@indigoai-us/hq-cli 5.345.146 → 5.345.148

package/dist/lib/flag-registry.js

@@ -12,6 +12,7 @@ import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.gener
 import { resolveFlagSnapshotCompanyUid, resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 import { registerFlagRegistryRefreshWaiter } from "./flag-registry-refresh-wait.js";
 import { flagSnapshotWriteFailureTags, readDefaultOnFlagSnapshot, readFlagSnapshotFile, writePersonFlagSnapshotFile, writeFlagSnapshotFile, } from "./flag-snapshot-file.js";
+import { freshAnywhereRuntimeFlags } from "./anywhere-runtime-flag-key.js";
 function captureFlagRegistryException(error, tags, sentry) {
     if (!sentry)
         return;
@@ -42,6 +43,7 @@ function normalizedCompanyUid(value) {
     return COMPANY_UID_RE.test(candidate) ? candidate : undefined;
 }
 let heldSnapshot = null;
+let heldSnapshotFetchedAt = 0;
 let processReader = null;
 let refreshCompletion = Promise.resolve();
 let completeRefresh = null;
@@ -113,7 +115,10 @@ function localOverrideOrFallback(flagKey, legacyFallback, env = process.env) {
     return processLocalOverride(flagKey, env) ?? legacyFallback();
 }
 /** Create the same snapshot-backed reader used by process gates. */
-export function createProcessSnapshotReader(companyIdentifiers, getSnapshot = () => heldSnapshot, env = process.env) {
+export function createProcessSnapshotReader(companyIdentifiers, getSnapshot = () => heldSnapshot && ({
+    ...heldSnapshot,
+    flags: freshAnywhereRuntimeFlags(heldSnapshot.flags, heldSnapshotFetchedAt),
+}), env = process.env) {
     return {
         isEnabled(flagKey, lookup = {}) {
             return resolveFlag({
@@ -169,6 +174,7 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
         : null;
     if (persistedSnapshot) {
         heldSnapshot = { version: 0, flags: persistedSnapshot.flags };
+        heldSnapshotFetchedAt = Date.parse(persistedSnapshot.fetched_at);
     }
     refreshCompletion = Promise.resolve();
     completeRefresh = null;
@@ -234,6 +240,7 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
         worker.on("message", (value) => {
             if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
+                heldSnapshotFetchedAt = Date.now();
                 if (completeRefresh)
                     refreshPendingSnapshot = value;
                 if (refreshCompanyUid && refreshPendingSnapshot) {
@@ -392,6 +399,7 @@ export function currentFlagSnapshot() {
 /** Test-only reset for process-global readiness state. */
 export function _resetFlagRegistryForTests() {
     heldSnapshot = null;
+    heldSnapshotFetchedAt = 0;
     processReader = null;
     refreshCompletion = Promise.resolve();
     completeRefresh = null;

package/dist/lib/flag-snapshot-file.js

@@ -2,6 +2,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { freshAnywhereRuntimeFlags, HQ_ANYWHERE_RUNTIME_FLAG, HQ_ANYWHERE_RUNTIME_FALSE_MAX_AGE_MS } from "./anywhere-runtime-flag-key.js";
 export const FLAG_SNAPSHOT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
 function markWriteFailure(error, context) {
@@ -263,7 +264,7 @@ export function readPersonFlagSnapshotFile(options = {}) {
             continue;
         if (file === fallback && fallback)
             fallbackCacheUsed = true;
-        return { scope: "person", fetched_at: value.fetched_at, flags: flags };
+        return { scope: "person", fetched_at: value.fetched_at, flags: freshAnywhereRuntimeFlags(flags, fetchedAt, options.now) };
     }
     return null;
 }
@@ -348,7 +349,7 @@ function parseSnapshotFile(companyUid, file, options) {
     return {
         company_uid: companyUid,
         fetched_at: value.fetched_at,
-        flags: flags,
+        flags: freshAnywhereRuntimeFlags(flags, fetchedAt, options.now),
     };
 }
 /** Return null for every miss, malformed file, company mismatch, or stale file. */
@@ -374,7 +375,11 @@ export function readFlagSnapshotFile(companyUid, options = {}) {
 }
 /** Resolve a default-on kill switch from offline snapshots, allowing stale decisions. */
 export function readDefaultOnFlagSnapshot(flagKey, companyUid, env = process.env) {
-    const options = { env, maxAgeMs: Number.POSITIVE_INFINITY };
+    // Native-route kill switches intentionally retain stale decisions. Only
+    // Anywhere has the GA one-hour disable limit; do not change other gates.
+    const options = { env, maxAgeMs: flagKey === HQ_ANYWHERE_RUNTIME_FLAG
+            ? HQ_ANYWHERE_RUNTIME_FALSE_MAX_AGE_MS
+            : Number.POSITIVE_INFINITY };
     if (companyUid)
         return readFlagSnapshotFile(companyUid, options)?.flags[flagKey] !== false;
     const directories = new Set([path.dirname(personFlagSnapshotPath(env))]);

package/dist/lib/hook-engine/resolve.d.ts

@@ -0,0 +1,31 @@
+export declare const HOOK_ENGINE_REPAIR = "npm install -g @indigoai-us/hq-cli --include=optional";
+export declare const HOOK_ENGINE_REPAIR_PIN = "hq core hook-engine-path --repair";
+export interface EngineOptions {
+    home?: string;
+    platform?: string;
+    arch?: string;
+    version?: string;
+    resolvePackage?: (name: string) => string;
+    repair?: boolean;
+}
+export interface EnginePackage {
+    source: string;
+    pinned: string;
+    version: string;
+    sourceDirectory: string;
+    pinnedDirectory: string;
+}
+/** US-020 must set this package capability when the replaced bash hooks retire. */
+export declare function hookEngineRequired(): boolean;
+/** Check the whole signed bundle, including its resource seal and stapled ticket. */
+export declare function pinnedHookEngineMatches(engine: EnginePackage): boolean;
+/** Offline lookup. Never silently use an engine from a different CLI version. */
+export declare function findHookEngine(options?: EngineOptions): EnginePackage | null;
+/** Never truncate or replace a running Windows executable. */
+export declare function installHookEngine(options?: EngineOptions): string | null;
+/** Call only after settings no longer reference these old versions. Windows
+ * refuses unlink of a mapped executable; a busy version stays for a later pass.
+ * POSIX permits unlink while running, so retain those versions conservatively.
+ */
+export declare function pruneHookEngines(current: string, referencedVersions: readonly string[], options?: EngineOptions): string[];
+//# sourceMappingURL=resolve.d.ts.map

