@indigoai-us/hq-cli 5.345.170 → 5.345.172

package/dist/commands/integrations-core.d.ts

@@ -74,7 +74,11 @@ export interface AdminConnection {
         grantCount?: number;
     };
     installation?: FactoryInstallation | null;
+    ownerType?: ConnectionOwnerType;
+    ownerId?: string;
+    accountLabel?: string;
 }
+export type ConnectionOwnerType = "person" | "company" | "legacy" | "invalid";
 /**
  * The actionable state returned instead of attempting to use a revoked
  * connection. Keep this machine-readable so commands and scripts get the same
@@ -111,6 +115,9 @@ export interface AdminSurface {
          */
         canAddIntegrations?: boolean;
     };
+    capabilities?: {
+        personalConnect?: boolean;
+    };
     connections: AdminConnection[];
     audit: AdminAuditEvent[];
 }
@@ -390,4 +397,20 @@ export declare function printIntegrationCallResultJson(value: unknown): void;
  * a user to fix something that is not broken.
  */
 export declare function printHealthNotice(connection: AdminConnection): void;
+export declare function connectionOwnerLabel(connection: Pick<AdminConnection, "ownerType">): string | undefined;
+export declare function connectionAccountLabel(connection: Pick<AdminConnection, "accountLabel">): string | undefined;
+export interface IntegrationAccountCandidate {
+    connectionId: string;
+    provider: string;
+    ownerType?: string;
+    accountLabel?: string;
+}
+export declare const ACCOUNT_REQUIRED_CODE = "AccountRequired";
+export declare const ACCOUNT_NOT_FOUND_CODE = "IntegrationAccountNotFound";
+export declare function accountSelectionMessage(code: typeof ACCOUNT_REQUIRED_CODE | typeof ACCOUNT_NOT_FOUND_CODE, candidates: readonly IntegrationAccountCandidate[], account?: string, rerun?: string): string;
+export declare function accountCandidateFor(connection: AdminConnection): IntegrationAccountCandidate;
+export declare function selectAccountConnections(connections: readonly AdminConnection[], opts: {
+    account: string;
+    provider?: string;
+}): AdminConnection[];
 //# sourceMappingURL=integrations-core.d.ts.map

package/dist/commands/integrations-core.js

@@ -397,6 +397,9 @@ export async function fetchAdminSurface(token, companyUid) {
     return {
         companyUid: data.companyUid ?? companyUid,
         ...(data.factoryEnabled !== undefined ? { factoryEnabled: data.factoryEnabled } : {}),
+        ...(data.capabilities && typeof data.capabilities === "object"
+            ? { capabilities: data.capabilities }
+            : {}),
         viewer: data.viewer ?? {
             personUid: "",
             role: "member",
@@ -717,6 +720,9 @@ export async function callGateway(token, params, idempotencyKey, method = "tools
         throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`, { expected: isClientError(res.status), status: res.status, gatewaySubcommand });
     }
     if (terminalMessage?.error) {
+        const accountError = accountSelectionError(terminalMessage.error, typeof params.account === "string" ? params.account : undefined);
+        if (accountError)
+            throw accountError;
         const gatewayError = gatewayErrorDetails(terminalMessage.error);
         const invalidEnvelope = gatewayError.rpcCode === undefined && !gatewayError.message;
         const gatewayFailureCode = invalidEnvelope
@@ -890,4 +896,98 @@ export function printHealthNotice(connection) {
     if (notice.remediation)
         console.log(chalk.yellow(`  ${redactUrlsInText(notice.remediation)}`));
 }
+const OWNER_LABELS = {
+    person: "Personal",
+    company: "Company",
+    legacy: "Shared (legacy)",
+    invalid: "Unknown owner",
+};
+export function connectionOwnerLabel(connection) {
+    const ownerType = connection.ownerType;
+    return ownerType && Object.hasOwn(OWNER_LABELS, ownerType) ? OWNER_LABELS[ownerType] : undefined;
+}
+export function connectionAccountLabel(connection) {
+    if (typeof connection.accountLabel !== "string")
+        return undefined;
+    const cleaned = safeAppName(connection.accountLabel, "");
+    return cleaned ? redactUrlsInText(cleaned) : undefined;
+}
+export const ACCOUNT_REQUIRED_CODE = "AccountRequired";
+export const ACCOUNT_NOT_FOUND_CODE = "IntegrationAccountNotFound";
+function accountCandidatesFrom(value) {
+    if (!Array.isArray(value))
+        return [];
+    const candidates = [];
+    for (const item of value) {
+        const record = recordValue(item);
+        if (!record || typeof record.connectionId !== "string" || typeof record.provider !== "string")
+            continue;
+        candidates.push({
+            connectionId: record.connectionId,
+            provider: record.provider,
+            ...(typeof record.ownerType === "string" ? { ownerType: record.ownerType } : {}),
+            ...(typeof record.accountLabel === "string" ? { accountLabel: record.accountLabel } : {}),
+        });
+    }
+    return candidates;
+}
+function formatAccountCandidate(candidate) {
+    const id = safeAppName(candidate.connectionId, "?");
+    const owner = connectionOwnerLabel({ ownerType: candidate.ownerType });
+    const label = connectionAccountLabel({ accountLabel: candidate.accountLabel });
+    const details = [safeAppName(bareProvider(candidate.provider), "?"), owner, label].filter(Boolean).join(" · ");
+    return `  ${id}  ${details}`;
+}
+export function accountSelectionMessage(code, candidates, account, rerun = "Rerun with --account <connection id or account label>.") {
+    const headline = code === ACCOUNT_REQUIRED_CODE
+        ? `More than one account can run this. ${rerun}`
+        : account
+            ? `No account matches '${safeAppName(account, "?")}'. ${rerun}`
+            : "No account you can use has this tool.";
+    if (candidates.length === 0)
+        return headline;
+    return [headline, "Accounts:", ...candidates.map(formatAccountCandidate)].join("\n");
+}
+function accountSelectionError(error, account) {
+    const data = recordValue(recordValue(error)?.data);
+    const code = data?.code;
+    if (code !== ACCOUNT_REQUIRED_CODE && code !== ACCOUNT_NOT_FOUND_CODE)
+        return null;
+    return new IntegrationsCliError(accountSelectionMessage(code, accountCandidatesFrom(data?.candidates), account), {
+        expected: true,
+        code,
+    });
+}
+export function accountCandidateFor(connection) {
+    return {
+        connectionId: connection.id,
+        provider: connection.provider,
+        ...(connection.ownerType ? { ownerType: connection.ownerType } : {}),
+        ...(connection.accountLabel ? { accountLabel: connection.accountLabel } : {}),
+    };
+}
+function matchesProviderSelector(connection, provider) {
+    const want = provider.trim().toLowerCase();
+    const wantHumanSlug = humanSlug(provider);
+    const displayName = connection.installation?.displayName ?? "";
+    return (bareProvider(connection.provider).toLowerCase() === want ||
+        connection.provider.toLowerCase() === want ||
+        displayName.trim().toLowerCase() === want ||
+        (wantHumanSlug !== "" && humanSlug(displayName) === wantHumanSlug));
+}
+export function selectAccountConnections(connections, opts) {
+    const pool = connections.filter((connection) => connection.status !== "revoked" &&
+        (!opts.provider || matchesProviderSelector(connection, opts.provider)));
+    const want = opts.account.trim().toLowerCase();
+    const matches = pool.filter((connection) => connection.id.toLowerCase() === want ||
+        (typeof connection.accountLabel === "string" && connection.accountLabel.trim().toLowerCase() === want));
+    if (matches.length === 0) {
+        throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_NOT_FOUND_CODE, pool.map(accountCandidateFor), opts.account), { expected: true, code: ACCOUNT_NOT_FOUND_CODE });
+    }
+    const providers = new Set(matches.map((connection) => connection.provider));
+    if (providers.size > 1) {
+        throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_REQUIRED_CODE, matches.map(accountCandidateFor), opts.account, "Rerun with --provider <app> or --account <connection id>."), { expected: true, code: ACCOUNT_REQUIRED_CODE });
+    }
+    return matches;
+}
 //# sourceMappingURL=integrations-core.js.map

package/dist/commands/integrations-manage.js

@@ -17,7 +17,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, printHealthNotice, connectionAccountLabel, connectionOwnerLabel, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
 import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, terminalSafeText, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
 const PERMISSIONS = ["read", "write", "admin"];
@@ -219,6 +219,13 @@ export function registerManageCommands(integrations) {
         if (install?.id)
             console.log(chalk.dim(`  installation: ${install.id}`));
         console.log(chalk.dim(`  status:      ${connection.status}`));
+        const owner = connectionOwnerLabel(connection);
+        if (owner) {
+            console.log(chalk.dim(`  owner:       ${owner}`));
+            const account = connectionAccountLabel(connection);
+            if (account)
+                console.log(chalk.dim(`  account:     ${account}`));
+        }
         if (connection.status === "revoked") {
             const details = revokedConnectionDetails(connection, opts.company);
             console.log(chalk.yellow(`  Revoked — ${details.reason}`));

package/dist/commands/integrations.js

@@ -56,7 +56,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, parseCallTimeoutMs, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, parseCallTimeoutMs, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, connectionAccountLabel, connectionOwnerLabel, selectAccountConnections, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, accountCandidateFor, accountSelectionMessage, ACCOUNT_REQUIRED_CODE, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
@@ -329,6 +329,26 @@ function approvalOutcomeFailed(row) {
     return ["failed", "write_unknown"].includes(row.status ?? "") ||
         ["failed", "unknown"].includes(row.outcome ?? "");
 }
+function selectToolConnection(connections, opts) {
+    if (opts.account === undefined) {
+        return { connection: selectConnection(connections, opts), accountMatches: [] };
+    }
+    if (opts.connection) {
+        throw new IntegrationsCliError("Use either --connection or --account, not both.", {
+            expected: true,
+        });
+    }
+    if (!opts.account.trim()) {
+        throw new IntegrationsCliError("--account was empty — pass a connection id or account label.", {
+            expected: true,
+        });
+    }
+    const accountMatches = selectAccountConnections(connections, {
+        account: opts.account,
+        ...(opts.provider ? { provider: opts.provider } : {}),
+    });
+    return { connection: accountMatches[0], accountMatches };
+}
 export function registerIntegrationsCommand(program) {
     const integrations = program
         .command("integrations")
@@ -375,7 +395,10 @@ export function registerIntegrationsCommand(program) {
             return;
         }
         for (const c of connections) {
+            const owner = connectionOwnerLabel(c);
             const flags = [
+                owner ?? null,
+                owner ? connectionAccountLabel(c) ?? null : null,
                 c.status,
                 c.writePolicy ? `writes: ${c.writePolicy}` : null,
                 c.installation?.status === "needs_credentials" ? "needs sign-in" : null,
@@ -397,13 +420,17 @@ export function registerIntegrationsCommand(program) {
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--company <slug>", "Company slug, e.g. indigo")
+        .option("--account <id-or-label>", "Which account of the app: its connection id or account label")
         .option("--describe <tool>", "Print the full input schema for one tool")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connections = await fetchConnections(token, companyUid);
-        const connection = selectConnection(connections, opts);
+        const { connection, accountMatches } = selectToolConnection(connections, opts);
+        if (accountMatches.length > 1) {
+            throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_REQUIRED_CODE, accountMatches.map(accountCandidateFor), opts.account, "Rerun with --account <connection id>."), { expected: true, code: ACCOUNT_REQUIRED_CODE });
+        }
         if (reportRevokedConnection(connection, opts))
             return;
         let payload;
@@ -479,6 +506,7 @@ export function registerIntegrationsCommand(program) {
         .description("Call one of a connected app's tools (approval-gated when it changes things)")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
+        .option("--account <id-or-label>", "Which account of the app: its connection id or account label")
         .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--args <json>", "Tool arguments as a JSON object (default {}); use - to read the JSON from stdin")
         .option("--args-file <path>", "Read tool arguments from a JSON file (use - for stdin); avoids shell quoting of apostrophes and parentheses")
@@ -490,9 +518,23 @@ export function registerIntegrationsCommand(program) {
         const parsedArgs = await resolveCallArgs(opts);
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        const { connection, accountMatches } = selectToolConnection(await fetchConnections(token, companyUid), opts);
         if (reportRevokedConnection(connection, { ...opts, fail: true }))
             return;
+        const accountSelector = opts.account !== undefined &&
+            accountMatches.length !== 1 &&
+            (connection.ownerType === "person" || connection.ownerType === "company")
+            ? opts.account.trim()
+            : undefined;
+        if (accountSelector === undefined && accountMatches.length > 1) {
+            throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_REQUIRED_CODE, accountMatches.map(accountCandidateFor), opts.account, "Rerun with --account <connection id>."), { expected: true, code: ACCOUNT_REQUIRED_CODE });
+        }
+        const routing = accountSelector === undefined
+            ? { connectionId: connection.id }
+            : {};
+        const accountParams = accountSelector === undefined
+            ? {}
+            : { account: accountSelector, provider: connection.provider };
         const idempotencyKey = opts.idempotencyKey ?? `hq-cli-${randomUUID()}`;
         let gatewayParams;
         if (isBuiltInGatewayProvider(connection.provider)) {
@@ -506,7 +548,8 @@ export function registerIntegrationsCommand(program) {
                 companyUid,
                 acceptAsync: true,
                 name: tool,
-                arguments: { ...parsedArgs, companyUid, connectionId: connection.id, idempotencyKey },
+                ...accountParams,
+                arguments: { ...parsedArgs, companyUid, ...routing, idempotencyKey },
             };
         }
         else {
@@ -515,9 +558,10 @@ export function registerIntegrationsCommand(program) {
                 companyUid,
                 acceptAsync: true,
                 name: `${prefix}.mcp.tools.call`,
+                ...accountParams,
                 arguments: {
                     companyUid,
-                    connectionId: connection.id,
+                    ...routing,
                     toolName: tool,
                     arguments: parsedArgs,
                     idempotencyKey,

package/dist/commands/lanes-loop.d.ts

@@ -1,4 +1,5 @@
 import type { Ctx, LaneResumeOptions } from "./lanes-shared.js";
+import { LanesError } from "../lib/lanes/errors.js";
 import type { LaneRecord } from "../lib/lanes/types.js";
 /**
  * A loop lane that finished a phase and is waiting for its next envelope is
@@ -14,6 +15,25 @@ export declare function settleLoopLaneIdle(hqRoot: string, laneId: string): Lane
  * worker, so it is handed to resume as the `done` lane the phase left.
  */
 export declare function prepareIdleLoopLaneForResume(hqRoot: string, laneId: string): LaneRecord;
+/**
+ * LanesError codes from the resume admission path that mean admission could
+ * not run right now and a later admission can retry: the admission or store
+ * lock timed out (store_lock_timeout), the lane changed while admission was
+ * checked (lane_admission_conflict), or a lane record CAS miss
+ * (version_conflict). Any other resume error is permanent and is rethrown.
+ */
+export declare const TRANSIENT_LOOP_ADMISSION_ERRORS: ReadonlySet<string>;
+/**
+ * Park a loop phase whose resume was refused before an engine launched. The
+ * lane becomes `queued` with `admit_failed` and the error, and carries the
+ * phase as `pending_resume`, so admission can launch it later and the lane is
+ * never left looking active with no engine.
+ */
+export declare function deferRefusedLoopPhase(hqRoot: string, laneId: string, at: string, error: LanesError, phase: {
+    text: string;
+    sessionId: string | undefined;
+    workingDirectory: string;
+}): LaneRecord;
 export interface LoopControllerDeps {
     resumeLane(laneId: string, options: LaneResumeOptions): Promise<unknown>;
     interruptLane(laneId: string, reason: string, options: {

