);
+export async function callGateway(token, params, idempotencyKey, method = "tools/call") {
+    const gatewaySubcommand = gatewaySubcommandFor(params, method);
     const deadline = Date.now() + ASYNC_GATEWAY_DEADLINE_MS;
     const res = await vaultApiFetch({
         token,
@@ -581,7 +594,7 @@ export async function callGateway(token, params, idempotencyKey) {
         body: {
             jsonrpc: "2.0",
             id: `hq-cli-${randomUUID()}`,
-            method: "tools/call",
+            method,
             params,
         },
     });

package/dist/commands/integrations.js

@@ -54,12 +54,39 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { registerSlackCommands } from "./integrations-slack.js";
 import { fetchPendingApprovals } from "./integrations-api.js";
+/** Routing ids hq sets on a built-in tool call; never accepted from --args. */
+const BUILT_IN_ROUTING_ARGS = ["companyUid", "connectionId", "idempotencyKey"];
+/**
+ * hq sets the routing ids on every built-in call and refuses them in --args,
+ * so discovery must not list them as inputs the caller provides.
+ */
+function withoutRoutingArgs(tool) {
+    const schema = tool.inputSchema;
+    if (!schema || typeof schema !== "object" || Array.isArray(schema))
+        return tool;
+    const { properties, required, ...rest } = schema;
+    const routing = new Set(BUILT_IN_ROUTING_ARGS);
+    const next = { ...rest };
+    if (properties && typeof properties === "object" && !Array.isArray(properties)) {
+        next.properties = Object.fromEntries(Object.entries(properties).filter(([key]) => !routing.has(key)));
+    }
+    else if (properties !== undefined) {
+        next.properties = properties;
+    }
+    if (Array.isArray(required)) {
+        next.required = required.filter((key) => !(typeof key === "string" && routing.has(key)));
+    }
+    else if (required !== undefined) {
+        next.required = required;
+    }
+    return { ...tool, inputSchema: next };
+}
 export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 /**
  * Gateway metadata is additive and may be absent when talking to an older
@@ -285,16 +312,33 @@ export function registerIntegrationsCommand(program) {
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        const connections = await fetchConnections(token, companyUid);
+        const connection = selectConnection(connections, opts);
         if (reportRevokedConnection(connection, opts))
             return;
-        const prefix = toolPrefixForProvider(connection.provider);
-        const message = await callGateway(token, {
-            companyUid,
-            name: `${prefix}.mcp.tools.list`,
-            arguments: { companyUid, connectionId: connection.id },
-        });
-        const payload = unwrapGatewayResult(message.result);
+        let payload;
+        const builtIn = isBuiltInGatewayProvider(connection.provider);
+        if (builtIn) {
+            // Built-in providers answer the gateway's own tools/list, which spans
+            // every connection in the company; keep only this connection's tools.
+            const message = await callGateway(token, { companyUid }, undefined, "tools/list");
+            const listed = unwrapGatewayResult(message.result);
+            payload = {
+                ...listed,
+                tools: (listed?.tools ?? [])
+                    .filter((tool) => tool.annotations?.connectionId === connection.id)
+                    .map(withoutRoutingArgs),
+            };
+        }
+        else {
+            const prefix = toolPrefixForProvider(connection.provider);
+            const message = await callGateway(token, {
+                companyUid,
+                name: `${prefix}.mcp.tools.list`,
+                arguments: { companyUid, connectionId: connection.id },
+            });
+            payload = unwrapGatewayResult(message.result);
+        }
         const tools = payload?.tools ?? [];
         if (tools.length === 0) {
             if (opts.json) {
@@ -331,7 +375,14 @@ export function registerIntegrationsCommand(program) {
             const badge = formatToolBadge(tool);
             console.log(`${chalk.bold(tool.name)}${badge ? `  ${badge}` : ""}${label}${required ? `  ${chalk.dim(required)}` : ""}`);
         }
-        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools --provider ${bareProvider(connection.provider)} --describe <tool>\nCall one with: hq integrations call <tool> --provider ${bareProvider(connection.provider)} --args '<json>'`));
+        // `--provider` resolves to the first matching connection, so when
+        // several connections share this provider the hint must name this one.
+        const sharedProvider = builtIn &&
+            connections.some((c) => c.id !== connection.id && c.status !== "revoked" && c.provider === connection.provider);
+        const selector = sharedProvider
+            ? `--connection ${connection.id}`
+            : `--provider ${bareProvider(connection.provider)}`;
+        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools ${selector} --describe <tool>\nCall one with: hq integrations call <tool> ${selector} --args '<json>'`));
     });
     integrations
         .command("call <tool>")
@@ -359,20 +410,38 @@ export function registerIntegrationsCommand(program) {
         const connection = selectConnection(await fetchConnections(token, companyUid), opts);
         if (reportRevokedConnection(connection, { ...opts, fail: true }))
             return;
-        const prefix = toolPrefixForProvider(connection.provider);
         const idempotencyKey = opts.idempotencyKey ?? `hq-cli-${randomUUID()}`;
-        const message = await callGateway(token, {
-            companyUid,
-            acceptAsync: true,
-            name: `${prefix}.mcp.tools.call`,
-            arguments: {
+        let gatewayParams;
+        if (isBuiltInGatewayProvider(connection.provider)) {
+            // Built-in tools take their args flat beside the routing ids, so an
+            // arg with a routing name would redirect the call; refuse it.
+            const reserved = BUILT_IN_ROUTING_ARGS.filter((key) => key in parsedArgs);
+            if (reserved.length) {
+                throw new IntegrationsCliError(`--args cannot include ${reserved.join(", ")}: it is set by hq from the selected connection.`, { expected: true });
+            }
+            gatewayParams = {
+                companyUid,
+                acceptAsync: true,
+                name: tool,
+                arguments: { ...parsedArgs, companyUid, connectionId: connection.id, idempotencyKey },
+            };
+        }
+        else {
+            const prefix = toolPrefixForProvider(connection.provider);
+            gatewayParams = {
                 companyUid,
-                connectionId: connection.id,
-                toolName: tool,
-                arguments: parsedArgs,
-                idempotencyKey,
-            },
-        }, idempotencyKey);
+                acceptAsync: true,
+                name: `${prefix}.mcp.tools.call`,
+                arguments: {
+                    companyUid,
+                    connectionId: connection.id,
+                    toolName: tool,
+                    arguments: parsedArgs,
+                    idempotencyKey,
+                },
+            };
+        }
+        const message = await callGateway(token, gatewayParams, idempotencyKey);
         const payload = unwrapGatewayResult(message.result);
         const queued = queuedOutcome(payload);
         if (queued) {

package/dist/commands/storage-gate.d.ts

@@ -1,9 +1,10 @@
 /**
  * Live HQ Storage gate and refusal surface for `hq storage`.
  *
- * Allowlist gate, fails closed (owner decision 2026-10-11, Indigo-only until
- * the owner widens it; see the storage-feature-flag module in src/lib). This
- * is the deliberate exception to the default-on kill-switch rule: any error,
+ * Registry gate, fails closed. The `hq-storage` registry row decides who has
+ * Storage; it defaults on for every signed-in account (widened 2026-10-13
+ * from the 2026-10-11 Indigo-only start; see the storage-feature-flag module
+ * in src/lib). The fail-closed client fallback is the deliberate exception to the default-on kill-switch rule: any error,
  * a signed-out caller, an API-key caller, a membership read failure, or an
  * unreadable registry all mean Storage is OFF.
  *

package/dist/commands/storage-gate.js

@@ -1,9 +1,10 @@
 /**
  * Live HQ Storage gate and refusal surface for `hq storage`.
  *
- * Allowlist gate, fails closed (owner decision 2026-10-11, Indigo-only until
- * the owner widens it; see the storage-feature-flag module in src/lib). This
- * is the deliberate exception to the default-on kill-switch rule: any error,
+ * Registry gate, fails closed. The `hq-storage` registry row decides who has
+ * Storage; it defaults on for every signed-in account (widened 2026-10-13
+ * from the 2026-10-11 Indigo-only start; see the storage-feature-flag module
+ * in src/lib). The fail-closed client fallback is the deliberate exception to the default-on kill-switch rule: any error,
  * a signed-out caller, an API-key caller, a membership read failure, or an
  * unreadable registry all mean Storage is OFF.
  *

package/dist/fast-scaffold.js

@@ -278,8 +278,6 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-worker-lint-fast.js",
         exportName: "runWorkerSkillLintFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-worker-skills",
-        asset: "core/scripts/lint-shared-worker-skills.sh",
         root: "cwd",
         shellCwd: "caller",
         shellHqRoot: "none",

package/dist/lib/storage-feature-flag.d.ts

@@ -1,13 +1,13 @@
 /**
- * HQ Storage allowlist gate (hq-flags key `hq-storage`).
+ * HQ Storage gate (hq-flags key `hq-storage`).
  *
  * Owner decision (Corey, 2026-10-11): "let's fully ship the storage feature
- * but all behind a feature flag for indigo users only." That is an explicit
- * hold on the default-on kill-switch rule
- * (`indigo-feature-flags-default-on-as-fail-safes`): the registry row is
- * `defaultValue: false` with a company override for Indigo, so this gate is
- * an ALLOWLIST, not a kill switch. It therefore FAILS CLOSED: a missing,
- * stale, discovered, archived or unreadable value means Storage is off.
+ * but all behind a feature flag for indigo users only." The registry row
+ * started as `defaultValue: false` with a company override for Indigo. It
+ * was widened on 2026-10-13: the row now defaults to true, so Storage is on
+ * for every signed-in account and the Indigo override is redundant. The
+ * client still FAILS CLOSED: a missing, stale, discovered, archived or
+ * unreadable value means Storage is off.
  *
  * Who it is on for is decided by hq-pro's shared evaluator (person override,
  * then company override by uid, then slug, then default), resolved

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.117",
+  "version": "5.345.119",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {