@indigoai-us/hq-cli 5.345.160 → 5.345.162

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 ## [Unreleased]
 
+## [5.345.162] — 2026-10-23
+- `hq agent inbox` no longer reports malformed server responses as a verified empty inbox. Invalid JSON or a missing/non-array `messages` field keeps `source: "local-mirror"` and a privacy-safe warning. Mixed responses retain usable messages with `source: "server-partial"` and an incomplete-result warning; only `source: "server"` certifies completeness. Human output also says when an empty result is unverified. Reads still never send replies or acknowledgments.
+- The bundled sync engine now uses hq-cloud 6.18.100, the current npm `latest`.
+  After an account switch, HQ Sync no longer pushes files left behind by the
+  previous person (hq-cloud #1040).
+- Park a loop when its phase handoff remains malformed after repair, preserving
+  worker evidence and later queued work. The existing question flow can accept a
+  validated repaired handoff without rerunning the phase, explicitly retry with
+  an external-effects warning, or leave the phase held. Durable holds survive
+  controller restart, and explicit interruption and stop remain available.
+- New `hq sync held` and `hq sync release-held`. After someone else signs in on the same computer, HQ sync holds every upload and cloud delete for the personal vault and each company until the signed-in person releases them. `hq sync held` lists what is held, with a count and sample paths. `hq sync release-held` shows the signed-in person's held scopes, asks "Are these files yours to upload?" and releases them (`--company <slug>`, `--personal`, `--yes`, `--json`). It identifies the person from the current session token, so a session without an email works, and it releases nothing if the signed-in account changes during the command. Both commands need an HQ sync engine with this hold; on an older one they say to update HQ. Feedback 3bf773c5-320e-433d-b84b-0bab13147ff5.
+
+## [5.345.161] — 2026-10-23
+- The bundled sync engine now uses hq-cloud 6.18.99, the current npm `latest`.
+  HQ Sync follows the server's telemetry decision for free-plan accounts,
+  failed company and personal sync legs report a short error summary with no
+  file names or paths, and the shell-script line-ending fix never rewrites a
+  file whose signature marks it as binary (hq-cloud #1039, #1043, #1044).
+- Fence session-journal counter owners with atomically published PID and owner-token records. Reclaim dead or aged PID-less publisher claims and aged orphan temp directories; holders that lose ownership retry before their callback or counter write.
+- `hq files cat` / `get` and the agent file tools now name the storage host when a signed vault download cannot connect (connection refused or reset, DNS failure, timeout, or a TLS failure from an HTTPS-inspecting proxy) and tell the operator to allow outbound HTTPS (TCP 443) to that host. Before this, the raw `fetch failed` error surfaced with no host.
+- New `hq feedback assign <id> --to <email|prs_uid>` reassigns a feedback ticket with your own login, including a ticket another person claimed. Agent and operator tokens still get `TICKET_CLAIMED_BY_HUMAN` for those tickets, and the command says to rerun it from your own login.
+- `hq integrations share`, `unshare`, `grant` and `ungrant` help now says the principal can be a vault group (`grp_…`), which the commands already accepted. Group membership is resolved when a tool is called, and `hq integrations access` shows the group's name once the server returns it.
+- Bot turns on the Claude runtime now bound each Bash tool call to 10 minutes (`BASH_DEFAULT_TIMEOUT_MS` / `BASH_MAX_TIMEOUT_MS`, kept when already set), and the runtime process is started with stdin closed, so a bot-authored command that waits on stdin (`cat > /dev/null`) can no longer hold a turn "working" indefinitely.
+- A bot no longer posts a short assistant aside (under 40 characters, no `hq-block`) that a tool call follows in the same assistant message ("Bind first, separately."); it is logged at debug level instead. Full-sentence progress notes still post.
+- `hq integrations reconnect` now accepts `--scopes <list>` like `connect` (space- or comma-separated). Use it when a provider such as Meta refuses a sign-in request that names no scopes.
+- Keep explicitly delivered conductor instructions replayable until the receiving
+  session acknowledges their stable receipt. Timing out or discarding hook output
+  no longer counts as instruction acceptance when the paired hook is installed.
+
+- Malformed rows now retain a private audit without preventing valid later
+  instructions from being accepted. Active Stop retries do not block repeatedly.
+- Keep temporary macOS Keychain read failures retryable instead of recording them as denied access, explain saved-sign-in fallback, and give explicit retries time to answer the prompt.
+- `hq lanes session-start` (the SessionStart auto-conduct hook) no longer reads the lanes registry flags over the network on every new session. It reads them from the local flag cache and person flag snapshot, fails open when none is known, and refreshes old or missing values in the background. It also skips loading the full command graph. On a warm cache it now returns in about 0.3 s instead of about 3 s, so the hook stays under its 2 s cap and the auto-conduct context is no longer dropped. Feedback 4db60cce.
+- `hq meetings list`, `get`, `transcript`, `search` and the other read subcommands now default to the bound company when the caller explicitly names its HQ session in the environment and omits `--company`. Before this they sent no company at all, so a bound session saw only the caller's personal recordings and missed the company's. Plain terminals and cron calls keep the server default; they never borrow the shared last-session pointer. `--company` still overrides, and `set-company` still requires an explicit target. Feedback 04771691-fcbc-4847-899a-6c966c561b52.
+- On Windows, remove npm's `hq.ps1` and `hq-auth-refresh.ps1` launchers after install, update and `hq install --global`, so PowerShell runs `hq.cmd` instead of failing with UnauthorizedAccess under the default Restricted execution policy. `hq doctor` reports a blocked launcher that is still present and `hq doctor --fix` removes it. The execution policy is only read, never changed.
+
 ## [5.345.160] — 2026-10-22
 - The bundled sync engine now uses hq-cloud 6.18.98. When HQ pauses an account because of usage, `hq sync` now shows the server's usage-pause message and a Billing link instead of a generic failure (hq-cloud #1036).
 - `hq billing usage` now shows the amounts on HQ's usage statement, which is what the invoice bills. Before this it re-priced the meters itself, so it could show a different figure than the statement, for example charging the vault fee during the trial when the statement waived it.

