@indigoai-us/hq-cli 5.345.179 → 5.345.181

package/dist/lib/hot-channels/adapters/meetings.js

@@ -48,6 +48,7 @@ import * as yaml from "js-yaml";
 import { isAuthError } from "../../../utils/auth-error.js";
 import { MAX_CATCH_UP_WINDOW_MS } from "../contract.js";
 import { assertSafeSegment, HOT_SIGNAL_ORIGIN, writeFileAtomic } from "../landing.js";
+import { SyncLockLostError } from "../sync-lock.js";
 import { MEETING_NOTE_PROVIDERS, MEETING_PROVIDERS, sameMeeting, } from "./meeting-providers.js";
 export const MEETINGS_ADAPTER_ID = "meetings";
 export const MEETINGS_CHANNEL = "meeting-events";
@@ -450,6 +451,7 @@ export function createMeetingsAdapter(options) {
                 mark = new Date(m.startMs).toISOString();
                 continue;
             }
+            await ctx.beforeWrite?.();
             const ref = await writeNotes(provider, gateway.connectionId, m, content.text);
             notes.push({ provider: provider.provider, id: m.id, connectionId: gateway.connectionId, identity: m });
             events.push(providerEvent(provider.provider, m, ref, content.text, ctx.personUid));
@@ -499,7 +501,7 @@ export function createMeetingsAdapter(options) {
                 catch (err) {
                     // A sign-in or revoked connection must reach run.ts so the ledger
                     // records the reconnect; only other provider errors are swallowed.
-                    if (isProviderAuthFailure(err))
+                    if (isProviderAuthFailure(err) || err instanceof SyncLockLostError)
                         throw err;
                     warn(`meetings: ${provider.provider} ${gateway.connectionId} failed; its watermark stays put: ${err instanceof Error ? err.message : String(err)}`);
                 }

package/dist/lib/hot-channels/contract.d.ts

@@ -79,6 +79,12 @@ export interface PollContext {
      * the vault and also pulls Fireflies or Granola notes).
      */
     gateways?: HotChannelGateway[];
+    /**
+     * Called before an adapter writes to the vault itself (meetings writes
+     * provider notes during fetch). Throws to stop the run when the sync lock
+     * was lost.
+     */
+    beforeWrite?: () => Promise<void>;
 }
 export interface PollPage {
     events: HotEvent[];

package/dist/lib/hot-channels/ledger.js

@@ -154,6 +154,13 @@ export async function runHotChannelSync(input) {
             crash = err;
         }
         finally {
+            // Check the lock before the ledger write too. When it is gone, this
+            // line records the lost lock (the one write still allowed) and the run stops.
+            if (!(crash instanceof SyncLockLostError) && input.beforeWrite) {
+                const guardError = await guardFailure(input.beforeWrite);
+                if (guardError !== undefined)
+                    crash = guardError;
+            }
             const failure = crash !== undefined ? errorText(crash) : (result?.error?.message ?? passFailure);
             const line = {
                 runId,
@@ -180,6 +187,16 @@ export async function runHotChannelSync(input) {
     }
     return { runId, results, entries };
 }
+/** Run the write guard and return what it threw, or undefined when the lock is still held. */
+async function guardFailure(beforeWrite) {
+    try {
+        await beforeWrite();
+        return undefined;
+    }
+    catch (err) {
+        return err;
+    }
+}
 function errorText(err) {
     return err instanceof Error ? err.message : String(err);
 }

package/dist/lib/hot-channels/loop.js

@@ -126,6 +126,7 @@ async function runPoll(ctx, adapter, result, key, gateway, gateways = []) {
         const response = await adapter.fetch(cursor, {
             since,
             personUid: ctx.personUid,
+            beforeWrite: ctx.beforeWrite,
             ...(gateway ? { gateway } : {}),
             ...(gateways.length > 0 ? { gateways } : {}),
         });
@@ -137,6 +138,7 @@ async function runPoll(ctx, adapter, result, key, gateway, gateways = []) {
         // Every event on this page is landed (or quarantined as malformed), so the cursor can move past it. An
         // empty page leaves the stored lastEventKey as it was.
         cursor = response.cursor;
+        await ctx.beforeWrite();
         await ctx.cursorStore.set(ctx.personKey, key, cursor, lastEventKey);
         result.cursorAfter = cursor;
         if (!response.hasMore)

