@indigoai-us/hq-cli 5.345.135 → 5.345.137

package/dist/commands/integrations-manage.js

@@ -17,7 +17,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
 import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
 const PERMISSIONS = ["read", "write", "admin"];
@@ -520,30 +520,36 @@ export function registerManageCommands(integrations) {
         .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Only this app")
         .option("--limit <n>", "How many events to show", "20")
+        .option("--since <iso>", "Only events at or after this ISO timestamp, e.g. 2026-10-01T00:00:00Z")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken();
-        const companyUid = await getCompanyUid(token, opts.company);
-        const surface = await fetchAdminSurface(token, companyUid);
         const limit = Number(opts.limit);
         if (!Number.isFinite(limit) || limit < 1) {
             throw new IntegrationsCliError("--limit must be a positive number.", { expected: true });
         }
-        // Normalize BOTH sides: `--provider` is routinely copied from JSON
-        // output, which carries the qualified `factory:linear` form, while every
-        // audit row is stored bare. Comparing them raw silently reports "no
-        // activity" for an app that has plenty.
-        const want = opts.provider ? bareProvider(opts.provider.trim()).toLowerCase() : undefined;
-        const rows = surface.audit
-            .filter((row) => !want || bareProvider(row.provider ?? "").toLowerCase() === want)
-            .slice(0, limit);
+        let sinceMs;
+        if (opts.since !== undefined) {
+            sinceMs = Date.parse(opts.since);
+            if (Number.isNaN(sinceMs)) {
+                throw new IntegrationsCliError("--since must be an ISO timestamp, e.g. 2026-10-01T00:00:00Z.", { expected: true });
+            }
+        }
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const result = await collectAuditRows(token, companyUid, {
+            limit: Math.floor(limit),
+            provider: opts.provider,
+            sinceMs,
+        });
+        const { rows } = result;
         if (opts.json) {
             printJson(rows);
+            if (result.pageCapHit)
+                console.error(auditPageCapNote());
             return;
         }
         if (rows.length === 0) {
             console.log("No recorded activity yet.");
-            return;
         }
         for (const row of rows) {
             const who = row.memberOrAgentName ?? row.memberOrAgent;
@@ -551,10 +557,21 @@ export function registerManageCommands(integrations) {
             if (row.reason)
                 console.log(chalk.dim(`    ${redactUrlsInText(row.reason)}`));
         }
-        // hq-pro caps its own feed at 50 events; say so rather than letting a
-        // truncated list read as "that is everything that ever happened".
-        if (surface.audit.length > rows.length) {
-            console.log(chalk.dim(`\nShowing ${rows.length} of ${surface.audit.length} recent events.`));
+        if (!result.paged) {
+            // An older hq-pro ignores view=audit and returns its surface feed,
+            // capped at 50 events; say so rather than letting a truncated list
+            // read as "that is everything that ever happened".
+            if (result.feedSize > rows.length && rows.length > 0) {
+                console.log(chalk.dim(`\nShowing ${rows.length} of ${result.feedSize} recent events.`));
+            }
+            console.log(chalk.dim("This server returns only the latest 50 events."));
+            return;
+        }
+        if (result.pageCapHit) {
+            console.log(chalk.dim(`\n${auditPageCapNote()}`));
+        }
+        else if (result.more && rows.length > 0) {
+            console.log(chalk.dim(`\nShowing ${rows.length} events. Raise --limit or use --since to see more.`));
         }
     });
     integrations
@@ -757,4 +774,62 @@ export function removeGrant(current, toolName, principal) {
     }
     return removed ? next : null;
 }
+/** Upper bound on audit pages one `hq integrations audit` run reads. */
+export const AUDIT_MAX_PAGES = 200;
+function auditPageCapNote() {
+    return `Stopped after reading ${AUDIT_MAX_PAGES} pages of activity; narrow the search with --since or --provider.`;
+}
+/**
+ * Page the audit feed (newest first) until `limit` rows match, the cursor runs
+ * out, a row is older than `sinceMs`, or AUDIT_MAX_PAGES pages were read.
+ * `provider` is matched client-side on the bare slug, so the qualified
+ * `factory:linear` form copied from JSON output matches bare stored rows.
+ */
+export async function collectAuditRows(token, companyUid, opts) {
+    const want = opts.provider ? bareProvider(opts.provider.trim()).toLowerCase() : undefined;
+    const matches = (row) => !want || bareProvider(row.provider ?? "").toLowerCase() === want;
+    const tooOld = (row) => {
+        if (opts.sinceMs === undefined)
+            return false;
+        const at = Date.parse(row.timestamp);
+        return !Number.isNaN(at) && at < opts.sinceMs;
+    };
+    const rows = [];
+    let cursor;
+    for (let page = 0; page < AUDIT_MAX_PAGES; page += 1) {
+        const remaining = opts.limit - rows.length;
+        // With a provider filter most rows may not match, so read full pages.
+        const pageLimit = want ? AUDIT_PAGE_MAX : Math.min(AUDIT_PAGE_MAX, remaining);
+        const res = await fetchAuditPage(token, companyUid, { limit: pageLimit, cursor });
+        if (!res.paged) {
+            if (page > 0)
+                return { rows, paged: true, feedSize: 0, more: false, pageCapHit: false };
+            const fallback = res.audit.filter((row) => !tooOld(row) && matches(row));
+            return {
+                rows: fallback.slice(0, opts.limit),
+                paged: false,
+                feedSize: res.audit.length,
+                more: fallback.length > opts.limit,
+                pageCapHit: false,
+            };
+        }
+        for (let i = 0; i < res.audit.length; i += 1) {
+            const row = res.audit[i];
+            if (tooOld(row))
+                return { rows, paged: true, feedSize: 0, more: false, pageCapHit: false };
+            if (!matches(row))
+                continue;
+            if (rows.length >= opts.limit) {
+                return { rows, paged: true, feedSize: 0, more: true, pageCapHit: false };
+            }
+            rows.push(row);
+        }
+        if (!res.nextCursor)
+            return { rows, paged: true, feedSize: 0, more: false, pageCapHit: false };
+        if (rows.length >= opts.limit)
+            return { rows, paged: true, feedSize: 0, more: true, pageCapHit: false };
+        cursor = res.nextCursor;
+    }
+    return { rows, paged: true, feedSize: 0, more: true, pageCapHit: true };
+}
 //# sourceMappingURL=integrations-manage.js.map

package/dist/commands/integrations.d.ts

@@ -21,6 +21,7 @@
  *   hq integrations show [app]               One app in full.
  *   hq integrations tools --provider <p>     What the connected app can do.
  *   hq integrations call <tool> --provider <p> --args '<json>'
+ *   hq integrations call <tool> --provider <p> --args-file args.json
  *   hq integrations pending                  Calls awaiting approval.
  *   hq integrations pending --history        Recently decided calls, including status.
  *   hq integrations approve|reject <queueId> Decide a queued call.
@@ -51,6 +52,16 @@
  */
 import { Command } from "commander";
 import { type PendingApproval } from "./integrations-api.js";
+/**
+ * Resolve `hq integrations call` tool arguments from `--args <json>`,
+ * `--args -` (stdin), or `--args-file <path>` (`-` also reads stdin). A file or
+ * stdin avoids shell quoting: zsh breaks inline JSON that contains apostrophes
+ * or parentheses. The result must be a JSON object.
+ */
+export declare function resolveCallArgs(opts: {
+    args?: string;
+    argsFile?: string;
+}, stdin?: NodeJS.ReadableStream): Promise<Record<string, unknown>>;
 export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 export type { AdminConnection, UsableApp, UsableAppsResult } from "./integrations-core.js";
 /** Wait for a decided queue item without resending the approve request. */

package/dist/commands/integrations.js

@@ -21,6 +21,7 @@
  *   hq integrations show [app]               One app in full.
  *   hq integrations tools --provider <p>     What the connected app can do.
