@indigoai-us/hq-cli 5.345.123 → 5.345.125

package/dist/commands/core-bucket-c-workflow-gate-native.js

@@ -0,0 +1,250 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+const ok = (stdout = "") => ({ code: 0, stdout, stderr: "" });
+const fail = (message, code = 1) => ({ code, stdout: "", stderr: `${message}\n` });
+const validId = /^[a-z0-9._-]+$/;
+const USAGE = `workflow-gate.sh — inspect and answer human gates opened by codex-workflow.mjs gate().
+
+A gate is a self-contained pending question file written by a paused workflow
+run; writing a matching answered/<id>.json resumes that run in place. Answers
+are durable: a re-launched run returns them instantly instead of re-asking
+the human, so never delete answered/ files while their project is live.
+
+Usage:
+  workflow-gate.sh list
+  workflow-gate.sh show <id>
+  workflow-gate.sh answer <id> <choice|N> [--notes "..."] [--by name] [--force] [--freeform]
+      <choice|N>   an option label, or a 1-based option index
+      --notes      free-text note stored alongside the choice
+      --by         who answered (recorded as answered_by)
+      --force      pre-answer a gate that has not opened yet, or overwrite an
+                   existing answer
+      --freeform   accept a choice that is not one of the gate's options
+  workflow-gate.sh wait-pending [--timeout secs]
+      Blocks until any pending gate exists (exit 0) or the timeout elapses
+      (exit 1). Monitor-friendly wake condition for watching sessions.
+  workflow-gate.sh watch-run <run-dir> [--timeout secs]
+      Run-scoped wake condition for the session that launched a workflow.
+      Blocks until a gate belonging to THAT run opens (prints its id, exit 0),
+      the run finishes (exit 3), or --timeout elapses (exit 1). Match is on
+      the run_dir every gate carries, which is the --run-dir the launching
+      session chose — no id parsing, no env coupling, no startup race.
+  workflow-gate.sh clear <id>
+      Remove both the pending and answered files for a gate id.
+
+Env: HQ_WORKFLOW_GATES_DIR overrides the gates root (default
+<hq-root>/workspace/gates); legacy CODEX_WORKFLOW_GATES_DIR is honored.
+`;
+function gateId(id) {
+    return !validId.test(id) ? fail(`workflow-gate: invalid gate id "${id}" — ids are lowercase [a-z0-9._-]`) : undefined;
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function listFiles(dir) {
+    try {
+        return fs.readdirSync(dir).filter((entry) => entry.endsWith(".json")).sort().map((entry) => path.join(dir, entry));
+    }
+    catch {
+        return [];
+    }
+}
+function parseTimeout(args) {
+    let timeout;
+    for (let index = 0; index < args.length;) {
+        if (args[index] !== "--timeout")
+            return { error: `workflow-gate: unknown flag: ${args[index]}` };
+        if (index + 1 >= args.length)
+            return { error: "workflow-gate: --timeout needs a value" };
+        const raw = args[index + 1];
+        if (!/^\d+$/.test(raw))
+            return { error: "workflow-gate: --timeout must be a whole number of seconds" };
+        timeout = Number(raw);
+        index += 2;
+    }
+    return { ...(timeout === undefined ? {} : { timeout }) };
+}
+const waitSecond = () => new Promise((resolve) => setTimeout(resolve, 1000));
+export async function runWorkflowGate(args, root, env = process.env, now = Date.now, sleep = waitSecond) {
+    const gatesDir = env.HQ_WORKFLOW_GATES_DIR || env.CODEX_WORKFLOW_GATES_DIR || path.join(root, "workspace/gates");
+    const pending = path.join(gatesDir, "pending");
+    const answered = path.join(gatesDir, "answered");
+    const [command, ...rest] = args;
+    if (!command)
+        return { code: 1, stdout: `${USAGE}\n`, stderr: "" };
+    if (command === "-h" || command === "--help" || command === "help")
+        return ok(`${USAGE}\n`);
+    if (command === "list") {
+        const files = listFiles(pending);
+        if (!files.length)
+            return ok("no pending gates\n");
+        return ok(files.map((file) => {
+            const gate = readJson(file);
+            if (!gate || typeof gate !== "object")
+                return `<unreadable> ${file}`;
+            const created = Date.parse(String(gate.created_at || 0));
+            const ageMin = Math.max(0, Math.round((now() - created) / 60000));
+            const options = Array.isArray(gate.options) ? gate.options.map((option, index) => `${index + 1}=${String(option?.label)}`).join(" ") : "";
+            return `${String(gate.id)}  (${ageMin}m)  ${String(gate.question)}${options ? `  [${options}]` : ""}`;
+        }).join("\n") + "\n");
+    }
+    if (command === "show") {
+        const id = rest[0] ?? "";
+        if (!id)
+            return fail("workflow-gate: usage: show <id>");
+        const invalid = gateId(id);
+        if (invalid)
+            return invalid;
+        const file = [path.join(pending, `${id}.json`), path.join(answered, `${id}.json`)].find((candidate) => {
+            try {
+                return fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!file)
+            return fail(`workflow-gate: no gate "${id}" in pending or answered`);
+        try {
+            return ok(fs.readFileSync(file, "utf8"));
+        }
+        catch {
+            return fail(`workflow-gate: no gate "${id}" in pending or answered`);
+        }
+    }
+    if (command === "answer") {
+        const [id = "", rawChoice = "", ...flags] = rest;
+        if (!id || !rawChoice)
+            return fail("workflow-gate: usage: answer <id> <choice|N> [--notes ...] [--by name] [--force] [--freeform]");
+        const invalid = gateId(id);
+        if (invalid)
+            return invalid;
+        let notes = "";
+        let by = "";
+        let force = false;
+        let freeform = false;
+        for (let index = 0; index < flags.length;) {
+            const flag = flags[index];
+            if (flag === "--force") {
+                force = true;
+                index += 1;
+            }
+            else if (flag === "--freeform") {
+                freeform = true;
+                index += 1;
+            }
+            else if (flag === "--notes" || flag === "--by") {
+                if (index + 1 >= flags.length)
+                    return fail(`workflow-gate: ${flag} needs a value`);
+                if (flag === "--notes")
+                    notes = flags[index + 1];
+                else
+                    by = flags[index + 1];
+                index += 2;
+            }
+            else
+                return fail(`workflow-gate: unknown flag: ${flag}`);
+        }
+        const pendingFile = path.join(pending, `${id}.json`);
+        const answerFile = path.join(answered, `${id}.json`);
+        const gate = readJson(pendingFile);
+        if (!gate && !force) {
+            const ids = listFiles(pending).map((file) => path.basename(file, ".json"));
+            return fail(`workflow-gate: no pending gate "${id}"${ids.length ? ` — pending: ${ids.join(", ")}` : " — nothing is pending"} (use --force to pre-answer)`);
+        }
+        let choice = rawChoice;
+        const options = gate && Array.isArray(gate.options) ? gate.options : [];
+        if (options.length) {
+            if (/^\d+$/.test(rawChoice)) {
+                const number = Number(rawChoice);
+                if (number >= 1 && number <= options.length)
+                    choice = String(options[number - 1].label);
+                else
+                    return fail(`workflow-gate: index ${number} is out of range 1..${options.length} for "${id}"`);
+            }
+            else {
+                const hit = options.find((option) => String(option.label).toLowerCase() === rawChoice.toLowerCase());
+                if (hit)
+                    choice = String(hit.label);
+                else if (!freeform)
+                    return fail(`workflow-gate: "${rawChoice}" is not an option for "${id}" — options: ${options.map((option) => option.label).join(", ")} (use --freeform to record it anyway)`);
+            }
+        }
+        if (fs.existsSync(answerFile) && !force)
+            return fail(`workflow-gate: gate "${id}" is already answered (${answerFile}) — use --force to overwrite`);
+        try {
+            fs.mkdirSync(answered, { recursive: true });
+            const temporary = `${answerFile}.tmp-${process.pid}`;
+            fs.writeFileSync(temporary, `${JSON.stringify({ id, choice, ...(notes ? { notes } : {}), ...(by ? { answered_by: by } : {}), answered_at: new Date(now()).toISOString() }, null, 2)}\n`);
+            fs.renameSync(temporary, answerFile);
+            try {
+                fs.rmSync(pendingFile, { force: true });
+            }
+            catch { /* shell is best-effort here */ }
+        }
+        catch (error) {
+            return fail(`workflow-gate: ${String(error.message)}`);
+        }
+        return ok(`answered ${id} -> ${choice}\n`);
+    }
+    if (command === "wait-pending" || command === "watch-run") {
+        let runDir = "";
