@indigoai-us/hq-cli 5.345.20 → 5.345.21

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.345.21] — 2026-10-06
+- Hook timeout reports now show elapsed time against the configured budget and include available phase and hook attribution.
+- Reconcile hire-grant carve accounting across resume, reparent and grant updates; decreases no longer fail because sibling grants exceed the senior allocation.
+- Route eligible Linux pull-request checks and local release guards through the registered ARM64 self-hosted runner. Keep the shared npm/OIDC publish job on its existing runner.
+- Gate `hq doctor --json --client-health-report` status reporting for sync FAIL/WARN results behind the separate, default-off `client-health-sync-check-status` hq-flag; reason-code eligibility remains independent.
+
 ## [5.345.20] — 2026-10-06
 - Keep bundled scaffold scripts and `hq core register-project` aligned with the shared source, including company UID lookup from `companies/manifest.yaml`.
 

package/dist/commands/doctor.d.ts

@@ -57,6 +57,8 @@ export interface RunDoctorOptions {
     json?: boolean;
     /** Resolve hq-flags independently for each company represented in sync results. */
     resolveClientHealthReasonCodesForCompany?: (companySlug: string | null) => Promise<boolean>;
+    /** Resolve the separate status-report flag per company in sync results. */
+    resolveClientHealthCheckStatusForCompany?: (companySlug: string | null) => Promise<boolean>;
     /** In text mode, also print every PASS result. Default: false. */
     verbose?: boolean;
     /** In text mode, emit ANSI colour. Default: false (no escape sequences). */
@@ -117,6 +119,7 @@ export interface RunDoctorResult {
  * read; all other default tiers remain local unless explicitly opted in.
  */
 export declare function runDoctor(options?: RunDoctorOptions): Promise<RunDoctorResult>;
+export declare function createClientHealthCheckStatusCompanyResolver(hqRoot: string): (companySlug: string | null) => Promise<boolean>;
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
 export declare function registerDoctorCommand(program: Command): void;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.js

@@ -32,7 +32,7 @@ import { DEEP_FAMILY_ID, DEEP_FAMILY_TITLE, runDeepGuardTests, } from "../lib/do
 import { PARITY_FAMILY_ID, PARITY_FAMILY_TITLE, runParityReplay, } from "../lib/doctor/deep/parity.js";
 import { applyFixes } from "../lib/doctor/fix/apply.js";
 import { renderDoctorFixJson } from "../lib/doctor/fix/json-output.js";
-import { clientHealthReasonCodesEnabled as isActiveCompanyClientHealthReasonCodesEnabled, clientHealthReasonCodesEnabledForCompany, } from "../lib/doctor/client-health-reason-codes-flag.js";
+import { clientHealthCheckStatusEnabled as isActiveCompanyClientHealthCheckStatusEnabled, clientHealthCheckStatusEnabledForCompany, clientHealthReasonCodesEnabled as isActiveCompanyClientHealthReasonCodesEnabled, clientHealthReasonCodesEnabledForCompany, } from "../lib/doctor/client-health-reason-codes-flag.js";
 import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
@@ -166,15 +166,21 @@ export async function runDoctor(options = {}) {
         });
     }
     if (options.json) {
-        const clientHealthReasonCodesEnabledCheckIds = options.resolveClientHealthReasonCodesForCompany
-            ? await resolveClientHealthReasonCodesCheckIds(families, options.resolveClientHealthReasonCodesForCompany)
-            : undefined;
+        const [clientHealthReasonCodesEnabledCheckIds, clientHealthCheckStatusEnabledCheckIds] = await Promise.all([
+            options.resolveClientHealthReasonCodesForCompany
+                ? resolveClientHealthReasonCodesCheckIds(families, options.resolveClientHealthReasonCodesForCompany)
+                : undefined,
+            options.resolveClientHealthCheckStatusForCompany
+                ? resolveClientHealthCheckStatusCheckIds(families, options.resolveClientHealthCheckStatusForCompany)
+                : undefined,
+        ]);
         write(renderJson(buildDoctorJson({
             hqRoot: hqRoot ?? "",
             families,
             platform,
             scope,
             clientHealthReasonCodesEnabledCheckIds,
+            clientHealthCheckStatusEnabledCheckIds,
         })));
     }
     else {
@@ -220,6 +226,34 @@ async function resolveClientHealthReasonCodesCheckIds(families, resolveForCompan
     }
     return enabledChecks;
 }
+async function resolveClientHealthCheckStatusCheckIds(families, resolveForCompany) {
+    const checksByCompany = new Map();
+    for (const run of families) {
+        if (run.family.id !== "sync")
+            continue;
+        for (const result of run.results) {
+            if (result.status !== "FAIL" && result.status !== "WARN")
+                continue;
+            const scoped = /^sync\.(?:journal|manifest)\.(.+)$/.exec(result.checkId);
+            const companySlug = scoped && isCompanyJournalSlug(scoped[1]) ? scoped[1] : null;
+            const checkIds = checksByCompany.get(companySlug) ?? [];
+            checkIds.push(result.checkId);
+            checksByCompany.set(companySlug, checkIds);
+        }
+    }
+    const enabledChecks = new Set();
+    const decisions = await Promise.all([...checksByCompany.entries()].map(async ([companySlug, checkIds]) => ({
+        checkIds,
+        enabled: await resolveForCompany(companySlug),
+    })));
+    for (const decision of decisions) {
+        if (decision.enabled) {
+            for (const checkId of decision.checkIds)
+                enabledChecks.add(checkId);
+        }
+    }
+    return enabledChecks;
+}
 function createClientHealthReasonCodeCompanyResolver(hqRoot) {
     const companies = readCompaniesManifestMap(hqRoot);
     return async (companySlug) => {
@@ -245,6 +279,37 @@ function createClientHealthReasonCodeCompanyResolver(hqRoot) {
         });
     };
 }
+export function createClientHealthCheckStatusCompanyResolver(hqRoot) {
+    const companies = readCompaniesManifestMap(hqRoot);
+    return async (companySlug) => {
+        if (companySlug === null) {
+            return isActiveCompanyClientHealthCheckStatusEnabled();
+        }
+        const scopedCompanyUid = /^company:(cmp_[A-Za-z0-9]{3,128})$/.exec(companySlug);
+        if (scopedCompanyUid) {
+            return clientHealthCheckStatusEnabledForCompany({
+                companyUid: scopedCompanyUid[1],
+            });
+        }
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(companySlug)) {
+            return false;
+        }
+        const manifestUid = companies?.[companySlug]?.cloud_uid;
+        const activeSlug = process.env.HQ_COMPANY_SLUG?.trim() || "";
+        const activeUid = process.env.HQ_COMPANY_UID?.trim() || "";
+        const companyUid = typeof manifestUid === "string" && manifestUid.trim()
+            ? manifestUid.trim()
+            : companySlug === activeSlug
+                ? activeUid
+                : "";
+        if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid))
+            return false;
+        return clientHealthCheckStatusEnabledForCompany({
+            companyUid,
+            companySlug,
+        });
+    };
+}
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
 export function registerDoctorCommand(program) {
     program
@@ -334,6 +399,14 @@ export function registerDoctorCommand(program) {
                     : undefined;
             })()
             : undefined;
+        const clientHealthCheckStatusResolver = json && opts.clientHealthReport === true
+            ? (() => {
+                const hqRoot = resolveHqRoot();
+                return hqRoot
+                    ? createClientHealthCheckStatusCompanyResolver(hqRoot)
+                    : undefined;
+            })()
+            : undefined;
         const result = await runDoctor({
             json,
             // `src/main.ts` also declares --verbose on the root program. When
@@ -350,6 +423,7 @@ export function registerDoctorCommand(program) {
             company: opts.company,
             only: parseOnly(opts.only),
             resolveClientHealthReasonCodesForCompany: clientHealthReasonCodesResolver,
+            resolveClientHealthCheckStatusForCompany: clientHealthCheckStatusResolver,
         });
         // Set the exit code rather than calling process.exit, so the CLI's
         // normal shutdown (telemetry flush) still runs. Non-zero means either an

package/dist/commands/integrations-connect.js

@@ -19,6 +19,7 @@
 import chalk from "chalk";
 import open from "open";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { safeCaughtError } from "../utils/safe-caught-error.js";
 import { runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { consoleOrigin } from "../utils/console-origin.js";
 export { consoleOrigin };
@@ -29,6 +30,9 @@ import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBluep
 import { OAUTH_LOOPBACK_TIMEOUT_CODE, startLoopbackListener, } from "./integrations-oauth.js";
 /** hq-pro's machine code for "this endpoint needs a browser sign-in". */
 const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
+function warnBrowserOpenFailure(error) {
+    console.warn("[hq-cli:integrations-connect] browser open failed", safeCaughtError(error));
+}
 /**
  * A server-authoritative "this endpoint is OAuth-protected, run the browser
  * sign-in instead" signal, in EITHER of the two shapes hq-pro emits it:
@@ -679,7 +683,7 @@ async function consoleHandoff(target, opts) {
         console.error(chalk.yellow(`Note: --scopes cannot be carried into a console sign-in, so this connect will use ${target.label}'s default permissions.`));
     }
     if (url && opts.browser !== false)
-        await open(url).catch(() => { });
+        await open(url).catch((error) => warnBrowserOpenFailure(error));
     console.error(chalk.dim("When the browser says it connected, run `hq integrations list` to confirm."));
     return null;
 }
@@ -712,7 +716,7 @@ export async function bringYourOwnClientHandoff(target, opts, reason, redirectUr
     console.error("The console shows the callback URL to register and takes the credentials.");
     printConsoleDestination(target, opts, url);
     if (url && opts.browser !== false)
-        await open(url).catch(() => { });
+        await open(url).catch((error) => warnBrowserOpenFailure(error));
     return null;
 }
 /**
@@ -837,7 +841,7 @@ async function userClientSignIn(token, companyUid, target, opts, client, request
     if (googleHint)
         console.error(chalk.yellow(googleHint));
     if (opts.browser !== false)
-        await open(started.authorizationUrl).catch(() => { });
+        await open(started.authorizationUrl).catch((error) => warnBrowserOpenFailure(error));
     console.error(chalk.dim("The browser finishes on the HQ console. When it says connected, " +
         "run `hq integrations list` to confirm."));
     return null;