  *   hq integrations call <tool> --provider <p> --args '<json>'
+ *   hq integrations call <tool> --provider <p> --args-file args.json
  *   hq integrations pending                  Calls awaiting approval.
  *   hq integrations pending --history        Recently decided calls, including status.
  *   hq integrations approve|reject <queueId> Decide a queued call.
@@ -50,6 +51,7 @@
  * `integrations-manage.ts`.
  */
 import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
 import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
@@ -60,6 +62,69 @@ import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { registerSlackCommands } from "./integrations-slack.js";
 import { fetchPendingApprovals } from "./integrations-api.js";
+const CALL_ARGS_EXAMPLE = `--args '{"assignee":"me"}' or --args-file args.json`;
+function readStream(stream) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        stream.setEncoding("utf8");
+        stream.on("data", (chunk) => {
+            data += chunk;
+        });
+        stream.on("end", () => resolve(data));
+        stream.on("error", reject);
+    });
+}
+/**
+ * Resolve `hq integrations call` tool arguments from `--args <json>`,
+ * `--args -` (stdin), or `--args-file <path>` (`-` also reads stdin). A file or
+ * stdin avoids shell quoting: zsh breaks inline JSON that contains apostrophes
+ * or parentheses. The result must be a JSON object.
+ */
+export async function resolveCallArgs(opts, stdin = process.stdin) {
+    if (opts.args !== undefined && opts.argsFile !== undefined) {
+        throw new IntegrationsCliError("Use either --args or --args-file, not both.", { expected: true });
+    }
+    let text;
+    let source;
+    const fromStdin = opts.args === "-" || opts.argsFile === "-";
+    if (fromStdin) {
+        if (stdin.isTTY) {
+            throw new IntegrationsCliError("Reading tool arguments from stdin needs piped input, e.g. `hq integrations call <tool> --args - < args.json`.", { expected: true });
+        }
+        text = await readStream(stdin);
+        source = "stdin";
+    }
+    else if (opts.argsFile !== undefined) {
+        source = `--args-file ${opts.argsFile}`;
+        try {
+            text = await readFile(opts.argsFile, "utf8");
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new IntegrationsCliError(`Could not read --args-file ${opts.argsFile}: ${reason}`, { expected: true });
+        }
+    }
+    else {
+        text = opts.args ?? "{}";
+        source = "--args";
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new IntegrationsCliError(source === "--args"
+            ? `--args must be a JSON object, e.g. ${CALL_ARGS_EXAMPLE}`
+            : `Tool arguments from ${source} are not valid JSON (${reason}). They must be a JSON object, e.g. {"assignee":"me"}.`, { expected: true });
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new IntegrationsCliError(source === "--args"
+            ? `--args must be a JSON object, e.g. ${CALL_ARGS_EXAMPLE}`
+            : `Tool arguments from ${source} must be a JSON object, e.g. {"assignee":"me"}.`, { expected: true });
+    }
+    return raw;
+}
 /** Routing ids hq sets on a built-in tool call; never accepted from --args. */
 const BUILT_IN_ROUTING_ARGS = ["companyUid", "connectionId", "idempotencyKey"];
 /**
@@ -382,7 +447,7 @@ export function registerIntegrationsCommand(program) {
         const selector = sharedProvider
             ? `--connection ${connection.id}`
             : `--provider ${bareProvider(connection.provider)}`;
-        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools ${selector} --describe <tool>\nCall one with: hq integrations call <tool> ${selector} --args '<json>'`));
+        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools ${selector} --describe <tool>\nCall one with: hq integrations call <tool> ${selector} --args '<json>'\nIf the JSON has apostrophes or parentheses, put it in a file: --args-file args.json (or --args - to read stdin)`));
     });
     integrations
         .command("call <tool>")
@@ -390,21 +455,12 @@ export function registerIntegrationsCommand(program) {
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--company <slug>", "Company slug, e.g. indigo")
-        .option("--args <json>", "Tool arguments as JSON", "{}")
+        .option("--args <json>", "Tool arguments as a JSON object (default {}); use - to read the JSON from stdin")
+        .option("--args-file <path>", "Read tool arguments from a JSON file (use - for stdin); avoids shell quoting of apostrophes and parentheses")
         .option("--idempotency-key <key>", "Stable key so retries execute at most once (default: generated)")
         .option("--json", "Machine-readable output")
         .action(async (tool, opts) => {
-        let parsedArgs;
-        try {
-            const raw = JSON.parse(opts.args);
-            if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-                throw new Error("not an object");
-            }
-            parsedArgs = raw;
-        }
-        catch {
-            throw new IntegrationsCliError(`--args must be a JSON object, e.g. --args '{"assignee":"me"}'`, { expected: true });
-        }
+        const parsedArgs = await resolveCallArgs(opts);
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connection = selectConnection(await fetchConnections(token, companyUid), opts);
@@ -417,7 +473,7 @@ export function registerIntegrationsCommand(program) {
             // arg with a routing name would redirect the call; refuse it.
             const reserved = BUILT_IN_ROUTING_ARGS.filter((key) => key in parsedArgs);
             if (reserved.length) {
-                throw new IntegrationsCliError(`--args cannot include ${reserved.join(", ")}: it is set by hq from the selected connection.`, { expected: true });
+                throw new IntegrationsCliError(`Tool arguments cannot include ${reserved.join(", ")}: it is set by hq from the selected connection.`, { expected: true });
             }
             gatewayParams = {
                 companyUid,
@@ -525,16 +581,41 @@ export function registerIntegrationsCommand(program) {
                     process.exitCode = 1;
                 return;
             }
+            if (decision === "reject") {
+                if (opts.json)
+                    printJson(body);
+                else
+                    console.log(chalk.yellow(`Rejected (status: ${body.status ?? "rejected"}).`));
+                return;
+            }
+            // A synchronous approve runs the call inline. The gateway answers a
+            // provider-side tool error with { status: "rejected", outcome:
+            // "failed", rejectionReason: "provider_tool_error" }; an older
+            // gateway reports "resumed" with an isError result. Classify both as
+            // failures, the same way the polling path does.
+            const result = body.result === undefined ? undefined : unwrapGatewayResult(body.result);
+            const toolError = body.result !== undefined &&
+                (gatewayResultIsError(result) || gatewayResultIsError(body.result));
+            const failed = approvalOutcomeFailed(body) || toolError;
+            if (failed)
+                process.exitCode = 1;
             if (opts.json) {
                 printJson(body);
                 return;
             }
-            console.log(decision === "approve"
-                ? chalk.green(`Approved — the call ran (status: ${body.status ?? "resumed"}).`)
-                : chalk.yellow(`Rejected (status: ${body.status ?? "rejected"}).`));
-            if (decision === "approve" && body.result !== undefined) {
-                printJson(unwrapGatewayResult(body.result));
+            if (failed) {
+                const reason = body.rejectionReason ??
+                    (toolError ? "provider_tool_error" : body.outcome ?? body.status ?? "failed");
+                console.log(chalk.red(`The approved call failed at the provider (${reason}).`));
             }
+            else if (body.status === "resumed" || body.status === "completed" || body.outcome === "ran") {
+                console.log(chalk.green(`Approved — the call ran (status: ${body.status ?? body.outcome}).`));
+            }
+            else {
+                console.log(chalk.yellow(`Approval ended with status ${body.status ?? "unknown"}.`));
+            }
+            if (result !== undefined)
+                printJson(result);
         });
     }
     registerConnectCommands(integrations);

package/dist/commands/lanes-loop.d.ts

@@ -18,9 +18,18 @@ export interface LoopControllerDeps {
     resumeLane(laneId: string, options: LaneResumeOptions): Promise<unknown>;
     interruptLane(laneId: string, reason: string, options: {
         preserveLoopQueue: boolean;
+        terminalReason?: string;
     }): Promise<void>;
     emitTerminal(lane: LaneRecord): Promise<void>;
 }
+/**
+ * terminal_reason values for interrupts HQ issues itself. An operator
+ * interrupt (`hq lanes interrupt`) records `operator_interrupt`; these keep a
+ * system recovery from looking like an operator action in the lane record.
+ */
+export declare const LOOP_CONTROLLER_RECOVERY_REASON = "loop_controller_recovery";
+export declare const LOOP_STALL_RESTART_REASON = "loop_stall_restart";
+export declare const LOOP_PHASE_DEADLINE_REASON = "loop_phase_deadline";
 export declare function startLaneLoopController(ctx: Ctx, laneId: string, initialAdmission?: boolean): number;
 export declare function runLaneLoopController(ctx: Ctx, laneId: string, deps: LoopControllerDeps): Promise<void>;
 //# sourceMappingURL=lanes-loop.d.ts.map

package/dist/commands/lanes-loop.js

@@ -52,6 +52,14 @@ function casLoopLaneState(hqRoot, laneId, from, to) {
         }
     }
 }
+/**
+ * terminal_reason values for interrupts HQ issues itself. An operator
+ * interrupt (`hq lanes interrupt`) records `operator_interrupt`; these keep a
+ * system recovery from looking like an operator action in the lane record.
+ */
+export const LOOP_CONTROLLER_RECOVERY_REASON = "loop_controller_recovery";
+export const LOOP_STALL_RESTART_REASON = "loop_stall_restart";
+export const LOOP_PHASE_DEADLINE_REASON = "loop_phase_deadline";
 export function startLaneLoopController(ctx, laneId, initialAdmission = false) {
     const entry = process.argv[1];
     if (!entry)
@@ -202,7 +210,7 @@ export async function runLaneLoopController(ctx, laneId, deps) {
                 }
                 let interruptPromise;
                 const abortPhase = () => {
-                    interruptPromise = deps.interruptLane(laneId, "loop phase deadline exceeded", { preserveLoopQueue: true }).catch((error) => {
+                    interruptPromise = deps.interruptLane(laneId, "loop phase deadline exceeded", { preserveLoopQueue: true, terminalReason: LOOP_PHASE_DEADLINE_REASON }).catch((error) => {
                         process.stderr.write(`hq lanes: could not interrupt stalled loop phase ${laneId}: ${error instanceof Error ? error.message : String(error)}\n`);
                     });
                 };

package/dist/commands/lanes.js

@@ -48,7 +48,7 @@ import { appendLaneFocusOverride, assertFocusGuardAllows, makeFocusOverride } fr
 import { LANE_FOCUS_GUARD_FLAG, LANE_FOCUS_DASHBOARD_FLAG, LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_LIST_SKIP_REMOTE_REFRESH_FLAG, LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG, LANE_PROFILE_PIN_EXHAUSTED_FALLBACK_FLAG, LANE_STATUS_ROW_FIELDS_FLAG, LANE_REAP_STOP_FLAG, LANE_REUSE_REFRESHES_PROFILE_FLAG, LANE_WORKER_CONTINUITY_FLAG, LANE_CONDUCT_LOOP_FLAG, LANE_ENVELOPE_REPAIR_GUIDANCE_FLAG, } from "../lib/lanes/flag-keys.js";
 import { applyContinuitySettings, findWorkerContinuityLane, sameLaneHost, workerContinuityPrompt } from "../lib/lanes/worker-continuity.js";
 import { commitIdleLoopStop, enqueueLoopEnvelope, interruptLoopQueue, interruptLoopQueueForStory, loopControllerIsAlive, loopLaneIsIdle, loopStatus, validateLoopEnvelope } from "../lib/lanes/loop.js";
-import { runLaneLoopController, startLaneLoopController } from "./lanes-loop.js";
+import { LOOP_CONTROLLER_RECOVERY_REASON, LOOP_STALL_RESTART_REASON, runLaneLoopController, startLaneLoopController } from "./lanes-loop.js";
 import { configuredCodexRolloutHomes, retainCodexRollouts } from "../lib/lanes/disk-guard.js";
 import { isControllerAliasOutpostId } from "../lib/lanes/admission-host.js";
 import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
@@ -494,6 +494,41 @@ function livenessDepsFromCtx(ctx) {
         hostname: ctx.hostname,
     };
 }
+/**
+ * Start a lane that admission just let through. A queued loop lane is marked
+ * running and gets its loop controller, which works through the queued phase
+ * envelopes; every other lane spawns its worker directly. Every admission path
+ * (reconcile, in-process queue drain, hq lanes admit) goes through here so a
+ * loop lane never runs its brief without a controller.