+        let optionArgs = rest;
+        if (command === "watch-run") {
+            runDir = rest[0] ?? "";
+            if (!runDir || runDir.startsWith("-"))
+                return fail("workflow-gate: usage: watch-run <run-dir> [--timeout secs]");
+            optionArgs = rest.slice(1);
+        }
+        const parsed = parseTimeout(optionArgs);
+        if (parsed.error)
+            return fail(parsed.error);
+        let elapsed = 0;
+        for (;;) {
+            const files = listFiles(pending);
+            if (command === "wait-pending" && files.length)
+                return ok();
+            if (command === "watch-run") {
+                const wanted = path.resolve(runDir);
+                for (const file of files) {
+                    const gate = readJson(file);
+                    if (gate?.run_dir && path.resolve(String(gate.run_dir)) === wanted)
+                        return ok(`${String(gate.id || path.basename(file, ".json"))}\n`);
+                }
+                const journal = path.join(runDir, "journal.jsonl");
+                try {
+                    if (fs.readFileSync(journal, "utf8").includes('"event":"run-done"'))
+                        return { code: 3, stdout: "", stderr: "" };
+                }
+                catch { /* not finished */ }
+            }
+            if (parsed.timeout !== undefined && elapsed >= parsed.timeout)
+                return { code: 1, stdout: "", stderr: "" };
+            await sleep();
+            elapsed += 1;
+        }
+    }
+    if (command === "clear") {
+        const id = rest[0] ?? "";
+        if (!id)
+            return fail("workflow-gate: usage: clear <id>");
+        const invalid = gateId(id);
+        if (invalid)
+            return invalid;
+        try {
+            fs.rmSync(path.join(pending, `${id}.json`), { force: true });
+            fs.rmSync(path.join(answered, `${id}.json`), { force: true });
+        }
+        catch (error) {
+            return fail(`workflow-gate: ${String(error.message)}`);
+        }
+        return ok(`cleared ${id}\n`);
+    }
+    return fail(`workflow-gate: unknown command: ${command} (list | show | answer | wait-pending | watch-run | clear)`);
+}
+//# sourceMappingURL=core-bucket-c-workflow-gate-native.js.map

package/dist/commands/core.js

@@ -248,6 +248,18 @@ export const SCAFFOLD_COMMANDS = [
         root: "live",
         summary: "Check whether a company-scoped skill is installed",
     },
+    {
+        name: "work-mesh-project-registration-offer",
+        asset: "core/scripts/work-mesh-project-registration-offer.sh",
+        root: "live",
+        summary: "Check and record the work-mesh project registration offer",
+    },
+    {
+        name: "workflow-gate",
+        asset: "core/scripts/workflow-gate.sh",
+        root: "live",
+        summary: "Inspect, answer, and wait for workflow gates",
+    },
     // Session/harness plumbing relocated out of the HQ tree so a single published
     // CLI owns it. Both are `root: "live"`: they read and write the live HQ tree
     // (workspace/sessions, companies/, workspace/orchestrator/hook-state), so the

package/dist/commands/lanes-accounts.js

@@ -4,7 +4,7 @@ import { buildOutpostBalanceMoveCommand, dispatchErrorMessage } from "../lib/lan
 import { BALANCE_MOVABLE_STATES, accountLoadsForReport, planClaudeBalanceMoves, selectClaudeAccount } from "../lib/lanes/claude-balance.js";
 import { CompanySelectionError } from "../utils/company-selection-error.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, PROVIDER_HOME_ENV, accountStatus, canonicalizeHome, installDrainHook, isLanesError, listAccountStatuses, loadLanesConfig, parseLaneProvider, readLane, writeLanesConfig } from "../lib/lanes/index.js";
+import { AccountResolutionError, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, accountStatus, canonicalizeHome, claudeIdentityDiffers, installDrainHook, isLanesError, listAccountStatuses, loadLanesConfig, parseLaneProvider, probeInteractiveClaudeIdentity, readLane, withProviderHomeEnv, writeLanesConfig } from "../lib/lanes/index.js";
 import { assertUniqueAccountHomes, providerCompactAfterMs } from "../lib/lanes/config.js";
 import { resolveLaneEffort } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
@@ -113,9 +113,16 @@ export function createLaneAccountsHandlers(deps) {
         // model and effort are what a spawn on each account would start from
         // (spec: --model/--effort, then the account, then the provider).
         const quota = loadQuotaState(hqRoot);
+        // The login the interactive `claude` uses (no CLAUDE_CONFIG_DIR), so a
+        // lane account that resolves to a different keychain credential is
+        // visible here instead of only as a 429 on the wrong subscription.
+        const interactiveIdentity = providers.includes("claude") && ctx.probeProvider
+            ? probeInteractiveClaudeIdentity(ctx.probeProvider, ctx.env)
+            : null;
         const accounts = providers.flatMap((provider) => listAccountStatuses(provider, config, {
             existsSync: ctx.existsSync,
             hostname: ctx.hostname(),
+            homedir: ctx.homedir,
             probe: ctx.probeProvider,
             env: ctx.env,
         }).map((status) => {
@@ -129,6 +136,9 @@ export function createLaneAccountsHandlers(deps) {
                 providerEffort: config.providers[provider].effort,
                 model,
             });
+            const differs = provider === "claude"
+                ? claudeIdentityDiffers(status.identity, interactiveIdentity)
+                : null;
             return {
                 ...status,
                 effective_home: status.home,
@@ -136,6 +146,13 @@ export function createLaneAccountsHandlers(deps) {
                     error: "home_missing",
                     fix_command: `hq lanes accounts set-home ${provider} ${status.id} <host-home>`,
                 } : {}),
+                ...(provider === "claude" ? {
+                    identity: status.identity ?? null,
+                    credential_matches_interactive: differs === null ? null : !differs,
+                    ...(differs === true ? {
+                        warning: `Lane credential ${status.identity?.email ?? status.identity?.org_id ?? "(unknown)"} differs from the interactive claude login ${interactiveIdentity?.email ?? interactiveIdentity?.org_id ?? "(unknown)"}; lanes on this account bill that other subscription`,
+                    } : {}),
+                } : {}),
                 model: accountCfg?.model ?? null,
                 effort: accountCfg?.effort ?? null,
                 effective_model: model ?? null,
@@ -154,6 +171,7 @@ export function createLaneAccountsHandlers(deps) {
             ok: true,
             action: "accounts.list",
             providers: providerDefaults,
+            ...(providers.includes("claude") ? { interactive_identity: interactiveIdentity } : {}),
             accounts,
         });
     }
@@ -387,15 +405,16 @@ export function createLaneAccountsHandlers(deps) {
             });
         const copied = defaultHome !== home ? copyHookRails(defaultHome, home) : railsPresent(home);
         installDrainHook(provider, home);
-        const envVar = PROVIDER_HOME_ENV[provider];
         const login = VENDOR_LOGIN[provider];
         const loginArgs = provider === "codex" && opts.deviceAuth
             ? [...login.args, "--device-auth"]
             : login.args;
+        // Same rule as the worker spawn: the default Claude home logs in with
+        // CLAUDE_CONFIG_DIR unset so the credential matches the interactive one.
         const result = await ctx.spawnLogin({
             command: login.command,
             args: loginArgs,
-            env: { ...ctx.env, [envVar]: home },
+            env: withProviderHomeEnv(ctx.env, provider, home, ctx.homedir),
             cwd: home,
         });
         if (result.status !== 0) {

package/dist/commands/lanes.js

@@ -2331,6 +2331,27 @@ function orchestratorEngine(hqRoot, senior, ctx) {
         return "claude";
     return undefined;
 }
+/**
+ * Starts the worker lane a lead autopilot fill-grant wake asks for. Provider,
+ * model and effort are left to `runCreate`, so the worker follows the
+ * orchestrator engine (the lead lane provider, then the harness markers) and
+ * that provider default model, and fails with `provider_required` when no
+ * engine is known. There is no hard-coded engine.
+ */
+function autopilotWorkerStarter(ctx) {
+    return async ({ lead, story }) => {
+        const workerCtx = { ...ctx, env: { ...ctx.env, HQ_LANE_ID: lead.lane_id } };
+        const started = await runCreate(workerCtx, {
+            company: lead.company?.slug,
+            project: lead.project_id,
+            story: story.id,
+            briefFile: story.briefPath,
+            senior: "lane:" + lead.lane_id,
+            quiet: true,
+        });
+        return { lane_id: started.lane_id };
+    };
+}
 function defaultSenior(ctx) {
     const parent = ctx.env.HQ_PARENT_SESSION_ID?.trim();
     if (parent)
@@ -7389,7 +7410,7 @@ async function prepareAccountMove(ctx, lane, input) {
     });
     const block = quotaBlockFor(loadQuotaState(hqRoot), lane.provider, target, model, now);
     if (block.blocked) {
-        throw new LanesError("account_quota_held", `Account ${target} for ${lane.provider} is held${block.quota_reset_at ? ` until ${block.quota_reset_at}` : ""}${block.marker ? ` (${block.marker})` : ""}`, { provider: lane.provider, account: target, quota_reset_at: block.quota_reset_at ?? null, marker: block.marker ?? null, model: model ?? null });
+        throw new LanesError("account_quota_held", `Account ${target} for ${lane.provider} is held${block.quota_reset_at ? ` until ${block.quota_reset_at}` : ""}${block.marker ? ` (${block.marker})` : ""}. Clear the hold with: hq lanes accounts clear-quota ${lane.provider} ${target}`, { provider: lane.provider, account: target, quota_reset_at: block.quota_reset_at ?? null, marker: block.marker ?? null, model: model ?? null, clear_command: `hq lanes accounts clear-quota ${lane.provider} ${target}` });
     }
     if (model !== undefined) {
         validateLaneModel(lane.provider, model, targetHome, {
@@ -7407,7 +7428,7 @@ async function prepareAccountMove(ctx, lane, input) {
     const copy = ensureSessionHome({
         provider: lane.provider,
         sessionId,
-        cwd: hqRoot,
+        cwd: lane.working_directory_at_spawn ?? hqRoot,
         targetHome,
         registeredHomes: Object.values(providerCfg.accounts).map((account) => effectiveAccountHome(account, ctx.hostname()).home),
         providerHomeAtSpawn: lane.provider_home_at_spawn ?? sourceHome,
@@ -9399,21 +9420,7 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
             dryRun: Boolean(opts.dryRun),
             readFlag: readLanesRegistryFlag,
             keepAliveResumedLeads: new Set(summary.resumed.filter((entry) => entry.reason === "keep_alive").map((entry) => entry.id)),
-            startWorker: async ({ lead, story }) => {
-                const workerCtx = { ...ctx, env: { ...ctx.env, HQ_LANE_ID: lead.lane_id } };
-                const started = await runCreate(workerCtx, {
-                    company: lead.company?.slug,
-                    project: lead.project_id,
-                    story: story.id,
-                    briefFile: story.briefPath,
-                    provider: "codex",
-                    model: "gpt-6-luna",
-                    effort: "high",
-                    senior: `lane:${lead.lane_id}`,
-                    quiet: true,
-                });
-                return { lane_id: started.lane_id };
-            },
+            startWorker: autopilotWorkerStarter(ctx),
         });
     }
     catch (error) {
@@ -10446,21 +10453,7 @@ export function registerLanesCommand(parent, deps = {}) {
             now: ctx.now(),
             dryRun: Boolean(opts.dryRun),
             readFlag: readLanesRegistryFlag,
-            startWorker: async ({ lead, story }) => {
-                const workerCtx = { ...ctx, env: { ...ctx.env, HQ_LANE_ID: lead.lane_id } };
-                const started = await runCreate(workerCtx, {
-                    company: lead.company?.slug,
-                    project: lead.project_id,
-                    story: story.id,
-                    briefFile: story.briefPath,
-                    provider: "codex",
-                    model: "gpt-6-luna",
-                    effort: "high",
-                    senior: `lane:${lead.lane_id}`,
-                    quiet: true,
-                });
-                return { lane_id: started.lane_id };
-            },
+            startWorker: autopilotWorkerStarter(ctx),
         });
         printJson(result);
     }));