@indigoai-us/hq-cli 5.345.197 → 5.345.199

package/dist/commands/integrations-connect.js

@@ -365,6 +365,39 @@ function withDocumentedRemoteMcp(target, domainHint) {
         },
     };
 }
+/**
+ * Google Workspace is a built-in OAuth connector (provider `google-workspace`,
+ * its own `/v1/integrations/google-workspace/connect` flow), not a remote MCP
+ * catalog entry. The CLI has no way to start that flow, so a bare `google` fell
+ * through to an install by free-text query, which hq-pro answers with
+ * "mcpUrl is required" because no catalog entry or domain resolves. The console
+ * is the surface that runs the built-in sign-in, so route there.
+ */
+const BUILT_IN_CONSOLE_APPS = {
+    google: "Google Workspace",
+    "google-workspace": "Google Workspace",
+    "google workspace": "Google Workspace",
+    google_workspace: "Google Workspace",
+};
+function builtInConsoleApp(app) {
+    return BUILT_IN_CONSOLE_APPS[app?.trim().toLowerCase() ?? ""];
+}
+/**
+ * hq-pro rejects an install/sign-in that names neither an endpoint nor a
+ * resolvable catalog entry or domain with a bare "mcpUrl is required". That is
+ * the caller's name not matching anything, so say so and name the way forward.
+ */
+function explainUnresolvableApp(target, err) {
+    if (!(err instanceof IntegrationsCliError) ||
+        err.code !== "DIRECT_MCP_INVALID_INPUT" ||
+        target.ref.mcpUrl ||
+        target.ref.discoveryReceiptId ||
+        target.ref.catalogEntryId) {
+        return err;
+    }
+    return new IntegrationsCliError(`${target.label} was not found in the app catalog, so HQ has no MCP server address for it. ` +
+        "Search with `hq integrations catalog <name>`, or re-run with --mcp-url <endpoint>.", { expected: true, status: err.status, code: err.code });
+}
 function unsupportedCatalogSurfaceError(label, cause) {
     return new IntegrationsCliError(`${label} cannot be connected because the app catalog has no MCP server URL. ` +
         "Re-run with --mcp-url <endpoint> (find it with `hq integrations inspect`).", { expected: true, status: cause.status, code: cause.code });
@@ -1100,6 +1133,11 @@ function reportInstall(result, opts, expectedRevivedConnectionId) {
  * URL: hq-pro recognizes the domain and revives the revoked row in place.
  */
 async function connectApp(token, companyUid, app, opts, expectedRevivedConnectionId) {
+    const builtIn = opts.mcpUrl || opts.docsUrl || opts.entryId ? undefined : builtInConsoleApp(app);
+    if (builtIn) {
+        await consoleHandoff({ ref: {}, label: builtIn }, opts);
+        return;
+    }
     const resolved = await resolveTarget(token, companyUid, app, opts, expectedRevivedConnectionId !== undefined);
     const scope = connectScopeFromOptions(opts);
     const target = scope ? { ...resolved, ref: { ...resolved.ref, scope } } : resolved;
@@ -1130,7 +1168,7 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
                 await finishWithAccessKey();
                 return;
             }
-            throw err;
+            throw explainUnresolvableApp(target, err);
         }
         return;
     }
@@ -1174,7 +1212,7 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
                     await finishWithAccessKey(bearerToken);
                     return;
                 }
-                throw oauthErr;
+                throw explainUnresolvableApp(target, oauthErr);
             }
             return;
         }
@@ -1182,7 +1220,7 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
             err.code === "INTEGRATION_FACTORY_UNSUPPORTED_SURFACE") {
             throw unsupportedCatalogSurfaceError(target.label, err);
         }
-        throw err;
+        throw explainUnresolvableApp(target, err);
     }
 }
 /**