package/dist/lib/lanes/accounts.d.ts

@@ -13,23 +13,7 @@
 import { type LaneRecord, type LaneProvider } from "./types.js";
 import type { LanesConfig } from "./types.js";
 import type { ClaudeCredentialReader, ClaudeTokenState } from "./claude-credential.js";
-export declare const PROVIDER_HOME_ENV: Record<LaneProvider, string>;
-/**
- * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
- * the variable unset it reads the plain `Claude Code-credentials` item, and
- * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
- * for that path. Setting the variable for the default home therefore makes a
- * lane use a different login than the interactive session (incident
- * 2026-10-13). A Claude account whose home is the default is launched with
- * the variable unset instead.
- */
-export declare function isDefaultProviderHome(provider: LaneProvider, home: string, homedir?: () => string): boolean;
-/**
- * Return a copy of `base` with the provider home variable set to `home`,
- * or, for a Claude account on the default home, with the variable removed
- * so the worker and the interactive session share one credential.
- */
-export declare function withProviderHomeEnv(base: NodeJS.ProcessEnv, provider: LaneProvider, home: string, homedir?: () => string): NodeJS.ProcessEnv;
+export { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "./provider-home.js";
 /** Who `claude auth status` says a home is logged in as. Never a token. */
 export interface ClaudeIdentity {
     email: string | null;

package/dist/lib/lanes/accounts.js

@@ -11,57 +11,17 @@
  * This module never prints, copies, or hashes credentials.
  */
 import * as fs from "node:fs";
-import * as os from "node:os";
 import { effectiveAccountHome } from "./account-home.js";
 import * as path from "node:path";
 import { AccountResolutionError } from "./errors.js";
 import { isTerminalLaneState } from "./types.js";
-import { DEFAULT_ACCOUNT_HOMES, accountMaxRunning, canonicalizeHome } from "./config.js";
+import { accountMaxRunning } from "./config.js";
 import { listLaneIds, readLane } from "./store.js";
 import { loadQuotaState, quotaBlockFor } from "./quota.js";
-export const PROVIDER_HOME_ENV = {
-    claude: "CLAUDE_CONFIG_DIR",
-    codex: "CODEX_HOME",
-    grok: "GROK_HOME",
-};
-/**
- * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
- * the variable unset it reads the plain `Claude Code-credentials` item, and
- * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
- * for that path. Setting the variable for the default home therefore makes a
- * lane use a different login than the interactive session (incident
- * 2026-10-13). A Claude account whose home is the default is launched with
- * the variable unset instead.
- */
-export function isDefaultProviderHome(provider, home, homedir = () => os.homedir()) {
-    const deps = {
-        homedir,
-        realpathSync: (p) => fs.realpathSync(p),
-        existsSync: (p) => fs.existsSync(p),
-    };
-    try {
-        return canonicalizeHome(home, deps) === canonicalizeHome(DEFAULT_ACCOUNT_HOMES[provider], deps);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Return a copy of `base` with the provider home variable set to `home`,
- * or, for a Claude account on the default home, with the variable removed
- * so the worker and the interactive session share one credential.
- */
-export function withProviderHomeEnv(base, provider, home, homedir) {
-    const next = { ...base };
-    const envVar = PROVIDER_HOME_ENV[provider];
-    if (provider === "claude" && isDefaultProviderHome(provider, home, homedir)) {
-        delete next[envVar];
-    }
-    else {
-        next[envVar] = home;
-    }
-    return next;
-}
+// Provider home helpers live in a leaf module so bot code can use them
+// without importing the lane store; re-exported for existing callers.
+export { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "./provider-home.js";
+import { PROVIDER_HOME_ENV, isDefaultProviderHome, withProviderHomeEnv } from "./provider-home.js";
 function optionalString(value) {
     return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }

package/dist/lib/lanes/provider-home.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Provider home environment helpers, split from accounts.ts so callers that
+ * only need to point a provider at a home (bots) do not pull in the lane
+ * store and its daemon imports. accounts.ts re-exports these.
+ */
+import type { LaneProvider } from "./types.js";
+export declare const PROVIDER_HOME_ENV: Record<LaneProvider, string>;
+/**
+ * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
+ * the variable unset it reads the plain `Claude Code-credentials` item, and
+ * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
+ * for that path. Setting the variable for the default home therefore makes a
+ * lane use a different login than the interactive session (incident
+ * 2026-10-13). A Claude account whose home is the default is launched with
+ * the variable unset instead.
+ */
+export declare function isDefaultProviderHome(provider: LaneProvider, home: string, homedir?: () => string): boolean;
+/**
+ * Return a copy of `base` with the provider home variable set to `home`,
+ * or, for a Claude account on the default home, with the variable removed
+ * so the worker and the interactive session share one credential.
+ */
+export declare function withProviderHomeEnv(base: NodeJS.ProcessEnv, provider: LaneProvider, home: string, homedir?: () => string): NodeJS.ProcessEnv;
+//# sourceMappingURL=provider-home.d.ts.map

package/dist/lib/lanes/provider-home.js

@@ -0,0 +1,52 @@
+/**
+ * Provider home environment helpers, split from accounts.ts so callers that
+ * only need to point a provider at a home (bots) do not pull in the lane
+ * store and its daemon imports. accounts.ts re-exports these.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import { DEFAULT_ACCOUNT_HOMES, canonicalizeHome } from "./config.js";
+export const PROVIDER_HOME_ENV = {
+    claude: "CLAUDE_CONFIG_DIR",
+    codex: "CODEX_HOME",
+    grok: "GROK_HOME",
+};
+/**
+ * Claude Code keys its OS keychain credential by `CLAUDE_CONFIG_DIR`: with
+ * the variable unset it reads the plain `Claude Code-credentials` item, and
+ * with it set, even to the default `~/.claude`, it reads a hash-suffixed item
+ * for that path. Setting the variable for the default home therefore makes a
+ * lane use a different login than the interactive session (incident
+ * 2026-10-13). A Claude account whose home is the default is launched with
+ * the variable unset instead.
+ */
+export function isDefaultProviderHome(provider, home, homedir = () => os.homedir()) {
+    const deps = {
+        homedir,
+        realpathSync: (p) => fs.realpathSync(p),
+        existsSync: (p) => fs.existsSync(p),
+    };
+    try {
+        return canonicalizeHome(home, deps) === canonicalizeHome(DEFAULT_ACCOUNT_HOMES[provider], deps);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Return a copy of `base` with the provider home variable set to `home`,
+ * or, for a Claude account on the default home, with the variable removed
+ * so the worker and the interactive session share one credential.
+ */
+export function withProviderHomeEnv(base, provider, home, homedir) {
+    const next = { ...base };
+    const envVar = PROVIDER_HOME_ENV[provider];
+    if (provider === "claude" && isDefaultProviderHome(provider, home, homedir)) {
+        delete next[envVar];
+    }
+    else {
+        next[envVar] = home;
+    }
+    return next;
+}
+//# sourceMappingURL=provider-home.js.map

package/dist/lib/lanes/spawn.d.ts

@@ -204,6 +204,18 @@ export declare const FOREGROUND_ONLY_RULE: string;
  * install has it, the command fails with "No such file".
  */
 export declare function tempHomeRule(hqRoot: string): string;
+/**
+ * Self-review rule carried next to the temp-home rule in every composed
+ * brief, for every provider. A PR URL reaches the core-pr-reviews channel only
+ * after two zero-critical reviews of its head: the lane's own review and an
+ * independent senior review. The lane supplies the first one and never posts.
+ *
+ * The report file under workspace/reviews/ uses the format the hq-core
+ * channel guard (block-core-pr-reviews-dm.sh) reads before a URL is posted.
+ * The skill path is absolute so codex and grok lanes, which have no /review
+ * slash command, can read and follow it.
+ */
+export declare function selfReviewRule(hqRoot: string): string;
 /**
  * The answers as written by the reconcile pass (`answered-questions.json`),
  * reduced to id + choice. A malformed file reads as no inline answers; the

package/dist/lib/lanes/spawn.js

@@ -1378,6 +1378,33 @@ export function tempHomeRule(hqRoot) {
         "each fresh home re-downloads the Rust toolchain and pnpm store and is never deleted. " +
         "The wrapper keeps the real caches and removes the temp home when the command exits.");
 }
+/**
+ * Self-review rule carried next to the temp-home rule in every composed
+ * brief, for every provider. A PR URL reaches the core-pr-reviews channel only
+ * after two zero-critical reviews of its head: the lane's own review and an
+ * independent senior review. The lane supplies the first one and never posts.
+ *
+ * The report file under workspace/reviews/ uses the format the hq-core
+ * channel guard (block-core-pr-reviews-dm.sh) reads before a URL is posted.
+ * The skill path is absolute so codex and grok lanes, which have no /review
+ * slash command, can read and follow it.
+ */
+export function selfReviewRule(hqRoot) {
+    const root = path.resolve(hqRoot);
+    const skill = path.join(root, ".claude", "skills", "review", "SKILL.md");
+    const reviews = path.join(root, "workspace", "reviews");
+    return ("SELF-REVIEW. Before reporting done on work that opens or updates a PR, " +
+        `run the paranoid /review (${skill}) on your own final diff, fix every critical, ` +
+        "and re-run until there are 0 criticals. " +
+        "Put the report in the PR body under a 'Self-review' heading with the head SHA. " +
+        `Also save it as a file under ${reviews}/ whose first lines are ` +
+        "`Review-Report: hq-pr-review.v1`, `PR: <url>`, `Head: <40-char head SHA>`, " +
+        "`Reviewer-Role: self-review` and `Criticals: 0`. " +
+        "Save only the final zero-critical run in that file: no other line may start with " +
+        "`PR:`, `Head:`, `Reviewer-Role:` or `Criticals:`. " +
+        "A new commit needs a new review of the new head. " +
+        "Never post to core-pr-reviews. If you cannot produce the report, mark the PR as draft.");
+}
 /**
  * The answers as written by the reconcile pass (`answered-questions.json`),
  * reduced to id + choice. A malformed file reads as no inline answers; the

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -3,6 +3,7 @@
  * outbox/last-flush, and unhealthy when unacked spool age > 60s while online.
  */
 import { type CognitoActorKind, type CognitoTokenSource } from "../../../../utils/cognito-session.js";
+import { type OwnerPushStatus } from "./owner-inbox-push.js";
 import { type UnattributedEventCounts } from "../spool.js";
 import { type DaemonStateFile } from "./state.js";
 import { type LegacyListenPlatform } from "./legacy-listen.js";
@@ -70,6 +71,8 @@ export interface DaemonDoctorReport {
     }>;
     /** True when PATH lists more than one hq. */
     multipleHqOnPath: boolean;
+    /** Owner DM push signal (person accounts). Content-free counter only. */
+    ownerPush?: OwnerPushStatus;
 }
 export interface DaemonDoctorDeps {
     home?: string;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -11,6 +11,7 @@ import { readSessionState } from "../../../work-context/state.js";
 import { workContextRoot } from "../../../work-context/paths.js";
 import { outboxQuarantineStatusEnabled } from "../../../work-context/outbox-quarantine-status-flag.js";
 import { formatDroppedPresenceCompany } from "./credentials.js";
+import { formatOwnerPushStatus, ownerPushStatusForAccount, readOwnerInboxPushState, } from "./owner-inbox-push.js";
 import { countDistinctHeldEvents, countJsonlLines, countUnattributedEvents, } from "../spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../paths.js";
 import { daemonDir, daemonPidPath } from "./paths.js";
@@ -248,6 +249,14 @@ export function collectDaemonDoctor(deps = {}) {
     if (emitRetry > 0) {
         unhealthyReasons.push(`direct-emit retry depth=${emitRetry}`);
     }
+    // Only a person account has an owner DM topic; any other account reports off.
+    const ownerPush = ownerPushStatusForAccount(readOwnerInboxPushState(meshRoot), now(), auth.actorKind);
+    // Only a subscribed push whose heartbeat stopped counts. A rejected or
+    // retrying best-effort subscribe writes connected:false, and an offline
+    // daemon stops the heartbeat; neither makes the daemon unhealthy.
+    if (running && online && ownerPush.connected && ownerPush.status === "stale") {
+        unhealthyReasons.push(`owner push stale (last event ${ownerPush.lastAt ?? "never"})`);
+    }
     return {
         running,
         pid: running ? record?.pid : undefined,
@@ -282,6 +291,7 @@ export function collectDaemonDoctor(deps = {}) {
         emitMode,
         subscribed,
         emitRetryDepth: emitRetry,
+        ownerPush,
         lastPostAt: emitState?.lastPostAt,
         lastEmit: emitState
             ? {
@@ -341,6 +351,9 @@ export function formatDaemonDoctor(report) {
             ` unassigned=${report.lastEmit.unassigned ?? 0}` +
             ` rejected=${report.lastEmit.rejected ?? 0}`
         : ""}`, `emit retry depth: ${report.emitRetryDepth}`);
+    if (report.ownerPush) {
+        lines.push(formatOwnerPushStatus(report.ownerPush));
+    }
     if (report.presenceRefusal) {
         lines.push(`presence refusal: ${report.presenceRefusal.code} (HTTP ${report.presenceRefusal.status}); next retry at ${report.presenceRefusal.nextRetryAt}`);
     }

package/dist/lib/mesh/live/daemon/owner-inbox-push.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Owner (prs_) DM doorbell state for the mesh daemon.
+ *
+ * The server publishes a wake to `hq/{prs}/dm` for each DM, thread reply and
+ * channel post the owner should see. The daemon reads only `type`,
+ * `channelId` and `eventId` from that payload, keeps a channel event only when
+ * the channel belongs to an allowed company, and bumps a content-free counter
+ * in `owner-inbox-push.json`. Message text, poster name and email are never
+ * stored, logged or forwarded.
+ */
+export { OWNER_INBOX_PUSH_STATE_BASENAME } from "../paths.js";
+/** Heartbeat cadence while the owner DM topic is subscribed. */
+export declare const OWNER_PUSH_HEARTBEAT_MS = 5000;
+/** A heartbeat older than this means the push signal is stale. */
+export declare const OWNER_PUSH_STALE_MS = 15000;
+/** Channel list refreshes at most this often when an unknown channel arrives. */
+export declare const OWNER_CHANNEL_REFRESH_MIN_MS = 60000;
+/** A channel-list fetch that runs longer than this is abandoned. */
+export declare const OWNER_CHANNEL_REFRESH_TIMEOUT_MS = 10000;
+export type OwnerDoorbellType = "dm" | "thread" | "channel";
+export interface OwnerDoorbell {
+    type: OwnerDoorbellType;
+    channelId?: string;
+    eventId?: string;
+}
+/** Every key the state file may contain. Nothing else is ever written. */
+export declare const OWNER_INBOX_PUSH_STATE_KEYS: readonly ["connected", "heartbeatAtMs", "count", "lastAt", "lastType", "principalUid"];
+export interface OwnerInboxPushState {
+    connected: boolean;
+    heartbeatAtMs: number;
+    count: number;
+    lastAt?: string;
+    lastType?: OwnerDoorbellType;
+    principalUid?: string;
+}
+/**
+ * Read only `type`, `channelId` and `eventId`. Returns null for anything that
+ * is not a dm, thread or channel wake. Other payload fields are discarded.
+ */
+export declare function parseOwnerDoorbell(payload: Buffer | string): OwnerDoorbell | null;
+/** Read the state file. Missing, non-regular or malformed files return null. */
+export declare function readOwnerInboxPushState(meshRoot: string, onInfo?: (message: string) => void): OwnerInboxPushState | null;
+/** Atomic write (temp file plus rename), mode 0600, allowed keys only. */
+export declare function writeOwnerInboxPushState(meshRoot: string, state: OwnerInboxPushState): void;
+/**
+ * Remove the state file. Used when the account is not a person account, so a
+ * file left by an earlier person login cannot report the push as stale.
+ */
+export declare function clearOwnerInboxPushState(meshRoot: string): void;
+export type OwnerPushStatusKind = "live" | "stale" | "off";
+export interface OwnerPushStatus {
+    status: OwnerPushStatusKind;
+    connected: boolean;
+    count: number;
+    lastAt: string | null;
+    lastType: OwnerDoorbellType | null;
+    heartbeatAt: string | null;
+    heartbeatAgeMs: number | null;
+}
+/**
+ * live: connected with a fresh heartbeat. stale: the file exists but the
+ * subscriber is disconnected or its heartbeat is older than the stale window.
+ * off: no state file (the daemon never subscribed on this machine).
+ */
+export declare function ownerPushStatus(state: OwnerInboxPushState | null, nowMs: number, staleMs?: number): OwnerPushStatus;
+/**
+ * Status for the signed-in account. Only a person account has an owner DM
+ * topic, so any other account kind (agent, outpost, or no login) reports off.
+ */
+export declare function ownerPushStatusForAccount(state: OwnerInboxPushState | null, nowMs: number, actorKind: string): OwnerPushStatus;
+export declare function formatOwnerPushStatus(status: OwnerPushStatus): string;
+export interface ChannelCompanyRow {
+    channelId: string;
+    companyUid?: string;
+}
+export interface OwnerChannelScope {
+    /** True only when the channel is known and its company is allowed. */
+    isInScope(channelId: string): Promise<boolean>;
+}
+/**
+ * Channel filter backed by the owner's channel list. A channel with no
+ * company, an unknown channel, or a company outside the allowed set is
+ * dropped. The allowed set is read on every check so a session lock change
+ * applies at once. The list refreshes at most once per refresh window.
+ */
+export declare function createOwnerChannelScope(opts: {
+    listChannels: () => Promise<ChannelCompanyRow[]>;
+    allowedCompanyUids: () => readonly string[] | undefined;
+    now?: () => number;
+    refreshMinMs?: number;
+    refreshTimeoutMs?: number;
+    onInfo?: (message: string) => void;
+}): OwnerChannelScope;
+//# sourceMappingURL=owner-inbox-push.d.ts.map