+ */
+function startAdmittedLane(ctx, root, candidate) {
+    if (candidate.loop_mode !== true || candidate.state !== "queued") {
+        const admissionHost = reconcileHostFromCtx(ctx);
+        return spawnLaneWorker(root, candidate, {
+            env: ctx.env,
+            hostname: admissionHost.hostname,
+            admissionHost,
+            modelDeps: { readFileSync: ctx.readFileSync, probe: ctx.probeProvider, env: ctx.env },
+            existsSync: ctx.existsSync,
+            spawnProcess: ctx.spawnProcess,
+            proveDetached: ctx.proveDetached,
+            killProcess: ctx.killProcess,
+            now: ctx.now,
+            resolveMachineIdentity: ctx.resolveMachineIdentity,
+            runCompaction: ctx.runCompaction,
+            locateTranscript: ctx.locateTranscript,
+        });
+    }
+    const admitted = casUpdateLane(root, candidate.lane_id, (current) => ({
+        ...current,
+        state: "running",
+        queued_reason: undefined,
+        queued_details: undefined,
+        admission_reserved_at: undefined,
+    }));
+    startLaneLoopController(ctx, candidate.lane_id, true);
+    return admitted;
+}
 /**
  * Admit queued lanes in-process after a command frees or adds capacity, so
  * the queue drains without `hq daemon`. Best effort: an admission failure is
@@ -516,6 +551,7 @@ async function admitQueuedFromCtx(ctx) {
                 runCompaction: ctx.runCompaction,
                 locateTranscript: ctx.locateTranscript,
             },
+            spawn: (root, candidate) => startAdmittedLane(ctx, root, candidate),
             throttleDeps: ctx.throttleDeps,
             livenessDeps: livenessDepsFromCtx(ctx),
             presenceConnected: ctx.presenceConnected,
@@ -3355,7 +3391,7 @@ async function runCreate(ctx, opts) {
     const requestedHireGrant = opts.hireGrant === undefined
         ? undefined
         : parseHireGrant(opts.hireGrant);
-    const requestedPlacement = opts.placement !== undefined
+    let requestedPlacement = opts.placement !== undefined
         ? parsePlacementPolicy(opts.placement)
         : undefined;
     const defaultPlacement = opts.defaultPlacement !== undefined
@@ -3575,6 +3611,13 @@ async function runCreate(ctx, opts) {
         placementGate ??= readLanePlacementEnabled(ctx, resolvePlacementCompany());
         return placementGate;
     };
+    if (requestedPlacement?.kind === "local" &&
+        defaultPlacement === undefined &&
+        !(await placementEnabled())) {
+        // With placement off every lane already runs here, so --placement local
+        // asks for the default. Treat it as omitted instead of refusing.
+        requestedPlacement = undefined;
+    }
     if (requestedPlacement !== undefined || defaultPlacement !== undefined) {
         await assertPlacementEnabled(ctx, resolvePlacementCompany(), placementEnabled);
     }
@@ -7159,22 +7202,7 @@ async function runAdmit(ctx, laneId, opts) {
             });
             return;
         }
-        const started = spawnLaneWorker(hqRoot, lane, {
-            env: ctx.env,
-            modelDeps: {
-                readFileSync: ctx.readFileSync,
-                probe: ctx.probeProvider,
-                env: ctx.env,
-            },
-            existsSync: ctx.existsSync,
-            spawnProcess: ctx.spawnProcess,
-            proveDetached: ctx.proveDetached,
-            killProcess: ctx.killProcess,
-            now: ctx.now,
-            resolveMachineIdentity: ctx.resolveMachineIdentity,
-            runCompaction: ctx.runCompaction,
-            locateTranscript: ctx.locateTranscript,
-        });
+        const started = startAdmittedLane(ctx, hqRoot, lane);
         const admitted = opts.force && started.state === "running"
             ? casUpdateLane(hqRoot, laneId, (current) => ({ ...current, admitted_reason: "operator_force" }))
             : started;
@@ -8811,7 +8839,7 @@ async function runStop(ctx, laneId, reason, quiet = false) {
         }
         const controllerAlive = loopControllerIsAlive(runDirPath);
         if (!controllerAlive && lane.state === "running") {
-            await runInterrupt(ctx, lane.lane_id, "loop controller exited; recovering queued work before stop", { preserveLoopQueue: true, quiet: true });
+            await runInterrupt(ctx, lane.lane_id, "loop controller exited; recovering queued work before stop", { preserveLoopQueue: true, quiet: true, terminalReason: LOOP_CONTROLLER_RECOVERY_REASON });
         }
         const queued = enqueueLoopEnvelope({ runDir: runDirPath, laneId: lane.lane_id, envelope: { kind: "stop" }, now: ctx.now });
         if (!controllerAlive && lane.state !== "queued")
@@ -8887,6 +8915,13 @@ function stopTerminalWarning(laneId) {
  * session so `hq lanes resume` continues it. Keep-alive resumes only
  * `exited_with_partial_output` interruptions, so it leaves this lane alone.
  */
+/** Stop-history text for an operator interrupt given without --reason. */
+function defaultOperatorInterruptReason(ctx) {
+    const sessionId = sessionIdFromEnv(ctx.env);
+    const laneId = ctx.env.HQ_LANE_ID?.trim();
+    const caller = laneId ? ` by lane ${laneId}` : sessionId ? ` by session ${sessionId}` : "";
+    return `hq lanes interrupt${caller} (no reason given)`;
+}
 async function runInterrupt(ctx, laneId, reason, options = {}) {
     const operatorReason = reason?.trim();
     if (reason !== undefined && !operatorReason) {
@@ -8894,6 +8929,11 @@ async function runInterrupt(ctx, laneId, reason, options = {}) {
     }
     if (operatorReason !== undefined)
         assertNoSecretText("interrupt reason", operatorReason);
+    const terminalReason = options.terminalReason ?? "operator_interrupt";
+    // Every interrupt leaves a stop-history entry, so an operator interrupt
+    // given without --reason is still distinguishable from a system one.
+    const historyReason = operatorReason ??
+        (terminalReason === "operator_interrupt" ? defaultOperatorInterruptReason(ctx) : terminalReason);
     const hqRoot = ctx.hqRoot();
     const lane = readLane(hqRoot, laneId);
     if (lane.host.kind === "outpost" && !laneRunsHereForOperatorMutation(ctx, lane)) {
@@ -8918,7 +8958,7 @@ async function runInterrupt(ctx, laneId, reason, options = {}) {
         if (!reason)
             reason = "story-scoped loop phase interrupt";
         const remaining = scoped;
-        await runInterrupt(ctx, laneId, reason, { preserveLoopQueue: true, quiet: true });
+        await runInterrupt(ctx, laneId, reason, { preserveLoopQueue: true, quiet: true, terminalReason: options.terminalReason });
         if (!options.quiet)
             printJson({ ok: true, action: "interrupt", lane_id: lane.lane_id, terminal: false, resumable: true, ...remaining });
         return;
@@ -8953,13 +8993,11 @@ async function runInterrupt(ctx, laneId, reason, options = {}) {
                 queued_reason: undefined,
                 queued_details: undefined,
                 interrupted_at: at,
-                terminal_reason: "operator_interrupt",
-                ...(operatorReason === undefined ? {} : {
