@indigoai-us/hq-cli 5.345.174 → 5.345.176

package/dist/commands/lanes.js

@@ -1,3 +1,4 @@
+import { readSessionCompanyLock } from "../lib/session-company-lock.js";
 /**
  * `hq lanes` — worker lane management and decision queue (spec §5–§7, §10–§11).
  *
@@ -50,7 +51,7 @@ import { LANE_FOCUS_GUARD_FLAG, LANE_FOCUS_DASHBOARD_FLAG, LANE_HIRE_GRANT_FINIS
 import { applyContinuitySettings, findWorkerContinuityLane, sameLaneHost, workerContinuityPrompt } from "../lib/lanes/worker-continuity.js";
 import { localHostIdsReferToSameMachine, observeLocalHostIdentity, resolveLocalHostIdentity } from "../lib/lanes/local-host-identity.js";
 import { commitIdleLoopStop, enqueueLoopEnvelope, interruptLoopQueue, interruptLoopQueueForStory, loopControllerIsAlive, loopLaneIsIdle, loopStatus, validateLoopEnvelope } from "../lib/lanes/loop.js";
-import { LOOP_CONTROLLER_RECOVERY_REASON, LOOP_STALL_RESTART_REASON, runLaneLoopController, startLaneLoopController } from "./lanes-loop.js";
+import { LOOP_CONTROLLER_RECOVERY_REASON, LOOP_STALL_RESTART_REASON, runLaneLoopController, startLaneLoopController, startLaneLoopControllerWithAdmissionLockHeld } from "./lanes-loop.js";
 import { configuredCodexRolloutHomes, retainCodexRollouts } from "../lib/lanes/disk-guard.js";
 import { isControllerAliasOutpostId } from "../lib/lanes/admission-host.js";
 import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
@@ -76,6 +77,7 @@ import { CompanySelectionError } from "../utils/company-selection-error.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
+import { applyLoopDisposition, loopDispositionSnapshot } from "../lib/lanes/loop-disposition.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
 import { remoteControlSelectionConfig, remoteControlSessionHome } from "../lib/lanes/remote-control-lane.js";
@@ -446,6 +448,7 @@ function resolveDeps(deps = {}) {
         killProcess: deps.killProcess,
         isAlive: deps.isAlive,
         readStarttime: deps.readStarttime,
+        controllerProcessIdentity: deps.controllerProcessIdentity,
         watcherLoopDeps: deps.watcherLoopDeps,
         stopSleepMs: deps.stopSleepMs,
         livenessDeps: deps.livenessDeps,
@@ -544,7 +547,7 @@ function startAdmittedLane(ctx, root, candidate) {
         queued_details: undefined,
         admission_reserved_at: undefined,
     }));
-    startLaneLoopController(ctx, candidate.lane_id, true);
+    startLaneLoopControllerWithAdmissionLockHeld(ctx, candidate.lane_id, true);
     return admitted;
 }
 /**
@@ -4552,7 +4555,7 @@ async function runCreate(ctx, opts) {
             : { ...current });
         started = lane;
         if (admission.action === "start")
-            loopControllerPid = startLaneLoopController(ctx, lane.lane_id, true);
+            loopControllerPid = await startLaneLoopController(ctx, lane.lane_id, true);
     }
     else if (admission.action === "start") {
         started = spawnLaneWorker(hqRoot, lane, {
@@ -9339,12 +9342,23 @@ async function runStop(ctx, laneId, reason, quiet = false) {
             throw new LanesError("already_terminal", `Loop lane ${lane.lane_id} is already ${lane.state}`, { lane_id: lane.lane_id, state: lane.state });
         }
         const controllerAlive = loopControllerIsAlive(runDirPath);
+        // An explicitly disposed lane may already contain the requested stop.
+        // Commit that idle stop before enqueue rejects a second stop or any
+        // controller is restarted. This does not certify the abandoned effects.
+        if (!controllerAlive && lane.terminal_details?.recovery_decision) {
+            const finalized = await finalizeIdleLoopStop(ctx, lane);
+            if (finalized) {
+                if (!quiet)
+                    printJson({ ok: true, action: "stop", lane_id: lane.lane_id, terminal: true, lane: finalized, external_effects: "not-certified" });
+                return;
+            }
+        }
         if (!controllerAlive && lane.state === "running") {
             await runInterrupt(ctx, lane.lane_id, "loop controller exited; recovering queued work before stop", { preserveLoopQueue: true, quiet: true, terminalReason: LOOP_CONTROLLER_RECOVERY_REASON });
         }
         const queued = enqueueLoopEnvelope({ runDir: runDirPath, laneId: lane.lane_id, envelope: { kind: "stop" }, now: ctx.now });
         if (!controllerAlive && lane.state !== "queued")