package/dist/commands/lanes-report.d.ts

@@ -1,9 +1,10 @@
 import type { Command } from "commander";
 import { type QuestionBody } from "../lib/lanes/questions.js";
-import type { LaneCompanyRef, QuestionRecord } from "../lib/lanes/types.js";
+import type { LaneCompanyRef, LaneRecord, QuestionRecord } from "../lib/lanes/types.js";
 import { type LaneChecksDeps } from "./lanes-checks.js";
 type WrapHandler = <Args extends unknown[]>(action: (...args: Args) => Promise<void>) => (...args: Args) => Promise<void>;
 export interface LaneReportsDeps extends LaneChecksDeps {
+    laneRunsHere: (lane: LaneRecord) => boolean;
     readQuestionBody: (root: string, question: QuestionRecord) => QuestionBody;
     focusDashboardEnabled: (company: LaneCompanyRef) => Promise<boolean>;
 }

package/dist/commands/lanes-report.js

@@ -1,12 +1,15 @@
+import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "../lib/lanes/errors.js";
 import { assertQuestionBodySecretSafe } from "../lib/lanes/questions.js";
-import { questionRecordPath } from "../lib/lanes/store.js";
+import { listLanesBySource, questionRecordPath } from "../lib/lanes/store.js";
 import { normalizeIsoTimestamp } from "../lib/lanes/timestamp.js";
 import { mapSourceStoryStatus } from "../lib/mesh/story-status.js";
 import { buildTrackerOwnerReport, buildTrackerTeamPage, renderTrackerOwnerReportText, renderTrackerTeamPageText, } from "../lib/lanes/tracker-report.js";
 import { FIRST_TRACKER_REPORT_SINCE, readTrackerReportState, writeTrackerReportState, } from "../lib/lanes/tracker-report-state.js";
 import { listTrackerRecordsTolerant, loadCompanyQuestionRecords, loadProjectMappings, mappingIncludesStory, pathForTrackerRecord, readProject, resolveTrackerCompany, } from "./lanes-checks.js";
+import { buildSourceReport, renderSourceReportText } from "../lib/lanes/source-report.js";
+import { readLaneStatusRowFields } from "../lib/lanes/status-fields.js";
 function fail(error, message, details = {}) {
     throw new LanesError(error, message, details);
 }
@@ -331,10 +334,50 @@ export function registerLaneReportCommands(parent, deps, wrap) {
     parent.command("report")
         .description("Generate the owner report for tracker teams")
         .option("--company <slug>", "Select the company by slug")
+        .option("--source <ref>", "Report lanes for a source (requires --company; excludes --since)")
         .option("--since <iso>", "Report activity from this ISO timestamp")
         .option("--json", "Emit JSON instead of the owner report text")
         .action(wrap(async (options) => {
+        if (options.source !== undefined && (!options.company?.trim() || options.since !== undefined || !options.source.trim())) {
+            fail("source_report_options_invalid", "--source requires --company and a non-empty ref, and cannot be combined with --since");
+        }
         const company = await resolveTrackerCompany(deps, options.company);
+        if (options.source !== undefined) {
+            const root = deps.hqRoot();
+            const lanes = listLanesBySource(company.slug, options.source, root)
+                .filter(lane => lane.company?.uid === company.uid);
+            const ids = new Set(lanes.map(lane => lane.lane_id));
+            const questions = new Map();
+            if (lanes.length) {
+                const pending = loadCompanyQuestionRecords(root, company)
+                    .filter(question => ids.has(question.lane_id) && question.status === "pending")
+                    .sort((a, b) => a.asked_at.localeCompare(b.asked_at) || a.question_id.localeCompare(b.question_id));
+                for (const question of pending) {
+                    if (questions.has(question.lane_id))
+                        continue;
+                    const body = deps.readQuestionBody(root, question);
+                    assertQuestionBodySecretSafe(body);
+                    questions.set(question.lane_id, { question_id: question.question_id, question: body.question });
+                }
+            }
+            const progress = new Map(lanes.filter(lane => lane.state === "running" || lane.state === "queued")
+                .map(lane => [lane.lane_id, readLaneStatusRowFields(root, lane, deps.now().getTime(), deps.laneRunsHere(lane)).last_line ?? "No progress recorded yet."]));
+            const report = buildSourceReport(company.slug, options.source, lanes, { questions, progress });
+            if (options.json)
+                console.log(JSON.stringify(report, null, 2));
+            else {
+                let template;
+                try {
+                    template = fs.readFileSync(path.join(root, "personal/settings/executive/report.md"), "utf8");
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+                console.log(renderSourceReportText(report, template));
+            }
+            return;
+        }
         const root = deps.hqRoot();
         const generatedAt = deps.now().toISOString();
         const focusDashboardEnabled = await deps.focusDashboardEnabled(company);