package/dist/commands/lanes.js

@@ -62,7 +62,7 @@ import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, lan
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, aliveDirectChildren, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "../lib/lanes/lane-company.js";
@@ -507,7 +507,12 @@ function laneHireFields(lane, lanes, aliveChildrenByParent, finishedChildrenDoNo
     };
 }
 function hireGrantFinishedChildrenDoNotCount(ctx, lane) {
-    const resolution = resolveLaneCompany(ctx.hqRoot(), lane);
+    const resolution = resolveLaneCompany(ctx.hqRoot(), {
+        lane_id: lane.lane_id,
+        company: lane.company ?? null,
+        mesh_company: lane.mesh_company,
+        project_id: lane.project_id ?? "",
+    });
     const company = resolution.company ?? undefined;
     return readLanesRegistryFlagFailOff(LANE_HIRE_GRANT_FINISHED_LANES_FLAG, {
         company,
@@ -1036,9 +1041,15 @@ async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
         !sameHireGrantSenior(lane.senior, grantContext.expected_senior))) {
         throw new LanesError("hire_grant_senior_changed", `Lane ${lane.lane_id}'s senior changed after the primary authorized its Outpost dispatch`, { lane_id: lane.lane_id, expected_senior: grantContext.expected_senior, current_senior: lane.senior });
     }
-    const finishedChildrenDoNotCount = isFinishedResumableHireChild(lane.state)
-        ? await hireGrantFinishedChildrenDoNotCount(ctx, lane)
-        : false;
+    let finishedChildrenDoNotCount = false;
+    if (isTerminalLaneState(lane.state) || isFinishedResumableHireChild(lane.state)) {
+        const seniorLaneId = lane.senior.kind === "lane" ? lane.senior.id : undefined;
+        const resumeSenior = seniorLaneId
+            ? grantContext?.hierarchy.find((entry) => entry.lane_id === seniorLaneId) ??
+                (listLaneIds(hqRoot).includes(seniorLaneId) ? readLane(hqRoot, seniorLaneId) : lane)
+            : lane;
+        finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, resumeSenior);
+    }
     const shouldCheckGrant = isTerminalLaneState(lane.state) ||
         (finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state));
     if (!shouldCheckGrant ||
@@ -5736,6 +5747,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
         initial.senior.kind === "lane" && initial.senior.id
         ? await readRemoteHireGrantSenior(ctx, hqRoot, initial.senior.id)
         : undefined;
+    const finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, initial);
     const updated = ctx.withGrantHireLocks(hqRoot, lockedLaneIds, () => {
         const current = readLane(hqRoot, laneId);
         const currentCallerAuthorization = authorization === "senior"
@@ -5779,11 +5791,11 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
             if (isTerminalLaneState(parent.state)) {
                 throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot change grants`, { senior_lane_id: parent.lane_id, state: parent.state });
             }
-            const siblings = aliveDirectChildren(hierarchy, parent.lane_id);
+            const siblings = childrenHoldingHireGrantCarve(hierarchy, parent.lane_id, finishedChildrenDoNotCount);
             const parentGrant = parent.hire_grant ?? 0;
             const assigned = assignedChildHireGrants(siblings, current.lane_id);
             const available = Math.max(0, parentGrant - assigned);
-            if (hireGrant > available) {
+            if (hireGrant > (current.hire_grant ?? 0) && hireGrant > available) {
                 throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
                     senior_lane_id: parent.lane_id,
                     parent_grant: parentGrant,
@@ -5794,7 +5806,7 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
                 });
             }
         }
-        const children = aliveDirectChildren(hierarchy, current.lane_id);
+        const children = childrenHoldingHireGrantCarve(hierarchy, current.lane_id, finishedChildrenDoNotCount);
         const allocated = assignedChildHireGrants(children);
         const minimumGrant = Math.max(allocated, children.length);
         if (hireGrant < minimumGrant) {
@@ -7063,6 +7075,7 @@ async function reparentOnOwner(ctx, laneId, opts) {
     const nextSenior = parseSeniorRef(opts.senior);
     assertSeniorExists(hqRoot, nextSenior, ctx);
     const initial = readLane(hqRoot, laneId);
+    const finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, initial);
     const refreshParents = new Set();
     if (initial.senior.kind === "lane" && initial.senior.id)
         refreshParents.add(initial.senior.id);
@@ -7074,7 +7087,7 @@ async function reparentOnOwner(ctx, laneId, opts) {
         ...(initial.senior.kind === "lane" && initial.senior.id ? [initial.senior.id] : []),
         ...(nextSenior.kind === "lane" && nextSenior.id ? [nextSenior.id] : []),
     ];
-    return withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts));
+    return withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount));
 }
 async function runReparentOwnerTarget(ctx, laneId, opts) {
     if (!ctx.isSsmOwnerDispatch()) {
@@ -7094,7 +7107,7 @@ async function runReparentOwnerTarget(ctx, laneId, opts) {
         changed_descendant_ids: result.changedDescendantIds,
     });
 }
-function runReparentLocked(ctx, laneId, opts) {
+function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false) {
     const hqRoot = ctx.hqRoot();
     if (!opts.senior) {
         throw new LanesError("missing_senior", "--senior is required", {});
@@ -7108,26 +7121,27 @@ function runReparentLocked(ctx, laneId, opts) {
     }
     const seniorCompany = companyOfSenior(hqRoot, nextSenior, ctx);
     assertSameTenant(lane.company, nextSenior, seniorCompany, { lane_id: laneId });
-    if (nextSenior.kind === "lane" &&
-        seniorKey(lane.senior) !== seniorKey(nextSenior)) {
+    if (nextSenior.kind === "lane" && seniorKey(lane.senior) !== seniorKey(nextSenior)) {
         const parent = readLane(hqRoot, nextSenior.id);
         if (isTerminalLaneState(parent.state)) {
             throw new LanesError("hire_grant_senior_inactive", `Senior lane ${parent.lane_id} is ${parent.state} and cannot accept lane children`, { senior_lane_id: parent.lane_id, state: parent.state });
         }
-        const children = aliveDirectChildren(loadAllLanes(hqRoot), parent.lane_id);
-        if (children.length >= (parent.hire_grant ?? 0)) {
-            throw hireGrantCapacityError(parent, children);
-        }
-        const available = Math.max(0, (parent.hire_grant ?? 0) - assignedChildHireGrants(children));
-        const requested = lane.hire_grant ?? 0;
-        if (requested > available) {
-            throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
-                senior_lane_id: parent.lane_id,
-                parent_grant: parent.hire_grant ?? 0,
-                assigned_child_grants: assignedChildHireGrants(children),
-                requested_hire_grant: requested,
-                available_hire_grant: available,
-            });
+        if (laneHoldsHireGrantCarve(lane, finishedChildrenDoNotCount)) {
+            const children = childrenHoldingHireGrantCarve(loadAllLanes(hqRoot), parent.lane_id, finishedChildrenDoNotCount);
+            if (children.length >= (parent.hire_grant ?? 0)) {
+                throw hireGrantCapacityError(parent, children);
+            }
+            const available = Math.max(0, (parent.hire_grant ?? 0) - assignedChildHireGrants(children));
+            const requested = lane.hire_grant ?? 0;
+            if (requested > available) {
+                throw new LanesError("hire_grant_carve_exceeded", `Senior lane ${parent.lane_id} has ${available} unassigned hire grant remaining for lane ${laneId}`, {
+                    senior_lane_id: parent.lane_id,
+                    parent_grant: parent.hire_grant ?? 0,
+                    assigned_child_grants: assignedChildHireGrants(children),
+                    requested_hire_grant: requested,
+                    available_hire_grant: available,
+                });
+            }
         }
     }
     if (walkHitsLane(hqRoot, nextSenior, laneId, ctx)) {

package/dist/lib/bot/continuity-download.js

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
 import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
 import { vaultApiFetch } from "../../utils/vault-api.js";
+import { safeCaughtError } from "../../utils/safe-caught-error.js";
 async function readOwnVault(input) {
     const client = new S3Client({ region: "us-east-1", credentials: input.credentials });
     try {
@@ -52,7 +53,9 @@ export async function downloadContinuitySnapshot(input, deps = { credential: ens
         }
     }
     finally {
-        await reader.cancel().catch(() => { });
+        await reader.cancel().catch((error) => {
+            console.warn("[hq-cli:bot/continuity-download] reader.cancel failed", safeCaughtError(error));
+        });
         download.close();
     }
     const bytes = Buffer.concat(chunks);

package/dist/lib/core-utils/sentry-report.js

@@ -48,6 +48,7 @@ const SENTRY_REPORT_LEVELS = new Set([
 const HOOK_TIMEOUT_WARNING_TYPE = "hook_timeout_warning";
 const HOOK_TIMEOUT_EXCEEDED_TYPE = "hook_timeout_exceeded";
 const HOOK_LATE_FINISH_TYPE = "hook_late_finish";
+const HOOK_TIMEOUT_FINGERPRINT = "hook-timeout";
 const HOOK_TIMEOUT_WARNING_METRIC = "hq.hook_timeout_warning";
 const HOOK_TIMEOUT_EXCEEDED_METRIC = "hq.hook_timeout_exceeded";
 const MAX_HOOK_SEQUENCE_ENTRIES = 20;
@@ -275,6 +276,17 @@ function safeSlowPhase(value) {
         return "unknown";
     return SAFE_SLOW_PHASES.has(value) ? value : "other";
 }
+function resolvedSlowPhase(metadata) {
+    const reported = safeSlowPhase(metadata.slow_phase);
+    if (reported !== "unknown" && reported !== "other")
+        return reported;
+    // Which measured master-hook phase consumed the most time when the caller's
+    // active-phase field was absent or unusable?
+    const debugContext = metadata.hook_timeout_debug_context;
+    const slowestPhase = debugContext?.phase_timings
+        .reduce((slowest, timing) => slowest === undefined || timing.elapsed_ms > slowest.elapsed_ms ? timing : slowest, undefined);
+    return slowestPhase ? safeSlowPhase(slowestPhase.phase) : reported;
+}
 function boundedDebugHookEvent(value) {
     return typeof value === "string" && DEBUG_CONTEXT_HOOK_EVENTS.has(value) ? value : "other";
 }
@@ -534,6 +546,28 @@ function timeoutElapsedMs(metadata) {
 function formatNumber(value) {
     return value.toFixed(2).replace(/\.00$|(?<=\.[0-9])0$/, "");
 }
+function formatSeconds(milliseconds) {
+    return `${formatNumber(milliseconds / 1_000)}s`;
+}
+// How much of the declared timeout has elapsed, and how much remains?
+function hookTimeoutMessage(event) {
+    if (event.type !== HOOK_TIMEOUT_WARNING_TYPE)
+        return event.message;
+    const elapsedMs = timeoutElapsedMs(event.metadata);
+    const declaredTimeoutMs = event.metadata.declared_timeout_ms;
+    if (elapsedMs === undefined ||
+        typeof declaredTimeoutMs !== "number" ||
+        !Number.isFinite(declaredTimeoutMs) ||
+        declaredTimeoutMs <= 0) {
+        return event.message;
+    }
+    const elapsed = formatSeconds(elapsedMs);
+    const budget = formatSeconds(declaredTimeoutMs);
+    if (elapsedMs >= declaredTimeoutMs) {
+        return `HQ hook used ${elapsed} of its ${budget} configured timeout (${formatSeconds(elapsedMs - declaredTimeoutMs)} over budget).`;
+    }
+    return `HQ hook used ${elapsed} of its ${budget} configured timeout (${formatSeconds(declaredTimeoutMs - elapsedMs)} remaining).`;
+}
 function elapsedBucket(elapsedMs) {
     if (elapsedMs === undefined)
         return "unknown";
@@ -672,9 +706,33 @@ function safeSlowChild(metadata) {
         (typeof value !== "string" || value.length === 0 || value === "other")) {
         return "entry-bash-startup";
     }
-    if (typeof value !== "string" || !SAFE_HOOK_SCRIPT.test(value))
-        return "other";
-    return value;
+    return typeof value === "string" && SAFE_HOOK_SCRIPT.test(value) ? value : "other";
+}
+function resolvedSlowChild(metadata) {
+    const directName = safeSlowChild(metadata);
+    const directDuration = metadata.slow_child_ms;
+    const hasDirectDuration = typeof directDuration === "number" && Number.isFinite(directDuration) && directDuration >= 0;
+    if (directName !== "other") {
+        return { name: directName, ...(hasDirectDuration ? { durationMs: directDuration } : {}) };
+    }
+    const currentScript = hookScript(metadata);
+    const currentEvent = stringMetadata(metadata, "hook_event", "");
+    const sequence = metadata.hook_sequence;
+    if (Array.isArray(sequence)) {
+        // Which named hook from this event's serialized sequence took longest
+        // when dispatch could not directly name its slow child?
+        const slowestNamedHook = sequence
+            .filter((entry) => entry.event === currentEvent &&
+            entry.script !== currentScript &&
+            SAFE_HOOK_SCRIPT.test(entry.script) &&
+            Number.isFinite(entry.ms) &&
+            entry.ms >= 0)
+            .reduce((slowest, entry) => (slowest === undefined || entry.ms > slowest.ms ? entry : slowest), undefined);
+        if (slowestNamedHook) {
+            return { name: slowestNamedHook.script, durationMs: slowestNamedHook.ms };
+        }
+    }
+    return { name: directName, ...(hasDirectDuration ? { durationMs: directDuration } : {}) };
 }
 function isMachineWideHookSlowness(metadata) {
     const spawnMs = metadata.spawn_ms;
@@ -717,7 +775,7 @@ function hookTimeoutTags(event) {
     const shell = stringMetadata(metadata, "shell");
     const nproc = metadata.nproc;
     const loadAverage = parsedLoadAverage(metadata);
-    const slowChildMs = metadata.slow_child_ms;
+    const slowChild = resolvedSlowChild(metadata);
     return {
         hook_timeout_kind: hookTimeoutKind(event),
         hook_event: hookEvent(metadata),
@@ -738,11 +796,9 @@ function hookTimeoutTags(event) {
         load_bucket: typeof loadAverage === "string" ? loadAverage : loadBucket(loadAverage),
         root_storage_class: rootStorageClassTag(metadata),
         spawn_ms_bucket: spawnMsBucket(metadata),
-        slow_child: safeSlowChild(metadata),
-        slow_phase: safeSlowPhase(metadata.slow_phase),
-        slow_child_ms_bucket: typeof slowChildMs === "number" && Number.isFinite(slowChildMs)
-            ? elapsedBucket(slowChildMs)
-            : "unknown",
+        slow_child: slowChild.name,
+        slow_phase: resolvedSlowPhase(metadata),
+        slow_child_ms_bucket: elapsedBucket(slowChild.durationMs),
         machine_wide: isMachineWideHookSlowness(metadata) ? "true" : "false",
         nproc: typeof nproc === "number" || typeof nproc === "string"
             ? safeTagValue(String(nproc), SAFE_NPROC)
@@ -777,7 +833,7 @@ function sentryEnvelope(event, overrides, additionalTags = {}) {
 /** Build the same scrubbed event projection that the live SDK path uses. */
 function scrubbedSentryEnvelope(event, overrides, additionalTags = {}) {
     return beforeSend({
-        message: event.message,
+        message: hookTimeoutMessage(event),
         ...sentryEnvelope(event, overrides, additionalTags),
     }, {});
 }
@@ -787,7 +843,7 @@ function hookTimeoutExceededOverrides(event) {
         return undefined;
     return {
         level: "warning",
-        fingerprint: ["hook-timeout", hookTimeoutKind(event)],
+        fingerprint: [HOOK_TIMEOUT_FINGERPRINT, hookTimeoutKind(event)],
     };
 }
 /**
@@ -1090,7 +1146,7 @@ export async function reportSentryEvent(stdin, options = {}, dependencies = defa
             : {};
         const envelope = sentryEnvelope(event, overrides, { ...debugContextTags, ...tags });
         try {
-            dependencies.sentry.captureMessage(event.message, envelope);
+            dependencies.sentry.captureMessage(hookTimeoutMessage(event), envelope);
             rateLimit.commitCapture();
             if (await flushWithin(dependencies.sentry, timeoutMs))
                 return result;
@@ -1104,7 +1160,7 @@ export async function reportSentryEvent(stdin, options = {}, dependencies = defa
     }
     const envelope = sentryEnvelope(event, overrides, debugContextTags);
     try {
-        dependencies.sentry.captureMessage(event.message, envelope);
+        dependencies.sentry.captureMessage(hookTimeoutMessage(event), envelope);
         if (await flushWithin(dependencies.sentry, timeoutMs))
             return result;
     }

package/dist/lib/doctor/client-health-reason-codes-flag.d.ts

@@ -2,6 +2,8 @@ import { type FlagClient, type FlagClientOptions } from "@indigoai-us/hq-flags-c
 export declare const CLIENT_HEALTH_REASON_CODES_FLAG = "client-health-sync-reason-codes";
 export declare const CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK = false;
 export declare const CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS = 150;
+export declare const CLIENT_HEALTH_CHECK_STATUS_FLAG = "client-health-sync-check-status";
+export declare const CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK = false;
 type ClientHealthFlagClient = Pick<FlagClient, "ready" | "isEnabled" | "close">;
 export interface ClientHealthReasonCodesFlagDependencies {
     env?: NodeJS.ProcessEnv;
@@ -21,7 +23,11 @@ export interface ClientHealthReasonCodesCompany {
  * off so a flag outage cannot delay the doctor's health result.
  */
 export declare function clientHealthReasonCodesEnabled(dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
+/** Resolve the separate status-report gate for the active company. */
+export declare function clientHealthCheckStatusEnabled(dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
 /** Resolve the same default-off gate for one explicitly identified company. */
 export declare function clientHealthReasonCodesEnabledForCompany(company: ClientHealthReasonCodesCompany, dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
+/** Resolve the separate default-off check-status gate for one company. */
+export declare function clientHealthCheckStatusEnabledForCompany(company: ClientHealthReasonCodesCompany, dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
 export {};
 //# sourceMappingURL=client-health-reason-codes-flag.d.ts.map

package/dist/lib/doctor/client-health-reason-codes-flag.js

@@ -4,12 +4,14 @@ import { getClientHealthFlagToken } from "./client-health-flag-token.js";
 export const CLIENT_HEALTH_REASON_CODES_FLAG = "client-health-sync-reason-codes";
 export const CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK = false;
 export const CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS = 150;
+export const CLIENT_HEALTH_CHECK_STATUS_FLAG = "client-health-sync-check-status";
+export const CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK = false;
 function safeErrorClass(error) {
     const name = error instanceof Error ? error.name : "UnknownError";
     return /^[A-Za-z][A-Za-z0-9]{0,63}$/.test(name) ? name : "UnknownError";
 }
 function reportFlagFailure(error) {
-    process.stderr.write(`HQ client-health reason-code flag lookup failed (${safeErrorClass(error)}); using default off.\n`);
+    process.stderr.write(`HQ client-health flag lookup failed (${safeErrorClass(error)}); using default off.\n`);
 }
 function combineSignals(first, second) {
     return first ? AbortSignal.any([first, second]) : second;
@@ -30,13 +32,32 @@ export async function clientHealthReasonCodesEnabled(dependencies = {}, callerSi
         companySlug: env.HQ_COMPANY_SLUG?.trim() || undefined,
     }, dependencies, callerSignal);
 }
+/** Resolve the separate status-report gate for the active company. */
+export async function clientHealthCheckStatusEnabled(dependencies = {}, callerSignal) {
+    const env = dependencies.env ?? process.env;
+    const companyUid = env.HQ_COMPANY_UID?.trim() || "";
+    if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
+        return CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK;
+    }
+    return clientHealthCheckStatusEnabledForCompany({
+        companyUid,
+        companySlug: env.HQ_COMPANY_SLUG?.trim() || undefined,
+    }, dependencies, callerSignal);
+}
 /** Resolve the same default-off gate for one explicitly identified company. */
 export async function clientHealthReasonCodesEnabledForCompany(company, dependencies = {}, callerSignal) {
+    return clientHealthFlagEnabledForCompany(CLIENT_HEALTH_REASON_CODES_FLAG, CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK, company, dependencies, callerSignal);
+}
+/** Resolve the separate default-off check-status gate for one company. */
+export async function clientHealthCheckStatusEnabledForCompany(company, dependencies = {}, callerSignal) {
+    return clientHealthFlagEnabledForCompany(CLIENT_HEALTH_CHECK_STATUS_FLAG, CLIENT_HEALTH_CHECK_STATUS_FLAG_FALLBACK, company, dependencies, callerSignal);
+}
+async function clientHealthFlagEnabledForCompany(flagKey, fallback, company, dependencies, callerSignal) {
     const env = dependencies.env ?? process.env;
     const endpoint = resolveFlagRegistryEndpoint(undefined, env);
     const companyUid = company.companyUid.trim();
-    if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
-        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
+    if (!endpoint || !/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
+        return fallback;
     }
     const companySlug = company.companySlug?.trim() || "";
     if (callerSignal?.aborted)
@@ -44,7 +65,7 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
     let client;
     let failed = false;
     let failureReported = false;
-    let enabled = CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
+    let enabled = fallback;
     const reportFailureOnce = (error) => {
         failed = true;
         if (failureReported)
@@ -83,8 +104,8 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
         });
         await client.ready();
         if (!failed && !signal.aborted) {
-            enabled = client.isEnabled(CLIENT_HEALTH_REASON_CODES_FLAG, {
-                fallback: CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK,
+            enabled = client.isEnabled(flagKey, {
+                fallback,
             });
         }
     }
@@ -100,7 +121,7 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
         }
     }
     return failed || signal.aborted
-        ? CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK
+        ? fallback
         : enabled;
 }
 //# sourceMappingURL=client-health-reason-codes-flag.js.map