package/assets/scaffold/core/scripts/session-journal.sh

@@ -3,7 +3,7 @@
 # Spec: core/knowledge/public/hq-core/session-journal-spec.md
 #
 # Usage:
-#   session-journal.sh write "<title>" [--files f1,f2,...] [--body-file PATH] [--session KEY]
+#   session-journal.sh write "<title>" [--files f1,f2,...] [--body-file PATH] [--session KEY] [--company SLUG]
 #   session-journal.sh list [--date YYYY-MM-DD]
 #   session-journal.sh read <NNN> [--date YYYY-MM-DD]
 #   session-journal.sh index-path [--date YYYY-MM-DD]   # prints the INDEX.md path
@@ -18,6 +18,7 @@
 # "unscoped". A date-global counter let concurrent Claude and Codex tasks
 # trigger and reset each other's journal reminders.
 #
+# HQ_JOURNAL_COUNTER_NOW overrides epoch seconds only in the counter-lock age check, for deterministic tests.
 # All commands fail-soft: warn to stderr, exit 0 — never block the caller.
 
 set -uo pipefail
@@ -131,7 +132,8 @@ resolve_session_key() {
 counter_lock_is_aged() {
   local lockdir="$1" lock_mtime now
   lock_mtime="$(stat -c %Y "$lockdir" 2>/dev/null)" || lock_mtime="$(stat -f %m "$lockdir" 2>/dev/null)" || return 1
-  now="$(date -u +%s 2>/dev/null)" || return 1
+  now="${HQ_JOURNAL_COUNTER_NOW:-$(date -u +%s 2>/dev/null)}"
+  [ -n "$now" ] || return 1
   case "$lock_mtime:$now" in *[!0-9:]*|:*|*:) return 1 ;; esac
   [ "$now" -ge "$lock_mtime" ] && [ "$((now - lock_mtime))" -ge 60 ]
 }
@@ -158,8 +160,9 @@ counter_lock_owner_is_alive() {
 }
 
 reclaim_stale_counter_lock() {
-  local lockdir="$1" owner_pid current_owner current_windows_pid windows_pid claim stale_dir suffix=0 pidless=0
+  local lockdir="$1" owner_pid current_owner current_windows_pid windows_pid owner_token current_token claim stale_dir suffix=0 pidless=0
   owner_pid="$(cat "$lockdir/pid" 2>/dev/null || true)"
+  owner_token="$(cat "$lockdir/owner-token" 2>/dev/null || true)"
   case "$owner_pid" in
     '')
       windows_pid="$(cat "$lockdir/winpid" 2>/dev/null || true)"
@@ -189,6 +192,7 @@ reclaim_stale_counter_lock() {
 
   current_owner="$(cat "$lockdir/pid" 2>/dev/null || true)"
   current_windows_pid="$(cat "$lockdir/winpid" 2>/dev/null || true)"
+  current_token="$(cat "$lockdir/owner-token" 2>/dev/null || true)"
   if [ "$pidless" -eq 1 ]; then
     # Recheck both identity and age after winning the claim, before renaming.
     if [ -z "$current_owner" ] && [ "$current_windows_pid" = "$windows_pid" ] \
@@ -200,6 +204,7 @@ reclaim_stale_counter_lock() {
     fi
   fi
   if [ "$current_owner" = "$owner_pid" ] && [ "$current_windows_pid" = "${windows_pid:-$(cat "$lockdir/winpid" 2>/dev/null || true)}" ] \
+    && [ "$current_token" = "$owner_token" ] \
     && { [ "$pidless" -eq 1 ] || ! counter_lock_owner_is_alive "$lockdir" "$owner_pid"; }; then
     stale_dir="${lockdir}.stale.$$.$RANDOM"
     while [ -e "$stale_dir" ]; do
@@ -217,38 +222,111 @@ reclaim_stale_counter_lock() {
   return 1
 }
 
+reclaim_stale_counter_tempdirs() {
+  local lockdir="$1" candidate owner_pid windows_pid owner_token current_pid current_windows current_token stale_dir suffix=0
+  # Publishers create <lock>.tmp.XXXXXX. Older native hq-cli builds used
+  # <lock>.tmp-XXXXXX, so reclaim aged orphans with either prefix.
+  for candidate in "${lockdir}.tmp."* "${lockdir}.tmp-"*; do
+    [ -d "$candidate" ] || continue
+    counter_lock_is_aged "$candidate" || continue
+    owner_pid="$(cat "$candidate/pid" 2>/dev/null || true)"
+    windows_pid="$(cat "$candidate/winpid" 2>/dev/null || true)"
+    owner_token="$(cat "$candidate/owner-token" 2>/dev/null || true)"
+    case "$owner_pid" in
+      '')
+        if [ -n "$windows_pid" ] && counter_windows_pid_is_alive "$windows_pid"; then continue; fi
+        ;;
+      *[!0-9]*) continue ;;
+      *)
+        [ "$owner_pid" -gt 1 ] 2>/dev/null || continue
+        counter_lock_owner_is_alive "$candidate" "$owner_pid" && continue
+        ;;
+    esac
+    current_pid="$(cat "$candidate/pid" 2>/dev/null || true)"
+    current_windows="$(cat "$candidate/winpid" 2>/dev/null || true)"
+    current_token="$(cat "$candidate/owner-token" 2>/dev/null || true)"
+    [ "$current_pid" = "$owner_pid" ] && [ "$current_windows" = "$windows_pid" ] \
+      && [ "$current_token" = "$owner_token" ] && counter_lock_is_aged "$candidate" || continue
+    [ -z "$current_pid" ] || ! counter_lock_owner_is_alive "$candidate" "$current_pid" || continue
+    [ -z "$current_windows" ] || ! counter_windows_pid_is_alive "$current_windows" || continue
+    stale_dir="${candidate}.stale.$$.$RANDOM"
+    while [ -e "$stale_dir" ]; do suffix=$((suffix + 1)); stale_dir="${candidate}.stale.$$.$RANDOM.$suffix"; done
+    if mv "$candidate" "$stale_dir" 2>/dev/null; then rm -rf "$stale_dir" 2>/dev/null || true; fi
+  done
+}
+
 with_counter_lock() {
   local lockdir="$1"; shift
-  local i=0 acquired=0 rc=0 tries="${HQ_JOURNAL_COUNTER_LOCK_TRIES:-250}"
+  local i=0 acquired=0 rc=0 tries="${HQ_JOURNAL_COUNTER_LOCK_TRIES:-250}" owner_token tempdir windows_pid token_file publish_claim
   case "$tries" in ''|*[!0-9]*) tries=250 ;; esac
   while [ "$i" -lt "$tries" ]; do
-    if mkdir "$lockdir" 2>/dev/null; then
-      acquired=1
+    reclaim_stale_counter_tempdirs "$lockdir"
+    # Publish a complete owner record in one rename. Legacy clients may still
+    # leave PID-less lock directories, which the age-based reclaim handles.
+    tempdir="$(mktemp -d "${lockdir}.tmp.XXXXXX" 2>/dev/null)" || tempdir=""
+    if [ -n "$tempdir" ]; then
+      owner_token="$$.$RANDOM.$RANDOM.$(date -u +%s 2>/dev/null)"
       if [[ "${OSTYPE:-}" == msys* ]] || [[ "${OSTYPE:-}" == cygwin* ]]; then
-        local windows_pid
         windows_pid="$(cat "/proc/$$/winpid" 2>/dev/null || true)"
-        case "$windows_pid" in ''|*[!0-9]*) ;; *) printf '%s\n' "$windows_pid" > "$lockdir/winpid" || { rm -rf "$lockdir" 2>/dev/null || true; return 0; } ;; esac
+        case "$windows_pid" in ''|*[!0-9]*) windows_pid="" ;; esac
+        if [ -n "$windows_pid" ] && ! printf '%s\n' "$windows_pid" > "$tempdir/winpid"; then rm -rf "$tempdir"; tempdir=""; fi
       fi
-      if ! printf '%s\n' "$$" > "$lockdir/pid" 2>/dev/null; then
-        rm -rf "$lockdir" 2>/dev/null || true
-        return 0
+      if [ -n "$tempdir" ] && printf '%s\n' "$$" > "$tempdir/pid" \
+        && printf '%s\n' "$owner_token" > "$tempdir/owner-token"; then
+        # Serialize publishers so mv cannot interpret a concurrently-created
+        # lock directory as a destination directory and nest the temp folder.
+        publish_claim="${lockdir}.publish"
+        if mkdir "$publish_claim" 2>/dev/null; then
+          # Exclusive token creation fences a publisher resumed after a stale
+          # PID-less claim was reclaimed and reused by another process.
+          if (set -C; printf '%s\n' "$owner_token" > "$publish_claim/owner-token") 2>/dev/null \
+            && [ "$(cat "$publish_claim/owner-token" 2>/dev/null || true)" = "$owner_token" ] \
+            && (set -C; printf '%s\n' "$$" > "$publish_claim/pid") 2>/dev/null \
+            && [ "$(cat "$publish_claim/owner-token" 2>/dev/null || true)" = "$owner_token" ] \
+            && [ ! -e "$lockdir" ] && mv "$tempdir" "$lockdir" 2>/dev/null; then :; fi
+          if [ "$(cat "$publish_claim/owner-token" 2>/dev/null || true)" = "$owner_token" ]; then
+            rm -rf "$publish_claim" 2>/dev/null || true
+          fi
+        else
+          rm -rf "$tempdir" 2>/dev/null || true
+          reclaim_stale_counter_lock "$publish_claim" && continue
+        fi
+        if [ ! -e "$tempdir" ] && [ "$(cat "$lockdir/owner-token" 2>/dev/null || true)" = "$owner_token" ]; then
+          acquired=1
+          rmdir "$tempdir" 2>/dev/null || true
+          token_file="$lockdir/owner-token"
+          if [ "$(cat "$token_file" 2>/dev/null || true)" = "$owner_token" ]; then
+            "$@" "$owner_token"
+            rc=$?
+            if [ "$rc" -eq 75 ]; then
+              acquired=0
+              i=$((i + 1))
+              continue
+            fi
+            if [ "$(cat "$token_file" 2>/dev/null || true)" = "$owner_token" ]; then
+              rm -rf "$lockdir" 2>/dev/null || true
+            fi
+            return "$rc"
+          fi
+          acquired=0
+          i=$((i + 1))
+          continue
+        fi
+        if [ ! -e "$tempdir" ]; then rm -rf "$lockdir/$(basename "$tempdir")" 2>/dev/null || true; fi
       fi
-      break
+      if [ -n "$tempdir" ]; then rm -rf "$tempdir" 2>/dev/null || true; fi
     fi
     reclaim_stale_counter_lock "$lockdir" && continue
     i=$((i + 1))
     [ "$i" -ge "$tries" ] || sleep 0.02 2>/dev/null || sleep 1
   done
-  if [ "$acquired" -ne 1 ]; then
-    warn "tool-counter: lock remained busy; skipped update"
-    return 0
-  fi
+  warn "tool-counter: lock remained busy; skipped update"
+  return 0
+}
 
-  "$@" || rc=$?
-  if [ "$(cat "$lockdir/pid" 2>/dev/null || true)" = "$$" ]; then
-    rm -rf "$lockdir" 2>/dev/null || true
-  fi
-  return "$rc"
+counter_lock_token_is_current() {
+  local lockdir="$1" owner_token="$2"
+  [ -n "$owner_token" ] && [ "$(cat "$lockdir/owner-token" 2>/dev/null || true)" = "$owner_token" ]
 }
 
 counter_read_raw() {
@@ -303,8 +381,10 @@ case "$cmd" in
     files_csv=""
     body_file=""
     session_arg=""
+    company_arg="${HQ_ACTIVE_COMPANY:-}"
     while [ $# -gt 0 ]; do
       case "$1" in
+        --company)   company_arg="${2:-}"; shift 2 || break ;;
         --files)     files_csv="${2:-}"; shift 2 || break ;;
         --body-file) body_file="${2:-}"; shift 2 || break ;;
         --session)   session_arg="${2:-}"; shift 2 || break ;;
@@ -313,6 +393,9 @@ case "$cmd" in
     done
 
     [ -z "$title" ] && { warn "write: title required"; exit 0; }
+    # The bound company tags the entry so the SessionStart index loader can
+    # surface only that company's entries. Anything not slug-shaped is dropped.
+    [[ "$company_arg" =~ ^[A-Za-z0-9_-]+$ ]] || company_arg=""
 
     d="$(today)"
     dir="$(journal_dir_for "$d")"
@@ -346,6 +429,7 @@ case "$cmd" in
           printf 'ts: %s\n' "$(now_iso_z)"
           printf 'title: %s\n' "$yaml_title"
           printf 'slug: %s\n' "$yaml_slug"
+          [ -z "$company_arg" ] || printf 'company: %s\n' "$company_arg"
           if [ -n "$files_csv" ]; then
             printf 'files:\n'
             old_ifs="$IFS"
@@ -384,7 +468,9 @@ case "$cmd" in
     if [ ! -f "$idx" ]; then
       printf '# Session journal — %s\n\n' "$d" > "$idx"
     fi
-    printf -- '- `%s` %s — %s\n' "$seq" "$(now_hhmm_z)" "$title" >> "$idx" \
+    company_tag=""
+    [ -z "$company_arg" ] || company_tag=" [company: $company_arg]"
+    printf -- '- `%s` %s — %s%s\n' "$seq" "$(now_hhmm_z)" "$title" "$company_tag" >> "$idx" \
       || warn "write: INDEX update failed"
 
     # Reset the tool counter for THIS session only — journaling one task's
@@ -452,8 +538,10 @@ case "$cmd" in
     case "$sub" in
       increment)
         do_increment() {
-          local n
+          local owner_token="${1:-}" n
+          counter_lock_token_is_current "$lockdir" "$owner_token" || return 75
           n=$(counter_read_raw "$counter")
+          counter_lock_token_is_current "$lockdir" "$owner_token" || return 75
           echo $((n + 1)) > "$counter" 2>/dev/null || true
         }
         with_counter_lock "$lockdir" do_increment
@@ -462,7 +550,11 @@ case "$cmd" in
         printf '%d\n' "$(counter_read_raw "$counter")"
         ;;
       reset)
-        do_reset() { echo 0 > "$counter" 2>/dev/null || true; }
+        do_reset() {
+          local owner_token="${1:-}"
+          counter_lock_token_is_current "$lockdir" "$owner_token" || return 75
+          echo 0 > "$counter" 2>/dev/null || true
+        }
         with_counter_lock "$lockdir" do_reset
         ;;
       *) warn "tool-counter: subcommand required (increment|read|reset)" ;;