package/dist/commands/lanes.d.ts

@@ -165,6 +165,15 @@ export declare function pickupFailureUpdater(reasonRaw: string, details: Record<
  */
 export declare function applyOutpostAccountPickup(hqRoot: string, laneId: string, modelDeps?: KnownModelsDeps): LaneRecord;
 export declare function cancelPendingQuestionsForLane(hqRoot: string, laneId: string, nowIso: string, operatorReason?: string): QuestionRecord[];
+/** In-process signal entry point sharing CLI admission, dedupe and conductor rules. */
+export declare function createLaneFromSignal(input: {
+    hqRoot: string;
+    company: string;
+    signal_id: string;
+}, deps?: LanesCommandDeps): Promise<{
+    lane_id: string;
+    existing: boolean;
+}>;
 /** @internal Exported for regression tests of the profile-refresh company check. */
 export declare function applyResumeProfileAndEffort(hqRoot: string, current: LaneRecord, next: LaneRecord, input: {
     profile?: ResolvedResumeProfile;

package/dist/commands/lanes.js

@@ -75,6 +75,7 @@ import { resolveActiveMembershipCompany } from "../lib/mesh/api.js";
 import { openMeshTransport, requireToken } from "../lib/mesh/client.js";
 import { CompanySelectionError } from "../utils/company-selection-error.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
+import { createSignalLane } from "../lib/lanes/signal-lane.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { applyLoopDisposition, loopDispositionSnapshot } from "../lib/lanes/loop-disposition.js";
@@ -285,7 +286,7 @@ function failJson(err) {
             process.stderr.write(`hq lanes: ${commandError.message}\n`);
         }
         printJson({ ...commandError.toJSON(), message: commandError.message });
-        process.exit(1);
+        process.exit(["signal_not_found", "no_conductor_link"].includes(commandError.error) ? 2 : 1);
     }
     const message = commandError instanceof Error ? commandError.message : String(commandError);
     process.stderr.write(`hq lanes: ${message}${commandError instanceof Error && commandError.stack ? `\n${commandError.stack}` : ""}\n`);
@@ -1935,6 +1936,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
                 before.envelope_summary !== envelopeSummary ||
                 (mirroredReportAt !== undefined && before.last_host_report_at !== mirroredReportAt) ||
                 (isTerminalLaneState(owner.state) && (JSON.stringify(before.last_envelope) !== JSON.stringify(owner.last_envelope) ||
+                    JSON.stringify(before.outcome) !== JSON.stringify(owner.outcome) ||
                     before.story_complete !== owner.story_complete ||
                     before.story_complete_reason !== owner.story_complete_reason ||
                     before.story_status !== owner.story_status ||
@@ -1964,6 +1966,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
                     ...(mirroredReportAt !== undefined ? { last_host_report_at: mirroredReportAt } : {}),
                     ...(isTerminalLaneState(owner.state) ? {
                         last_envelope: owner.last_envelope,
+                        outcome: owner.outcome,
                         story_complete: owner.story_complete,
                         story_complete_reason: owner.story_complete_reason,
                         story_status: owner.story_status,
@@ -3465,7 +3468,34 @@ export function cancelPendingQuestionsForLane(hqRoot, laneId, nowIso, operatorRe
 function mintMessageId() {
     return `msg_${Date.now().toString(36)}_${randomBytes(3).toString("hex")}`;
 }
+/** In-process signal entry point sharing CLI admission, dedupe and conductor rules. */
+export async function createLaneFromSignal(input, deps = {}) {
+    const ctx = resolveDeps({ ...deps, hqRoot: () => input.hqRoot });
+    const company = await ctx.resolveCompany(input.company);
+    const result = await createSignalLane(input.hqRoot, {
+        company: company.slug, signal: input.signal_id, env: ctx.env,
+    }, options => runCreate(ctx, { ...options, company: company.slug, project: "executive-bot",
+        noStory: `signal:${input.signal_id}`, freshThread: true, quiet: true }));
+    return { lane_id: result.lane.lane_id, existing: result.existing };
+}
 async function runCreate(ctx, opts) {
+    if (opts.signal !== undefined) {
+        if (!opts.company?.trim())
+            throw new LanesError("missing_company", "--signal requires --company");
+        if (opts.story || opts.additionalStory?.length || opts.briefFile || (opts.project && opts.project !== "executive-bot")) {
+            throw new LanesError("signal_option_conflict", "Signal lanes use project executive-bot and a generated brief without a story");
+        }
+        const company = await ctx.resolveCompany(opts.company);
+        const result = await createSignalLane(ctx.hqRoot(), {
+            company: company.slug, signal: opts.signal, rulesFile: opts.rulesFile ? resolveCallerPath(ctx.callerCwd(), opts.rulesFile) : undefined,
+            anyType: opts.anyType, senior: opts.senior, link: opts.link, env: ctx.env,
+        }, input => runCreate(ctx, { ...opts, ...input, company: company.slug, signal: undefined, project: "executive-bot", noStory: `signal:${opts.signal}`, freshThread: opts.runner === "subagent" ? undefined : true, quiet: true }));
+        if (!opts.quiet)
+            printJson({ lane_id: result.lane.lane_id, signal_id: result.lane.signal.signal_id,
+                source_ref: result.lane.signal.source_ref, senior: result.lane.senior, link: result.lane.signal_link ?? null,
+                existing: result.existing, brief_path: result.brief_path });
+        return result.lane;
+    }
     if (opts.runner !== undefined && parseLaneRunner(opts.runner) === "subagent") {
         return runCreateSubagent(ctx, opts);
     }
@@ -4304,6 +4334,7 @@ async function runCreate(ctx, opts) {
         const admissionReservedAt = admission.action === "start" ? ctx.now().toISOString() : undefined;
         const laneInit = {
             company,
+            ...(opts.signalMetadata ? { signal: opts.signalMetadata, signal_link: opts.signalLink } : {}),
             ...(company === null && meshCompany
                 ? { mesh_company: meshCompany }
                 : {}),
@@ -6182,7 +6213,54 @@ function formatLaneListHuman(lanes) {
         rows.push("No lanes.");
     return rows.join("\n");
 }
-async function runStatus(ctx, opts) {
+async function runLaneStatus(ctx, laneId, opts) {
+    const lane = (await resolveMessageLaneTarget(ctx, laneId)).lane;
+    const status = {
+        schema_version: "hq-lanes-lane-status.v1",
+        lane_id: lane.lane_id,
+        company: lane.company?.slug ?? null,
+        state: lane.state,
+        decision: lane.last_envelope?.decision ?? null,
+        envelope_ref: lane.last_envelope?.ref ?? null,
+        story_status: lane.story_status ?? null,
+        story_complete: lane.story_complete ?? null,
+        outcome: lane.outcome ?? null,
+    };
+    if (opts.json) {
+        printJson(status);
+        return;
+    }
+    const lines = [
+        `lane ${status.lane_id}: ${status.state}` +
+            (status.decision ? ` (decision ${status.decision})` : ""),
+    ];
+    if (status.outcome) {
+        lines.push(`outcome ${status.outcome.state}: ${status.outcome.outcome}`);
+        for (const item of status.outcome.gathered) {
+            lines.push(`  gathered ${item.label}: ${item.text}${item.ref ? ` (${item.ref})` : ""}`);
+        }
+        for (const step of status.outcome.next_steps)
+            lines.push(`  next: ${step}`);
+        if (status.outcome.decision_id)
+            lines.push(`  decision_id: ${status.outcome.decision_id}`);
+    }
+    else {
+        lines.push("outcome: none");
+    }
+    console.log(lines.join("\n"));
+}
+async function runStatus(ctx, opts, laneId) {
+    if (laneId !== undefined) {
+        if (opts.project !== undefined || opts.company !== undefined) {
+            throw new LanesError("invalid_args", "hq lanes status <lane-id> reports one lane; drop --project and --company", { lane_id: laneId });
+        }
+        await runLaneStatus(ctx, laneId, opts);
+        return;
+    }
+    if (opts.project === undefined) {
+        throw new LanesError("invalid_args", "hq lanes status requires --project <slug>, or a lane id for one lane", {});
+    }
+    const projectId = opts.project;
     if (!ctx.storyLedgerEnabled()) {
         throw new LanesError("story_ledger_disabled", "hq lanes status requires the lanes.story-ledger flag", {
             flag: "lanes.story-ledger",
@@ -6216,7 +6294,7 @@ async function runStatus(ctx, opts) {
     }
     const snapshot = buildLaneStatusSnapshot({
         hqRoot,
-        projectId: opts.project,
+        projectId,
         ...(company ? { companySlug: company.slug } : {}),
         ...(company ? { companyUid: company.uid } : {}),
         lanes,
@@ -6500,6 +6578,7 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane, resolveLaneTarget
         fingerprint: lane.fingerprint ?? null,
         envelope_repair_mode: lane.envelope_repair?.mode ?? null,
         envelope_validation_errors: lane.envelope_validation_errors ?? [],
+        outcome: lane.outcome ?? null,
         last_resume: lane.last_resume ?? null,
         // Public JSON key for the bounded start audit; `last_resume` remains unchanged.
         resume_history: lane.resume_history ?? [],
@@ -9162,6 +9241,7 @@ async function runCreateSubagent(ctx, opts) {
     const createdAt = ctx.now().toISOString();
     const lane = createLane(hqRoot, {
         company,
+        ...(opts.signalMetadata ? { signal: opts.signalMetadata, signal_link: opts.signalLink } : {}),
         ...(company === null && meshCompany ? { mesh_company: meshCompany } : {}),
         project_id: project,
         story_id: story ?? "",
@@ -10402,6 +10482,7 @@ export function registerLanesCommand(parent, deps = {}) {
     });
     registerLaneReportCommands(lanes, {
         hqRoot: ctx.hqRoot,
+        laneRunsHere: (lane) => laneRunsHere(lane, reconcileHostFromCtx(ctx)),
         resolveCompany: ctx.resolveCompany,
         now: ctx.now,
         focusDashboardEnabled: (company) => readLanesRegistryFlagFailOff(LANE_FOCUS_DASHBOARD_FLAG, {
@@ -10446,12 +10527,16 @@ export function registerLanesCommand(parent, deps = {}) {
         .description("Register a lane, run admission, and return immediately")
         .option("--company <slug|uid>", "Company slug or cloud uid; omit for a core/personal lane")
         .option("--mesh-company <slug|uid>", "Explicit Work Mesh company for a personal lane; membership is verified")
-        .requiredOption("--project <slug>", "HQ project slug")
+        .option("--project <slug>", "HQ project slug (executive-bot for --signal)")
+        .option("--signal <id>", "Create one lane for a company signal")
+        .option("--rules-file <path>", "Standing rules for a signal lane")
+        .option("--any-type", "Allow signal types other than action_item")
+        .option("--link <id>", "Conductor link for a signal lane")
         .option("--story <id>", "Story id from the project's prd.json")
         .option("--focus-override <reason>", "Human-approved reason to override the lane focus guard")
         .addOption(noStoryOption)
         .option("--additional-story <id>", "Additional story carried by this lane; repeatable and discouraged when active", collectRepeatable)
-        .requiredOption("--brief-file <path>", "Path to the lane brief")
+        .option("--brief-file <path>", "Path to the lane brief (generated for --signal)")
         .option("--worker <name>", "HQ worker or reusable profile id")
         .option("--fresh-thread", "Skip worker continuity and start a cold provider session")
         .option("--loop", "Keep one worker lane registered to process queued phase envelopes")
@@ -10697,12 +10782,13 @@ export function registerLanesCommand(parent, deps = {}) {
     }));
     lanes
         .command("status")
-        .description("Summarize project stories, lanes, PRs, blockers, and pending questions")
-        .requiredOption("--project <slug>", "HQ project slug")
+        .description("Summarize project stories, lanes, PRs, blockers, and pending questions; with a lane id, report that lane's outcome")
+        .argument("[lane-id]", "Report one lane's state and outcome block instead of a project")
+        .option("--project <slug>", "HQ project slug (required without a lane id)")
         .option("--company <slug|uid>", "Company project scope; omit for a personal project")
         .option("--json", "Emit JSON on stdout")
-        .action(wrap(async (opts) => {
-        await runStatus(ctx, opts);
+        .action(wrap(async (laneId, opts) => {
+        await runStatus(ctx, opts, laneId);
     }));
     lanes
         .command("capacity")