-            startLaneLoopController(ctx, lane.lane_id);
+            await startLaneLoopController(ctx, lane.lane_id);
         const finalized = !controllerAlive ? await finalizeIdleLoopStop(ctx, readLane(hqRoot, lane.lane_id)) : undefined;
         const admitted = await admitQueuedFromCtx(ctx);
         if (!quiet)
@@ -10483,6 +10497,52 @@ export function registerLanesCommand(parent, deps = {}) {
             emitTerminal: (lane) => emitLaneTerminalStateSoft(ctx, lane),
         });
     }));
+    lanes
+        .command("recover-loop")
+        .description("Preview or explicitly fail/abandon uncertain loop effects; never replay work")
+        .argument("<lane-id>", "Loop lane id")
+        .option("--disposition <action>", "fail or abandon; omit for a read-only preview")
+        .option("--lane-version <number>", "Exact lane version from preview")
+        .option("--fingerprint <sha256>", "Exact preview envelope/lease fingerprint")
+        .option("--reason <text>", "Audited reason; does not certify external effects")
+        .option("--attest-owner-investigated", "Attest unknown lease ownership was investigated and no live owner exists")
+        .action(wrap(async (laneId, opts) => {
+        const hqRoot = ctx.hqRoot();
+        const authorize = (lane) => {
+            if (!lane.loop_mode)
+                throw new Error("Not a loop lane");
+            const authorization = callerSeniorAuthorization(ctx, lane.senior);
+            if (!authorization.authorized)
+                throw new Error(`Only the lane's senior may recover it: ${authorization.reason}`);
+            assertLaneRunsHereForAdmission(ctx, lane);
+            const lock = readSessionCompanyLock({ ...ctx.env, HQ_ROOT: hqRoot });
+            const company = (lane.company ?? lane.mesh_company)?.slug ?? "personal";
+            const sessionId = sessionIdFromEnv(ctx.env);
+            if ((sessionId && (!lock || lock.sessionId !== sessionId)) || (lock && !lock.companies.includes(company))) {
+                throw new LanesError("lane_recovery_company_locked", "This session is not bound to the lane's company", { lane_id: lane.lane_id, company });
+            }
+        };
+        const lane = readLane(hqRoot, laneId);
+        authorize(lane);
+        const enabled = await readLanesRegistryFlagFailOpen(LANE_CONDUCT_LOOP_FLAG, { company: lane.company ?? lane.mesh_company, defaultValue: true, env: ctx.env });
+        if (!enabled)
+            throw new Error("Loop lanes are disabled by the kill switch");
+        if (!opts.disposition) {
+            printJson({ ok: true, action: "recover-loop-preview", snapshot: loopDispositionSnapshot(hqRoot, lane), external_effects: "not-certified" });
+            return;
+        }
+        if (opts.disposition !== "fail" && opts.disposition !== "abandon")
+            throw new Error("Disposition must be fail or abandon");
+        assertNoSecretText("recovery reason", opts.reason ?? "");
+        const version = Number(opts.laneVersion);
+        if (!opts.laneVersion || !Number.isSafeInteger(version) || version < 1)
+            throw new Error("An exact preview version is required");
+        const result = await applyLoopDisposition({ hqRoot, laneId, expectedVersion: version,
+            fingerprint: opts.fingerprint ?? "", disposition: opts.disposition,
+            reason: opts.reason ?? "", ownershipAttested: opts.attestOwnerInvestigated,
+            authorize, now: ctx.now });
+        printJson({ ok: true, action: "recover-loop", ...result });
+    }));
     lanes
         .command("enqueue")
         .description("Validate and queue one phase envelope for a loop lane")
@@ -10526,7 +10586,7 @@ export function registerLanesCommand(parent, deps = {}) {
             await runInterrupt(ctx, lane.lane_id, "loop controller exited; recovering the queued phase", { preserveLoopQueue: true, quiet: true, terminalReason: LOOP_CONTROLLER_RECOVERY_REASON });
         }
         const shouldRestart = !controllerAlive && lane.state !== "queued";
-        const controllerPid = shouldRestart ? startLaneLoopController(ctx, lane.lane_id) : undefined;
+        const controllerPid = shouldRestart ? await startLaneLoopController(ctx, lane.lane_id) : undefined;
         printJson({ ok: true, action: "enqueue", ...result, lane: lane.lane_id, ...(controllerPid ? { controller_pid: controllerPid } : {}) });
     }));
     lanes