package/dist/lib/hook-engine/resolve.js

@@ -0,0 +1,134 @@
+import { createRequire } from 'node:module';
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, rmdirSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+const require = createRequire(import.meta.url);
+// Capture metadata while the package-use lease protects this install tree.
+// Resident commands may call doctor after an update removes the old manifest.
+const cliManifest = JSON.parse(readFileSync(new URL('../../../package.json', import.meta.url), 'utf8'));
+export const HOOK_ENGINE_REPAIR = 'npm install -g @indigoai-us/hq-cli --include=optional';
+export const HOOK_ENGINE_REPAIR_PIN = 'hq core hook-engine-path --repair';
+const platforms = new Set(['win32-x64', 'win32-arm64', 'darwin-x64', 'darwin-arm64', 'linux-x64', 'linux-arm64']);
+/** US-020 must set this package capability when the replaced bash hooks retire. */
+export function hookEngineRequired() {
+    return cliManifest.hqHookEngineRequired === true;
+}
+/** Check the whole signed bundle, including its resource seal and stapled ticket. */
+export function pinnedHookEngineMatches(engine) {
+    function equal(source, pinned) {
+        if (!existsSync(pinned))
+            return false;
+        const a = lstatSync(source);
+        const b = lstatSync(pinned);
+        if (a.isSymbolicLink())
+            return b.isSymbolicLink() && readlinkSync(source) === readlinkSync(pinned);
+        if (a.isDirectory()) {
+            if (!b.isDirectory())
+                return false;
+            const names = readdirSync(source).sort();
+            if (JSON.stringify(names) !== JSON.stringify(readdirSync(pinned).sort()))
+                return false;
+            return names.every(name => equal(join(source, name), join(pinned, name)));
+        }
+        return a.isFile() && b.isFile() && readFileSync(source).equals(readFileSync(pinned));
+    }
+    return equal(engine.sourceDirectory, engine.pinnedDirectory);
+}
+/** Offline lookup. Never silently use an engine from a different CLI version. */
+export function findHookEngine(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const key = `${platform}-${options.arch ?? process.arch}`;
+    if (!platforms.has(key))
+        return null;
+    const version = options.version ?? cliManifest.version;
+    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version))
+        throw new Error('Invalid hook engine version');
+    let manifest;
+    try {
+        manifest = (options.resolvePackage ?? require.resolve)(`@indigoai-us/hq-hook-${key}/package.json`);
+    }
+    catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND')
+            return null;
+        throw error;
+    }
+    const pkg = JSON.parse(readFileSync(manifest, 'utf8'));
+    if (pkg.version !== version)
+        return null;
+    const binary = platform === 'win32' ? 'hq-hook.exe' : platform === 'darwin' ? join('hq-hook.app', 'Contents', 'MacOS', 'hq-hook') : 'hq-hook';
+    const sourceDirectory = join(dirname(manifest), 'bin');
+    const pinnedDirectory = join(options.home ?? homedir(), '.hq', 'bin', 'hq-hook', version);
+    const source = join(sourceDirectory, binary);
+    if (!existsSync(source))
+        return null;
+    return { source, version, sourceDirectory, pinnedDirectory, pinned: join(pinnedDirectory, binary) };
+}
+/** Never truncate or replace a running Windows executable. */
+export function installHookEngine(options = {}) {
+    const engine = findHookEngine(options);
+    if (!engine)
+        return null;
+    if (options.repair && existsSync(engine.pinnedDirectory)) {
+        // Unlink the executable first: Windows refuses this if any process maps it.
+        // Never recursively remove the bundle before that lock check has succeeded.
+        try {
+            unlinkSync(engine.pinned);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw new Error('Close running HQ hook processes before repairing the pinned engine', { cause: error });
+        }
+        rmSync(engine.pinnedDirectory, { recursive: true });
+    }
+    mkdirSync(dirname(engine.pinnedDirectory), { recursive: true });
+    if (!existsSync(engine.pinnedDirectory)) {
+        const stage = mkdtempSync(join(dirname(engine.pinnedDirectory), '.install-'));
+        try {
+            cpSync(engine.sourceDirectory, stage, { recursive: true, errorOnExist: true, force: false });
+            try {
+                renameSync(stage, engine.pinnedDirectory);
+            }
+            catch (error) {
+                if (!existsSync(engine.pinned))
+                    throw error;
+            }
+        }
+        finally {
+            rmSync(stage, { recursive: true, force: true });
+        }
+    }
+    if (!pinnedHookEngineMatches(engine)) {
+        throw new Error(`Hook engine ${engine.version} differs from its pinned copy; close HQ sessions and repair with: ${HOOK_ENGINE_REPAIR_PIN}`);
+    }
+    return engine.pinned;
+}
+/** Call only after settings no longer reference these old versions. Windows
+ * refuses unlink of a mapped executable; a busy version stays for a later pass.
+ * POSIX permits unlink while running, so retain those versions conservatively.
+ */
+export function pruneHookEngines(current, referencedVersions, options = {}) {
+    if ((options.platform ?? process.platform) !== 'win32')
+        return [];
+    const root = join(options.home ?? homedir(), '.hq', 'bin', 'hq-hook');
+    if (!existsSync(root))
+        return [];
+    const removed = [];
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name === current || referencedVersions.includes(entry.name) || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(entry.name))
+            continue;
+        const dir = join(root, entry.name);
+        if (readdirSync(dir).some(name => name !== 'hq-hook.exe'))
+            continue;
+        try {
+            unlinkSync(join(dir, 'hq-hook.exe'));
+            rmdirSync(dir);
+            removed.push(entry.name);
+        }
+        catch (error) {
+            if (!['EPERM', 'EACCES', 'EBUSY', 'ENOENT', 'ENOTEMPTY'].includes(error.code ?? ''))
+                throw error;
+        }
+    }
+    return removed;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/lib/lanes/admission-host.d.ts

@@ -13,6 +13,7 @@ export type OutpostIdentity = {
 export declare function readOutpostIdentity(existsSync?: (p: string) => boolean, readFileSync?: (p: string) => string): OutpostIdentity;
 export declare function resolveAdmissionHost(deps?: {
     hostname?: () => string;
+    homedir?: () => string;
     readOutpostIdentity?: () => OutpostIdentity;
     existsSync?: (p: string) => boolean;
     readFileSync?: (p: string) => string;

package/dist/lib/lanes/admission-host.js

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
+import { observeLocalHostIdentity } from "./local-host-identity.js";
 export const OUTPOST_ID_PATH = "/etc/outpost/outpost-id";
 export const OUTPOST_DIR = "/etc/outpost";
 export function readOutpostIdentity(existsSync = (p) => fs.existsSync(p), readFileSync = (p) => fs.readFileSync(p, "utf8")) {
@@ -25,9 +26,15 @@ export function readOutpostIdentity(existsSync = (p) => fs.existsSync(p), readFi
 }
 export function resolveAdmissionHost(deps = {}) {
     const identity = deps.readOutpostIdentity?.() ?? readOutpostIdentity(deps.existsSync, deps.readFileSync);
+    const hostname = (deps.hostname ?? os.hostname)();
+    const observed = observeLocalHostIdentity({
+        homedir: deps.homedir?.() ?? os.homedir(),
+        hostname,
+    });
     return {
-        hostname: (deps.hostname ?? os.hostname)(),
+        hostname,
         outpostId: identity.kind === "id" ? identity.id : null,
+        ...(observed ? { machineId: observed.id, aliases: observed.aliases } : {}),
     };
 }
 /** `primary` names the controller registry unless the caller is a different Outpost. */

package/dist/lib/lanes/admission.d.ts

@@ -3,6 +3,10 @@ import { type LaneRecord, type LanesConfig } from "./types.js";
 export interface AdmissionHost {
     hostname: string;
     outpostId: string | null;
+    /** Stable id from ~/.hq/lane-host.json, when this process has read one. */
+    machineId?: string;
+    /** Hostnames this machine has already used. */
+    aliases?: readonly string[];
 }
 export type AdmissionCapReason = "provider_cap" | "account_cap" | "profile_cap";
 export declare const ADMISSION_LOCK_STALE_MS = 30000;

package/dist/lib/lanes/admission.js

@@ -2,8 +2,9 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { accountMaxRunning } from "./config.js";
 import { LanesError } from "./errors.js";
+import { localHostIdsReferToSameMachine } from "./local-host-identity.js";
 import { quotaBlockFor } from "./quota.js";
-import { isTerminalLaneState } from "./types.js";
+import { isSubagentLane, isTerminalLaneState } from "./types.js";
 export const ADMISSION_LOCK_STALE_MS = 30_000;
 const ADMISSION_LOCK_TIMEOUT_MS = 5_000;
 const ADMISSION_RESERVATION_GRACE_MS = 30_000;
@@ -117,7 +118,7 @@ export function laneRunsOnHost(lane, host) {
     if (host.outpostId && lane.host.kind === "outpost") {
         return lane.host.id === host.outpostId;
     }
-    return lane.host.kind === "local" && lane.host.id === host.hostname;
+    return lane.host.kind === "local" && localHostIdsReferToSameMachine(lane.host.id, host);
 }
 export function compareLaneQueueOrder(a, b) {
     if (b.priority !== a.priority)
@@ -188,6 +189,9 @@ export function laneOccupiesRunningSlot(lane, nowMs = Date.now()) {
     // count as a second owner of the slot that blocked it.
     if (lane.state === "queued" && lane.queued_reason === "account_cap")
         return false;
+    // A subagent lane runs inside its senior session, not in an HQ provider slot.
+    if (isSubagentLane(lane))
+        return false;
     return lane.state === "running" ||
         hasActiveAdmissionReservation(lane, nowMs) ||
         hasActivePendingResume(lane, nowMs);

package/dist/lib/lanes/envelope-repair-dispatch.d.ts

@@ -17,6 +17,11 @@ export interface EnvelopeRepairDispatchDeps {
     env?: NodeJS.ProcessEnv;
     spawnSync?: (command: string, args: string[], options: EnvelopeRepairDispatchOptions) => EnvelopeRepairDispatchResult;
 }
+/**
+ * True for the detached lane runner scripts. They are not the hq CLI: running
+ * one with `lanes ...` argv starts that runner for a lane named "lanes".
+ */
+export declare function isLaneRunnerEntry(entry: string): boolean;
 /**
  * Dispatch repair into the currently installed CLI. A watcher can stay alive
  * across upgrades, so repair must not call its in-memory spawn implementation.

package/dist/lib/lanes/envelope-repair-dispatch.js

@@ -1,6 +1,14 @@
 import { spawnSync as nodeSpawnSync } from "node:child_process";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
+const LANE_RUNNER_ENTRY_NAMES = new Set(["watcher-main", "worker-process", "remote-control-lane"]);
+/**
+ * True for the detached lane runner scripts. They are not the hq CLI: running
+ * one with `lanes ...` argv starts that runner for a lane named "lanes".
+ */
+export function isLaneRunnerEntry(entry) {
+    return LANE_RUNNER_ENTRY_NAMES.has(path.basename(entry).replace(/\.[cm]?[jt]s$/, ""));
+}
 /**
  * Dispatch repair into the currently installed CLI. A watcher can stay alive
  * across upgrades, so repair must not call its in-memory spawn implementation.
@@ -28,7 +36,10 @@ export function spawnEnvelopeRepairViaCurrentCli(hqRoot, lane, input, deps = {})
     });
     const env = deps.env ?? process.env;
     const cliEntry = env.HQ_LANE_CLI_ENTRY?.trim();
-    if (!cliEntry || !path.isAbsolute(cliEntry) || path.resolve(cliEntry) !== cliEntry) {
+    if (!cliEntry ||
+        !path.isAbsolute(cliEntry) ||
+        path.resolve(cliEntry) !== cliEntry ||
+        isLaneRunnerEntry(cliEntry)) {
         throw new LanesError("repair_cli_entry_invalid", "Lane watcher has no valid absolute hq CLI entrypoint for envelope repair", { lane_id: lane.lane_id });
     }
     const result = run(process.execPath, [cliEntry, "lanes", "_spawn-envelope-repair"], {

package/dist/lib/lanes/index.d.ts

@@ -36,8 +36,8 @@ export { ENVELOPE_INVALID_REASON, decideEnvelopeRepair, emitMeshSoft, envelopeQu
 export type { EnvelopeRepairDecision, LatestEnvelopeFile } from "./watcher.js";
 export { LANE_MESH_EVENTS, WIRE_EVENT_KINDS, createLaneMesh, emitLaneDecisionEvents, emitLaneProgressEvent, laneCanEmit, parseLaneMeshEvent, progressEventDue, toWireThreadEvent, } from "./mesh-events.js";
 export type { CreateLaneMeshOptions, LaneMesh, LaneMeshEvent, WireEventKind, WireThreadEvent, } from "./mesh-events.js";
-export { CPU_SAMPLE_MS, LANES_CPU_BUSY_OVERRIDE, LANES_CPU_CHECK, PROC_MEMINFO, STARVATION_MAX_DEFERRALS, STARVATION_MAX_MS, VM_STAT_BIN, applyThrottleDecision, busyFractionFromDeltas, cpuTimesSnapshot, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, parseMemAvailableKb, parseVmStatAvailableMb, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyFraction, starvationBoundReached, throttleStatePath, writeThrottleState, } from "./throttle.js";
-export type { CpuTimes, ThrottleAdmitReason, ThrottleDecision, ThrottleDeferReason, ThrottleDeps, ThrottleState, } from "./throttle.js";
+export { CPU_SAMPLE_MS, LANES_CPU_BUSY_OVERRIDE, LANES_CPU_CHECK, PROC_MEMINFO, STARVATION_MAX_DEFERRALS, STARVATION_MAX_MS, MEMORY_PRESSURE_SYSCTLS, SYSCTL_BIN, VM_STAT_BIN, applyThrottleDecision, busyFractionFromDeltas, cpuTimesSnapshot, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, formatMemoryHoldMessage, isCpuCheckEnabled, parseMemAvailableKb, parseMemoryPressureSysctl, parseVmStatAvailableMb, readAvailableMemMb, readMemorySignal, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyFraction, starvationBoundReached, throttleStatePath, writeThrottleState, } from "./throttle.js";
+export type { CpuTimes, MemoryHold, MemoryPressureLevel, MemorySignal, MemorySignalSource, ThrottleAdmitReason, ThrottleDecision, ThrottleDeferReason, ThrottleDeps, ThrottleState, } from "./throttle.js";
 export { effectiveAccountHome, } from "./account-home.js";
 export type { EffectiveAccountHome, } from "./account-home.js";
 export { AUTH_JSON_NAME, CLAUDE_CREDENTIALS_NAME, PROVIDER_CREDENTIAL_FILES, PROVIDER_HOME_ENV, accountEnv, accountStatus, authJsonPath, authStateFor, claudeIdentityDiffers, claudeIdentityFromProbe, clearQuotaCommand, credentialPaths, describeClaudeIdentity, hasCredentialFile, isCredentialProven, isDefaultProviderHome, isLoggedOut, probeInteractiveClaudeIdentity, withProviderHomeEnv, isOccupyingLaneState, lastStartedAt, listAccountStatuses, occupyingLaneCount, resolveAccount, runningLaneCount, selectBalancedAccount, } from "./accounts.js";

package/dist/lib/lanes/index.js

@@ -20,7 +20,7 @@ export { PID_LIVENESS_DECISIONS, PROVIDER_COMMAND, PROVIDER_MODEL_FLAG, SPAWN_TE
 export { SILENCE_MS, WATCHER_DECISION_EVENTS, WATCHER_OUT_MAX_BYTES, WATCHER_POLL_MS, WATCHER_SIGNAL_KINDS, appendCappedLog, appendWatcherSignal, applyTerminalToLane, classifyLaneExit, clearLaneStalled, isPidAlive, laneIdentityFromRecord, markLaneStalled, notifySlotFreed, parseWatcherSignalKind, readLatestEnvelope, runWatcherLoop, stalledReason, tickWatcher, watcherEventsPath, watcherLastSignalPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
 export { ENVELOPE_INVALID_REASON, decideEnvelopeRepair, emitMeshSoft, envelopeQuestionIds, readLatestEnvelopeFile, readLatestEnvelopeRecord, } from "./watcher.js";
 export { LANE_MESH_EVENTS, WIRE_EVENT_KINDS, createLaneMesh, emitLaneDecisionEvents, emitLaneProgressEvent, laneCanEmit, parseLaneMeshEvent, progressEventDue, toWireThreadEvent, } from "./mesh-events.js";
-export { CPU_SAMPLE_MS, LANES_CPU_BUSY_OVERRIDE, LANES_CPU_CHECK, PROC_MEMINFO, STARVATION_MAX_DEFERRALS, STARVATION_MAX_MS, VM_STAT_BIN, applyThrottleDecision, busyFractionFromDeltas, cpuTimesSnapshot, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, parseMemAvailableKb, parseVmStatAvailableMb, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyFraction, starvationBoundReached, throttleStatePath, writeThrottleState, } from "./throttle.js";
+export { CPU_SAMPLE_MS, LANES_CPU_BUSY_OVERRIDE, LANES_CPU_CHECK, PROC_MEMINFO, STARVATION_MAX_DEFERRALS, STARVATION_MAX_MS, MEMORY_PRESSURE_SYSCTLS, SYSCTL_BIN, VM_STAT_BIN, applyThrottleDecision, busyFractionFromDeltas, cpuTimesSnapshot, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, formatMemoryHoldMessage, isCpuCheckEnabled, parseMemAvailableKb, parseMemoryPressureSysctl, parseVmStatAvailableMb, readAvailableMemMb, readMemorySignal, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyFraction, starvationBoundReached, throttleStatePath, writeThrottleState, } from "./throttle.js";
 export { effectiveAccountHome, } from "./account-home.js";
 export { AUTH_JSON_NAME, CLAUDE_CREDENTIALS_NAME, PROVIDER_CREDENTIAL_FILES, PROVIDER_HOME_ENV, accountEnv, accountStatus, authJsonPath, authStateFor, claudeIdentityDiffers, claudeIdentityFromProbe, clearQuotaCommand, credentialPaths, describeClaudeIdentity, hasCredentialFile, isCredentialProven, isDefaultProviderHome, isLoggedOut, probeInteractiveClaudeIdentity, withProviderHomeEnv, isOccupyingLaneState, lastStartedAt, listAccountStatuses, occupyingLaneCount, resolveAccount, runningLaneCount, selectBalancedAccount, } from "./accounts.js";
 export { LIVE_WITHIN_MS, LIVENESS_EVENT_KINDS, SILENT_LOST_MS, TURN_START_LOST_MS, buildLivenessIndexFromSpool, classifySessionLiveness, defaultLivenessDeps, defaultSpoolPath, ingestSpoolLine, listSessionLiveness, livenessIndexPath, loadLivenessIndex, readDaemonPresenceConnected, readLivenessIndex, rebuildLivenessIndex, sessionLiveness, } from "./liveness.js";

package/dist/lib/lanes/keep-alive.js

@@ -3,7 +3,7 @@ import * as path from "node:path";
 import { LanesError } from "./errors.js";
 import { dropboxInboxHasMessages } from "./dropbox.js";
 import { appendCappedHistory, listQuestionIds, readQuestion, retryUpdateLane } from "./store.js";
-import { isTerminalLaneState, isIsoDateTime, } from "./types.js";
+import { isSubagentLane, isTerminalLaneState, isIsoDateTime, } from "./types.js";
 export const LEAD_LANE_KEEP_ALIVE_FLAG = "lanes.lead-keep-alive";
 export const LEAD_LANE_KEEP_ALIVE_DEFAULT_ENABLED = false;
 export const LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS = 24 * 60 * 60 * 1000;
@@ -24,6 +24,9 @@ export const LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS = 5 * 60 * 1000;
 const LEAD_LANE_KEEP_ALIVE_MAX_BACKOFF_MS = 60 * 60 * 1000;
 /** Shared resume transition for terminal gate follow-ups. */
 export function queueLaneTerminalResume(current, at, resumeText, options = {}) {
+    // HQ holds no provider session for a subagent lane, so it can never resume one.
+    if (isSubagentLane(current))
+        return { lane: current, resumeQueued: false, resumeSkippedReason: "no_provider_session" };
     if (options.mergeExisting && current.pending_resume !== undefined) {
         return {
             lane: {

package/dist/lib/lanes/local-host-identity.d.ts

@@ -0,0 +1,40 @@
+export declare const LANE_HOST_SCHEMA = "hq-lane-host.v1";
+export declare const LANE_HOST_FILENAME = "lane-host.json";
+export interface LocalHostIdentity {
+    schema_version: typeof LANE_HOST_SCHEMA;
+    id: string;
+    aliases: string[];
+    /** Hardware UUID, `/etc/machine-id`, or Windows MachineGuid. Absent on older files. */
+    hardware_id?: string;
+}
+export interface LocalHostMatch {
+    hostname: string;
+    machineId?: string;
+    aliases?: readonly string[];
+}
+export declare function laneHostIdentityPath(homedir: string): string;
+/** True when `recordedId` is this machine's stable id, current hostname, or a known earlier hostname. */
+export declare function localHostIdsReferToSameMachine(recordedId: string, host: LocalHostMatch): boolean;
+/**
+ * Read the stable id, creating it once. A lost race re-reads the winner
+ * instead of minting a second id that would strand the lanes just created.
+ * A stored hardware id that does not match this machine mints a new id so a
+ * cloned home directory does not keep the source machine's id.
+ */
+export declare function resolveLocalHostIdentity(input: {
+    homedir: string;
+    hostname: string;
+    createId?: () => string;
+    readHardwareId?: () => string | null;
+}): LocalHostIdentity;
+/**
+ * Read an existing identity. Does not create the file, record a hostname,
+ * or replace an id. A hardware mismatch returns null so a cloned id is not
+ * treated as this machine.
+ */
+export declare function observeLocalHostIdentity(input: {
+    homedir: string;
+    hostname: string;
+    readHardwareId?: () => string | null;
+}): LocalHostIdentity | null;
+//# sourceMappingURL=local-host-identity.d.ts.map