package/dist/commands/meetings.js

@@ -6,6 +6,7 @@ import { sessionIdFromEnv } from "../lib/core-utils/session-id.js";
 import { vaultApiFetch, getCompanyUid, resolveCallerPersonUid, } from "../utils/vault-api.js";
 import { isPlanGateError, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 import { mapWithConcurrency } from "./sync-manifest.js";
+import { fetchAttendedLiveBots } from "../lib/live-meetings.js";
 import { isUsageOnly, pricingPlanFromBody, resolveCompanyPricingPlan, usageOnlyCardRequiredLines, usagePauseFromBody, } from "../lib/billing/usage-only.js";
 const LIVE_SNAPSHOT_STATUSES = new Set([
     "joining",
@@ -110,27 +111,6 @@ function liveBotTime(bot) {
         .filter(Number.isFinite);
     return times.length > 0 ? Math.max(...times) : Number.NEGATIVE_INFINITY;
 }
-/**
- * Live meetings in this company the caller may read but did not record.
- *
- * `/v1/bot/list` returns only the caller's own notetakers, so a meeting a
- * coworker recorded never appears there. The meetings API lists the live
- * meetings the caller is an attendee of. An older server ignores `view=live`
- * and answers with the ordinary meeting list, which has no `bots`, and any
- * failure here leaves the caller's own list unchanged.
- */
-async function fetchAttendedLiveBots(token, companyId) {
-    try {
-        const res = await vaultApiFetch({ token, path: "/v1/meetings", query: { companyId, view: "live" } });
-        if (!res.ok)
-            return [];
-        const data = (await res.json());
-        return Array.isArray(data.bots) ? data.bots : [];
-    }
-    catch {
-        return [];
-    }
-}
 /** The caller's own bots first; attended meetings they did not record added after. */
 function mergeLiveMeetingBots(own, attended) {
     const seen = new Set(own.map(liveBotId).filter((id) => Boolean(id)));

package/dist/commands/secrets.js

@@ -2,7 +2,7 @@ import { assertScriptUnchanged, planScriptBinding, selectChildLaunch } from "../
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
-import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
+import { assertApiKeyCompany, assertDelegatedMachineSessionUsable, buildSecretUsage, callerIsCompanyOutpost, companyOutpostIdentityFromToken, companyOutpostReadDenialMessage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, resolveSecretsReadCompanyUid, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 import { readSessionCompanyLock } from "../lib/session-company-lock.js";
 import { sessionIdFromEnv } from "../lib/core-utils/session-id.js";
 import { appendPersonalSecretsAudit, isEntityScopeRef, PERSONAL_SCOPE_READ_ONLY_MESSAGE, } from "../lib/personal-secrets-audit.js";
@@ -797,6 +797,7 @@ export function registerSecretsCommand(program) {
         .option("--reveal", "Include the decrypted secret value")
         .action(async (name, opts) => {
         try {
+            assertDelegatedMachineSessionUsable();
             const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets get", secretsCredentialOptions());
             if (cred.kind === "api-key") {
                 if (!opts.reveal) {
@@ -848,7 +849,7 @@ export function registerSecretsCommand(program) {
                 return;
             }
             const token = cred.token;
-            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const companyUid = await resolveSecretsReadCompanyUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: buildSecretNamePath(companyUid, name),
@@ -862,6 +863,16 @@ export function registerSecretsCommand(program) {
                     console.error(chalk.red(highSecuritySandboxOnlyMessage(name)));
                     process.exit(1);
                 }
+                // A company Outpost gets a code-less 403 both for an unshared secret
+                // and for an inactive binding; say both, as the reveal path does.
+                const outpost = companyOutpostIdentityFromToken(token);
+                const outpostDenial = outpost
+                    ? companyOutpostReadDenialMessage(name, res.status, body, companyUid, outpost)
+                    : null;
+                if (outpostDenial) {
+                    console.error(chalk.red(outpostDenial));
+                    process.exit(1);
+                }
                 console.error(chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
@@ -1384,9 +1395,17 @@ export function registerSecretsCommand(program) {
             // interactive session last ran a hook, and the job would read that
             // session's company's same-named secret. Without a session id the caller
             // must name its scope. HQ_API_KEY is exempt: the key is bound to one
-            // company and never reads the session lock below.
+            // company and never reads the session lock below. A company Outpost job
+            // is exempt too: its machine identity names its one bound company.
+            // An unusable HQ_MACHINE_SESSION_FILE fails here, naming the file,
+            // before the scope check below can report a generic error.
+            assertDelegatedMachineSessionUsable();
             const hasCallerSession = Boolean(sessionIdFromEnv(process.env));
-            if (!hasCallerSession && !requestedCompany && !parentScope.personal && peekHqApiKey() === undefined) {
+            if (!hasCallerSession &&
+                !requestedCompany &&
+                !parentScope.personal &&
+                peekHqApiKey() === undefined &&
+                !callerIsCompanyOutpost()) {
                 console.error(chalk.red("Error:"), SECRETS_EXEC_UNATTENDED_NO_COMPANY_MESSAGE);
                 process.exit(SECRETS_EXEC_UNATTENDED_NO_COMPANY_EXIT);
             }
@@ -1454,7 +1473,7 @@ export function registerSecretsCommand(program) {
                     ?? (unlockedApiKeyCompanyRef
                         ? await assertApiKeyCompany(cred.token, unlockedApiKeyCompanyRef, "secrets exec")
                         : "__api_key__"))
-                : await getEntityUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
+                : await resolveSecretsReadCompanyUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
             if (entityScopeRef && companyUid !== entityScopeRef) {
                 throw new Error("Another person's personal vault is outside this session's scope; refusing.");
             }
@@ -1482,8 +1501,10 @@ export function registerSecretsCommand(program) {
             const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, execUsage, { allowOfflineFallback: true, lockModes });
             // API-key auth has no signed-in person identity for the CLI telemetry
             // endpoint. Do not attribute that read to an unrelated cached session.
+            // hq-pro refuses every route but the secret read to a company Outpost,
+            // telemetry included, so an Outpost read sends no telemetry event.
             let revealed;
-            if (cred.kind === "cognito") {
+            if (cred.kind === "cognito" && !companyOutpostIdentityFromToken(cred.token)) {
                 const { withCliFeatureUsed } = await import("../utils/cli-telemetry.js");
                 revealed = await withCliFeatureUsed("secret_read", readSecrets, companyUid);
             }

package/dist/commands/signals-run.d.ts

@@ -11,6 +11,8 @@ import { Command } from "commander";
 import { type RunSignalsResult, type SignalsStepChoice, type SignalsTrigger } from "../lib/signals/engine.js";
 import type { SignalsRunAlertSenders } from "../lib/signals/failure-alert.js";
 interface RunCliOptions {
+    source?: string;
+    incremental?: boolean;
     company?: string;
     dryRun?: boolean;
     step: SignalsStepChoice;

package/dist/commands/signals-run.js

@@ -109,6 +109,8 @@ export async function runSignalsCli(options, overrides = {}) {
     const result = await runSignals({
         hqRoot: options.hqRoot,
         company: options.company,
+        source: options.source,
+        incremental: options.incremental,
         dryRun: options.dryRun === true,
         step: options.step,
         trigger: options.trigger,
@@ -134,7 +136,8 @@ export async function runSignalsCli(options, overrides = {}) {
         process.stdout.write(`${JSON.stringify({ status, startedAt, trigger })}\n`);
     }
     else if (options.json) {
-        const payload = options.company && result.records.length === 1 ? result.records[0] : result;
+        const record = result.records[0];
+        const payload = options.incremental && record ? { ...record, ...record.steps.find((s) => s.name === "extract")?.detail } : options.company && result.records.length === 1 ? record : result;
         process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
     }
     else {
@@ -150,6 +153,8 @@ export function registerSignalsRunSubcommand(signals) {
     run
         .description("Run the local signals engine (garden, adapters, extract, garden, upload) for companies with capture on")
         .option("--company <slug>", "Run one company (default: every company listed in the companies manifest)")
+        .option("--source <ref>", "Read a growing source: meeting:<id> or <channel>:<file> (needs --incremental and --company)")
+        .option("--incremental", "Extract only new signals from --source, retaining a cursor and prior signal ids")
         .option("--dry-run", "Print what would run; run no mutating step and write nothing")
         .addOption(new Option("--step <step>", "Run one step").choices([...SIGNALS_STEP_CHOICES]).default("all"))
         .addOption(new Option("--trigger <trigger>", "What started the run").choices([...SIGNALS_TRIGGERS]).default("manual"))

package/dist/lanes-drain-hook.js

@@ -187,6 +187,15 @@ async function main() {
     for await (const chunk of process.stdin)
         chunks.push(Buffer.from(chunk));
     const text = Buffer.concat(chunks).toString("utf8");
+    if (process.env.HQ_LANE_SIGNAL_LINK && process.env.HQ_ROOT) {
+        try {
+            const { bindSignalLaneHook } = await import("./lib/lanes/links.js");
+            bindSignalLaneHook(process.env.HQ_ROOT, text, process.env);
+        }
+        catch {
+            process.stderr.write("hq-lanes-drain: signal_link_binding_failed; conductor link remains unavailable\n");
+        }
+    }
     let input = {};
     let inputError = "";
     try {

package/dist/lib/bot/api.d.ts

@@ -62,6 +62,11 @@ export interface JobRunCompletion {
 }
 /** A job record as the cloud returns it (hq-pro-agents jobs/schema.ts `JobRecord`). */
 export interface BotJobRecord {
+    trigger?: {
+        kind: "event";
+        event: string;
+        filter?: Record<string, string>;
+    };
     jobId: string;
     prompt: string;
     status?: string;

package/dist/lib/bot/claude-login.d.ts

@@ -0,0 +1,31 @@
+export declare const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+export declare const CLAUDE_LOGIN_ENV_VARS: readonly ["ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+export type ClaudeLoginStatus = "ok" | "missing" | "expired" | "skipped";
+export interface ClaudeLoginSource {
+    source: string;
+    status: ClaudeLoginStatus;
+    reason: string;
+}
+export interface ClaudeLoginCheck {
+    signedIn: boolean;
+    /** The first source the runtime would use, when signed in. */
+    via: string | null;
+    sources: ClaudeLoginSource[];
+}
+export interface KeychainRead {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export interface ClaudeLoginDeps {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    platform?: NodeJS.Platform;
+    readKeychain?: () => KeychainRead;
+    now?: () => number;
+}
+export declare function checkClaudeCodeLogin(deps?: ClaudeLoginDeps): ClaudeLoginCheck;
+/** One sentence listing every source that did not yield a login. */
+export declare function describeClaudeLoginSources(check: ClaudeLoginCheck): string;
+export declare function claudeLoginFix(botName?: string): string;
+//# sourceMappingURL=claude-login.d.ts.map