@indigoai-us/hq-cli 5.345.119 → 5.345.120

package/CHANGELOG.md

@@ -2,11 +2,20 @@
 
 ## [Unreleased]
 
+## [5.345.120] — 2026-10-13
+- `hq dm forward --company <slug|cmp_id>` names the company a person or agent
+  destination belongs to. The CLI sends it as `companyUid`, so the server runs
+  its destination-side cross-company check. Without it the destination is
+  treated as personal. `--company` is refused for channel destinations, which
+  use the channel's own company.
+
 ## [5.345.119] — 2026-10-13
 - The checkpoint sibling no longer falls back to Codex. `--backend auto` now picks only Claude or grok. Codex runs only with `--backend codex` or the new `HQ_CHECKPOINT_BACKEND=codex` setting (process environment or the HQ settings file env block). A sibling run that left no report stops counting as a crash after 6 hours, so one transient failure no longer pins the choice. When no allowed backend is available the sibling is skipped with a log line.
 - Add native TypeScript hq core pipeline conductor and driver commands with the bundled shell companions as the flag-off fallback.
 - Fix native policy retirement reports for partly stale references, accept shell-written newline-terminated trigger cooldown stamps, and resolve derive-trigger-facts session metadata from `HQ_ROOT` when the caller cwd differs, including repo detection for Windows path separators.
 
+- `hq core session-journal tool-counter` now skips updates when its bounded lock retries are exhausted and reclaims stale counter locks like the shell implementation.
+
 ## [5.345.118] — 2026-10-13
 
 - Remove the bundled worker-skill shell fallbacks. `hq core worker lint` and

package/assets/scaffold/core/scripts/session-journal.sh

@@ -128,12 +128,57 @@ resolve_session_key() {
 }
 
 # Read-modify-write on the counter must not interleave across concurrent tasks.
+counter_lock_is_aged() {
+  local lockdir="$1" lock_mtime now
+  lock_mtime="$(stat -c %Y "$lockdir" 2>/dev/null)" || lock_mtime="$(stat -f %m "$lockdir" 2>/dev/null)" || return 1
+  now="$(date -u +%s 2>/dev/null)" || return 1
+  case "$lock_mtime:$now" in *[!0-9:]*|:*|*:) return 1 ;; esac
+  [ "$now" -ge "$lock_mtime" ] && [ "$((now - lock_mtime))" -ge 60 ]
+}
+
+counter_windows_pid_is_alive() {
+  local pid="$1" output
+  case "${OSTYPE:-}" in msys*|cygwin*|win32*) ;; *) return 1 ;; esac
+  case "$pid" in ''|*[!0-9]*) return 1 ;; esac
+  output="$(MSYS_NO_PATHCONV=1 tasklist.exe /FO CSV /NH /FI "PID eq $pid" 2>/dev/null)" || return 1
+  printf '%s\n' "$output" | tr -d '\r"' | cut -d, -f2 | grep -Fxq "$pid"
+}
+
+counter_lock_owner_is_alive() {
+  local lockdir="$1" owner_pid="$2" windows_pid
+  kill -0 "$owner_pid" 2>/dev/null && return 0
+  windows_pid="$(cat "$lockdir/winpid" 2>/dev/null || true)"
+  if [ -n "$windows_pid" ]; then
+    counter_windows_pid_is_alive "$windows_pid" && return 0
+  elif counter_windows_pid_is_alive "$owner_pid"; then
+    # Old native clients wrote only a Win32 process.pid to pid.
+    return 0
+  fi
+  return 1
+}
+
 reclaim_stale_counter_lock() {
-  local lockdir="$1" owner_pid current_owner claim stale_dir suffix=0
+  local lockdir="$1" owner_pid current_owner current_windows_pid windows_pid claim stale_dir suffix=0 pidless=0
   owner_pid="$(cat "$lockdir/pid" 2>/dev/null || true)"
-  case "$owner_pid" in ''|*[!0-9]*) return 1 ;; esac
-  [ "$owner_pid" -gt 1 ] 2>/dev/null || return 1
-  kill -0 "$owner_pid" 2>/dev/null && return 1
+  case "$owner_pid" in
+    '')
+      windows_pid="$(cat "$lockdir/winpid" 2>/dev/null || true)"
+      if [ -n "$windows_pid" ]; then
+        counter_windows_pid_is_alive "$windows_pid" && return 1
+      fi
+      # The complete counter retry window is 5 seconds (250 x 20 ms). A
+      # PID-less lock is reclaimable after one minute, twelve retry windows,
+      # allowing for a creator paused between mkdir and writing pid. The stat
+      # fallback keeps this elapsed-time threshold consistent on GNU/BSD find.
+      counter_lock_is_aged "$lockdir" || return 1
+      pidless=1
+      ;;
+    *[!0-9]*) return 1 ;;
+    *)
+      [ "$owner_pid" -gt 1 ] 2>/dev/null || return 1
+      counter_lock_owner_is_alive "$lockdir" "$owner_pid" && return 1
+      ;;
+  esac
 
   claim="${lockdir}.reclaim"
   mkdir "$claim" 2>/dev/null || return 1
@@ -143,7 +188,19 @@ reclaim_stale_counter_lock() {
   fi
 
   current_owner="$(cat "$lockdir/pid" 2>/dev/null || true)"
-  if [ "$current_owner" = "$owner_pid" ] && ! kill -0 "$owner_pid" 2>/dev/null; then
+  current_windows_pid="$(cat "$lockdir/winpid" 2>/dev/null || true)"
+  if [ "$pidless" -eq 1 ]; then
+    # Recheck both identity and age after winning the claim, before renaming.
+    if [ -z "$current_owner" ] && [ "$current_windows_pid" = "$windows_pid" ] \
+      && { [ -z "$current_windows_pid" ] || ! counter_windows_pid_is_alive "$current_windows_pid"; } \
+      && counter_lock_is_aged "$lockdir"; then
+      owner_pid=""
+    else
+      owner_pid="changed"
+    fi
+  fi
+  if [ "$current_owner" = "$owner_pid" ] && [ "$current_windows_pid" = "${windows_pid:-$(cat "$lockdir/winpid" 2>/dev/null || true)}" ] \
+    && { [ "$pidless" -eq 1 ] || ! counter_lock_owner_is_alive "$lockdir" "$owner_pid"; }; then
     stale_dir="${lockdir}.stale.$$.$RANDOM"
     while [ -e "$stale_dir" ]; do
       suffix=$((suffix + 1))
@@ -167,6 +224,11 @@ with_counter_lock() {
   while [ "$i" -lt "$tries" ]; do
     if mkdir "$lockdir" 2>/dev/null; then
       acquired=1
+      if [[ "${OSTYPE:-}" == msys* ]] || [[ "${OSTYPE:-}" == cygwin* ]]; then
+        local windows_pid
+        windows_pid="$(cat "/proc/$$/winpid" 2>/dev/null || true)"
+        case "$windows_pid" in ''|*[!0-9]*) ;; *) printf '%s\n' "$windows_pid" > "$lockdir/winpid" || { rm -rf "$lockdir" 2>/dev/null || true; return 0; } ;; esac
+      fi
       if ! printf '%s\n' "$$" > "$lockdir/pid" 2>/dev/null; then
         rm -rf "$lockdir" 2>/dev/null || true
         return 0

package/dist/command-catalog.generated.d.ts

@@ -3611,6 +3611,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--cross-company";
             readonly description: "Confirm forwarding across company boundaries";
             readonly hidden: false;
+        }, {
+            readonly flags: "--company <slug|cmp_id>";
+            readonly description: "Company the person or agent destination belongs to, so cross-company rules apply";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {

package/dist/command-catalog.generated.js

@@ -4370,6 +4370,11 @@ export const COMMAND_CATALOG = [
                         "flags": "--cross-company",
                         "description": "Confirm forwarding across company boundaries",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--company <slug|cmp_id>",
+                        "description": "Company the person or agent destination belongs to, so cross-company rules apply",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []

package/dist/commands/core-session-journal-native.js

@@ -89,6 +89,18 @@ function processIsAlive(pid) {
         return error.code !== "ESRCH";
     }
 }
+function counterLockOwnerIsAlive(lock, pid) {
+    if (processIsAlive(pid))
+        return true;
+    if (process.platform !== "win32")
+        return false;
+    let windowsPid = 0;
+    try {
+        windowsPid = Number.parseInt(fs.readFileSync(path.join(lock, "winpid"), "utf8"), 10) || 0;
+    }
+    catch { /* older shell locks did not record the Win32 PID */ }
+    return windowsPid > 1 && processIsAlive(windowsPid);
+}
 function acquireJournalWriteLock(dir) {
     const lock = path.join(dir, ".session-journal-write.lock");
     const ownerFile = path.join(lock, "pid");
@@ -142,26 +154,144 @@ function releaseJournalWriteLock(lock) {
     }
     catch { /* shell lock cleanup is best-effort */ }
 }
-function withCounterLock(lock, action) {
+const COUNTER_LOCK_PIDLESS_STALE_MS = 60_000;
+function isAgedPidlessCounterLock(lock, now) {
+    try {
+        return now().getTime() - fs.statSync(lock).mtimeMs >= COUNTER_LOCK_PIDLESS_STALE_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function reclaimStaleCounterLock(lock, now) {
+    let rawOwner;
+    try {
+        rawOwner = fs.readFileSync(path.join(lock, "pid"), "utf8").trim();
+    }
+    catch (error) {
+        if (error.code !== "ENOENT" || !isAgedPidlessCounterLock(lock, now))
+            return false;
+        rawOwner = "";
+    }
+    if (rawOwner !== "" && !/^\d+$/u.test(rawOwner))
+        return false;
+    let rawWindowsPid = "";
+    try {
+        rawWindowsPid = fs.readFileSync(path.join(lock, "winpid"), "utf8").trim();
+    }
+    catch { /* older shell locks did not record the Win32 PID */ }
+    if (rawWindowsPid !== "" && !/^\d+$/u.test(rawWindowsPid))
+        return false;
+    const owner = rawOwner ? Number.parseInt(rawOwner, 10) : 0;
+    const windowsOwner = rawWindowsPid ? Number.parseInt(rawWindowsPid, 10) : 0;
+    if (rawOwner && (owner <= 1 || counterLockOwnerIsAlive(lock, owner)))
+        return false;
+    if (!rawOwner && windowsOwner > 1 && processIsAlive(windowsOwner))
+        return false;
+    const claim = `${lock}.reclaim`;
+    try {
+        fs.mkdirSync(claim);
+    }
+    catch {
+        return false;
+    }
+    try {
+        fs.writeFileSync(path.join(claim, "pid"), `${process.pid}\n`, { flag: "wx" });
+    }
+    catch {
+        try {
+            fs.rmSync(claim, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+        return false;
+    }
+    let currentRawOwner;
+    try {
+        currentRawOwner = fs.readFileSync(path.join(lock, "pid"), "utf8").trim();
+    }
+    catch {
+        currentRawOwner = "";
+    }
+    let currentRawWindowsPid;
+    try {
+        currentRawWindowsPid = fs.readFileSync(path.join(lock, "winpid"), "utf8").trim();
+    }
+    catch {
+        currentRawWindowsPid = "";
+    }
+    const sameOwner = currentRawOwner === rawOwner && currentRawWindowsPid === rawWindowsPid;
+    const stillStale = rawOwner
+        ? sameOwner && !counterLockOwnerIsAlive(lock, owner)
+        : sameOwner && !(windowsOwner > 1 && processIsAlive(windowsOwner)) && isAgedPidlessCounterLock(lock, now);
+    if (stillStale) {
+        const stale = `${lock}.stale-${process.pid}-${Math.random().toString(16).slice(2)}`;
+        try {
+            fs.renameSync(lock, stale);
+            fs.rmSync(stale, { recursive: true, force: true });
+            fs.rmSync(claim, { recursive: true, force: true });
+            return true;
+        }
+        catch { /* another waiter reclaimed it */ }
+    }
+    try {
+        fs.rmSync(claim, { recursive: true, force: true });
+    }
+    catch { /* best effort */ }
+    return false;
+}
+function withCounterLock(lock, env, writers, now, action) {
     let i = 0;
     let acquired = false;
-    while (!acquired) {
+    let tries = env.HQ_JOURNAL_COUNTER_LOCK_TRIES ?? "250";
+    if (!/^\d+$/u.test(tries))
+        tries = "250";
+    const retryLimit = Number.parseInt(tries, 10);
+    while (i < retryLimit) {
         try {
             fs.mkdirSync(lock);
             acquired = true;
+            try {
+                if (process.platform === "win32")
+                    fs.writeFileSync(path.join(lock, "winpid"), `${process.pid}\n`, { flag: "wx" });
+                fs.writeFileSync(path.join(lock, "pid"), `${process.pid}\n`, { flag: "wx" });
+            }
+            catch {
+                try {
+                    fs.rmSync(lock, { recursive: true, force: true });
+                }
+                catch { /* best effort */ }
+                return;
+            }
+            break;
         }
         catch {
+            if (reclaimStaleCounterLock(lock, now))
+                continue;
             i++;
-            if (i >= 50)
-                break;
-            sleepSync(20);
+            if (i < retryLimit)
+                sleepSync(20);
         }
     }
-    action();
+    if (!acquired) {
+        writers.stderr("session-journal: tool-counter: lock remained busy; skipped update\n");
+        return;
+    }
     try {
-        fs.rmdirSync(lock);
+        action();
+    }
+    finally {
+        let owner = 0;
+        try {
+            owner = Number.parseInt(fs.readFileSync(path.join(lock, "pid"), "utf8"), 10) || 0;
+        }
+        catch { /* lock disappeared */ }
+        if (owner === process.pid) {
+            try {
+                fs.rmSync(lock, { recursive: true, force: true });
+            }
+            catch { /* best effort */ }
+        }
     }
-    catch { /* shell rmdir is best-effort */ }
 }
 function nextSequence(dir) {
     let names = [];
@@ -205,12 +335,12 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
         writers.stderr(`${sessionJournalAsset}: line ${line}: ${printableCounter}: Is a directory\n`);
     };
     if (action === "increment") {
-        withCounterLock(lock, () => {
+        withCounterLock(lock, env, writers, now, () => {
             try {
                 fs.writeFileSync(counter, `${readCounter(counter) + 1}\n`);
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 395);
+                reportDirectoryWriteFailure(error, 457);
             }
         });
     }
@@ -218,12 +348,12 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
         writers.stdout(`${readCounter(counter)}\n`);
     }
     else if (action === "reset") {
-        withCounterLock(lock, () => {
+        withCounterLock(lock, env, writers, now, () => {
             try {
                 fs.writeFileSync(counter, "0\n");
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 403);
+                reportDirectoryWriteFailure(error, 465);
             }
         });
     }

package/dist/commands/dm.js

@@ -1,7 +1,7 @@
 import chalk from "chalk";
 import { readFileSync } from "node:fs";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
 import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
@@ -830,12 +830,20 @@ async function runDmForward(eventId, opts) {
             console.error(chalk.red("--to accepts one recipient or channel, not a group recipient list."));
             process.exit(1);
         }
+        const destinationChannelName = parseChannelName(opts.to);
+        if (opts.company !== undefined && destinationChannelName !== null) {
+            console.error(chalk.red("--company applies to person or agent destinations; a channel uses its own company."));
+            process.exit(1);
+        }
+        if (opts.company !== undefined && !opts.company.trim()) {
+            console.error(chalk.red("--company requires a company slug or cmp_ ID."));
+            process.exit(1);
+        }
         const note = opts.noteFile !== undefined
             ? readFileSync(opts.noteFile, "utf8")
             : opts.note;
         const token = await ensureCognitoToken();
         const source = await resolveForwardSourceConversation(token, opts.from);
-        const destinationChannelName = parseChannelName(opts.to);
         const fileAccess = opts.grantFiles ? "grant" : opts.omitFiles ? "omit" : undefined;
         const shared = {
             ...(note !== undefined ? { body: note } : {}),
@@ -869,8 +877,19 @@ async function runDmForward(eventId, opts) {
                 console.error(chalk.red("--to must be a person email, person/agent UID, or channel name/ID."));
                 process.exit(1);
             }
+            // The server runs the destination-side cross-company check only when the
+            // request names the destination company; without it the destination is
+            // treated as personal. Not defaulted from the source, which would make a
+            // forward into another company look same-company.
+            const destinationCompanyUid = opts.company !== undefined
+                ? await resolveDestinationCompanyUid(token, opts.company.trim())
+                : undefined;
             path = "/v1/notify/dm";
-            payload = { ...recipient, ...shared };
+            payload = {
+                ...recipient,
+                ...shared,
+                ...(destinationCompanyUid ? { companyUid: destinationCompanyUid } : {}),
+            };
             destinationLabel = opts.to;
         }
         const res = await vaultApiFetch({ token, path, method: "POST", body: payload });
@@ -1529,6 +1548,7 @@ export function registerDmCommand(program) {
         .option("--grant-files", "Grant the recipient access to files they cannot currently open")
         .option("--omit-files", "Omit files the recipient cannot currently open")
         .option("--cross-company", "Confirm forwarding across company boundaries")
+        .option("--company <slug|cmp_id>", "Company the person or agent destination belongs to, so cross-company rules apply")
         .action(async (eventId, opts) => {
         await runDmForward(eventId, opts);
     });

package/dist/utils/vault-api.d.ts

@@ -68,6 +68,16 @@ export declare function vaultApiFetchPublic(opts: {
 }): Promise<Response>;
 export declare function looksLikeCompanyUid(ref: string): boolean;
 export declare function looksLikePersonVaultUid(ref: string): boolean;
+/**
+ * Resolve a company that may not be the caller's own — the destination of a
+ * cross-company DM forward. `getCompanyUid` prefers the caller's namespace, so
+ * when the destination company shares a slug with one of the caller's
+ * companies it would silently return the caller's company. Here a `cmp_` uid
+ * resolves directly; a slug goes to the global lookup first, and a slug that
+ * matches more than one company is refused with the candidate uids instead of
+ * guessing. Any other global failure falls back to `getCompanyUid`.
+ */
+export declare function resolveDestinationCompanyUid(token: string, ref: string, baseUrl?: string): Promise<string>;
 export declare function getCompanyUid(token: string, companySlug: string | undefined, 
 /**
  * Control-plane origin for the lookups. Defaults to DEFAULT_VAULT_API_URL;

package/dist/utils/vault-api.js

@@ -609,6 +609,33 @@ async function resolveCompanyUid(token, ref, baseUrl) {
     const data = (await res.json());
     return data.entity.uid;
 }
+/**
+ * Resolve a company that may not be the caller's own — the destination of a
+ * cross-company DM forward. `getCompanyUid` prefers the caller's namespace, so
+ * when the destination company shares a slug with one of the caller's
+ * companies it would silently return the caller's company. Here a `cmp_` uid
+ * resolves directly; a slug goes to the global lookup first, and a slug that
+ * matches more than one company is refused with the candidate uids instead of
+ * guessing. Any other global failure falls back to `getCompanyUid`.
+ */
+export async function resolveDestinationCompanyUid(token, ref, baseUrl) {
+    if (looksLikeCompanyUid(ref)) {
+        return resolveCompanyByUid(token, ref, baseUrl);
+    }
+    const res = await fetchGlobalCompanyBySlug(token, ref, baseUrl);
+    if (res.ok) {
+        const data = (await res.json());
+        return data.entity.uid;
+    }
+    raiseIfUnauthorized(res);
+    const body = (await res.json().catch(() => ({})));
+    if (res.status === 409 && Array.isArray(body.uids) && body.uids.length > 0) {
+        throw new CompanySelectionError(`Company slug '${ref}' matches ${body.uids.length} companies. ` +
+            `Re-run with --company <cmp_id> to name the destination company:\n` +
+            body.uids.map((u) => `  --company ${u}`).join('\n'));
+    }
+    return getCompanyUid(token, ref, baseUrl);
+}
 async function resolveCompanyFromMemberships(token, baseUrl) {
     const res = await vaultApiFetch({
         token,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.119",
+  "version": "5.345.120",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {