@indigoai-us/hq-cli 5.345.200 → 5.345.201

package/dist/lib/bot/legacy-provider-login.js

@@ -0,0 +1,144 @@
+/**
+ * Is the provider sign-in a legacy Codex or Grok bot needs readable on this
+ * computer, the way HQ Fleet Local imports it (`hq-fleet-local auth login`)?
+ *
+ * - Codex: the Codex CLI login file `<CODEX_HOME>/auth.json` (else
+ *   ~/.codex/auth.json) with a refreshable, unexpired token. A bot with its
+ *   own Codex login (hq bot login) or a capacity account imports from that
+ *   home instead, so the account it answered with comes along.
+ * - Grok: the runtime only copies another Fleet bot's Grok login (its own
+ *   device-code sign-in needs a browser), so the probe asks the helper of
+ *   every other Fleet bot on this computer whether it holds one.
+ *
+ * Nothing here reads, prints or copies a credential value: the Codex check
+ * decodes only the token's expiry claim, and the Grok check asks the helper
+ * for a yes or no.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fleetLocalProviderAuthStatus, listFleetLocalProfiles } from "./fleet-local.js";
+import { botOwnAuthHome, botRuntimeAuth, capacityAccountHome } from "./runtime-auth.js";
+export function codexCliAuthPath(home) {
+    return path.join(home, "auth.json");
+}
+/** The `exp` claim of a JWT, in seconds, or null when the token has none that reads. */
+export function jwtExpiry(token) {
+    const parts = token.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return typeof claims.exp === "number" && Number.isFinite(claims.exp) ? claims.exp : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Mirrors the runtime's `_import_codex_cli_tokens`: a refreshable, unexpired login in `<home>/auth.json`. */
+export function codexCliLoginReadable(home, now = Date.now()) {
+    const file = codexCliAuthPath(home);
+    if (!fs.existsSync(file))
+        return { readable: false, detail: `no Codex CLI login at ${file}` };
+    let tokens;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8").replace(/^\uFEFF/, ""));
+        tokens = parsed.tokens && typeof parsed.tokens === "object" ? parsed.tokens : undefined;
+    }
+    catch {
+        return { readable: false, detail: `${file} could not be read` };
+    }
+    const access = typeof tokens?.access_token === "string" ? tokens.access_token.trim() : "";
+    const refresh = typeof tokens?.refresh_token === "string" ? tokens.refresh_token.trim() : "";
+    if (!access || !refresh)
+        return { readable: false, detail: `${file} holds no refreshable Codex login` };
+    const exp = jwtExpiry(access);
+    if (exp !== null && exp * 1000 <= now)
+        return { readable: false, detail: `the Codex login at ${file} has expired` };
+    return { readable: true, detail: `Codex CLI login at ${file}` };
+}
+/**
+ * Where a legacy bot's Codex login lives: its own folder, a capacity account,
+ * or the owner's (CODEX_HOME, else ~/.codex). `env` is set when the import
+ * must look somewhere other than the owner's default.
+ */
+export function legacyCodexHome(dir, config, env = process.env, homedir = os.homedir()) {
+    const auth = botRuntimeAuth(config, "codex");
+    if (!auth) {
+        if (config.runtimeAuth?.codex !== undefined)
+            return { error: `${config.name}'s saved codex login setting is not readable` };
+        return { home: env.CODEX_HOME?.trim() || path.join(homedir, ".codex") };
+    }
+    if (auth.mode === "own") {
+        const home = botOwnAuthHome(dir, "codex");
+        return { home, env: { CODEX_HOME: home } };
+    }
+    try {
+        const home = capacityAccountHome(config.hqRoot, "codex", auth.account);
+        return { home, env: { CODEX_HOME: home } };
+    }
+    catch (err) {
+        return { error: err instanceof Error ? err.message : String(err) };
+    }
+}
+/** The helper asks the keychain per profile, so one list of bots shares a scan this long. */
+export const GROK_HOLDER_SCAN_TTL_MS = 30_000;
+let grokHolderScan = null;
+export function resetGrokHolderScan() {
+    grokHolderScan = null;
+}
+/** Every Fleet bot here with a Grok OAuth login, scanned at most once per TTL in this process (live deps are never cached). */
+function grokHolders(deps, now) {
+    const live = !deps.profiles && !deps.status;
+    if (live && grokHolderScan && now - grokHolderScan.at < GROK_HOLDER_SCAN_TTL_MS)
+        return grokHolderScan;
+    const profiles = (deps.profiles ?? listFleetLocalProfiles)();
+    const status = deps.status ?? ((agentUid) => fleetLocalProviderAuthStatus(agentUid, "xai-oauth"));
+    const holders = [];
+    const unanswered = [];
+    for (const profile of profiles) {
+        const found = status(profile.agentUid);
+        if (found === null)
+            unanswered.push(profile.agentUid);
+        else if (found.authenticated && found.authType === "oauth")
+            holders.push(profile.agentUid);
+    }
+    const scan = { at: now, holders, uids: profiles.map((profile) => profile.agentUid), unanswered };
+    // A scan that found nothing or got no answer may be a passing failure: ask again next time.
+    if (live && profiles.length > 0 && unanswered.length < profiles.length)
+        grokHolderScan = scan;
+    return scan;
+}
+/** Mirrors the helper's `_existing_machine_oauth`: another Fleet bot here holds a Grok OAuth login. */
+export function grokLoginReadableHere(exclude, deps = {}, now = Date.now()) {
+    const scan = grokHolders(deps, now);
+    const other = (agentUid) => agentUid.toLowerCase() !== exclude.toLowerCase();
+    const holder = scan.holders.find(other);
+    if (holder)
+        return { readable: true, detail: `the Grok sign-in of HQ Fleet bot ${holder} on this computer` };
+    const others = scan.uids.filter(other);
+    const unanswered = scan.unanswered.filter(other);
+    if (others.length && unanswered.length === others.length) {
+        return { readable: false, detail: `the HQ Fleet helper could not say whether any of the ${others.length} other Fleet bot(s) on this computer is signed in to Grok` };
+    }
+    return {
+        readable: false,
+        detail: others.length ? `none of the ${others.length} other HQ Fleet bot(s) on this computer is signed in to Grok` : "no other HQ Fleet bot on this computer is signed in to Grok",
+    };
+}
+/** The live probe for a bot: Codex from its login home, Grok from the other Fleet bots here. */
+export function legacyProviderLoginProbe(dir, config) {
+    return (runtime) => {
+        if (runtime === "grok") {
+            if (config.runtimeAuth?.grok !== undefined)
+                return { readable: false, detail: "it uses its own Grok login, which HQ Fleet Local cannot import" };
+            return grokLoginReadableHere(config.agentUid);
+        }
+        const home = legacyCodexHome(dir, config);
+        if ("error" in home)
+            return { readable: false, detail: home.error };
+        const login = codexCliLoginReadable(home.home);
+        return home.env && login.readable ? { ...login, env: home.env } : login;
+    };
+}
+//# sourceMappingURL=legacy-provider-login.js.map

package/dist/lib/bot/run.js

@@ -1,3 +1,4 @@
+import { createSourceReporter, ensureSourceReportJobs, SOURCE_REPORT_JOB_KIND } from "./jobs/source-report.js";
 import { ensureSignalToLaneJobs, runSignalToLane, SIGNAL_TO_LANE_JOB_KIND } from "./jobs/signal-to-lane.js";
 /**
  * The resident bot process: `hq bot run <name>` (local-bots US-003/US-004).
@@ -424,7 +425,13 @@ export async function runBot(deps) {
     const meetingRider = createMeetingRider(defaultMeetingRiderDeps(config, dir, (message) => log("info", message)));
     const meetingDetectDeps = defaultMeetingDetectDeps(config, dir, (message) => log("info", message));
     const meetingDetect = createMeetingDetect(meetingDetectDeps);
+    const sourceReporter = createSourceReporter({ config, api, now, botsDir: path.dirname(dir) });
     const eventHandlers = Object.create(builtinEventHandlers);
+    eventHandlers[SOURCE_REPORT_JOB_KIND] = async ({ item }) => {
+        const context = typeof item.context === "object" ? item.context : undefined;
+        const event = context?.event;
+        return sourceReporter.handle(event?.event, context?.payload, context?.company);
+    };
     eventHandlers[MEETING_RIDER_JOB_KIND] = async ({ item }) => {
         if (!isExecutiveBot(config))
             return { status: "skipped-precondition", output: "Not the Executive" };
@@ -2060,7 +2067,7 @@ export async function runBot(deps) {
         if (eventHandler) {
             // Recoverable built-ins persist intent before acknowledging the event.
             // Signal lane creation is idempotent, so a pre-ack crash can replay.
-            const durableEvent = typeof job.context === "object" && (job.context?.jobKind === MEETING_RIDER_JOB_KIND || job.context?.jobKind === SIGNAL_TO_LANE_JOB_KIND);
+            const durableEvent = typeof job.context === "object" && (job.context?.jobKind === SOURCE_REPORT_JOB_KIND || job.context?.jobKind === MEETING_RIDER_JOB_KIND || job.context?.jobKind === SIGNAL_TO_LANE_JOB_KIND);
             if (!durableEvent)
                 markProcessed(dir, id, now().toISOString());
             let completion;
@@ -2884,6 +2891,12 @@ export async function runBot(deps) {
     // up below: end here, before the kickoff can send a "needs a sign-in" DM.
     if (stopping)
         return await stoppedDuringStartup();
+    try {
+        ensureSourceReportJobs(dir, config);
+    }
+    catch {
+        log("warn", "Source report registration failed");
+    }
     try {
         ensureSignalToLaneJobs(dir, config);
     }
@@ -3016,6 +3029,12 @@ export async function runBot(deps) {
             // A failed signals run's automatic retry, once due (no model turn).
             enqueueDueSignalsRetries();
             if (isExecutiveBot(config)) {
+                try {
+                    await sourceReporter.recover();
+                }
+                catch {
+                    log("warn", "Source report recovery deferred");
+                }
                 try {
                     meetingDetect.tick();
                 }

package/dist/lib/doctor/checks/bots.d.ts

@@ -1,5 +1,7 @@
+import { type BotConfig } from "../../bot/config.js";
 import { type ClaudeLoginCheck } from "../../bot/claude-login.js";
 import { type BotStatusFile } from "../../bot/status.js";
+import { type LegacyMoveState } from "../../bot/legacy-convert.js";
 import { type NodeBinaryIo } from "../../node-binary.js";
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 export declare const BOTS_FAMILY_ID = "bots";
@@ -11,6 +13,8 @@ export interface BotsDoctorDeps {
     nodeIo?: NodeBinaryIo;
     /** The Claude Code login read the way the HQ Fleet Runtime reads it (tests). */
     claudeLogin?: () => ClaudeLoginCheck;
+    /** Whether and why a legacy bot moves to the HQ Fleet Runtime at its next start (tests). */
+    legacyMove?: (dir: string, config: BotConfig) => LegacyMoveState;
 }
 /** The last reported failure, unless a later turn worked. */
 export declare function unresolvedLastFailure(status: BotStatusFile | null): BotStatusFile["lastFailure"] | null;

package/dist/lib/doctor/checks/bots.js

@@ -10,10 +10,39 @@ import { botsRoot, botDir, launchdLabel } from "../../bot/paths.js";
 import { HQ_FLEET_RUNTIME_ENGINE_ID, readBotConfig } from "../../bot/config.js";
 import { checkClaudeCodeLogin, claudeLoginFix, describeClaudeLoginSources, } from "../../bot/claude-login.js";
 import { isPidAlive, readBotStatus } from "../../bot/status.js";
+import { legacyMoveState } from "../../bot/legacy-convert.js";
+import { legacyProviderLoginProbe } from "../../bot/legacy-provider-login.js";
+import { runtimeDisplayName } from "../../bot/runtime-sign-in.js";
 import { nodeBinaryProblem } from "../../node-binary.js";
 import { launchdPlistProgramArguments, parseLaunchdCommand } from "../../service-manager/launchd.js";
 export const BOTS_FAMILY_ID = "bots";
 export const BOTS_FAMILY_TITLE = "Local bots";
+function isLegacyBot(config) {
+    return config.engine?.id !== HQ_FLEET_RUNTIME_ENGINE_ID;
+}
+/** A bot still on its legacy runner: one WARN when it moves at its next start, one FAIL when it is held. */
+function legacyRuntimeCheck(name, dir, config, state) {
+    const tool = runtimeDisplayName(config.runtime);
+    const failure = state.lastFailure;
+    const lastMove = failure ? ` Its last move failed at ${failure.at}${failure.step ? ` (could not ${failure.step})` : ""}${failure.error ? `: ${failure.error}` : ""}.` : "";
+    if (state.decision.convert) {
+        return {
+            status: "WARN",
+            checkId: `bots.${name}.legacy-runtime`,
+            target: dir,
+            message: `${name} still runs on its older ${tool} runner and moves to the HQ Fleet Runtime at its next start.${lastMove}`,
+            remediation: `hq bot start ${name}`,
+        };
+    }
+    return {
+        // The env opt-out is the owner's choice (and read from this shell, not the bot's); a sign-in hold is a bot that cannot work.
+        status: state.decision.reason === "kept-by-env" ? "WARN" : "FAIL",
+        checkId: `bots.${name}.legacy-runtime`,
+        target: dir,
+        message: `${name} still runs on its older ${tool} runner (${state.decision.reason}): ${state.notice?.cause ?? state.decision.detail}${lastMove}`,
+        remediation: `${state.notice?.fix ?? ""} Details: hq bot status ${name}`.trim(),
+    };
+}
 const DEFAULT_DEPS = {
     home: () => os.homedir(),
     root: (home) => botsRoot(home ?? os.homedir()),
@@ -89,6 +118,10 @@ function runChecks(deps) {
             continue;
         const status = readBotStatus(dir);
         const alive = !!status && status.state === "running" && isPidAlive(status.pid);
+        if (isLegacyBot(config)) {
+            const state = (deps.legacyMove ?? ((d, c) => legacyMoveState(d, c, legacyProviderLoginProbe(d, c))))(dir, config);
+            results.push(legacyRuntimeCheck(name, dir, config, state));
+        }
         if (isClaudeFleetBot(config)) {
             claudeLogin ??= (deps.claudeLogin ?? (() => checkClaudeCodeLogin({ home })))();
             if (claudeLogin.signedIn) {