package/dist/lib/doctor/json-output.d.ts

@@ -54,6 +54,8 @@ export interface DoctorJsonResult {
     reasonCode?: SyncReasonCode;
     /** Present only when this result's company opted in through hq-flags. */
     clientHealthReasonCodesEnabled?: true;
+    /** Present only when this result's company opted in to status reporting through hq-flags. */
+    clientHealthCheckStatusEnabled?: true;
     /** What was inspected. Present only when the result carries one. */
     target?: string;
     /** Human-readable explanation. */
@@ -100,6 +102,8 @@ export interface BuildDoctorJsonInput {
     scope?: readonly string[];
     /** Check ids whose own company enabled diagnostic reason codes in hq-flags. */
     clientHealthReasonCodesEnabledCheckIds?: ReadonlySet<string>;
+    /** Check ids whose own company enabled per-check status reporting in hq-flags. */
+    clientHealthCheckStatusEnabledCheckIds?: ReadonlySet<string>;
 }
 /** Assemble the machine-readable document from a completed run. */
 export declare function buildDoctorJson(input: BuildDoctorJsonInput): DoctorJsonDocument;

package/dist/lib/doctor/json-output.js

@@ -34,7 +34,7 @@ export function buildDoctorJson(input) {
     const results = [];
     for (const run of input.families) {
         for (const result of run.results) {
-            results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds));
+            results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds, input.clientHealthCheckStatusEnabledCheckIds));
         }
     }
     return {
@@ -48,7 +48,7 @@ export function buildDoctorJson(input) {
     };
 }
 /** Convert one {@link CheckResult} into its JSON form, omitting empty optionals. */
-function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds) {
+function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds, clientHealthCheckStatusEnabledCheckIds) {
     const remediation = deriveRemediation(result);
     return {
         status: result.status,
@@ -58,6 +58,9 @@ function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds)
         ...(clientHealthReasonCodesEnabledCheckIds?.has(result.checkId)
             ? { clientHealthReasonCodesEnabled: true }
             : {}),
+        ...(clientHealthCheckStatusEnabledCheckIds?.has(result.checkId)
+            ? { clientHealthCheckStatusEnabled: true }
+            : {}),
         ...(result.target !== undefined ? { target: result.target } : {}),
         message: result.message,
         ...(result.details !== undefined ? { details: result.details } : {}),

package/dist/lib/lanes/autopilot.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { safeCaughtError } from "../../utils/safe-caught-error.js";
 import { laneRunsOnHost } from "./admission.js";
 import { isControllerAliasOutpostId } from "./admission-host.js";
 import { LEAD_REGISTRY_REL, validateOutpostLeadRegistry } from "./autopilot-registry.js";
@@ -783,7 +784,10 @@ async function runLeadAutopilotPassUnlocked(input) {
             input.outpostId === registered.host &&
             lead.host.kind === "local" &&
             lead.host.id === input.hostname &&
-            await (input.readFlag ?? readLanesRegistryFlag)(LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG, { company }).catch(() => false);
+            await (input.readFlag ?? readLanesRegistryFlag)(LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG, { company }).catch((error) => {
+                console.warn("[hq-cli:lanes/autopilot] outpost-native lead flag read failed", safeCaughtError(error));
+                return false;
+            });
         const hostMatchesRegistry = registeredLocalHost
             ? lead.host.kind === "local"
             : outpostNativeLead ||