-                    stop_history: [
-                        ...(current.stop_history ?? []),
-                        { at, reason: operatorReason },
-                    ],
-                }),
+                terminal_reason: terminalReason,
+                stop_history: [
+                    ...(current.stop_history ?? []),
+                    { at, reason: historyReason },
+                ],
             };
         });
         stopLaneProcesses(hqRoot, laneId, {
@@ -9315,31 +9353,7 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
             runCompaction: ctx.runCompaction,
             locateTranscript: ctx.locateTranscript,
         },
-        spawn: (root, candidate) => {
-            if (candidate.loop_mode !== true || candidate.state !== "queued") {
-                return spawnLaneWorker(root, candidate, {
-                    env: ctx.env,
-                    modelDeps: { readFileSync: ctx.readFileSync, probe: ctx.probeProvider, env: ctx.env },
-                    existsSync: ctx.existsSync,
-                    spawnProcess: ctx.spawnProcess,
-                    proveDetached: ctx.proveDetached,
-                    killProcess: ctx.killProcess,
-                    now: ctx.now,
-                    resolveMachineIdentity: ctx.resolveMachineIdentity,
-                    runCompaction: ctx.runCompaction,
-                    locateTranscript: ctx.locateTranscript,
-                });
-            }
-            const admitted = casUpdateLane(root, candidate.lane_id, (current) => ({
-                ...current,
-                state: "running",
-                queued_reason: undefined,
-                queued_details: undefined,
-                admission_reserved_at: undefined,
-            }));
-            startLaneLoopController(ctx, candidate.lane_id, true);
-            return admitted;
-        },
+        spawn: (root, candidate) => startAdmittedLane(ctx, root, candidate),
         throttleDeps: ctx.throttleDeps,
         livenessDeps: livenessDepsFromCtx(ctx),
         presenceConnected: ctx.presenceConnected,
@@ -9701,7 +9715,7 @@ export function registerLanesCommand(parent, deps = {}) {
                 return deps.restartLoopController(handlerCtx, laneId);
             const current = readLane(handlerCtx.hqRoot(), laneId);
             if (current.state === "running") {
-                await runInterrupt(handlerCtx, laneId, "loop stall question answered; restarting controller", { preserveLoopQueue: true, quiet: true });
+                await runInterrupt(handlerCtx, laneId, "loop stall question answered; restarting controller", { preserveLoopQueue: true, quiet: true, terminalReason: LOOP_STALL_RESTART_REASON });
             }
             const runDirPath = runDir(handlerCtx.hqRoot(), laneId);
             if (loopControllerIsAlive(runDirPath)) {
@@ -9991,7 +10005,7 @@ export function registerLanesCommand(parent, deps = {}) {
         const controllerAlive = loopControllerIsAlive(runDirPath);
         const result = enqueueLoopEnvelope({ runDir: runDirPath, laneId: lane.lane_id, envelope, now: ctx.now });
         if (!controllerAlive && lane.state === "running") {
-            await runInterrupt(ctx, lane.lane_id, "loop controller exited; recovering the queued phase", { preserveLoopQueue: true, quiet: true });
+            await runInterrupt(ctx, lane.lane_id, "loop controller exited; recovering the queued phase", { preserveLoopQueue: true, quiet: true, terminalReason: LOOP_CONTROLLER_RECOVERY_REASON });
         }
         const shouldRestart = !controllerAlive && lane.state !== "queued";
         const controllerPid = shouldRestart ? startLaneLoopController(ctx, lane.lane_id) : undefined;
@@ -10386,6 +10400,7 @@ export function registerLanesCommand(parent, deps = {}) {
     }));
     lanes
         .command("stop")
+        .alias("cancel")
         .description("Cancel a queued lane or kill a running one (terminal; use interrupt to keep it resumable)")
         .argument("<lane-id>", "Lane id")
         .option("--reason <text>", "Record the reason in the lane's terminal history")

package/dist/commands/meetings.d.ts

@@ -1,3 +1,5 @@
 import { Command } from "commander";
+/** Upper bound on list pages one short-id lookup reads (per cursor chain). */
+export declare const SHORT_ID_MAX_PAGES = 50;
 export declare function registerMeetingsCommand(program: Command): void;
 //# sourceMappingURL=meetings.d.ts.map