@indigoai-us/hq-cli 5.345.191 → 5.345.193

package/dist/lib/hot-channels/adapters/linear.js

@@ -34,7 +34,19 @@
  * A revoked or expired token (`invalid_grant`) surfaces from the gateway call;
  * run.ts turns it into a reconnect prompt in the run ledger and the cursor
  * does not move.
+ *
+ * A rate-limited call (HTTP 429, or a rate-limit error from the gateway) is
+ * retried up to `LINEAR_MAX_RETRIES` times, waiting for `Retry-After` when the
+ * error carries one (capped) or an exponential backoff otherwise. When the
+ * retries run out the fetch throws `LinearRateLimitedError`, so the run fails,
+ * nothing lands for that page and the cursor does not move.
+ *
+ * Request budget: a run makes at most `DEFAULT_MAX_PAGES_PER_ADAPTER` (20)
+ * pages, each at most `1 + LINEAR_MAX_RETRIES` requests, so
+ * `LINEAR_MAX_REQUESTS_PER_RUN` is 60. 41 worst-case runs in one hour still
+ * stay under `LINEAR_REQUESTS_PER_HOUR` (2,500).
  */
+import { DEFAULT_MAX_PAGES_PER_ADAPTER } from "../loop.js";
 export const LINEAR_ADAPTER_ID = "linear";
 export const LINEAR_CHANNEL = "linear";
 export const LINEAR_PROVIDER = "linear";
@@ -44,6 +56,12 @@ export const LINEAR_LIST_ISSUES_TOOL = "list_issues";
 export const LINEAR_REQUESTS_PER_HOUR = 2500;
 export const LINEAR_CATCH_UP_WINDOW_MS = 14 * 24 * 60 * 60 * 1000;
 const SUGGESTION_WINDOW_MS = 14 * 24 * 60 * 60 * 1000;
+/** Retries for one rate-limited `list_issues` call before the run gives up. */
+export const LINEAR_MAX_RETRIES = 2;
+/** Most requests one run can make: every page, every retry. */
+export const LINEAR_MAX_REQUESTS_PER_RUN = DEFAULT_MAX_PAGES_PER_ADAPTER * (1 + LINEAR_MAX_RETRIES);
+const BASE_BACKOFF_MS = 1000;
+const MAX_BACKOFF_MS = 30_000;
 const DEFAULT_PAGE_SIZE = 100;
 const MAX_PAGE_SIZE = 250;
 export const LINEAR_ISSUE_FIELDS = [
@@ -70,6 +88,39 @@ const PRIORITY_LABELS = {
     3: "Medium",
     4: "Low",
 };
+/** Linear kept answering 429 after every retry; the cursor stays put. */
+export class LinearRateLimitedError extends Error {
+    retryAfterMs;
+    code = "rate_limited";
+    status = 429;
+    constructor(retryAfterMs) {
+        super("Linear rate limit (429): the run stopped and will resume from the same cursor next time");
+        this.retryAfterMs = retryAfterMs;
+        this.name = "LinearRateLimitedError";
+    }
+}
+const RATE_LIMIT_PATTERN = /\b429\b|rate[ _-]?limit|too many requests|RATELIMITED/i;
+function isRateLimited(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const e = err;
+    if (e.status === 429 || e.statusCode === 429)
+        return true;
+    if (typeof e.code === "string" && RATE_LIMIT_PATTERN.test(e.code))
+        return true;
+    return typeof e.message === "string" && RATE_LIMIT_PATTERN.test(e.message);
+}
+function retryAfterMs(err) {
+    const e = err;
+    let raw = e?.retryAfter;
+    if (raw === undefined && e?.headers && typeof e.headers === "object") {
+        const h = e.headers;
+        raw = typeof h.get === "function" ? h.get("retry-after") : (h["retry-after"] ?? h["Retry-After"]);
+    }
+    const secs = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
+    return Number.isFinite(secs) && secs >= 0 ? secs * 1000 : null;
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 function nonEmptyString(value) {
     return typeof value === "string" && value.trim() !== "" ? value : undefined;
 }
@@ -267,6 +318,22 @@ function toEvent(issue, personUid) {
 }
 export function createLinearAdapter(options = {}) {
     const pageSize = Math.min(MAX_PAGE_SIZE, Math.max(1, Math.floor(options.pageSize ?? DEFAULT_PAGE_SIZE)));
+    const sleep = options.sleep ?? defaultSleep;
+    async function listIssues(ctx, args) {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                return await ctx.gateway.call(LINEAR_LIST_ISSUES_TOOL, args);
+            }
+            catch (err) {
+                if (!isRateLimited(err))
+                    throw err;
+                const wait = retryAfterMs(err);
+                if (attempt >= LINEAR_MAX_RETRIES)
+                    throw new LinearRateLimitedError(wait);
+                await sleep(Math.min(MAX_BACKOFF_MS, wait ?? BASE_BACKOFF_MS * 2 ** attempt));
+            }
+        }
+    }
     async function fetch(cursor, ctx) {
         if (!ctx.gateway)
             throw new Error("Linear hot channel needs a gateway connection");
@@ -280,7 +347,7 @@ export function createLinearAdapter(options = {}) {
         };
         if (state.after)
             args.cursor = state.after;
-        const page = parseIssuePage(await ctx.gateway.call(LINEAR_LIST_ISSUES_TOOL, args));
+        const page = parseIssuePage(await listIssues(ctx, args));
         const watermarkMs = Date.parse(state.watermark);
         let high = state.high;
         const events = [];
@@ -311,6 +378,9 @@ export function createLinearAdapter(options = {}) {
     }
     return {
         id: LINEAR_ADAPTER_ID,
+        displayName: "Linear",
+        provider: LINEAR_PROVIDER,
+        watermarkKind: "cursor",
         channel: LINEAR_CHANNEL,
         transport: "poll",
         hotEventTypes: [LINEAR_ISSUE_UPDATED_EVENT],

package/dist/lib/hot-channels/adapters/meetings.js

@@ -372,7 +372,7 @@ export function createMeetingsAdapter(options) {
             ...(m.calendarEventId ? { calendar_event_id: m.calendarEventId } : {}),
             origin: HOT_SIGNAL_ORIGIN,
         };
-        await writeFileAtomic(file, `---\n${yaml.dump(frontmatter, { lineWidth: -1, noRefs: true }).trimEnd()}\n---\n${text}`);
+        await writeFileAtomic(options.vaultRoot, file, `---\n${yaml.dump(frontmatter, { lineWidth: -1, noRefs: true }).trimEnd()}\n---\n${text}`);
         return ref;
     }
     function providerEvent(provider, m, ref, text, me) {
@@ -515,6 +515,9 @@ export function createMeetingsAdapter(options) {
     }
     return {
         id: MEETINGS_ADAPTER_ID,
+        displayName: "Meetings",
+        provider: MEETINGS_PROVIDER,
+        watermarkKind: "timestamp",
         channel: MEETINGS_CHANNEL,
         transport: "poll",
         hotEventTypes: [MEETING_TRANSCRIPT_EVENT],

package/dist/lib/hot-channels/adapters/slack.js

@@ -149,9 +149,10 @@ function toEvent(t) {
         if (fm[field] !== undefined)
             raw[field] = fm[field];
     return {
-        providerId: `${t.channelId}:${t.threadTs}`,
-        // A thread that gains replies is landed again: new message count or last message.
-        version: `${count ?? 0}.${Number.isNaN(lastMs) ? t.tsMs : lastMs}`,
+        // The event key is `slack:{channel}:{ts}`: one item per thread. A thread
+        // that later gains replies keeps its key, so it does not land again.
+        providerId: t.channelId,
+        version: t.threadTs,
         who: owner,
         what: SLACK_THREAD_EVENT,
         where,
@@ -265,6 +266,9 @@ export function createSlackAdapter(options) {
     }
     return {
         id: SLACK_ADAPTER_ID,
+        displayName: "Slack",
+        provider: SLACK_PROVIDER,
+        watermarkKind: "timestamp",
         channel: SLACK_CHANNEL,
         transport: "poll",
         hotEventTypes: [SLACK_THREAD_EVENT],

package/dist/lib/hot-channels/alert.js

@@ -119,7 +119,7 @@ export async function raiseSignalsFailureAlerts(input) {
     }
     if (changed) {
         try {
-            await writeFileAtomic(file, `${JSON.stringify(state, null, 2)}\n`);
+            await writeFileAtomic(input.vaultRoot, file, `${JSON.stringify(state, null, 2)}\n`);
         }
         catch (err) {
             log(`signals alert state was not saved: ${err instanceof Error ? err.message : String(err)}`);

