@indigoai-us/hq-cli 5.345.122 → 5.345.123

package/dist/commands/core-bucket-c-small-native.d.ts

@@ -0,0 +1,11 @@
+export declare const KNOWLEDGE_PULSE_LOCK_ASSET = "core/scripts/knowledge-pulse-lock.sh";
+export declare const SKILL_INSTALLED_ASSET = "core/scripts/skill-installed.sh";
+export type BucketCSmallResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export declare function mkdirFailure(error: unknown, target: string, platform?: NodeJS.Platform): string;
+export declare function runKnowledgePulseLock(args: readonly string[]): BucketCSmallResult;
+export declare function runSkillInstalled(args: readonly string[], root: string, env?: NodeJS.ProcessEnv): Promise<BucketCSmallResult>;
+//# sourceMappingURL=core-bucket-c-small-native.d.ts.map

package/dist/commands/core-bucket-c-small-native.js

@@ -0,0 +1,197 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const KNOWLEDGE_PULSE_LOCK_ASSET = "core/scripts/knowledge-pulse-lock.sh";
+export const SKILL_INSTALLED_ASSET = "core/scripts/skill-installed.sh";
+const failure = (stderr, code = 1) => ({ code, stdout: "", stderr: `${stderr}\n` });
+export function mkdirFailure(error, target, platform = process.platform) {
+    const fsError = error;
+    // Node's Windows fs wrapper may report this ENOTDIR as code UNKNOWN, errno -20.
+    let code = platform === "win32" && fsError.errno === -20 ? "ENOTDIR" : fsError.code;
+    const absolute = path.resolve(target);
+    const parsed = path.parse(absolute);
+    const parts = absolute.slice(parsed.root.length).split(path.sep).filter(Boolean);
+    if (platform === "win32" && parts.some((part) => part.length > 255))
+        code = "ENAMETOOLONG";
+    const reason = {
+        EACCES: "Permission denied",
+        EEXIST: "File exists",
+        ELOOP: "Too many levels of symbolic links",
+        EMFILE: "Too many open files",
+        ENAMETOOLONG: "File name too long",
+        ENFILE: "Too many open files in system",
+        ENOENT: "No such file or directory",
+        ENOMEM: "Cannot allocate memory",
+        ENOSPC: "No space left on device",
+        ENOTDIR: "Not a directory",
+        EPERM: "Operation not permitted",
+        EROFS: "Read-only file system",
+    }[code ?? ""] ?? "Input/output error";
+    let failingPath = target;
+    if (code === "ENOTDIR" || code === "ELOOP" || code === "ENAMETOOLONG") {
+        let current = parsed.root;
+        for (const part of parts) {
+            current = path.join(current, part);
+            if (platform === "win32" && part.length > 255) {
+                failingPath = current;
+                break;
+            }
+            try {
+                if (!fs.statSync(current).isDirectory()) {
+                    failingPath = current;
+                    break;
+                }
+            }
+            catch (error) {
+                if (error.code === code)
+                    failingPath = current;
+                break;
+            }
+        }
+    }
+    if (platform === "darwin")
+        return `mkdir: ${failingPath}: ${reason}`;
+    if (platform === "win32") {
+        const shellPathParts = path.parse(failingPath);
+        // MSYS converts the incoming drive path for mkdir, retaining Node's root slash and adding its own.
+        const driveRoot = shellPathParts.root.endsWith("\\") ? `${shellPathParts.root}\\` : shellPathParts.root;
+        const shellPath = `${driveRoot}${failingPath.slice(shellPathParts.root.length).replaceAll("\\", "/")}`;
+        return `mkdir: cannot create directory '${shellPath}': ${reason}`;
+    }
+    return `mkdir: cannot create directory ‘${failingPath}’: ${reason}`;
+}
+export function runKnowledgePulseLock(args) {
+    if (args.length !== 4 || args[0] !== "claim") {
+        return failure("Usage: knowledge-pulse-lock.sh claim <claim-root> <company-slug> <YYYY-MM-DD>", 2);
+    }
+    const [_, claimRoot, company, date] = args;
+    if (!claimRoot || !/^[a-z0-9][a-z0-9-]*$/.test(company) || !/^\d{4}-\d{2}-\d{2}$/.test(date)) {
+        return failure("knowledge-pulse-lock: invalid claim root, company slug, or date", 2);
+    }
+    try {
+        fs.mkdirSync(claimRoot, { recursive: true });
+    }
+    catch (error) {
+        return failure(mkdirFailure(error, claimRoot));
+    }
+    const marker = path.join(claimRoot, `${company}-${date}.claimed`);
+    try {
+        fs.mkdirSync(marker);
+        return { code: 0, stdout: "claimed\n", stderr: "" };
+    }
+    catch (error) {
+        if (error.code === "EEXIST") {
+            try {
