@indigoai-us/hq-cli 5.345.133 → 5.345.135

package/CHANGELOG.md

@@ -2,13 +2,27 @@
 
 ## [Unreleased]
 
+## [5.345.135] — 2026-10-15
+- `hq fingerprint self` prints the current session's HQ fingerprint, and `hq fingerprint <value>` resolves a fingerprint to its local session record. The commit-msg hook calls `hq fingerprint self --json --offline`, which stays offline and always exits 0.
+- Worker lanes get their own `HQ_SESSION_ID`, `HQ_LANE_ID`, `HQ_PARENT_SESSION_ID` and `HQ_COMPANY` with every inherited session id removed; lane records carry a `fingerprint` field shown by `lanes status --json` and `lanes show`; handoff commits add an `HQ-Fingerprint` trailer when a value exists. The handoff lookup is read-only and the offline builder never loads network modules (US-005).
+- `hq fingerprint self` records the session's fingerprint with the HQ registry once per session after printing it, and writes `registered_at` to the session's fingerprint.yaml. The call has a 3 s timeout and never changes the output or the exit code. Failures go to one line in `~/.hq/fingerprint.log` with no token values. `--no-register`, `--offline` and `HQ_FINGERPRINT_OFFLINE=1` skip it. Outpost hosts, which the registry does not accept, log a skip once and are not retried (US-007).
+- `hq fingerprint <value>` asks the HQ registry when no local session record matches, and prints source `registry` with the identity name, machine label and host kind. `--json` includes `source`, `label` and `firstSeenAt`. A value found nowhere prints `no fingerprint record` and exits 1. A local match makes no network call (US-007).
+- `hq fingerprint self` run outside an HQ folder prints a fingerprint with machine `-`, creates no files, skips registration and reports `reason: "no HQ root"` in `--json`. A registry that answers 404 records `registration_skipped: unavailable`, logs one line and is not called again for that session (US-005).
+
+## [5.345.134] — 2026-10-15
+- `hq access --as <member>` now honors the most specific ACL row covering a path, so an empty folder lock reports no access instead of the write access of a broader grant. `hq access` also reports "no access" rather than "never created" when a caller cannot list a path that an ACL lock denies them.
+
 ## [5.345.133] — 2026-10-15
+- Pipeline loop lanes no longer hang after their first phase. 5.345.132 kept the lane running while its next phase resumed, which left the previous phase's watcher holding the lane, so the next phase's result was never recorded. That change is reverted; a loop lane may again show as done for a few seconds while its next phase starts.
+
+## [5.345.132] — 2026-10-14
+- A loop lane starting its next phase now stays running in `hq lanes status` and `hq lanes list` while the phase resumes, instead of showing done for several seconds.
+- Recognize Git Bash on Git for Windows 2.56+, which reports `MSYSTEM=UCRT64` instead of `MINGW64`, so delegate jq calls keep their byte-exact output and journal titles with newlines get a valid file name on Windows.
+
+## [5.345.131] — 2026-10-14
 - `hq lanes --account auto` and `hq capacity route` no longer refuse every signed-in account when the capacity collector is off or its readings are stale; those accounts are picked with unknown usage, below accounts with fresh headroom.
 - `hq lanes create` now resumes an earlier worker session only when the project, model, and effort match, and otherwise starts a fresh thread.
-- A loop lane starting its next phase now stays running in `hq lanes status` and `hq lanes list` while the phase resumes, instead of showing done for several seconds.
 - A loop lane waiting for its next phase now shows as running in `hq lanes status` and `hq lanes list`, and becomes done only after it is stopped.
-- Recognize Git Bash on Git for Windows 2.56+, which reports `MSYSTEM=UCRT64` instead of `MINGW64`, so delegate jq calls keep their byte-exact output and journal titles with newlines get a valid file name on Windows.
-- Pipeline loop lanes no longer hang after their first phase. 5.345.132 kept the lane running while its next phase resumed, which left the previous phase's watcher holding the lane, so the next phase's result was never recorded. That change is reverted; a loop lane may again show as done for a few seconds while its next phase starts.
 
 ## [5.345.130] — 2026-10-14
 - Add native TypeScript `hq core workflow run` orchestration with the bundled runner as its flag-off fallback.

package/dist/command-catalog.generated.d.ts

@@ -1352,6 +1352,51 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly hidden: false;
     }];
     readonly subcommands: readonly [];
+}, {
+    readonly name: "fingerprint";
+    readonly description: "Print this session's HQ fingerprint, or resolve a fingerprint to its session";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly helpOption: true;
+    readonly helpCommand: false;
+    readonly usage: "[options] [command] [value]";
+    readonly helpText: readonly [];
+    readonly arguments: readonly [{
+        readonly name: "value";
+        readonly required: false;
+        readonly variadic: false;
+        readonly description: "fingerprint value to resolve (hqfp1:...)";
+    }];
+    readonly options: readonly [{
+        readonly flags: "--json";
+        readonly description: "output JSON";
+        readonly hidden: false;
+    }];
+    readonly subcommands: readonly [{
+        readonly name: "self";
+        readonly description: "Print the fingerprint for the current HQ session";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "output JSON";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--offline";
+            readonly description: "never make a network call (identity lookup or registration)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--no-register";
+            readonly description: "do not record this fingerprint with the HQ registry";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }];
 }, {
     readonly name: "capture";
     readonly description: "Record your screen with HQ Capture: start, record, stop, status and wait";

package/dist/command-catalog.generated.js

@@ -1621,6 +1621,62 @@ export const COMMAND_CATALOG = [
         ],
         "subcommands": []
     },
+    {
+        "name": "fingerprint",
+        "description": "Print this session's HQ fingerprint, or resolve a fingerprint to its session",
+        "aliases": [],
+        "hidden": false,
+        "helpOption": true,
+        "helpCommand": false,
+        "usage": "[options] [command] [value]",
+        "helpText": [],
+        "arguments": [
+            {
+                "name": "value",
+                "required": false,
+                "variadic": false,
+                "description": "fingerprint value to resolve (hqfp1:...)"
+            }
+        ],
+        "options": [
+            {
+                "flags": "--json",
+                "description": "output JSON",
+                "hidden": false
+            }
+        ],
+        "subcommands": [
+            {
+                "name": "self",
+                "description": "Print the fingerprint for the current HQ session",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "output JSON",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--offline",
+                        "description": "never make a network call (identity lookup or registration)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--no-register",
+                        "description": "do not record this fingerprint with the HQ registry",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            }
+        ]
+    },
     {
         "name": "capture",
         "description": "Record your screen with HQ Capture: start, record, stop, status and wait",

package/dist/command-registration-plan.d.ts

@@ -213,6 +213,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/version.js";
     readonly exportName: "registerVersionCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "fingerprint";
+    readonly parent: "program";
+    readonly module: "./commands/fingerprint.js";
+    readonly exportName: "registerFingerprintCommand";
 }, {
     readonly type: "registrar";
     readonly root: "capture";

package/dist/command-registration-plan.js

@@ -38,6 +38,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "resolve-company", parent: "program", module: "./commands/link.js", exportName: "registerResolveCompanyCommand" },
     { type: "registrar", root: "provider", parent: "program", module: "./commands/provider.js", exportName: "registerProviderCommand" },
     { type: "registrar", root: "version", parent: "program", module: "./commands/version.js", exportName: "registerVersionCommand" },
+    { type: "registrar", root: "fingerprint", parent: "program", module: "./commands/fingerprint.js", exportName: "registerFingerprintCommand" },
     { type: "registrar", root: "capture", parent: "program", module: "./commands/capture.js", exportName: "registerCaptureCommand" },
     { type: "registrar", root: "auth", parent: "program", module: "./commands/auth.js", exportName: "registerAuthCommands" },
     { type: "registrar", root: "secrets", parent: "program", module: "./commands/secrets.js", exportName: "registerSecretsCommand" },

package/dist/commands/access.d.ts

@@ -48,6 +48,8 @@ export interface AccessAclTree {
         updatedAt: string;
     } | null;
     effectivePermission: string | null;
+    /** Most-specific ACL row covering this prefix, including empty lock rows. */
+    coveringAclPath?: string | null;
 }
 export interface AccessMember {
     personUid: string;

package/dist/commands/access.js

@@ -91,6 +91,27 @@ function fileGrantCoversPath(grantPath, targetPath) {
     return classifyAclSource(targetPath, [grantPath]) !== "role-bypass";
 }
 const FILE_PERMISSION_RANK = { read: 1, write: 2, admin: 3 };
+function aclPatternSpecificity(pattern) {
+    if (pattern === "*" || pattern === "")
+        return [0, 0];
+    const glob = pattern.endsWith("/*");
+    const body = glob ? pattern.slice(0, -2) : pattern;
+    const segs = body.split("/").filter(Boolean).length;
+    return [segs, glob ? 0 : 1];
+}
+function pickMostSpecificCoveringRow(rows, targetPath, company) {
+    const covering = rows.filter((row) => fileGrantCoversPath(toBucketRelative(row.path, company), targetPath));
+    if (covering.length === 0)
+        return null;
+    covering.sort((a, b) => {
+        const [aSegs, aExact] = aclPatternSpecificity(toBucketRelative(a.path, company));
+        const [bSegs, bExact] = aclPatternSpecificity(toBucketRelative(b.path, company));
+        if (aSegs !== bSegs)
+            return bSegs - aSegs;
+        return bExact - aExact;
+    });
+    return covering[0] ?? null;
+}
 function httpStatusOf(err) {
     if (!err || typeof err !== "object")
         return undefined;
@@ -146,10 +167,13 @@ function treeIsEmpty(tree) {
 function aclDenied(tree) {
     if (!tree)
         return false;
+    const perm = tree.effectivePermission;
+    const denied = perm === null || perm === "none" || perm === "deny";
+    if (tree.coveringAclPath && denied)
+        return true;
     if (treeIsEmpty(tree))
         return false;
-    const perm = tree.effectivePermission;
-    return perm === null || perm === "none" || perm === "deny";
+    return denied;
 }
 /**
  * Build the result and record one cause-mix telemetry line. Every exit path
@@ -289,6 +313,18 @@ export async function runAccess(input) {
             }
             else if (fuzzy.length === 0) {
                 steps.push("list: 0 hits");
+                const tree = await deps.fetchAclTree(relative);
+                if (aclDenied(tree)) {
+                    steps.push("acl: deny");
+                    const result = finish("no-access", {
+                        path: anchored(relative) || input.target,
+                        company: slug,
+                        exists: true,
+                        steps,
+                    }, finishCtx);
+                    emit(input, result, log);
+                    return result;
+                }
                 const result = finish("never-existed", {
                     path: anchored(relative) || input.target,
                     company: slug,
@@ -632,7 +668,7 @@ async function promptPick(candidates) {
 function treeFromBody(body) {
     if (!body)
         return null;
-    if (treeIsEmpty(body))
+    if (treeIsEmpty(body) && !body.coveringAclPath)
         return null;
     return body;
 }
@@ -730,12 +766,25 @@ export async function runAccessForPerson(rawPath, personUid, opts) {
     }
     const roleBypass = projection.files.roleBypass === true;
     const grants = Array.isArray(projection.files.grants) ? projection.files.grants : [];
-    const matchingPermissions = grants
-        .filter((grant) => typeof grant.path === "string" && typeof grant.permission === "string" &&
-        grant.permission in FILE_PERMISSION_RANK &&
-        fileGrantCoversPath(toBucketRelative(grant.path, company), relativePath))
-        .map((grant) => grant.permission);
-    const permission = roleBypass ? "admin" : matchingPermissions.reduce((best, candidate) => best === null || FILE_PERMISSION_RANK[candidate] > FILE_PERMISSION_RANK[best] ? candidate : best, null);
+    const locks = Array.isArray(projection.files.locks) ? projection.files.locks : [];
+    const coveringRows = [];
+    for (const grant of grants) {
+        if (typeof grant.path === "string" &&
+            typeof grant.permission === "string" &&
+            grant.permission in FILE_PERMISSION_RANK) {
+            coveringRows.push({
+                path: grant.path,
+                permission: grant.permission,
+            });
+        }
+    }
+    for (const lock of locks) {
+        if (typeof lock.path === "string") {
+            coveringRows.push({ path: lock.path, permission: null });
+        }
+    }
+    const winner = pickMostSpecificCoveringRow(coveringRows, relativePath, company);
+    const permission = roleBypass ? "admin" : (winner?.permission ?? null);
     return {
         personUid: uid,
         company,

package/dist/commands/core-bucket-c-handoff-knowledge-native.d.ts

@@ -10,6 +10,8 @@ type CommandResult = {
     stderr: string | Buffer;
 };
 type GitRunner = (args: string[], cwd: string) => CommandResult;
+/** Builds the HQ-Fingerprint commit trailer value; null adds no trailer. */
+export type FingerprintBuilder = (root: string) => string | null;
 declare function samePath(left: string, right: string): boolean;
 declare function windowsNativePath(value: string): string;
 declare function safePath(value: unknown): value is string;
@@ -30,7 +32,7 @@ declare function parseNulPaths(status: string): {
     paths: string[];
     originals: string[];
 };
-export declare function runHandoffKnowledgeCommit(args: readonly string[], cwd?: string, git?: GitRunner): KnowledgeCommitResult;
+export declare function runHandoffKnowledgeCommit(args: readonly string[], cwd?: string, git?: GitRunner, buildFingerprint?: FingerprintBuilder): KnowledgeCommitResult;
 export declare const __handoffKnowledgeTest: {
     safePath: typeof safePath;
     validChangeset: typeof validChangeset;

package/dist/commands/core-bucket-c-handoff-knowledge-native.js

@@ -1,10 +1,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
+import { fingerprintTrailerArgs, offlineFingerprint } from "../lib/fingerprint/offline.js";
 export const HANDOFF_KNOWLEDGE_COMMIT_ASSET = "core/scripts/handoff-knowledge-commit.sh";
 const USAGE = "Usage: handoff-knowledge-commit.sh --files-touched-json-file <path> [--root <hq-root>]";
 const fail = (message, code = 1) => ({ code, stdout: "", stderr: message + "\n" });
 const gitDefault = (args, cwd) => spawnSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+const fingerprintDefault = (root) => offlineFingerprint(root, process.env, "hq handoff", { readOnly: true });
 const text = (value) => typeof value === "string" ? value : value.toString("utf8");
 function canonicalPath(value) {
     const slashPath = value.replaceAll("\\", "/");
@@ -157,7 +159,7 @@ function parseNulPaths(status) {
     }
     return { paths, originals };
 }
-function commitKnowledge(git, root, changes, handled, output) {
+function commitKnowledge(git, root, changes, handled, output, trailer) {
     for (const entry of entriesUnder(root)) {
         let stat;
         try {
@@ -209,7 +211,7 @@ function commitKnowledge(git, root, changes, handled, output) {
             output.stderr.push(text(add.stderr));
             return { code: add.status ?? 1, stdout: output.stdout.join(""), stderr: output.stderr.join("") };
         }
-        const commit = git(["commit", "--only", "-m", "checkpoint: save session knowledge changes", "--", ...repoPaths], repo);
+        const commit = git(["commit", "--only", "-m", "checkpoint: save session knowledge changes", ...trailer(), "--", ...repoPaths], repo);
         output.stdout.push(text(commit.stdout));
         output.stderr.push(text(commit.stderr));
         if (commit.status !== 0)
@@ -217,7 +219,7 @@ function commitKnowledge(git, root, changes, handled, output) {
     }
     return undefined;
 }
-export function runHandoffKnowledgeCommit(args, cwd = process.cwd(), git = gitDefault) {
+export function runHandoffKnowledgeCommit(args, cwd = process.cwd(), git = gitDefault, buildFingerprint = fingerprintDefault) {
     let changesFile = "";
     let root = cwd;
     for (let index = 0; index < args.length;) {
@@ -270,7 +272,9 @@ export function runHandoffKnowledgeCommit(args, cwd = process.cwd(), git = gitDe
     });
     const output = { stdout: [], stderr: [] };
     const handled = new Set();
-    const commitFailure = commitKnowledge(git, root, changes, handled, output);
+    let trailerArgs;
+    const trailer = () => (trailerArgs ??= fingerprintTrailerArgs(buildFingerprint(root)));
+    const commitFailure = commitKnowledge(git, root, changes, handled, output, trailer);
     if (commitFailure)
         return commitFailure;
     for (const touched of changes) {

package/dist/commands/core-handoff.d.ts

@@ -13,6 +13,8 @@ type HandoffContext = {
     now?: () => Date;
     /** Test-only override for the finalizer's historical fixed /tmp paths. */
     tmpDir?: string;
+    /** Builds the HQ-Fingerprint commit trailer value. Defaults to the offline builder. */
+    buildFingerprint?: (root: string) => string | null;
 };
 export declare function runHandoffFinalize(args: string[], context: HandoffContext): RunResult;
 export declare function runHandoffPost(args: string[], context: HandoffContext): RunResult | Promise<RunResult>;

package/dist/commands/core-handoff.js

@@ -14,6 +14,7 @@ import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
+import { fingerprintTrailerArgs, offlineFingerprint } from "../lib/fingerprint/offline.js";
 import { compactJson, isRecord, jqTruthy, prettyJson, runHandoffOpenSteps, shellDate, } from "./core-handoff-open-steps.js";
 export { runHandoffOpenSteps };
 const ASSETS = {
@@ -585,7 +586,8 @@ export function runHandoffFinalize(args, context) {
         if (probe.hasGit && staged > 0) {
             const pending = git(["diff", "--cached", "--name-only"], root).stdout.split(/\r?\n/).filter(Boolean);
             if (pending.length > 0) {
-                const committed = git(["commit", "-m", `checkpoint: handoff ${threadId}`], root);
+                const fingerprint = (context.buildFingerprint ?? ((hqRoot) => offlineFingerprint(hqRoot, process.env, "hq handoff", { readOnly: true })))(root);
+                const committed = git(["commit", "-m", `checkpoint: handoff ${threadId}`, ...fingerprintTrailerArgs(fingerprint)], root);
                 if (committed.code === 0) {
                     hqCommitted = true;
                     commitStatus = "committed";

package/dist/commands/core-pipeline-workflow-runner-native.js

@@ -340,18 +340,20 @@ function readSessionCompanySlugs(sid) {
     return [...new Set(slugs)];
 }
 function parentSessionId() {
-    return String(process.env.HQ_PARENT_SESSION_ID
-        || process.env.HQ_SESSION_ID
+    const own = process.env.HQ_SESSION_ID
         || process.env.CLAUDE_CODE_SESSION_ID
         || process.env.CLAUDE_SESSION_ID
         || process.env.CODEX_SESSION_ID
-        || process.env.CODEX_THREAD_ID
-        || '').replace(/\s+/g, '');
+        || process.env.CODEX_THREAD_ID;
+    // Inside a lane worker HQ_PARENT_SESSION_ID names the session that started
+    // the worker; the worker's own session is the parent of what it spawns.
+    const laneWorker = Boolean(process.env.HQ_LANE_ID?.trim()) && Boolean(own?.trim());
+    return String((laneWorker ? own : process.env.HQ_PARENT_SESSION_ID || own) || '').replace(/\s+/g, '');
 }
 function engineChildEnv() {
     const extra = {};
     const parent = parentSessionId();
-    if (!process.env.HQ_PARENT_SESSION_ID && parent)
+    if (parent && parent !== process.env.HQ_PARENT_SESSION_ID)
         extra.HQ_PARENT_SESSION_ID = parent;
     if (!process.env.HQ_SPAWN_COMPANY) {
         const capability = readSessionCompanyCapability(parent);

package/dist/commands/fingerprint.d.ts

@@ -0,0 +1,10 @@
+import { Command } from "commander";
+/**
+ * The HQ root for `self`: HQ_ROOT, else the nearest ancestor of `cwd` (itself
+ * included) that holds `.claude` or `workers` and core/core.yaml. Null when
+ * there is none. Unlike findHqRoot it never falls back to `cwd`, so a commit
+ * in an unrelated repo does not create `.hq/` or session files there.
+ */
+export declare function findSelfHqRoot(env?: NodeJS.ProcessEnv, cwd?: string, existsSync?: (candidate: string) => boolean): string | null;
+export declare function registerFingerprintCommand(program: Command): void;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/commands/fingerprint.js

@@ -0,0 +1,191 @@
+/**
+ * hq fingerprint - print or resolve HQ session fingerprints.
+ *
+ *   hq fingerprint self [--json] [--offline] [--no-register]
+ *   hq fingerprint <value> [--json]
+ *
+ * `self` records the fingerprint with the hq-pro registry once per session
+ * after printing it (skipped with --no-register, --offline, and
+ * HQ_FINGERPRINT_OFFLINE=1). `<value>` checks local session records first and
+ * asks the registry only when none matches.
+ *
+ * Exit codes for `hq fingerprint <value>`: 0 found, 1 no fingerprint record,
+ * 2 not an HQ fingerprint. `self` exits 0 whether or not a value is built or
+ * registered.
+ *
+ * Outside an HQ tree (no HQ_ROOT and no ancestor with `.claude` or `workers`
+ * plus core/core.yaml) `self` prints a fingerprint with machine `-`, writes
+ * nothing, skips registration, and reports `reason: "no HQ root"` in --json.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { isFingerprint } from "../lib/fingerprint/format.js";
+import { resolveLocalFingerprint } from "../lib/fingerprint/resolve-local.js";
+import { buildSelfFingerprint, registerSelfFingerprint } from "../lib/fingerprint/self.js";
+import { findHqRoot } from "../utils/manifest.js";
+function hqRootFromEnv() {
+    return process.env.HQ_ROOT || findHqRoot();
+}
+/**
+ * The HQ root for `self`: HQ_ROOT, else the nearest ancestor of `cwd` (itself
+ * included) that holds `.claude` or `workers` and core/core.yaml. Null when
+ * there is none. Unlike findHqRoot it never falls back to `cwd`, so a commit
+ * in an unrelated repo does not create `.hq/` or session files there.
+ */
+export function findSelfHqRoot(env = process.env, cwd = process.cwd(), existsSync = fs.existsSync) {
+    const fromEnv = env.HQ_ROOT?.trim();
+    if (fromEnv)
+        return fromEnv;
+    let dir = path.resolve(cwd);
+    while (true) {
+        const marked = existsSync(path.join(dir, ".claude")) || existsSync(path.join(dir, "workers"));
+        if (marked && existsSync(path.join(dir, "core", "core.yaml")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+async function loadIdToken() {
+    const { loadCachedTokens } = await import("../utils/cognito-session.js");
+    return loadCachedTokens()?.idToken ?? null;
+}
+/** Asks the registry about a fingerprint with no local record. Never throws. */
+async function lookupRegistry(value) {
+    // Loaded here so a local hit never loads the registry client.
+    const registry = await import("../lib/fingerprint/registry-client.js");
+    let token;
+    try {
+        token = await loadIdToken();
+    }
+    catch (err) {
+        registry.appendFingerprintLog("lookup", `failed: could not read the cached token: ${err.name}`);
+        return null;
+    }
+    if (!token)
+        return null;
+    const result = await registry.lookupFingerprint(value, token);
+    if (!result.ok) {
+        registry.appendFingerprintLog("lookup", `failed: ${registry.describeFailure(result)} fingerprint=${value}`);
+        return null;
+    }
+    return result.found ? result.record : null;
+}
+export function registerFingerprintCommand(program) {
+    const fingerprint = program
+        .command("fingerprint")
+        .description("Print this session's HQ fingerprint, or resolve a fingerprint to its session")
+        .argument("[value]", "fingerprint value to resolve (hqfp1:...)")
+        .option("--json", "output JSON")
+        .action(async (value, opts) => {
+        if (!value) {
+            fingerprint.help();
+            return;
+        }
+        if (!isFingerprint(value)) {
+            process.stderr.write("not an HQ fingerprint\n");
+            process.exitCode = 2;
+            return;
+        }
+        const record = resolveLocalFingerprint(hqRootFromEnv(), value);
+        if (record) {
+            if (opts.json) {
+                process.stdout.write(`${JSON.stringify({ ...record, found: true })}\n`);
+                return;
+            }
+            const lines = [
+                `fingerprint: ${record.fingerprint}`,
+                `identity:    ${record.identityUid ?? "-"} (${record.identityKind ?? "unknown"})`,
+                `machine:     ${record.machineId ?? "-"} (${record.hostKind ?? "unknown"})`,
+                `session:     ${record.sessionId ?? "-"}`,
+                `company:     ${record.company ?? "-"}`,
+                `source:      ${record.source}`,
+            ];
+            process.stdout.write(`${lines.join("\n")}\n`);
+            return;
+        }
+        let remote = null;
+        try {
+            remote = await lookupRegistry(value);
+        }
+        catch (err) {
+            // lookupRegistry already turns request failures into null; this is a
+            // failure to load the client itself.
+            process.stderr.write(`hq fingerprint: registry lookup failed: ${err.message}\n`);
+        }
+        if (!remote) {
+            if (opts.json) {
+                process.stdout.write(`${JSON.stringify({ fingerprint: value, found: false })}\n`);
+            }
+            process.stderr.write("no fingerprint record\n");
+            process.exitCode = 1;
+            return;
+        }
+        if (opts.json) {
+            process.stdout.write(`${JSON.stringify({
+                fingerprint: value,
+                ...remote,
+                source: "registry",
+                label: remote.machineLabel,
+                firstSeenAt: remote.firstSeenAt,
+                found: true,
+            })}\n`);
+            return;
+        }
+        const identityName = remote.identityName ? `${remote.identityName} ` : "";
+        const machineLabel = remote.machineLabel ? `${remote.machineLabel} ` : "";
+        const lines = [
+            `fingerprint: ${value}`,
+            `identity:    ${identityName}(${remote.identityUid}, ${remote.identityKind})`,
+            `machine:     ${machineLabel}(${remote.hostKind})`,
+            `session:     ${remote.sessionId}`,
+            `company:     ${remote.companySlug}`,
+            `first seen:  ${remote.firstSeenAt}`,
+            `source:      registry`,
+        ];
+        process.stdout.write(`${lines.join("\n")}\n`);
+    });
+    fingerprint
+        .command("self")
+        .description("Print the fingerprint for the current HQ session")
+        .option("--json", "output JSON")
+        .option("--offline", "never make a network call (identity lookup or registration)")
+        .option("--no-register", "do not record this fingerprint with the HQ registry")
+        .action(async (_opts, cmd) => {
+        // The parent also defines --json and commander hands it to the parent,
+        // so read the merged options.
+        const opts = cmd.optsWithGlobals();
+        const offline = opts.offline === true || process.env.HQ_FINGERPRINT_OFFLINE === "1";
+        const foundRoot = findSelfHqRoot();
+        const noRoot = foundRoot === null;
+        const hqRoot = foundRoot ?? process.cwd();
+        // The commit-msg hook calls this on every commit, so it never throws
+        // and always exits 0.
+        let result;
+        let built = null;
+        try {
+            built = await buildSelfFingerprint({ hqRoot, offline, noRoot });
+            result = built;
+        }
+        catch (err) {
+            process.stderr.write(`hq fingerprint: ${err.message}\n`);
+            result = { fingerprint: null, reason: `could not build fingerprint: ${err.message}` };
+        }
+        if (opts.json) {
+            process.stdout.write(`${JSON.stringify(result)}\n`);
+        }
+        else if (result.fingerprint) {
+            process.stdout.write(`${result.fingerprint}\n`);
+        }
+        else {
+            process.stdout.write(`no fingerprint: ${result.reason ?? "unknown"}\n`);
+        }
+        // Registration runs after the output is written and reports only to
+        // ~/.hq/fingerprint.log; registerSelfFingerprint does not throw.
+        if (built?.fingerprint && !noRoot) {
+            await registerSelfFingerprint(built, { hqRoot, offline, register: opts.register !== false });
+        }
+    });
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/commands/lanes.js

@@ -2432,11 +2432,18 @@ function autopilotWorkerStarter(ctx) {
         return { lane_id: started.lane_id };
     };
 }
+/**
+ * The senior for a lane created without `--senior`. Inside a lane worker
+ * (HQ_LANE_ID set) the worker's own session wins, because HQ_PARENT_SESSION_ID
+ * there names the session that started the worker, one level too high.
+ */
 function defaultSenior(ctx) {
+    const sessionId = sessionIdFromEnv(ctx.env);
+    if (ctx.env.HQ_LANE_ID?.trim() && sessionId)
+        return { kind: "session", id: sessionId };
     const parent = ctx.env.HQ_PARENT_SESSION_ID?.trim();
     if (parent)
         return { kind: "session", id: parent };
-    const sessionId = sessionIdFromEnv(ctx.env);
     if (sessionId)
         return { kind: "session", id: sessionId };
     return { kind: "user" };
@@ -6305,6 +6312,7 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane, resolveLaneTarget
         ...(showRefresh.remoteRefresh === undefined ? {} : { remote_refresh: showRefresh.remoteRefresh }),
         provider_session_id: lane.provider_session_id ?? null,
         provider_session_id_absent: lane.provider_session_id_absent ?? null,
+        fingerprint: lane.fingerprint ?? null,
         envelope_repair_mode: lane.envelope_repair?.mode ?? null,
         envelope_validation_errors: lane.envelope_validation_errors ?? [],
         last_resume: lane.last_resume ?? null,