package/dist/commands/sync-core.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
 import { type SyncCoreReconcileResult } from "../lib/sync-core/reconcile.js";
+import { type EngineManifestScope } from "../lib/sync-core/manifest-scopes.js";
+import type { RunSyncManifestOptions, RunSyncManifestOutcome, SyncManifestDeps } from "./sync-manifest.js";
 export interface SyncCoreReconcileCommandOptions {
     hqRoot?: string;
     companiesOnly?: boolean;
@@ -15,6 +17,21 @@ export interface SyncCoreCommandDeps {
     err: (line: string) => void;
 }
 export declare function runSyncCoreReconcile(opts: SyncCoreReconcileCommandOptions, d?: SyncCoreCommandDeps): Promise<SyncCoreReconcileResult>;
+export interface SyncCoreManifestCommandOptions {
+    hqRoot?: string;
+    json?: boolean;
+}
+export interface SyncCoreManifestDeps extends SyncCoreCommandDeps {
+    runManifest?: (options: RunSyncManifestOptions, deps: SyncManifestDeps) => Promise<RunSyncManifestOutcome>;
+    manifestDeps?: () => SyncManifestDeps;
+}
+export interface SyncCoreManifestResult {
+    scope: EngineManifestScope;
+    status: string;
+    mode?: string;
+    errorKind?: string;
+}
+export declare function runSyncCoreManifest(opts: SyncCoreManifestCommandOptions, d?: SyncCoreManifestDeps): Promise<SyncCoreManifestResult[]>;
 export declare function runSyncCoreStatus(opts: {
     json?: boolean;
 }, d?: SyncCoreCommandDeps): void;

package/dist/commands/sync-core.js

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import { ensureSyncCoreBinary } from "../lib/sync-core/release.js";
 import { readCompanyRolloutFlag } from "../lib/sync-core/flag.js";
 import { reconcileSyncCore } from "../lib/sync-core/reconcile.js";
+import { engineOwnedManifestScopes, manifestScopeArg } from "../lib/sync-core/manifest-scopes.js";
 import { readSyncCoreRolloutState, syncCoreRolloutStatePath } from "../lib/sync-core/rollout-state.js";
 import { readVaultSyncSwitches } from "../lib/vault-sync-switches.js";
 function defaultDeps() {
@@ -66,6 +67,45 @@ export async function runSyncCoreReconcile(opts, d = defaultDeps()) {
         d.out("no vault on this machine is switched to the new sync engine");
     return result;
 }
+export async function runSyncCoreManifest(opts, d = defaultDeps()) {
+    const hqRoot = await resolveHqRoot(opts.hqRoot, d.env);
+    const scopes = engineOwnedManifestScopes(readVaultSyncSwitches(d.home), readSyncCoreRolloutState(d.home)?.vaults);
+    if (scopes.length === 0) {
+        if (opts.json)
+            d.out("[]");
+        else
+            d.out("no vault on this machine is owned by the new sync engine; the current sync uploads its own manifests");
+        return [];
+    }
+    const manifest = await import("./sync-manifest.js");
+    const runManifest = d.runManifest ?? manifest.runSyncManifest;
+    const manifestDeps = d.manifestDeps ?? manifest.createDefaultDeps;
+    const results = [];
+    for (const scope of scopes) {
+        const label = manifestScopeArg(scope);
+        try {
+            const outcome = await runManifest({ scopeArg: manifestScopeArg(scope), hqRoot, respectThrottle: true, json: true, engineOwned: true }, { ...manifestDeps(), log: () => { } });
+            const { status, mode, error } = outcome.result;
+            results.push({
+                scope,
+                status,
+                ...(mode ? { mode } : {}),
+                ...(error?.kind ? { errorKind: error.kind } : {}),
+            });
+            if (!opts.json)
+                d.out(`${label}: ${status}${mode ? ` (${mode})` : ""}${error?.kind ? ` ${error.kind}` : ""}`);
+        }
+        catch (err) {
+            results.push({ scope, status: "failed", errorKind: "command_error" });
+            d.err(`${label}: manifest pass failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (opts.json)
+        d.out(JSON.stringify(results, null, 2));
+    if (results.some((r) => r.status === "failed"))
+        process.exitCode = 1;
+    return results;
+}
 export function runSyncCoreStatus(opts, d = defaultDeps()) {
     const state = readSyncCoreRolloutState(d.home);
     if (opts.json) {
@@ -83,15 +123,16 @@ export function runSyncCoreStatus(opts, d = defaultDeps()) {
     for (const vault of state.vaults) {
         const legacyOff = vault.kind === "personal" ? switches.personalOff : switches.offCompanies.has(vault.slug ?? "");
         d.out(`  ${vault.uid}  ${vault.kind}${vault.slug ? ` ${vault.slug}` : ""}  ${vault.phase === "full" ? "full" : "read-only"}  legacy sync ${legacyOff ? "off" : "still on"}  home ${vault.engineHome}`);
-        if (vault.plan) {
-            const p = vault.plan;
-            d.out(`    plan ${p.at}: ${p.remoteRows} server rows, ${p.localFiles} local files; would upload ${p.uploads}, download ${p.downloads}, delete ${p.deletes}, write ${p.conflicts} conflict or merge copies`);
+        if (vault.firstCycle) {
+            const c = vault.firstCycle;
+            d.out(`    first full cycle ${c.at}: ${c.planned} planned, ${c.completed} completed, ${c.pending} pending, ${c.held} held, ${c.notApplied} not applied`);
+            d.out(`    listed work${c.truncated ? ` (first ${c.listed} items only)` : ""}: ${c.uploads} uploads, ${c.downloads} downloads, ${c.deletes} deletes, ${c.conflicts} conflict or merge copies, ${c.deferred} deferred`);
         }
-        if (vault.hold)
-            d.out(`    held read-only: ${vault.hold}`);
     }
     for (const skip of state.skipped ?? [])
         d.out(`  ${skip.uid}  skipped on this machine: ${skip.reason}`);
+    for (const hold of state.held ?? [])
+        d.out(`  ${hold.uid}  held: ${hold.reason}`);
     if (state.vaults.length === 0)
         d.out("  no vault is switched to the new sync engine");
 }

package/dist/commands/sync-manifest.d.ts

@@ -110,7 +110,13 @@ export interface RunSyncManifestOptions {
      * `resend_full_scheduled` too, and none of those uploaded anything.
      */
     json?: boolean;
+    engineOwned?: boolean;
 }
+export declare const SYNC_CORE_OWNS_SCOPE_LEDGER_CLASS = "SyncCoreOwnsScope";
+export declare class SyncCoreOwnsScope extends Error {
+    constructor();
+}
+export declare function engineOwnedLedger(): never;
 /** The machine-readable outcome `--json` prints. Fixed tokens only, no paths. */
 export interface ManifestOutcomeLine {
     status: string;

package/dist/commands/sync-manifest.js

@@ -64,6 +64,16 @@ export const MANIFEST_UPLOAD_PATH = "/v1/sync-manifest/upload";
 export { MANIFEST_DISABLED_ENV, manifestUploadsDisabled };
 /** The literal `--scope` value that selects the personal (non-company) tree. */
 export const PERSONAL_SCOPE = "personal";
+export const SYNC_CORE_OWNS_SCOPE_LEDGER_CLASS = "SyncCoreOwnsScope";
+export class SyncCoreOwnsScope extends Error {
+    constructor() {
+        super("the new sync engine owns this scope; the legacy journal is not its ledger");
+        this.name = SYNC_CORE_OWNS_SCOPE_LEDGER_CLASS;
+    }
+}
+export function engineOwnedLedger() {
+    throw new SyncCoreOwnsScope();
+}
 /** Build the `--json` line for one pass. The free-text error detail is left out. */
 export function manifestOutcomeLine(result) {
     return {
@@ -333,6 +343,7 @@ export async function runSyncManifest(options, deps) {
         dryRun: print,
         forceFull: options.full === true,
         ignoreThrottle: options.respectThrottle !== true,
+        ...(options.engineOwned === true ? { listJournalsImpl: engineOwnedLedger } : {}),
     });
     if (print) {
         deps.log(JSON.stringify(result.chunks ?? [], null, 2));
@@ -358,6 +369,7 @@ export function registerSyncManifestCommand(syncCmd) {
         .option("--print", "Build and print the chunks as JSON; upload nothing")
         .option("--json", "Print the pass outcome as one JSON line instead of a summary")
         .option("--respect-throttle", "Honour the 24h per-scope upload throttle instead of forcing a pass (for scheduled callers)")
+        .option("--engine-owned", "The new sync engine owns this scope here: build the manifest from disk alone and mark the legacy journal as not its ledger")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .action(async (options) => {
         // Capability gate BEFORE anything else: on a published hq-cloud that
@@ -376,6 +388,7 @@ export function registerSyncManifestCommand(syncCmd) {
                 print: options.print,
                 respectThrottle: options.respectThrottle,
                 json: options.json,
+                engineOwned: options.engineOwned,
             }, createDefaultDeps());
             if (outcome.exitCode !== 0)
                 process.exit(outcome.exitCode);