package/dist/lib/lanes/store.js

@@ -495,6 +495,9 @@ export function parseLaneRecord(raw, filePath) {
     const schema_version = requireString(raw.schema_version, "schema_version");
     parseMajorSchema(schema_version, "hq-lane", 1);
     requireString(raw.lane_id, "lane_id");
+    if (raw.source_report_pending !== undefined && typeof raw.source_report_pending !== "boolean") {
+        throw new LaneSchemaError("source_report_pending must be boolean", { field: "source_report_pending" });
+    }
     if (raw.signal !== undefined) {
         if (!raw.signal || typeof raw.signal !== "object" || Array.isArray(raw.signal)) {
             throw new LaneSchemaError("signal must be an object", { field: "signal" });
@@ -1818,6 +1821,10 @@ export function updateLane(hqRoot, laneId, expectedVersion, writer, updater, dep
             }
         }
         if (!isTerminalLaneState(current.state) && isTerminalLaneState(updated.state)) {
+            // Couple the report-event intent to the terminal commit. The resident
+            // Executive can publish it even if the watcher dies before appending.
+            if (updated.signal && updated.company)
+                updated.source_report_pending = true;
             const releasedGrant = updated.hire_grant ?? current.hire_grant ?? 0;
             return withoutStaleQueuedDetails({
                 ...updated,

package/dist/lib/lanes/types.d.ts

@@ -654,6 +654,8 @@ export interface LaneSignal {
 export interface LaneRecord {
     signal?: LaneSignal;
     signal_link?: string;
+    /** Event outbox bit, persisted atomically with a signaled lane's terminal transition. */
+    source_report_pending?: boolean;
     schema_version: typeof LANE_SCHEMA_VERSION | string;
     lane_id: string;
     /** CLI release that most recently wrote this lane record. Absent on legacy rows. */

package/dist/lib/lanes/types.js

@@ -255,6 +255,7 @@ export const LANE_WRITERS = ["creator", "command", "watcher", "reconcile", "spaw
 /** Field ownership at the durable-record mutation boundary (spec §10.1). */
 export const LANE_FIELD_WRITERS = {
     signal: ["creator"], signal_link: ["creator"],
+    source_report_pending: ["watcher"],
     schema_version: ["creator"], lane_id: ["creator"], written_by_version: [], owner_written_by_version: [], company: ["creator", "command"], company_history: ["command"],
     project_id: ["command"], story_id: ["command"], no_story_reason: ["creator", "command"], focus_overrides: ["command"], ledger_sync_error: ["story-ledger"], pending_question_ids: ["story-ledger"], stories: ["creator", "command", "watcher", "reconcile", "spawn"], thread_id: ["creator", "command", "spawn"], mesh_company: ["creator", "command"],
     depth: ["command"], senior: ["command"], senior_history: ["command"],

package/dist/lib/lanes/watcher.d.ts

@@ -1,36 +1,3 @@
-/**
- * Per-lane watcher (spec §5.7).
- *
- * Armed at spawn, detached from the caller. Emits on progress, terminal, and
- * silence (20 minutes with the process still alive). Terminal classification
- * follows spec §5: an envelope decides done/ask/blocked; a process that exits
- * with partial output and no envelope is `interrupted`; silence is never
- * success.
- *
- * Progress has two sources. Output files (worker.out, worker.err,
- * last-message.txt) cover codex and grok, which stream as they work. They do
- * not cover Claude: `claude -p --output-format json` writes nothing until it
- * exits, so a healthy Claude lane used to hit the silence deadline at exactly
- * 20 minutes every time, and a hung one looked identical. The second source
- * is logs/tool-activity.json, which the drain hook rewrites on every
- * PreToolUse call (dropbox.ts). A worker that is working calls tools; a
- * worker that has not called a tool or written output for the whole window
- * is `stalled`, and the watcher says so on the lane record.
- *
- * What this cannot tell apart: a worker hung inside one tool call from a
- * worker running one legitimately long tool call (a 25-minute build); a
- * worker looping on tool calls without making progress from a working one;
- * a model stuck mid-generation with no tool call from one that is writing a
- * long answer. It also depends on the drain hook being registered in the
- * provider home (hooks-install.ts): with no hook there is no touch, and the
- * lane reads as stalled every window, which is the pre-existing behaviour.
- * Distinguishing a hung tool from a slow one needs the provider to report
- * per-call state, which none of the three CLIs expose today. `stalled` is
- * therefore a flag for the senior to look at, never a kill.
- *
- * Queue admission of the next lane when a slot frees is owned by the
- * periodic reconcile pass and is out of scope here.
- */
 import { ENVELOPE_INVALID_REASON, type LaneEnvelope, type LaneCompanyRef, type LaneRecord, type LaneState } from "./types.js";
 import { type QuotaSignal } from "./quota.js";
 import { type ProviderRejection } from "./provider-rejection.js";

package/dist/lib/lanes/watcher.js

@@ -1,3 +1,4 @@
+import { emitExecutiveLaneFinished } from "../bot/jobs/source-report.js";
 /**
  * Per-lane watcher (spec §5.7).
  *
@@ -561,6 +562,12 @@ function applyTerminalToLaneWithResult(hqRoot, laneId, classification, opts = {}
         updated.model) {
         clearAccountQuotaAfterSuccessfulTurnBestEffort(hqRoot, updated.provider, updated.account, updated.model, new Date(at));
     }
+    try {
+        emitExecutiveLaneFinished(hqRoot, updated);
+    }
+    catch (error) {
+        process.stderr.write(`hq lanes watcher: source report event failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    }
     notifySlotFreed({
         hqRoot,
         provider: updated.provider,

package/dist/utils/resident-package-preload.js

@@ -69,15 +69,22 @@ export const RESIDENT_PACKAGE_MODULES = {
         "../lib/first-sync-next-step.js",
         "@indigoai-us/hq-cloud",
         "../lib/lanes/reconcile.js",
+        "../utils/local-files-overview.js",
+        "../utils/vault-api.js",
+        "../commands/files-browse.js",
+        "@aws-sdk/client-s3",
+        "../commands/access.js",
+        "../commands/sources.js",
+        "../lib/hot-channels/adapters/index.js",
     ],
     "daemon-logs-follow": [],
     "mesh-daemon": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
-    "lanes-watch": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
-    "monitor-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
-    "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
+    "lanes-watch": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js", "../commands/lanes.js"],
+    "monitor-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js", "../commands/lanes.js"],
+    "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js"],
     "agents-message-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     "integrations-oauth-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
-    "outpost-wait": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
+    "outpost-wait": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js"],
     "secrets-sandbox": [],
     "pkg-update": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../utils/cognito-session.js", "@indigoai-us/hq-cloud"],
     "pack-install": [
@@ -252,6 +259,14 @@ const LOADERS = {
         () => import("../lib/first-sync-next-step.js"),
         () => import("@indigoai-us/hq-cloud"),
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
     ],
     "daemon-logs-follow": [],
     "mesh-daemon": [
@@ -283,6 +298,16 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
+        () => import("../commands/lanes.js"),
     ],
     "monitor-wait": [
         async () => {
@@ -299,6 +324,16 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
+        () => import("../commands/lanes.js"),
     ],
     "monitor-run": [
         () => import("../commands/lanes.js"),
@@ -316,6 +351,15 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
     ],
     "agents-message-wait": [
         async () => {
@@ -361,6 +405,15 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
     ],
     "secrets-sandbox": [],
     "pkg-update": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.200",
+  "version": "5.345.201",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -116,11 +116,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.200",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.200",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.200",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.200",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.200",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.200"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.201",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.201",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.201",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.201",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.201",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.201"
   }
 }