package/dist/lib/lanes/grants.d.ts

@@ -2,7 +2,10 @@ import { type LaneRecord } from "./types.js";
 import { LanesError } from "./errors.js";
 export type LaneHireGrantRow = Pick<LaneRecord, "lane_id" | "state" | "senior" | "hire_grant">;
 export declare function isFinishedResumableHireChild(state: LaneRecord["state"]): boolean;
+export declare function laneHoldsHireGrantCarve(lane: Pick<LaneHireGrantRow, "state">, finishedChildrenDoNotCount?: boolean): boolean;
 export declare function aliveDirectChildren<T extends LaneHireGrantRow>(lanes: readonly T[], parentLaneId: string, finishedChildrenDoNotCount?: boolean): T[];
+/** Children whose existing hire grants occupy their senior's carve. */
+export declare function childrenHoldingHireGrantCarve<T extends LaneHireGrantRow>(lanes: readonly T[], parentLaneId: string, finishedChildrenDoNotCount?: boolean): T[];
 export declare function assignedChildHireGrants(children: readonly LaneHireGrantRow[], exceptLaneId?: string): number;
 export interface HireGrantAdmissionSnapshot {
     parent: LaneHireGrantRow;

package/dist/lib/lanes/grants.js

@@ -4,11 +4,18 @@ import { LanesError } from "./errors.js";
 export function isFinishedResumableHireChild(state) {
     return state === "awaiting_input" || state === "blocked" || state === "done";
 }
+export function laneHoldsHireGrantCarve(lane, finishedChildrenDoNotCount = false) {
+    return !isTerminalLaneState(lane.state) &&
+        !(finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state));
+}
 export function aliveDirectChildren(lanes, parentLaneId, finishedChildrenDoNotCount = false) {
+    return childrenHoldingHireGrantCarve(lanes, parentLaneId, finishedChildrenDoNotCount);
+}
+/** Children whose existing hire grants occupy their senior's carve. */
+export function childrenHoldingHireGrantCarve(lanes, parentLaneId, finishedChildrenDoNotCount = false) {
     return lanes.filter((lane) => lane.senior.kind === "lane" &&
         lane.senior.id === parentLaneId &&
-        !isTerminalLaneState(lane.state) &&
-        !(finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state)));
+        laneHoldsHireGrantCarve(lane, finishedChildrenDoNotCount));
 }
 export function assignedChildHireGrants(children, exceptLaneId) {
     return children.reduce((sum, child) => child.lane_id === exceptLaneId ? sum : sum + (child.hire_grant ?? 0), 0);
@@ -101,7 +108,7 @@ export function withHireGrantAdmission(hqRoot, parentLaneId, fn, suppliedHierarc
             }
             parent = suppliedParent;
         }
-        const children = aliveDirectChildren(allLanes, parentLaneId, finishedChildrenDoNotCount);
+        const children = childrenHoldingHireGrantCarve(allLanes, parentLaneId, finishedChildrenDoNotCount);
         const parentGrant = parent.hire_grant ?? 0;
         const availableChildGrant = Math.max(0, parentGrant - assignedChildHireGrants(children));
         return fn({ parent, children, parentGrant, availableChildGrant });

package/dist/lib/lanes/index.d.ts

@@ -3,7 +3,7 @@
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
 export { MAX_LANE_DEPTH } from "./constants.js";
-export { assignedChildHireGrants, aliveDirectChildren, isFinishedResumableHireChild, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
+export { assignedChildHireGrants, aliveDirectChildren, childrenHoldingHireGrantCarve, isFinishedResumableHireChild, laneHoldsHireGrantCarve, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
 export type { HireGrantBackfillRow } from "./grants.js";
 export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneOccupiesRunningSlot, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
 export type { AdmissionCapReason, AdmissionHost } from "./admission.js";

package/dist/lib/lanes/index.js

@@ -3,7 +3,7 @@
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
 export { MAX_LANE_DEPTH } from "./constants.js";
-export { assignedChildHireGrants, aliveDirectChildren, isFinishedResumableHireChild, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
+export { assignedChildHireGrants, aliveDirectChildren, childrenHoldingHireGrantCarve, isFinishedResumableHireChild, laneHoldsHireGrantCarve, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
 export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneOccupiesRunningSlot, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
 export { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "./host-capacity.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STORY_STATUSES, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";

package/dist/utils/safe-caught-error.d.ts

@@ -0,0 +1,3 @@
+/** Render an unknown rejection safely for a concise diagnostic log. */
+export declare function safeCaughtError(error: unknown): string;
+//# sourceMappingURL=safe-caught-error.d.ts.map

package/dist/utils/safe-caught-error.js

@@ -0,0 +1,16 @@
+import { redactErrorText } from "./redact-error-text.js";
+/** Render an unknown rejection safely for a concise diagnostic log. */
+export function safeCaughtError(error) {
+    const rawName = error instanceof Error ? error.name : "UnknownError";
+    // A writable `name` can carry arbitrary text, so only class-shaped names are logged.
+    const name = /^[A-Za-z]{1,64}(?:Error|Exception)$/.test(rawName) ? rawName : "Error";
+    const rawMessage = error instanceof Error ? error.message : "non-Error rejection";
+    const message = redactErrorText(rawMessage)
+        .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s"<>]+/gi, "[URL]")
+        .replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[EMAIL]")
+        .replace(/\b(?:agt|cmp|prs|prj|session|sess|usr|user|acct|fin|st|e)_[A-Za-z0-9_-]+\b/gi, "[ID]")
+        .replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/gi, "[ID]")
+        .slice(0, 160);
+    return `${name}: ${message || "[empty]"}`;
+}
+//# sourceMappingURL=safe-caught-error.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.20",
+  "version": "5.345.21",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {