@indigoai-us/hq-cli 5.345.19 → 5.345.21

package/assets/scaffold/core/scripts/work-mesh-live-bind-trusted.sh

@@ -144,9 +144,41 @@ if [ "${HQ_WORK_MESH_RECONCILE_STUB:-}" = "1" ]; then
 fi
 
 HQ_BIN="$(command -v hq 2>/dev/null || true)"
-if [ -n "$HQ_BIN" ] && [ -f "$OBS_FILE" ]; then
-  nohup "$HQ_BIN" mesh context reconcile --observation-file "$OBS_FILE" --machine \
-    >/dev/null 2>&1 </dev/null &
-  disown 2>/dev/null || true
+if [ -z "$HQ_BIN" ]; then
+  printf '%s\n' 'Work Mesh reconcile skipped: hq CLI not found on PATH.' >&2
+else
+  flag_reader="$ROOT/.claude/hooks/work-mesh-daemon-not-loaded-flag.cjs"
+  daemon_warning_enabled=false
+  if [[ -n "${HQ_FLAGS_API_URL:-}" \
+    && "${HQ_COMPANY_UID:-}" =~ ^cmp_[A-Za-z0-9]{3,128}$ ]] \
+    && command -v node >/dev/null 2>&1 && [[ -f "$flag_reader" ]]; then
+    daemon_warning_enabled="$(HQ_CLI_BIN="$HQ_BIN" node "$flag_reader")" || daemon_warning_enabled=false
+  fi
+  if [ "$daemon_warning_enabled" = "true" ]; then
+    # Status only reads the installed service and its live state. Keep this hook
+    # bounded, and fail quiet when the CLI or service manager cannot answer.
+    daemon_status_file="$(mktemp "${TMPDIR:-/tmp}/hq-work-mesh-daemon-status.XXXXXX" 2>/dev/null)" || daemon_status_file=""
+    if [ -n "$daemon_status_file" ]; then
+      HQ_NO_UPDATE_CHECK=1 "$HQ_BIN" mesh daemon status --json >"$daemon_status_file" 2>/dev/null &
+      daemon_status_pid=$!
+      ( sleep 2; kill "$daemon_status_pid" 2>/dev/null || true ) &
+      daemon_status_watchdog=$!
+      daemon_status_rc=0
+      wait "$daemon_status_pid" || daemon_status_rc=$?
+      kill "$daemon_status_watchdog" 2>/dev/null || true
+      wait "$daemon_status_watchdog" 2>/dev/null || true
+      if [ "$daemon_status_rc" -eq 0 ] && command -v jq >/dev/null 2>&1 && \
+        jq -e '(.ok == true) and (.running == false) and (.message | type == "string" and contains("installed ("))' \
+          "$daemon_status_file" >/dev/null 2>&1; then
+        printf '%s\n' 'Work Mesh daemon is installed but not loaded; start it with: hq mesh daemon install' >&2
+      fi
+      rm -f "$daemon_status_file" 2>/dev/null || true
+    fi
+  fi
+  if [ -f "$OBS_FILE" ]; then
+    nohup "$HQ_BIN" mesh context reconcile --observation-file "$OBS_FILE" --machine \
+      >/dev/null 2>&1 </dev/null &
+    disown 2>/dev/null || true
+  fi
 fi
 exit 0

package/assets/scaffold/core/scripts/worktree-gc.sh

@@ -249,7 +249,7 @@ for wt in "${CANDIDATES[@]:-}"; do
   created_epoch="$wt_mtime"
   stamp_file="$GC_META_DIR/$(path_key "$wt").json"
   if [[ -f "$stamp_file" ]]; then
-    stamped=$(jq -r '.createdAtEpoch // empty' "$stamp_file" 2>/dev/null || echo "")
+    stamped=$(jq -r '.createdAtEpoch // empty' "$stamp_file" 2>/dev/null | tr -d '\r' || echo "")
     [[ -n "$stamped" ]] && created_epoch="$stamped"
   fi
   age_days=$(( (NOW - created_epoch) / 86400 ))

package/dist/commands/core-ontology-native.js

@@ -799,15 +799,119 @@ export function worklistCommand(args, root) {
     if (validation.code !== 0)
         return err(2, `${validation.stderr}${validation.stdout}${validation.stderr}`);
     const ledger = path.join(directory, ".processed");
+    const skipLedger = path.join(directory, ".skipped");
+    const parserVersion = 2;
     if (doneItem) {
-        fs.appendFileSync(ledger, `${path.basename(doneItem)}\n`);
+        fs.appendFileSync(ledger, `${path.basename(doneItem)}\t${parserVersion}\n`);
         return ok();
     }
+    const hasFrontmatterField = (file, field) => {
+        if (!fs.existsSync(file))
+            return false;
+        let frontmatter = 0;
+        for (const rawLine of fs.readFileSync(file, "utf8").split("\n")) {
+            const line = rawLine.replace(/\r$/, "");
+            if (line === "---") {
+                frontmatter += 1;
+                if (frontmatter === 2)
+                    return false;
+                continue;
+            }
+            if (frontmatter === 1 && line.startsWith(`${field}:`))
+                return true;
+        }
+        return false;
+    };
+    const rewriteIfChanged = (file, original, output) => {
+        if (output === original)
+            return;
+        const temporary = `${file}.native-${process.pid}`;
+        fs.writeFileSync(temporary, output);
+        fs.renameSync(temporary, file);
+    };
+    // Match the shell's parser-version migration. Unstamped legacy rows are
+    // stamped unless they carry the old resolved_participants bug signature;
+    // older parser versions are dropped so those sources are re-evaluated.
+    let processed = "";
+    if (fs.existsSync(ledger)) {
+        const original = fs.readFileSync(ledger, "utf8");
+        const kept = [];
+        let changed = false;
+        const rows = original.split("\n");
+        if (rows.at(-1) === "")
+            rows.pop();
+        for (const rawLine of rows) {
+            const fields = rawLine.split("\t");
+            const basename = (fields[0] ?? "").replace(/\r$/, "");
+            const version = (fields[1] ?? "").replace(/\r$/, "");
+            if (!basename)
+                continue;
+            if (version) {
+                if (/^[+-]?\d+$/.test(version) && Number(version) < parserVersion) {
+                    changed = true;
+                    continue;
+                }
+                kept.push(`${basename}\t${version}`);
+                continue;
+            }
+            changed = true;
+            if (hasFrontmatterField(path.join(directory, basename), "resolved_participants"))
+                continue;
+            kept.push(`${basename}\t${parserVersion}`);
+        }
+        processed = kept.join("\n");
+        if (kept.length > 0)
+            processed += "\n";
+        if (changed)
+            rewriteIfChanged(ledger, original, processed);
+    }
+    let skipped = "";
+    if (fs.existsSync(skipLedger)) {
+        const original = fs.readFileSync(skipLedger, "utf8");
+        const kept = [];
+        let changed = false;
+        const rows = original.split("\n");
+        if (rows.at(-1) === "")
+            rows.pop();
+        for (const rawLine of rows) {
+            const fields = rawLine.split("\t");
+            const basename = fields[0] ?? "";
+            const reason = fields[1] ?? "";
+            const version = fields[2] ?? "";
+            if (!basename)
+                continue;
+            if (!version || (/^[+-]?\d+$/.test(version) && Number(version) < parserVersion)) {
+                changed = true;
+                continue;
+            }
+            kept.push(`${basename}\t${reason}\t${version}`);
+        }
+        skipped = kept.join("\n");
+        if (kept.length > 0)
+            skipped += "\n";
+        if (changed)
+            rewriteIfChanged(skipLedger, original, skipped);
+    }
+    const isProcessed = (basename) => processed.split("\n").some((line) => {
+        if (!line)
+            return false;
+        const [name, version] = line.split("\t");
+        if (name !== basename)
+            return false;
+        if (version === undefined || version === "")
+            return true;
+        return Number(version) >= parserVersion;
+    });
+    const isSkippedAtCurrentVersion = (basename) => skipped.split("\n").some((line) => {
+        if (!line)
+            return false;
+        const fields = line.split("\t");
+        return fields[0] === basename && fields[2] === String(parserVersion);
+    });
     const run = awkField(sourceFile, "run", false);
     const rule = awkField(sourceFile, "audience_rule", false);
     if (run === "cloud" && !force)
         return err(4, "assigned to cloud agent (run: cloud); pass --force to run locally\n");
-    const processed = fs.existsSync(ledger) ? fs.readFileSync(ledger, "utf8").split("\n") : [];
     const entries = fs.existsSync(directory)
         ? fs.readdirSync(directory).filter((name) => name.endsWith(".md") && !name.startsWith("."))
             .filter((name) => { try {
@@ -821,12 +925,12 @@ export function worklistCommand(args, root) {
     const output = [];
     let count = 0;
     for (const name of entries) {
-        if (processed.includes(name))
+        if (isProcessed(name) || isSkippedAtCurrentVersion(name))
             continue;
         if (/^[+-]?\d+$/.test(limit) && count >= Number(limit))
             break;
         if (!/^[+-]?\d+$/.test(limit)) {
-            process.stderr.write(`${resolveBundledAsset(`${ASSET}ontology-source-worklist.sh`)}: line 61: [: ${limit}: integer expression expected\n`);
+            process.stderr.write(`${resolveBundledAsset(`${ASSET}ontology-source-worklist.sh`)}: line 186: [: ${limit}: integer expression expected\n`);
         }
         count += 1;
         const file = path.join(directory, name);
@@ -860,6 +964,8 @@ export function worklistCommand(args, root) {
             }
         }
         if (!audience) {
+            fs.appendFileSync(skipLedger, `${name}\tno-audience\t${parserVersion}\n`);
+            skipped += `${name}\tno-audience\t${parserVersion}\n`;
             output.push(`${JSON.stringify({ file: relative, skip: "no-audience" })}\n`);
             continue;
         }

package/dist/commands/core-register-project-native.js

@@ -51,11 +51,44 @@ function companyUid(company, deps) {
         return direct;
     const file = path.join(deps.root, "companies", company, ".company-uid");
     try {
-        return deps.fs.readFileSync(file, "utf8").replace(/[\s\u0085\u00a0]+/g, "");
+        const fromFile = deps.fs.readFileSync(file, "utf8").replace(/[\s\u0085\u00a0]+/g, "");
+        if (fromFile)
+            return fromFile;
+    }
+    catch { /* shell falls through to companies/manifest.yaml */ }
+    const manifest = path.join(deps.root, "companies", "manifest.yaml");
+    let contents;
+    try {
+        contents = deps.fs.readFileSync(manifest, "utf8");
     }
     catch {
         return null;
     }
+    let inCompanies = false;
+    let inCompany = false;
+    for (const line of contents.split(/\r?\n/u)) {
+        if (/^companies:[\t ]*$/u.test(line)) {
+            inCompanies = true;
+            continue;
+        }
+        if (inCompanies && /^[^\t ]/u.test(line)) {
+            inCompanies = false;
+            inCompany = false;
+        }
+        if (inCompanies && /^ {2}[^ #][^:]*:/u.test(line)) {
+            const slug = line.trim().split(/[\t ]+/u, 1)[0]?.replace(/:$/u, "");
+            inCompany = slug === company;
+            continue;
+        }
+        if (inCompany && /^ {2}[^\t ]/u.test(line))
+            break;
+        if (inCompany) {
+            const fields = line.trim().split(/[\t ]+/u);
+            if (fields[0] === "cloud_uid:" && fields[1])
+                return fields[1].replace(/["']/gu, "").replace(/[\t ]+$/u, "");
+        }
+    }
+    return null;
 }
 function boardPath(company, deps) { return path.join(deps.root, "companies", company, "board.json"); }
 function runHelpProbe(deps) {
@@ -217,7 +250,7 @@ function audit(company, deps) {
                 return false;
             const uid = companyUid(company, deps);
             if (uid === null) {
-                stderr += `no company uid for ${company} (set HQ_COMPANY_UID or companies/${company}/.company-uid)\n`;
+                stderr += `no company uid for ${company} (set HQ_COMPANY_UID, companies/${company}/.company-uid, or manifest cloud_uid)\n`;
                 return true;
             }
             return !deps.fs.existsSync(path.join(deps.env.HOME || os.homedir(), ".hq/work-mesh/cache/projects", uid, `${project}.json`));
@@ -243,7 +276,7 @@ function storyNotDone(prd, deps, diagnostics) {
             diagnostics.push(jq.stderr);
         else if (jq.error?.code === "ENOENT") {
             const script = resolveBundledAsset(REGISTER_PROJECT_ASSET);
-            diagnostics.push(`${script}: line 34: jq: command not found\n`);
+            diagnostics.push(`${script}: line 65: jq: command not found\n`);
         }
         return false;
     }

package/dist/commands/doctor.d.ts

@@ -57,6 +57,8 @@ export interface RunDoctorOptions {
     json?: boolean;
     /** Resolve hq-flags independently for each company represented in sync results. */
     resolveClientHealthReasonCodesForCompany?: (companySlug: string | null) => Promise<boolean>;
+    /** Resolve the separate status-report flag per company in sync results. */
+    resolveClientHealthCheckStatusForCompany?: (companySlug: string | null) => Promise<boolean>;
     /** In text mode, also print every PASS result. Default: false. */
     verbose?: boolean;
     /** In text mode, emit ANSI colour. Default: false (no escape sequences). */
@@ -117,6 +119,7 @@ export interface RunDoctorResult {
  * read; all other default tiers remain local unless explicitly opted in.
  */
 export declare function runDoctor(options?: RunDoctorOptions): Promise<RunDoctorResult>;
+export declare function createClientHealthCheckStatusCompanyResolver(hqRoot: string): (companySlug: string | null) => Promise<boolean>;
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
 export declare function registerDoctorCommand(program: Command): void;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.js

@@ -32,7 +32,7 @@ import { DEEP_FAMILY_ID, DEEP_FAMILY_TITLE, runDeepGuardTests, } from "../lib/do
 import { PARITY_FAMILY_ID, PARITY_FAMILY_TITLE, runParityReplay, } from "../lib/doctor/deep/parity.js";
 import { applyFixes } from "../lib/doctor/fix/apply.js";
 import { renderDoctorFixJson } from "../lib/doctor/fix/json-output.js";
-import { clientHealthReasonCodesEnabled as isActiveCompanyClientHealthReasonCodesEnabled, clientHealthReasonCodesEnabledForCompany, } from "../lib/doctor/client-health-reason-codes-flag.js";
+import { clientHealthCheckStatusEnabled as isActiveCompanyClientHealthCheckStatusEnabled, clientHealthCheckStatusEnabledForCompany, clientHealthReasonCodesEnabled as isActiveCompanyClientHealthReasonCodesEnabled, clientHealthReasonCodesEnabledForCompany, } from "../lib/doctor/client-health-reason-codes-flag.js";
 import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
@@ -166,15 +166,21 @@ export async function runDoctor(options = {}) {
         });
     }
     if (options.json) {
-        const clientHealthReasonCodesEnabledCheckIds = options.resolveClientHealthReasonCodesForCompany
-            ? await resolveClientHealthReasonCodesCheckIds(families, options.resolveClientHealthReasonCodesForCompany)
-            : undefined;
+        const [clientHealthReasonCodesEnabledCheckIds, clientHealthCheckStatusEnabledCheckIds] = await Promise.all([
+            options.resolveClientHealthReasonCodesForCompany
+                ? resolveClientHealthReasonCodesCheckIds(families, options.resolveClientHealthReasonCodesForCompany)
+                : undefined,
+            options.resolveClientHealthCheckStatusForCompany
+                ? resolveClientHealthCheckStatusCheckIds(families, options.resolveClientHealthCheckStatusForCompany)
+                : undefined,
+        ]);
         write(renderJson(buildDoctorJson({
             hqRoot: hqRoot ?? "",
             families,
             platform,
             scope,
             clientHealthReasonCodesEnabledCheckIds,
+            clientHealthCheckStatusEnabledCheckIds,
         })));
     }
     else {
@@ -220,6 +226,34 @@ async function resolveClientHealthReasonCodesCheckIds(families, resolveForCompan
     }
     return enabledChecks;
 }
+async function resolveClientHealthCheckStatusCheckIds(families, resolveForCompany) {
+    const checksByCompany = new Map();
+    for (const run of families) {
+        if (run.family.id !== "sync")
+            continue;
+        for (const result of run.results) {
+            if (result.status !== "FAIL" && result.status !== "WARN")
+                continue;
+            const scoped = /^sync\.(?:journal|manifest)\.(.+)$/.exec(result.checkId);
+            const companySlug = scoped && isCompanyJournalSlug(scoped[1]) ? scoped[1] : null;
+            const checkIds = checksByCompany.get(companySlug) ?? [];
+            checkIds.push(result.checkId);
+            checksByCompany.set(companySlug, checkIds);
+        }
+    }
+    const enabledChecks = new Set();
+    const decisions = await Promise.all([...checksByCompany.entries()].map(async ([companySlug, checkIds]) => ({
+        checkIds,
+        enabled: await resolveForCompany(companySlug),
+    })));
+    for (const decision of decisions) {
+        if (decision.enabled) {
+            for (const checkId of decision.checkIds)
+                enabledChecks.add(checkId);
+        }
+    }
+    return enabledChecks;
+}
 function createClientHealthReasonCodeCompanyResolver(hqRoot) {
     const companies = readCompaniesManifestMap(hqRoot);
     return async (companySlug) => {
@@ -245,6 +279,37 @@ function createClientHealthReasonCodeCompanyResolver(hqRoot) {
         });
     };
 }
+export function createClientHealthCheckStatusCompanyResolver(hqRoot) {
+    const companies = readCompaniesManifestMap(hqRoot);
+    return async (companySlug) => {
+        if (companySlug === null) {
+            return isActiveCompanyClientHealthCheckStatusEnabled();
+        }
+        const scopedCompanyUid = /^company:(cmp_[A-Za-z0-9]{3,128})$/.exec(companySlug);
+        if (scopedCompanyUid) {
+            return clientHealthCheckStatusEnabledForCompany({
+                companyUid: scopedCompanyUid[1],
+            });
+        }
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(companySlug)) {
+            return false;
+        }
+        const manifestUid = companies?.[companySlug]?.cloud_uid;
+        const activeSlug = process.env.HQ_COMPANY_SLUG?.trim() || "";
+        const activeUid = process.env.HQ_COMPANY_UID?.trim() || "";
+        const companyUid = typeof manifestUid === "string" && manifestUid.trim()
+            ? manifestUid.trim()
+            : companySlug === activeSlug
+                ? activeUid
+                : "";
+        if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid))
+            return false;
+        return clientHealthCheckStatusEnabledForCompany({
+            companyUid,
+            companySlug,
+        });
+    };
+}
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
 export function registerDoctorCommand(program) {
     program
@@ -334,6 +399,14 @@ export function registerDoctorCommand(program) {
                     : undefined;
             })()
             : undefined;
+        const clientHealthCheckStatusResolver = json && opts.clientHealthReport === true
+            ? (() => {
+                const hqRoot = resolveHqRoot();
+                return hqRoot
+                    ? createClientHealthCheckStatusCompanyResolver(hqRoot)
+                    : undefined;
+            })()
+            : undefined;
         const result = await runDoctor({
             json,
             // `src/main.ts` also declares --verbose on the root program. When
@@ -350,6 +423,7 @@ export function registerDoctorCommand(program) {
             company: opts.company,
             only: parseOnly(opts.only),
             resolveClientHealthReasonCodesForCompany: clientHealthReasonCodesResolver,
+            resolveClientHealthCheckStatusForCompany: clientHealthCheckStatusResolver,
         });
         // Set the exit code rather than calling process.exit, so the CLI's
         // normal shutdown (telemetry flush) still runs. Non-zero means either an

package/dist/commands/integrations-connect.js

@@ -19,6 +19,7 @@
 import chalk from "chalk";
 import open from "open";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { safeCaughtError } from "../utils/safe-caught-error.js";
 import { runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { consoleOrigin } from "../utils/console-origin.js";
 export { consoleOrigin };
@@ -29,6 +30,9 @@ import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBluep
 import { OAUTH_LOOPBACK_TIMEOUT_CODE, startLoopbackListener, } from "./integrations-oauth.js";
 /** hq-pro's machine code for "this endpoint needs a browser sign-in". */
 const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
+function warnBrowserOpenFailure(error) {
+    console.warn("[hq-cli:integrations-connect] browser open failed", safeCaughtError(error));
+}
 /**
  * A server-authoritative "this endpoint is OAuth-protected, run the browser
  * sign-in instead" signal, in EITHER of the two shapes hq-pro emits it:
@@ -679,7 +683,7 @@ async function consoleHandoff(target, opts) {
         console.error(chalk.yellow(`Note: --scopes cannot be carried into a console sign-in, so this connect will use ${target.label}'s default permissions.`));
     }
     if (url && opts.browser !== false)
-        await open(url).catch(() => { });
+        await open(url).catch((error) => warnBrowserOpenFailure(error));
     console.error(chalk.dim("When the browser says it connected, run `hq integrations list` to confirm."));
     return null;
 }
@@ -712,7 +716,7 @@ export async function bringYourOwnClientHandoff(target, opts, reason, redirectUr
     console.error("The console shows the callback URL to register and takes the credentials.");
     printConsoleDestination(target, opts, url);
     if (url && opts.browser !== false)
-        await open(url).catch(() => { });
+        await open(url).catch((error) => warnBrowserOpenFailure(error));
     return null;
 }
 /**
@@ -837,7 +841,7 @@ async function userClientSignIn(token, companyUid, target, opts, client, request
     if (googleHint)
         console.error(chalk.yellow(googleHint));
     if (opts.browser !== false)
-        await open(started.authorizationUrl).catch(() => { });
+        await open(started.authorizationUrl).catch((error) => warnBrowserOpenFailure(error));
     console.error(chalk.dim("The browser finishes on the HQ console. When it says connected, " +
         "run `hq integrations list` to confirm."));
     return null;

package/dist/commands/lanes.js

@@ -62,7 +62,7 @@ import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, lan
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, aliveDirectChildren, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "../lib/lanes/lane-company.js";
@@ -507,7 +507,12 @@ function laneHireFields(lane, lanes, aliveChildrenByParent, finishedChildrenDoNo
     };
 }
 function hireGrantFinishedChildrenDoNotCount(ctx, lane) {
-    const resolution = resolveLaneCompany(ctx.hqRoot(), lane);
+    const resolution = resolveLaneCompany(ctx.hqRoot(), {
+        lane_id: lane.lane_id,
+        company: lane.company ?? null,
+        mesh_company: lane.mesh_company,
+        project_id: lane.project_id ?? "",
+    });
     const company = resolution.company ?? undefined;
     return readLanesRegistryFlagFailOff(LANE_HIRE_GRANT_FINISHED_LANES_FLAG, {
         company,
@@ -1036,9 +1041,15 @@ async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
         !sameHireGrantSenior(lane.senior, grantContext.expected_senior))) {
         throw new LanesError("hire_grant_senior_changed", `Lane ${lane.lane_id}'s senior changed after the primary authorized its Outpost dispatch`, { lane_id: lane.lane_id, expected_senior: grantContext.expected_senior, current_senior: lane.senior });
     }
-    const finishedChildrenDoNotCount = isFinishedResumableHireChild(lane.state)
-        ? await hireGrantFinishedChildrenDoNotCount(ctx, lane)
-        : false;
+    let finishedChildrenDoNotCount = false;
+    if (isTerminalLaneState(lane.state) || isFinishedResumableHireChild(lane.state)) {
+        const seniorLaneId = lane.senior.kind === "lane" ? lane.senior.id : undefined;
+        const resumeSenior = seniorLaneId
+            ? grantContext?.hierarchy.find((entry) => entry.lane_id === seniorLaneId) ??
+                (listLaneIds(hqRoot).includes(seniorLaneId) ? readLane(hqRoot, seniorLaneId) : lane)
+            : lane;
+        finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, resumeSenior);
+    }
     const shouldCheckGrant = isTerminalLaneState(lane.state) ||
         (finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state));
     if (!shouldCheckGrant ||
@@ -5736,6 +5747,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
         initial.senior.kind === "lane" && initial.senior.id
         ? await readRemoteHireGrantSenior(ctx, hqRoot, initial.senior.id)
         : undefined;
+    const finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, initial);
     const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
         const currentCallerAuthorization = authorization === "senior"
@@ -5779,11 +5791,11 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
             if (isTerminalLaneState(parent.state)) {
                 throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot change grants`, { senior_lane_id: parent.lane_id, state: parent.state });
             }
-            const siblings = aliveDirectChildren(hierarchy, parent.lane_id);
+            const siblings = childrenHoldingHireGrantCarve(hierarchy, parent.lane_id, finishedChildrenDoNotCount);
             const parentGrant = parent.hire_grant ?? 0;
             const assigned = assignedChildHireGrants(siblings, current.lane_id);
             const available = Math.max(0, parentGrant - assigned);
-            if (hireGrant > available) {
+            if (hireGrant > (current.hire_grant ?? 0) && hireGrant > available) {
                 throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
                     senior_lane_id: parent.lane_id,
                     parent_grant: parentGrant,
@@ -5794,7 +5806,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
                 });
             }
         }
-        const children = aliveDirectChildren(hierarchy, current.lane_id);
+        const children = childrenHoldingHireGrantCarve(hierarchy, current.lane_id, finishedChildrenDoNotCount);
         const allocated = assignedChildHireGrants(children);
         const minimumGrant = Math.max(allocated, children.length);
         if (hireGrant < minimumGrant) {
@@ -7063,6 +7075,7 @@ async function reparentOnOwner(ctx, laneId, opts) {
     const nextSenior = parseSeniorRef(opts.senior);
     assertSeniorExists(hqRoot, nextSenior, ctx);
     const initial = readLane(hqRoot, laneId);
+    const finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, initial);
     const refreshParents = new Set();
     if (initial.senior.kind === "lane" && initial.senior.id)
         refreshParents.add(initial.senior.id);
@@ -7074,7 +7087,7 @@ async function reparentOnOwner(ctx, laneId, opts) {
         ...(initial.senior.kind === "lane" && initial.senior.id ? [initial.senior.id] : []),
         ...(nextSenior.kind === "lane" && nextSenior.id ? [nextSenior.id] : []),
     ];
-    return withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts));
+    return withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount));
 }
 async function runReparentOwnerTarget(ctx, laneId, opts) {
     if (!ctx.isSsmOwnerDispatch()) {
@@ -7094,7 +7107,7 @@ async function runReparentOwnerTarget(ctx, laneId, opts) {
         changed_descendant_ids: result.changedDescendantIds,
     });
 }
-function runReparentLocked(ctx, laneId, opts) {
+function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false) {
     const hqRoot = ctx.hqRoot();
     if (!opts.senior) {
         throw new LanesError("missing_senior", "--senior is required", {});
@@ -7108,26 +7121,27 @@ function runReparentLocked(ctx, laneId, opts) {
     }
     const seniorCompany = companyOfSenior(hqRoot, nextSenior, ctx);
     assertSameTenant(lane.company, nextSenior, seniorCompany, { lane_id: laneId });
-    if (nextSenior.kind === "lane" &&
-        seniorKey(lane.senior) !== seniorKey(nextSenior)) {
+    if (nextSenior.kind === "lane" && seniorKey(lane.senior) !== seniorKey(nextSenior)) {
         const parent = readLane(hqRoot, nextSenior.id);
         if (isTerminalLaneState(parent.state)) {
             throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot accept lane children`, { senior_lane_id: parent.lane_id, state: parent.state });
         }
-        const children = aliveDirectChildren(loadAllLanes(hqRoot), parent.lane_id);
-        if (children.length >= (parent.hire_grant ?? 0)) {
-            throw hireGrantCapacityError(parent, children);
-        }
-        const available = Math.max(0, (parent.hire_grant ?? 0) - assignedChildHireGrants(children));
-        const requested = lane.hire_grant ?? 0;
-        if (requested > available) {
-            throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
-                senior_lane_id: parent.lane_id,
-                parent_grant: parent.hire_grant ?? 0,
-                assigned_child_grants: assignedChildHireGrants(children),
-                requested_hire_grant: requested,
-                available_hire_grant: available,
-            });
+        if (laneHoldsHireGrantCarve(lane, finishedChildrenDoNotCount)) {
+            const children = childrenHoldingHireGrantCarve(loadAllLanes(hqRoot), parent.lane_id, finishedChildrenDoNotCount);
+            if (children.length >= (parent.hire_grant ?? 0)) {
+                throw hireGrantCapacityError(parent, children);
+            }
+            const available = Math.max(0, (parent.hire_grant ?? 0) - assignedChildHireGrants(children));
+            const requested = lane.hire_grant ?? 0;
+            if (requested > available) {
+                throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
+                    senior_lane_id: parent.lane_id,
+                    parent_grant: parent.hire_grant ?? 0,
+                    assigned_child_grants: assignedChildHireGrants(children),
+                    requested_hire_grant: requested,
+                    available_hire_grant: available,
+                });
+            }
         }
     }
     if (walkHitsLane(hqRoot, nextSenior, laneId, ctx)) {

package/dist/lib/bot/continuity-download.js

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
 import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
 import { vaultApiFetch } from "../../utils/vault-api.js";
+import { safeCaughtError } from "../../utils/safe-caught-error.js";
 async function readOwnVault(input) {
     const client = new S3Client({ region: "us-east-1", credentials: input.credentials });
     try {
@@ -52,7 +53,9 @@ export async function downloadContinuitySnapshot(input, deps = { credential: ens
         }
     }
     finally {
-        await reader.cancel().catch(() => { });
+        await reader.cancel().catch((error) => {
+            console.warn("[hq-cli:bot/continuity-download] reader.cancel failed", safeCaughtError(error));
+        });
         download.close();
     }
     const bytes = Buffer.concat(chunks);