package/dist/commands/lanes-loop.js

@@ -3,6 +3,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { readLane, retryUpdateLane, updateLane } from "../lib/lanes/store.js";
 import { LanesError, isLaneVersionConflict } from "../lib/lanes/errors.js";
+import { liveNodeBinary } from "../lib/lanes/node-binary.js";
 import { readLatestEnvelopeRecord } from "../lib/lanes/watcher.js";
 import { spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { raiseLaneQuestion } from "../lib/lanes/questions.js";
@@ -33,6 +34,44 @@ export function settleLoopLaneIdle(hqRoot, laneId) {
 export function prepareIdleLoopLaneForResume(hqRoot, laneId) {
     return casLoopLaneState(hqRoot, laneId, "running", "done");
 }
+/**
+ * LanesError codes from the resume admission path that mean admission could
+ * not run right now and a later admission can retry: the admission or store
+ * lock timed out (store_lock_timeout), the lane changed while admission was
+ * checked (lane_admission_conflict), or a lane record CAS miss
+ * (version_conflict). Any other resume error is permanent and is rethrown.
+ */
+export const TRANSIENT_LOOP_ADMISSION_ERRORS = new Set([
+    "store_lock_timeout",
+    "lane_admission_conflict",
+    "version_conflict",
+]);
+/**
+ * Park a loop phase whose resume was refused before an engine launched. The
+ * lane becomes `queued` with `admit_failed` and the error, and carries the
+ * phase as `pending_resume`, so admission can launch it later and the lane is
+ * never left looking active with no engine.
+ */
+export function deferRefusedLoopPhase(hqRoot, laneId, at, error, phase) {
+    return retryUpdateLane(hqRoot, laneId, "command", (record) => ({
+        ...record,
+        state: "queued",
+        queued_reason: "admit_failed",
+        queued_details: { reason: "admit_failed", error: error.error, message: error.message || error.error },
+        queued_at: at,
+        admission_reserved_at: undefined,
+        pending_resume: {
+            ...(phase.sessionId ? { session_id: phase.sessionId } : { fresh_thread: true }),
+            trigger: "resume",
+            caller: "loop",
+            resumed_from: "done",
+            text: phase.text,
+            compact: true,
+            working_directory: phase.workingDirectory,
+            at,
+        },
+    }));
+}
 function casLoopLaneState(hqRoot, laneId, from, to) {
     for (let attempt = 0;; attempt += 1) {
         const current = readLane(hqRoot, laneId);
@@ -67,8 +106,8 @@ export function startLaneLoopController(ctx, laneId, initialAdmission = false) {
     const args = [entry, "lanes", "_loop-worker", laneId];
     const env = { ...ctx.env, HQ_LANE_LOOP_CONTROLLER: "1", ...(initialAdmission ? { HQ_LANE_LOOP_INITIAL: "1" } : {}) };
     const child = ctx.spawnProcess
-        ? ctx.spawnProcess(process.execPath, args, { cwd: ctx.hqRoot(), detached: true, windowsHide: true, stdio: ["ignore", 1, 2], env })
-        : spawn(process.execPath, args, { cwd: ctx.hqRoot(), detached: true, stdio: "ignore", env });
+        ? ctx.spawnProcess(liveNodeBinary(), args, { cwd: ctx.hqRoot(), detached: true, windowsHide: true, stdio: ["ignore", 1, 2], env })
+        : spawn(liveNodeBinary(), args, { cwd: ctx.hqRoot(), detached: true, stdio: "ignore", env });
     child.unref();
     if (child.pid === undefined)
         throw new LanesError("loop_controller_spawn_failed", "Loop controller did not start", { lane_id: laneId });
@@ -208,15 +247,34 @@ export async function runLaneLoopController(ctx, laneId, deps) {
                 else {
                     if (current.state === "running")
                         current = prepareIdleLoopLaneForResume(hqRoot, laneId);
-                    await deps.resumeLane(laneId, {
-                        text: `Read ${briefPath} and follow it as the complete instruction for this phase.`,
-                        project: current.project_id,
-                        ...(storyId ? { story: storyId } : {}),
-                        freshThread: fresh,
-                        ...(sessionId ? { loopSessionId: sessionId } : {}),
-                        ...(repairError !== undefined ? { loopHandoffRepair: true } : {}),
-                        workingDirectory: worktree,
-                    });
+                    const resumeText = `Read ${briefPath} and follow it as the complete instruction for this phase.`;
+                    try {
+                        await deps.resumeLane(laneId, {
+                            text: resumeText,
+                            project: current.project_id,
+                            ...(storyId ? { story: storyId } : {}),
+                            freshThread: fresh,
+                            ...(sessionId ? { loopSessionId: sessionId } : {}),
+                            ...(repairError !== undefined ? { loopHandoffRepair: true } : {}),
+                            workingDirectory: worktree,
+                        });
+                    }
+                    catch (error) {
+                        // Transient admission refusal before any engine launched (for
+                        // example a store lock timeout). The envelope is already active, so keep it
+                        // and park the lane as queued with a reason `hq lanes show`
+                        // displays; the next admission launches this phase from
+                        // pending_resume and the wait below picks up its result.
+                        if (!(error instanceof LanesError) ||
+                            !TRANSIENT_LOOP_ADMISSION_ERRORS.has(error.error) ||
+                            readLane(hqRoot, laneId).state !== "done")
+                            throw error;
+                        deferRefusedLoopPhase(hqRoot, laneId, ctx.now().toISOString(), error, {
+                            text: resumeText,
+                            sessionId: fresh ? undefined : sessionId ?? current.provider_session_id,
+                            workingDirectory: worktree,
+                        });
+                    }
                 }
                 let interruptPromise;
                 const abortPhase = () => {

package/dist/commands/lanes.js

@@ -508,9 +508,17 @@ function livenessDepsFromCtx(ctx) {
  * envelopes; every other lane spawns its worker directly. Every admission path
  * (reconcile, in-process queue drain, hq lanes admit) goes through here so a
  * loop lane never runs its brief without a controller.
+ *
+ * A queued loop lane whose controller is still alive is a deferred phase: the
+ * controller already activated the envelope and is waiting for its engine.
+ * That lane spawns the phase worker from pending_resume; starting a second
+ * controller would lose the runner lease and leave the lane running with no
+ * engine (feedback_865fe8a0).
  */
 function startAdmittedLane(ctx, root, candidate) {
-    if (candidate.loop_mode !== true || candidate.state !== "queued") {
+    const deferredLoopPhase = candidate.loop_mode === true && candidate.pending_resume !== undefined &&
+        loopControllerIsAlive(runDir(root, candidate.lane_id));
+    if (candidate.loop_mode !== true || candidate.state !== "queued" || deferredLoopPhase) {
         const admissionHost = reconcileHostFromCtx(ctx);
         return spawnLaneWorker(root, candidate, {
             env: ctx.env,

package/dist/commands/rescue.d.ts

@@ -21,6 +21,7 @@
  */
 import { Command } from 'commander';
 import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
+import { repairDanglingReleaseLinks } from '../lib/doctor/checks/release-links.js';
 export interface RescueTarget {
     source: string;
     /** undefined → let the script apply its own default ref (`main`). */
@@ -52,6 +53,14 @@ export declare function shouldAttemptSelfUpdate(opts: {
  * changes the rescue's exit status, because the core update itself succeeded.
  */
 export declare function retrustHooksAfterRescue(hqRoot: string, retrust?: typeof retrustCodexHooksAfterRescue): Promise<void>;
+/**
+ * Repair HQ-managed release links (`.agents/skills`, `.codex/claude`, ...)
+ * that do not resolve after a rescue, for example because they were laid at
+ * the rescue's temp extraction folder, which is then deleted
+ * (feedback_2ab63e50). Exported for tests. Best-effort: a failure is reported
+ * but never changes the rescue's exit status.
+ */
+export declare function repairReleaseLinksAfterRescue(hqRoot: string, repair?: typeof repairDanglingReleaseLinks): void;
 /** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
 export declare function getLatestReleaseTag(repo: string, token?: string): Promise<string>;
 /** Resolve a tag to its commit SHA, dereferencing annotated tags. */

package/dist/commands/rescue.js

@@ -6,6 +6,7 @@ import { rescue } from '@indigoai-us/hq-cloud';
 import { findHqRoot } from '../utils/manifest.js';
 import { selfUpdateAndReexec } from '../utils/self-update.js';
 import { retrustCodexHooksAfterRescue } from '../utils/hook-trust.js';
+import { repairDanglingReleaseLinks } from '../lib/doctor/checks/release-links.js';
 import { PROD_SOURCE, STAGING_SOURCE, resolveGhToken } from '../utils/shipped-codex-hooks.js';
 /**
  * Resolve the source repo + ref from the user's flags. Pure + exported for
@@ -49,6 +50,35 @@ export async function retrustHooksAfterRescue(hqRoot, retrust = retrustCodexHook
             'Codex will skip changed HQ hooks until you run `hq reindex`.'));
     }
 }
+/**
+ * Repair HQ-managed release links (`.agents/skills`, `.codex/claude`, ...)
+ * that do not resolve after a rescue, for example because they were laid at
+ * the rescue's temp extraction folder, which is then deleted
+ * (feedback_2ab63e50). Exported for tests. Best-effort: a failure is reported
+ * but never changes the rescue's exit status.
+ */
+export function repairReleaseLinksAfterRescue(hqRoot, repair = repairDanglingReleaseLinks) {
+    try {
+        for (const entry of repair(hqRoot)) {
+            if (entry.action === 'repointed') {
+                console.log(`rescue: repointed dangling link ${entry.rel} -> ${entry.linkText ?? entry.target}`);
+            }
+            else if (entry.action === 'removed') {
+                console.log(`rescue: removed dangling link ${entry.rel} (its target is missing)`);
+            }
+            else if (entry.action === 'skipped') {
+                console.log(`rescue: left dangling link ${entry.rel} alone: ${entry.reason ?? 'not an HQ-managed target'}`);
+            }
+            else {
+                console.warn(chalk.yellow(`rescue: could not repair ${entry.rel}: ${entry.reason ?? 'unknown error'}. Run \`hq doctor --fix\`.`));
+            }
+        }
+    }
+    catch (err) {
+        console.warn(chalk.yellow(`rescue: could not repair dangling release links: ${err instanceof Error ? err.message : 'unknown error'}. ` +
+            'Run `hq doctor --fix`.'));
+    }
+}
 function ghHeaders(token) {
     const headers = {
         Accept: 'application/vnd.github+json',
@@ -185,6 +215,7 @@ export function registerRescueCommand(program) {
                 ghToken: token,
             });
             if (status === 0 && !opts.check) {
+                repairReleaseLinksAfterRescue(hqRoot);
                 await retrustHooksAfterRescue(hqRoot);
             }
             process.exit(status);