+                if (fs.statSync(marker).isDirectory())
+                    return { code: 0, stdout: "already-claimed\n", stderr: "" };
+            }
+            catch { /* fall through to the shell-compatible failure */ }
+        }
+        return failure("knowledge-pulse-lock: could not create claim marker");
+    }
+}
+function skillName(file) {
+    try {
+        if (!fs.statSync(file).isFile())
+            return undefined;
+        const contents = fs.readFileSync(file, "utf8");
+        const lines = (process.platform === "win32" ? contents.replaceAll("\r\n", "\n") : contents).split("\n");
+        let inFrontmatter = false;
+        let name;
+        for (const line of lines) {
+            if (/^---[ \t]*$/.test(line)) {
+                if (inFrontmatter)
+                    return name;
+                inFrontmatter = true;
+                continue;
+            }
+            if (!inFrontmatter || !/^name:[ \t]*/.test(line))
+                continue;
+            name = line.replace(/^name:[ \t]*/, "").replace(/^["']|["']$/g, "");
+        }
+    }
+    catch { /* unreadable skill files are skipped by the shell catalog */ }
+    return undefined;
+}
+function skillFiles(root, companies) {
+    const files = [];
+    const appendDirectories = (base, skipHidden) => {
+        let names;
+        try {
+            names = fs.readdirSync(base).sort((a, b) => a.localeCompare(b, "en"));
+        }
+        catch {
+            return;
+        }
+        for (const name of names) {
+            if (name.startsWith(".") || (skipHidden && (name.startsWith("_") || name.startsWith("README"))))
+                continue;
+            const dir = path.join(base, name);
+            try {
+                if (!fs.statSync(dir).isDirectory())
+                    continue;
+                const file = path.join(dir, "SKILL.md");
+                if (fs.statSync(file).isFile())
+                    files.push(file);
+            }
+            catch { /* non-directories and missing/unreadable files are skipped */ }
+        }
+    };
+    for (const company of companies)
+        appendDirectories(path.join(root, "companies", company, "skills"), false);
+    appendDirectories(path.join(root, ".claude", "skills"), true);
+    let packages = [];
+    try {
+        packages = fs.readdirSync(path.join(root, "core", "packages")).sort((a, b) => a.localeCompare(b, "en"));
+    }
+    catch {
+        return files;
+    }
+    for (const pkg of packages)
+        appendDirectories(path.join(root, "core", "packages", pkg, "skills"), false);
+    return files;
+}
+export async function runSkillInstalled(args, root, env = process.env) {
+    const skill = args[0] ?? "";
+    let company = args[1] ?? env.HQ_ACTIVE_COMPANY ?? "";
+    if (!company) {
+        const [{ sessionCompanySlugs }, { fastFlagEnabledDefaultOn }, { MULTI_COMPANY_SESSION_LOCK_FLAG }] = await Promise.all([
+            import("../lib/core-utils/session-company.js"),
+            import("../native-fast-route.js"),
+            import("../lib/cli-flag-keys.js"),
+        ]);
+        const multiCompanyLockEnabled = await fastFlagEnabledDefaultOn(MULTI_COMPANY_SESSION_LOCK_FLAG, env);
+        company = sessionCompanySlugs(root, env, multiCompanyLockEnabled).join(",");
+    }
+    if (!/^[a-z0-9][a-z0-9_-]*$/.test(skill))
+        return { code: 1, stdout: "", stderr: "" };
+    if (!company)
+        company = "__hq_unbound_session__";
+    const companies = company.split(",");
+    if (companies.at(-1) === "")
+        companies.pop();
+    if (companies.some((slug) => !/^[a-z][a-z0-9_-]*$/.test(slug)))
+        return { code: 1, stdout: "", stderr: "" };
+    const resolver = path.join(root, "core", "scripts", "lib", "session-skill-catalog.sh");
+    try {
+        fs.accessSync(resolver, fs.constants.R_OK);
+    }
+    catch {
+        return failure(`skill availability resolver is missing: ${resolver}`, 2);
+    }
+    const seen = new Set();
+    for (const file of skillFiles(root, companies)) {
+        const name = skillName(file);
+        if (!name || seen.has(name))
+            continue;
+        seen.add(name);
+        if (name === skill) {
+            try {
+                if (fs.statSync(file).isFile())
+                    return { code: 0, stdout: "", stderr: "" };
+            }
+            catch { /* catalog entry disappeared, continue */ }
+        }
+    }
+    return { code: 1, stdout: "", stderr: "" };
+}
+//# sourceMappingURL=core-bucket-c-small-native.js.map

package/dist/commands/core-derive-trigger-facts-native.js

@@ -591,7 +591,10 @@ export function runDeriveTriggerFacts(options) {
     }
 }
 export function runDeriveTriggerFactsFast(argv, stdin, cwd, hqRoot) {
-    const result = runDeriveTriggerFactsFastResult(argv, stdin, cwd, hqRoot);
+    // The shell fast route runs from the live root and injects it as
+    // CLAUDE_PROJECT_DIR. Keep the native handler's PWD fallback aligned with
+    // that route when the caller supplied --hq-root.
+    const result = runDeriveTriggerFactsFastResult(argv, stdin, hqRoot ?? cwd, hqRoot);
     if (result.stdout.length)
         process.stdout.write(result.stdout);
     if (result.stderr.length)

package/dist/commands/core.js

@@ -218,12 +218,36 @@ export const REBUILD_INDEX_TARGETS = [
  * would make the forwarders harder to audit against this table.
  */
 export const SCAFFOLD_COMMANDS = [
+    {
+        name: "handoff-sync-prefetch",
+        asset: "core/scripts/handoff-sync-prefetch.sh",
+        root: "live",
+        summary: "Pull the latest continuity pointer before a session resumes",
+    },
+    {
+        name: "handoff-sync-publish",
+        asset: "core/scripts/handoff-sync-publish.sh",
+        root: "live",
+        summary: "Publish the session continuity pointer to the personal vault",
+    },
     {
         name: "hq-task",
         asset: "core/scripts/hq-task.sh",
         root: "live",
         summary: "List and update tasks on personal or company boards",
     },
+    {
+        name: "knowledge-pulse-lock",
+        asset: "core/scripts/knowledge-pulse-lock.sh",
+        root: "live",
+        summary: "Atomically claim a company knowledge-pulse run",
+    },
+    {
+        name: "skill-installed",
+        asset: "core/scripts/skill-installed.sh",
+        root: "live",
+        summary: "Check whether a company-scoped skill is installed",
+    },
     // Session/harness plumbing relocated out of the HQ tree so a single published
     // CLI owns it. Both are `root: "live"`: they read and write the live HQ tree
     // (workspace/sessions, companies/, workspace/orchestrator/hook-state), so the
@@ -250,6 +274,7 @@ export const SCAFFOLD_COMMANDS = [
  */
 export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/hq-task.mjs", root: "live", summary: "Sibling implementation used by the hq-task shell rollback companion" },
+    { asset: "core/scripts/lib/session-skill-catalog.sh", root: "live", summary: "Shared skill catalog helper used by bundled skill-installed" },
     { asset: "core/scripts/session-journal.sh", root: "live", summary: "Rollback companion for native session journal" },
     { asset: "core/scripts/session-project.sh", root: "live", summary: "Rollback companion for native session project" },
     { asset: "core/scripts/session-title.sh", root: "live", summary: "Rollback companion for native session title" },

package/dist/commands/deploy-comments.d.ts

@@ -1,3 +1,5 @@
 import { Command } from "commander";
+export declare function displayText(value: unknown): string;
+export declare function safeJson(value: object): string;
 export declare function registerDeployCommentsCommand(deploy: Command): void;
 //# sourceMappingURL=deploy-comments.d.ts.map

package/dist/commands/deploy-comments.js

@@ -74,7 +74,7 @@ async function listComments(token, appId, orgHeaders) {
     }
     return { commentsEnabled: result.commentsEnabled, comments: result.comments };
 }
-function displayText(value) {
+export function displayText(value) {
     return [...String(value ?? "")].map((character) => {
         const code = character.codePointAt(0) ?? 0;
         return isUnsafeTerminalCodePoint(code)
@@ -88,7 +88,7 @@ function isUnsafeTerminalCodePoint(code) {
         || (code >= 0x202a && code <= 0x202e)
         || (code >= 0x2066 && code <= 0x2069);
 }
-function safeJson(value) {
+export function safeJson(value) {
     return JSON.stringify(value, null, 2).replace(/[\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, (character) => `\\u${(character.codePointAt(0) ?? 0).toString(16).padStart(4, "0")}`);
 }
 function printCommentLine(comment) {

package/dist/commands/deploy-list.d.ts

@@ -0,0 +1,22 @@
+import { Command } from "commander";
+type ApiApp = Record<string, unknown>;
+export interface DeployAppSummary {
+    id: string | null;
+    name: string | null;
+    title: string | null;
+    subdomain: string | null;
+    url: string | null;
+    type: string | null;
+    accessMode: string | null;
+    status: string | null;
+    createdAt: string | null;
+    updatedAt: string | null;
+    lastVisitAt: string | null;
+}
+/** Public app base domain, derived from the deploy API host (api.<base>). */
+export declare function appBaseDomain(apiUrl?: string): string | null;
+export declare function summarizeApp(app: ApiApp): DeployAppSummary;
+export declare function matchesQuery(app: DeployAppSummary, query: string | undefined): boolean;
+export declare function registerDeployListCommand(deploy: Command): void;
+export {};
+//# sourceMappingURL=deploy-list.d.ts.map

package/dist/commands/deploy-list.js

@@ -0,0 +1,153 @@
+import { DEPLOY_API_URL, deployApiRequest } from "../lib/deploy-api.js";
+import { listDeployApps } from "../lib/deploy-apps.js";
+import { DEFAULT_HQ_ROOT, ensureCognitoToken } from "../utils/cognito-session.js";
+import { displayText, safeJson } from "./deploy-comments.js";
+import { readActiveCompanySlug } from "./skill.js";
+class DeployListError extends Error {
+}
+const SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+function resolveCompany(companyFlag) {
+    const slug = companyFlag ?? readActiveCompanySlug(DEFAULT_HQ_ROOT);
+    if (slug === undefined) {
+        throw new DeployListError("No active company. Pass --company <slug>.");
+    }
+    if (!SLUG_PATTERN.test(slug))
+        throw new DeployListError("The company slug is not valid.");
+    return slug;
+}
+function str(value) {
+    return typeof value === "string" && value.length > 0 ? value : null;
+}
+/** Public app base domain, derived from the deploy API host (api.<base>). */
+export function appBaseDomain(apiUrl = DEPLOY_API_URL) {
+    try {
+        const host = new URL(apiUrl).hostname;
+        return host.startsWith("api.") ? host.slice(4) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function appUrl(app, subdomain) {
+    const url = str(app.url);
+    if (url)
+        return url;
+    const base = appBaseDomain();
+    return subdomain && base ? `https://${subdomain}.${base}` : null;
+}
+export function summarizeApp(app) {
+    const subdomain = str(app.subdomain);
+    return {
+        id: str(app.id),
+        name: str(app.name),
+        title: str(app.title),
+        subdomain,
+        url: appUrl(app, subdomain),
+        type: str(app.type),
+        accessMode: str(app.accessMode),
+        status: str(app.status),
+        createdAt: str(app.createdAt),
+        updatedAt: str(app.updatedAt),
+        lastVisitAt: str(app.lastVisitAt),
+    };
+}
+export function matchesQuery(app, query) {
+    if (!query)
+        return true;
+    const needle = query.toLowerCase();
+    return [app.name, app.subdomain, app.title].some((field) => field?.toLowerCase().includes(needle) ?? false);
+}
+async function responseError(response, slug) {
+    const body = await response.json().catch(() => ({}));
+    const raw = body.error?.code;
+    const code = typeof raw === "string" && /^[A-Z0-9_]+$/.test(raw) ? raw : `HTTP_${response.status}`;
+    if (response.status === 401) {
+        return new DeployListError(`hq-deploy rejected your sign-in. Run 'hq login' and retry. (${code})`);
+    }
+    if (response.status === 403) {
+        return new DeployListError(`Company '${slug}' was not found in hq-deploy, or you do not have access to it. (${code})`);
+    }
+    if (response.status === 404) {
+        return new DeployListError(`Company '${slug}' was not found in hq-deploy. (${code})`);
+    }
+    return new DeployListError(`Could not list deploy apps (HTTP ${response.status}, ${code}).`);
+}
+async function fetchPage(token, slug, cursor) {
+    const route = cursor ? `/api/apps?cursor=${encodeURIComponent(cursor)}` : "/api/apps";
+    let response;
+    try {
+        response = await deployApiRequest(token, route, "GET", undefined, { "X-Org-Slug": slug });
+    }
+    catch {
+        throw new DeployListError("Could not reach hq-deploy.");
+    }
+    if (!response.ok)
+        throw await responseError(response, slug);
+    try {
+        return await response.json();
+    }
+    catch {
+        throw new DeployListError("hq-deploy returned an invalid response.");
+    }
+}
+function printApp(app) {
+    const updated = app.updatedAt ?? app.lastVisitAt ?? app.createdAt;
+    console.log([
+        displayText(app.name ?? app.subdomain ?? app.id ?? "unnamed"),
+        displayText(app.url ?? "-"),
+        displayText(app.type ?? "-"),
+        displayText(app.accessMode ?? "-"),
+        displayText(updated ?? "-"),
+    ].join("  |  "));
+}
+async function listAction(query, options) {
+    const slug = resolveCompany(options.company);
+    const token = await ensureCognitoToken();
+    let raw;
+    try {
+        raw = await listDeployApps((cursor) => fetchPage(token, slug, cursor));
+    }
+    catch (error) {
+        if (error instanceof DeployListError)
+            throw error;
+        throw new DeployListError(error instanceof Error ? error.message : "Could not list deploy apps.");
+    }
+    const apps = raw
+        .filter((app) => typeof app === "object" && app !== null)
+        .map(summarizeApp)
+        .filter((app) => matchesQuery(app, query));
+    if (options.json) {
+        console.log(safeJson({ company: slug, query: query ?? null, apps }));
+        return;
+    }
+    if (apps.length === 0) {
+        if (query) {
+            console.log(`No deploy apps in '${slug}' matched '${displayText(query)}'.`);
+        }
+        else {
+            console.log(`hq-deploy returned no apps for '${slug}'.`);
+            console.log("Hint: this list can come back empty while the org still has apps. "
+                + "Check the HQ console before concluding none exist.");
+        }
+        return;
+    }
+    for (const app of apps)
+        printApp(app);
+}
+export function registerDeployListCommand(deploy) {
+    deploy
+        .command("list [query]")
+        .description("List deploy apps in your company, optionally filtered by name or subdomain")
+        .option("--company <slug>", "use this company instead of the active company")
+        .option("--json", "print the matching apps as JSON")
+        .action(async (query, options) => {
+        try {
+            await listAction(query, options);
+        }
+        catch (error) {
+            console.error(error instanceof DeployListError ? error.message : "Deploy list command failed.");
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=deploy-list.js.map

package/dist/commands/lanes.js

@@ -38,6 +38,7 @@ import { registerLanesLinkCommand } from "./lanes-link.js";
 import { laneDepthCap } from "../lib/lanes/depth-cap.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
+import { codexEnvEvidence, grokEnvEvidence } from "../lib/doctor/platform.js";
 import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff, readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
 import { readLaneStatusRowFields } from "../lib/lanes/status-fields.js";
 import { appendProjectFocusOverride, readProjectStoryFocusData, removeProjectFocusOverride } from "../lib/lanes/story-ledger.js";
@@ -74,7 +75,7 @@ import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
 import { remoteControlSelectionConfig, remoteControlSessionHome } from "../lib/lanes/remote-control-lane.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, syncLaneToProjectStoryLedger, removeLaneFromProjectStoryLedger, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, isFailedQuotaKeepAliveLane, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, syncLaneToProjectStoryLedger, removeLaneFromProjectStoryLedger, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, isLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, isFailedQuotaKeepAliveLane, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "../lib/lanes/lane-company.js";
@@ -2295,6 +2296,41 @@ function callerDepth(hqRoot, ctx) {
     }
     return 0;
 }
+/**
+ * Engine of the orchestrator that is creating a lane, used as the provider
+ * fallback when neither --provider nor the worker profile names one. Order:
+ * the senior lane's provider, the senior session's `conduct_engine` metadata,
+ * then the harness markers in the environment (`HQ_HARNESS`, Codex/Grok
+ * runtime variables, `CLAUDECODE=1`). Returns undefined when none apply.
+ */
+function orchestratorEngine(hqRoot, senior, ctx) {
+    if (senior.kind === "lane" && senior.id) {
+        try {
+            const provider = readLane(hqRoot, senior.id).provider;
+            if (isLaneProvider(provider))
+                return provider;
+        }
+        catch {
+            // Fall through to the environment markers.
+        }
+    }
+    if (senior.kind === "session" && senior.id) {
+        const engine = readSessionMeta(hqRoot, senior.id, ctx)?.conduct_engine;
+        const value = typeof engine === "string" ? engine.trim().toLowerCase() : "";
+        if (isLaneProvider(value))
+            return value;
+    }
+    const harness = ctx.env.HQ_HARNESS?.trim().toLowerCase() ?? "";
+    if (isLaneProvider(harness))
+        return harness;
+    if (codexEnvEvidence(ctx.env).length > 0)
+        return "codex";
+    if (grokEnvEvidence(ctx.env).length > 0)
+        return "grok";
+    if (ctx.env.CLAUDECODE?.trim() === "1")
+        return "claude";
+    return undefined;
+}
 function defaultSenior(ctx) {
     const parent = ctx.env.HQ_PARENT_SESSION_ID?.trim();
     if (parent)
@@ -3450,7 +3486,10 @@ async function runCreate(ctx, opts) {
     const profile = resolvedWorker?.profile;
     const provider = explicitProvider ??
         profile?.meta.provider ??
-        parseLaneProvider(opts.remoteControl === true ? "claude" : "codex");
+        (opts.remoteControl === true ? parseLaneProvider("claude") : orchestratorEngine(hqRoot, senior, ctx));
+    if (provider === undefined) {
+        throw new LanesError("provider_required", "Cannot tell which engine runs the orchestrator session, so no lane provider was chosen. Pass --provider claude, --provider codex, or --provider grok.", { accepted: [...LANE_PROVIDERS] });
+    }
     if (opts.remoteControl === true && provider !== "claude") {
         throw new LanesError("remote_control_requires_claude", "--remote-control requires a Claude lane", { provider });
     }

package/dist/fast-scaffold.js

@@ -160,6 +160,54 @@ export function isDefaultOnFastFamily(flagKey) {
 }
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export const FAST_SCAFFOLD_SCRIPTS = [
+    {
+        name: "handoff-sync-prefetch",
+        kind: "native",
+        modulePath: "./commands/core-bucket-c-handoff-sync-fast.js",
+        exportName: "runHandoffSyncPrefetchFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-bucket-c",
+        asset: "core/scripts/handoff-sync-prefetch.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
+    {
+        name: "knowledge-pulse-lock",
+        kind: "native",
+        modulePath: "./commands/core-bucket-c-small-fast.js",
+        exportName: "runKnowledgePulseLockFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-bucket-c",
+        asset: "core/scripts/knowledge-pulse-lock.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
+    {
+        name: "handoff-sync-publish",
+        kind: "native",
+        modulePath: "./commands/core-bucket-c-handoff-sync-fast.js",
+        exportName: "runHandoffSyncPublishFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-bucket-c",
+        asset: "core/scripts/handoff-sync-publish.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
+    {
+        name: "skill-installed",
+        kind: "native",
+        modulePath: "./commands/core-bucket-c-small-fast.js",
+        exportName: "runSkillInstalledFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-bucket-c",
+        asset: "core/scripts/skill-installed.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
     {
         name: "sentry report",
         kind: "native",

package/dist/lib/core-utils/session-company.d.ts

@@ -0,0 +1,3 @@
+/** Reads the active session's company lock without importing the full hq-session command. */
+export declare function sessionCompanySlugs(root: string, env?: NodeJS.ProcessEnv, multiCompanyLockEnabled?: boolean): string[];
+//# sourceMappingURL=session-company.d.ts.map