package/dist/lib/hot-channels/contract.d.ts

@@ -123,7 +123,18 @@ export interface HotChannelDeclaration {
      * run hands every matching connection to `fetch` as `PollContext.gateways`.
      */
     companionProviders?: readonly string[];
+    /** Optional human label, matching the hq-pro catalog entry's `displayName` (US-008). */
+    displayName?: string;
+    /** Optional catalog provider id; defaults to `tokenScope.provider` when unset (US-008). */
+    provider?: string;
+    /**
+     * Optional description of what the stored cursor is (US-008): an opaque
+     * provider `cursor`, an ISO `timestamp`, or a `webhook` buffer position.
+     */
+    watermarkKind?: WatermarkKind;
 }
+export type WatermarkKind = "cursor" | "timestamp" | "webhook";
+export declare const WATERMARK_KINDS: readonly WatermarkKind[];
 /** A feature flag the adapter needs on before it runs. */
 export interface HotChannelGate {
     /** Flag key as registered in hq-pro, e.g. `hq.hot-channel-gmail`. */

package/dist/lib/hot-channels/contract.js

@@ -17,4 +17,5 @@ export const SUGGESTION_RULE_KINDS = [
     "assigned-to-me",
     "owned-by-me",
 ];
+export const WATERMARK_KINDS = ["cursor", "timestamp", "webhook"];
 //# sourceMappingURL=contract.js.map

package/dist/lib/hot-channels/cursors.js

@@ -77,7 +77,7 @@ export function createVaultCursorStore(vaultRoot, options = {}) {
             const file = cursorFilePath(vaultRoot, personKey, adapterId);
             const kept = lastEventKey === undefined ? ((await read(personKey, adapterId))?.lastEventKey ?? null) : lastEventKey;
             const record = { cursor, updatedAt: now().toISOString(), lastEventKey: kept };
-            await writeFileAtomic(file, `${JSON.stringify(record)}\n`);
+            await writeFileAtomic(vaultRoot, file, `${JSON.stringify(record)}\n`);
         },
     };
 }

package/dist/lib/hot-channels/landing.d.ts

@@ -71,8 +71,12 @@ export declare function assertHotEvent(event: HotEvent): void;
  * checks a landed `payload_ref` with the same rule before reading it.
  */
 export declare function assertPayloadRef(ref: string): void;
-/** Write via a sibling temp file and rename, so readers never see a partial file. */
-export declare function writeFileAtomic(file: string, contents: string): Promise<void>;
+/**
+ * Write via a sibling temp file and rename, so readers never see a partial
+ * file. Both paths go through the company-scoped write guard first: a link
+ * that would carry the write into another company's folder fails closed.
+ */
+export declare function writeFileAtomic(vaultRoot: string, file: string, contents: string): Promise<void>;
 /**
  * Land one normalized event as a source document under
  * `sources/{channel}/{source_id}.md`, with its raw payload alongside and a row

package/dist/lib/hot-channels/landing.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
+import { assertVaultPath } from "../signals/write-guard.js";
 /** `origin` written on every hot-signal landed document. */
 export const HOT_SIGNAL_ORIGIN = "hot-signal-sync";
 const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -74,10 +75,16 @@ async function exists(file) {
         return false;
     }
 }
-/** Write via a sibling temp file and rename, so readers never see a partial file. */
-export async function writeFileAtomic(file, contents) {
-    await fs.mkdir(path.dirname(file), { recursive: true });
+/**
+ * Write via a sibling temp file and rename, so readers never see a partial
+ * file. Both paths go through the company-scoped write guard first: a link
+ * that would carry the write into another company's folder fails closed.
+ */
+export async function writeFileAtomic(vaultRoot, file, contents) {
     const tmp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    assertVaultPath(vaultRoot, file);
+    assertVaultPath(vaultRoot, tmp);
+    await fs.mkdir(path.dirname(file), { recursive: true });
     try {
         await fs.writeFile(tmp, contents, "utf8");
         await fs.rename(tmp, file);
@@ -102,7 +109,7 @@ async function appendIndexEntry(vaultRoot, day, entry) {
     if (rows.some((row) => row.channel === entry.channel && row.source_id === entry.source_id))
         return;
     rows.push(entry);
-    await writeFileAtomic(file, `${JSON.stringify(rows, null, 2)}\n`);
+    await writeFileAtomic(vaultRoot, file, `${JSON.stringify(rows, null, 2)}\n`);
 }
 /**
  * Land one normalized event as a source document under
@@ -158,8 +165,8 @@ export async function landHotEvent(input) {
     const markdown = `---\n${yaml.dump(frontmatter, { lineWidth: -1, noRefs: true }).trimEnd()}\n---\n${event.body ?? ""}`;
     // Raw first, markdown second: the markdown is the dedupe marker, so it must
     // only exist once its payload_ref target does.
-    await writeFileAtomic(path.join(vaultRoot, rawKey), `${JSON.stringify(event.raw ?? event, null, 2)}\n`);
-    await writeFileAtomic(markdownFile, markdown);
+    await writeFileAtomic(vaultRoot, path.join(vaultRoot, rawKey), `${JSON.stringify(event.raw ?? event, null, 2)}\n`);
+    await writeFileAtomic(vaultRoot, markdownFile, markdown);
     await appendIndexEntry(vaultRoot, now.slice(0, 10), {
         source_ref: frontmatter.source_ref,
         channel: adapter.channel,

package/dist/lib/hot-channels/ledger.js

@@ -8,6 +8,7 @@
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { assertVaultPath } from "../signals/write-guard.js";
 import { assertNotIntegrationSecretsPath, personDirName } from "./cursors.js";
 import { runHotChannelLoop } from "./loop.js";
 import { SyncLockLostError } from "./sync-lock.js";
@@ -35,6 +36,7 @@ export function runLedgerPath(vaultRoot, personKey, day) {
  */
 export async function appendRunLedgerEntry(vaultRoot, personKey, entry) {
     const file = runLedgerPath(vaultRoot, personKey, ledgerDay(new Date(entry.startedAt)));
+    assertVaultPath(vaultRoot, file);
     await fs.mkdir(path.dirname(file), { recursive: true });
     await fs.appendFile(file, `${JSON.stringify(entry)}\n`, { encoding: "utf8", flag: "a" });
     return file;

package/dist/lib/hot-channels/loop.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { assertVaultPath } from "../signals/write-guard.js";
 import { createVaultCursorStore, cursorKey } from "./cursors.js";
 import { assertHotEvent, assertSafeSegment, eventKey, HotEventValidationError, landHotEvent } from "./landing.js";
 import { SyncLockLostError } from "./sync-lock.js";
@@ -73,19 +74,27 @@ async function landOne(ctx, adapter, event, result) {
  * copy is neither overwritten nor a reason to abort the drain. `link` fails
  * atomically on an existing target.
  */
-async function moveToRejected(file) {
+async function moveToRejected(vaultRoot, file) {
+    assertVaultPath(vaultRoot, file);
+    assertVaultPath(vaultRoot, `${file}.rejected`);
     try {
         await fs.link(file, `${file}.rejected`);
     }
     catch (err) {
         if (err.code !== "EEXIST")
             throw err;
-        await fs.link(file, `${file}.${randomUUID()}.rejected`);
+        const unique = `${file}.${randomUUID()}.rejected`;
+        assertVaultPath(vaultRoot, unique);
+        await fs.link(file, unique);
     }
+    assertVaultPath(vaultRoot, file);
     await fs.rm(file, { force: true });
 }
 async function drainPush(ctx, adapter, result) {
     const dir = pushBufferDir(ctx.vaultRoot, adapter.id, ctx.personUid);
+    // Check the buffer folder before reading it: a link here would read another
+    // company's buffered events into this run and then delete them there.
+    assertVaultPath(ctx.vaultRoot, path.join(dir, ".write-guard-probe"));
     let names;
     try {
         names = await fs.readdir(dir);
@@ -98,6 +107,10 @@ async function drainPush(ctx, adapter, result) {
     const files = names.filter((name) => name.endsWith(".json")).sort().slice(0, ctx.maxPushEvents);
     for (const name of files) {
         const file = path.join(dir, name);
+        // Check each buffer file before reading it. readFile follows a link, so a
+        // buffer file linked into another company would land that company's
+        // event here before any later check ran. A refused file fails the drain.
+        assertVaultPath(ctx.vaultRoot, file);
         let event;
         try {
             event = JSON.parse(await fs.readFile(file, "utf8"));
@@ -105,17 +118,18 @@ async function drainPush(ctx, adapter, result) {
             assertHotEvent(event);
         }
         catch (err) {
-            await moveToRejected(file);
+            await moveToRejected(ctx.vaultRoot, file);
             reject(ctx, adapter, result, `${name}: ${reasonOf(err)}`);
             continue;
         }
         const before = result.rejected;
         await landOne(ctx, adapter, event, result);
         if (result.rejected > before) {
-            await moveToRejected(file);
+            await moveToRejected(ctx.vaultRoot, file);
             continue;
         }
         // Removed only after the event landed, was a duplicate, or was stale.
+        assertVaultPath(ctx.vaultRoot, file);
         await fs.rm(file, { force: true });
     }
 }

package/dist/lib/hot-channels/registry.js

@@ -1,4 +1,4 @@
-import { HOT_TRANSPORTS, MAX_CATCH_UP_WINDOW_MS, SUGGESTION_RULE_KINDS, } from "./contract.js";
+import { HOT_TRANSPORTS, MAX_CATCH_UP_WINDOW_MS, SUGGESTION_RULE_KINDS, WATERMARK_KINDS, } from "./contract.js";
 /** Adapter ids and channels become path segments, so keep them to a safe set. */
 const SAFE_SEGMENT = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 export class InvalidHotChannelAdapterError extends Error {
@@ -84,6 +84,14 @@ export function validateHotChannelAdapter(adapter) {
             rule.minEvents < 1)) {
         fail(a, "recent-activity rules need withinMs > 0 and an integer minEvents >= 1");
     }
+    if (a.watermarkKind !== undefined && !WATERMARK_KINDS.includes(a.watermarkKind)) {
+        fail(a, `watermarkKind must be one of ${WATERMARK_KINDS.join(", ")}`);
+    }
+    for (const field of ["displayName", "provider"]) {
+        if (a[field] !== undefined && (typeof a[field] !== "string" || a[field].trim() === "")) {
+            fail(a, `${field} must be a non-empty string when set`);
+        }
+    }
     if (a.gate !== undefined) {
         const gate = a.gate;
         if (!gate || typeof gate !== "object" || typeof gate.flag !== "string" || gate.flag.trim() === "") {

package/dist/lib/hot-channels/run.d.ts

@@ -90,6 +90,13 @@ export interface OnDemandSyncInput {
     personKey: string;
     /** `--adapter`: a catalog provider or a registered adapter id. */
     adapter?: string;
+    /**
+     * Registered adapter ids allowed to run (the signals adapters step's
+     * locally enabled list). Catalog items and gated adapters outside the list
+     * are left out of this run without an outcome. An id the catalog does not
+     * list is not an error: it simply has nothing to run. Unset = no filter.
+     */
+    onlyAdapters?: readonly string[];
     now?: () => Date;
     runId?: string;
     maxPagesPerAdapter?: number;
@@ -124,13 +131,24 @@ export interface SyncOutcome {
         reason: ReconnectReason;
         prompt: string;
     };
+    /**
+     * Which token the run used for this connection (US-010): `user` when the
+     * signed-in person created the connection, `workspace` when it is a shared
+     * company connection. Absent when no connection was used.
+     */
+    tokenLevel?: HotChannelTokenLevel;
 }
+export type HotChannelTokenLevel = "user" | "workspace";
+/** The token level of a connection: the person's own (`user`) or a shared one (`workspace`). */
+export declare function tokenLevelOf(app: Pick<HotChannelApp, "ownedByCaller">): HotChannelTokenLevel;
 export interface OnDemandSyncReport {
     runId: string | null;
     /** True when the HQ session was gone before anything ran; nothing was written. */
     signInRequired: boolean;
     /** True when another sync for this person and company was running; nothing ran. */
     skipped?: boolean;
+    /** The signed-in person's cursor directory key (`_cursors/@{personKey}`); unset when nobody is signed in. */
+    personKey?: string;
     outcomes: SyncOutcome[];
     entries: RunLedgerEntry[];
     /** Lines for the person (no channels, sign-in needed). */

package/dist/lib/hot-channels/run.js

@@ -72,6 +72,10 @@ export class UnknownSyncAdapterError extends Error {
         this.name = "UnknownSyncAdapterError";
     }
 }
+/** The token level of a connection: the person's own (`user`) or a shared one (`workspace`). */
+export function tokenLevelOf(app) {
+    return app.ownedByCaller === true ? "user" : "workspace";
+}
 const SIGN_IN_PROMPT = "Your HQ session has expired or you're not signed in. Run `hq login`, then `hq sources sync` again.";
 const REVOKED_PATTERN = /revoked|reconnect|invalid_grant|token (has )?expired|OAUTH_REQUIRED/i;
 function statusOf(err) {
@@ -102,11 +106,13 @@ export function reconnectPrompt(app, reason) {
  * adapter with a `gate` that no catalog item resolves to is gated off. These
  * are reported but never planned: no fetch, no cursor and no ledger line.
  */
-function gatedOutcomes(registry, resolvedIds, wanted) {
+function gatedOutcomes(registry, resolvedIds, wanted, only) {
     const out = [];
     for (const adapter of registry.list()) {
         if (!adapter.gate || resolvedIds.has(adapter.id))
             continue;
+        if (only && !only.has(adapter.id))
+            continue;
         const provider = adapter.tokenScope.provider;
         if (wanted !== undefined && adapter.id !== wanted && provider.toLowerCase() !== wanted)
             continue;
@@ -195,6 +201,7 @@ export async function runOnDemandSync(input) {
     const report = {
         runId: null,
         signInRequired: false,
+        personKey: input.personKey,
         outcomes: [],
         entries: [],
         notices: [],
@@ -214,8 +221,9 @@ export async function runOnDemandSync(input) {
         return report;
     }
     const wanted = input.adapter?.toLowerCase();
+    const only = input.onlyAdapters ? new Set(input.onlyAdapters) : undefined;
     if (!items || items.length === 0) {
-        const gated = gatedOutcomes(input.registry, new Set(), wanted);
+        const gated = gatedOutcomes(input.registry, new Set(), wanted, only);
         if (wanted !== undefined && gated.length === 0)
             throw new UnknownSyncAdapterError(input.adapter, []);
         if (wanted === undefined)
@@ -224,7 +232,7 @@ export async function runOnDemandSync(input) {
         return report;
     }
     const resolved = items.map((item) => ({ item, hit: resolveAdapter(input.registry, item) }));
-    const gated = gatedOutcomes(input.registry, new Set(resolved.flatMap(({ hit }) => (hit ? [hit.adapter.id] : []))), wanted);
+    const gated = gatedOutcomes(input.registry, new Set(resolved.flatMap(({ hit }) => (hit ? [hit.adapter.id] : []))), wanted, only);
     if (wanted !== undefined && gated.length === 0) {
         const valid = new Set();
         for (const { item, hit } of resolved) {
@@ -235,7 +243,8 @@ export async function runOnDemandSync(input) {
         if (!valid.has(wanted))
             throw new UnknownSyncAdapterError(input.adapter, [...valid].sort());
     }
-    const selected = resolved.filter(({ item, hit }) => wanted === undefined || item.provider.toLowerCase() === wanted || hit?.adapter.id === wanted);
+    const selected = resolved.filter(({ item, hit }) => (wanted === undefined || item.provider.toLowerCase() === wanted || hit?.adapter.id === wanted) &&
+        (only === undefined || !hit || only.has(hit.adapter.id)));
     const planned = [];
     const skipped = [];
     for (const { item, hit } of selected) {
@@ -328,6 +337,8 @@ export async function runOnDemandSync(input) {
             duplicates: result?.duplicates ?? 0,
             message: result?.error?.message ?? null,
         };
+        if (p.app)
+            outcome.tokenLevel = tokenLevelOf(p.app);
         if (failed && p.app) {
             const reason = reconnects.get(p.app.connectionId) ?? (p.app.status === "needs-attention" ? "revoked" : undefined);
             if (reason)

package/dist/lib/hot-channels/signals-pass.d.ts

@@ -117,6 +117,7 @@ interface ParsedSignal {
     body: string;
 }
 export declare function defaultPromptFile(): string;
+export declare const CLAUDE_LOGGED_OUT_RE: RegExp;
 /**
  * The text claude gets for one landed document. A pointer (both `payload_ref`
  * and `raw_ref` set) gets its payload appended after a separator line. Any

package/dist/lib/hot-channels/signals-pass.js

@@ -25,6 +25,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import * as yaml from "js-yaml";
 import { audienceKey, COMPANY_AUDIENCE_KEY } from "./audience.js";
+import { assertVaultPath } from "../signals/write-guard.js";
 import { assertPayloadRef, assertSafeSegment, writeFileAtomic } from "./landing.js";
 /**
  * A pass failure the run ledger records as `status: failed` with `error` set
@@ -171,7 +172,7 @@ export function runBounded(command, args, options) {
 export function defaultPromptFile() {
     return path.join(path.dirname(fileURLToPath(import.meta.url)), "prompts", "signals-pass.md");
 }
-const LOGGED_OUT = /not logged in|log ?in|\/login|invalid api key|authenticat|oauth token/i;
+export const CLAUDE_LOGGED_OUT_RE = /not logged in|log ?in|\/login|invalid api key|authenticat|oauth token/i;
 function channelOf(key) {
     const parts = key.split("/");
     if (parts.length !== 3 || parts[0] !== "sources" || !parts[2].endsWith(".md"))
@@ -284,7 +285,7 @@ export function parseClaudeSignals(stdout) {
     const env = envelope;
     if (env.is_error === true) {
         const text = typeof env.result === "string" ? env.result : "";
-        if (LOGGED_OUT.test(text))
+        if (CLAUDE_LOGGED_OUT_RE.test(text))
             throw new SignalsPassError("claude-logged-out", "claude reported it is not logged in");
         throw new SignalsPassError("claude-bad-output", "claude returned an error result");
     }
@@ -353,6 +354,7 @@ export async function ensureAudienceFile(vaultRoot, item) {
         return;
     assertSafeSegment(item.audienceKey, "audience key");
     const file = path.join(vaultRoot, "signals", `@${item.audienceKey}`, "_audience.yaml");
+    assertVaultPath(vaultRoot, file);
     if (await exists(file))
         return;
     const principals = [...new Set(item.principals.map((p) => p.trim()).filter((p) => p.length > 0))].sort();
@@ -384,7 +386,7 @@ async function appendSignalIndex(vaultRoot, day, rows) {
     const added = rows.filter((row) => !seen.has(row.signal_id));
     if (added.length === 0)
         return;
-    await writeFileAtomic(file, `${JSON.stringify([...existing, ...added], null, 2)}\n`);
+    await writeFileAtomic(vaultRoot, file, `${JSON.stringify([...existing, ...added], null, 2)}\n`);
 }
 /**
  * Build the claude signals pass for one company. The pass keeps state for one
@@ -502,7 +504,7 @@ export function createClaudeSignalsPass(options) {
             throw new SignalsPassError("claude-timeout", `claude timed out after ${timeoutMs}ms on ${item.file}`);
         if (run.spawnError !== undefined)
             throw new SignalsPassError("claude-logged-out", `claude could not start: ${run.spawnError}`);
-        if (run.code !== 0 && LOGGED_OUT.test(`${run.stderr}\n${run.stdout}`) && !run.stdout.trim().startsWith("{")) {
+        if (run.code !== 0 && CLAUDE_LOGGED_OUT_RE.test(`${run.stderr}\n${run.stdout}`) && !run.stdout.trim().startsWith("{")) {
             throw new SignalsPassError("claude-logged-out", "claude reported it is not logged in");
         }
         return parseClaudeSignals(run.stdout);
@@ -537,7 +539,7 @@ export function createClaudeSignalsPass(options) {
                 frontmatter.payload_fallback = input.fallback;
             const text = `---\n${yaml.dump(frontmatter, { lineWidth: -1, noRefs: true }).trimEnd()}\n---\n## ${heading(signal.type)}\n\n${signal.body || signal.title}\n`;
             await beforeWrite();
-            await writeFileAtomic(file, text);
+            await writeFileAtomic(vaultRoot, file, text);
             written += 1;
         }
         await beforeWrite();