@indigoai-us/hq-cli 5.345.25 → 5.345.27

package/dist/commands/lanes.js

@@ -62,19 +62,21 @@ import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, lan
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, aliveDirectChildren, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, syncLaneToProjectStoryLedger, removeLaneFromProjectStoryLedger, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "../lib/lanes/lane-company.js";
 import { doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
 import { questionBodyAbsPath, resolveQuestionCompanyWithFallback, resolveProjectQuestionCompany, } from "../lib/lanes/questions.js";
 import { assertQuestionBodySecretSafe } from "../lib/lanes/questions.js";
+import { writeQuestionBody } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { parseCliEffort, resolveLaneEffort, } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { readLatestEnvelopeRecord } from "../lib/lanes/watcher.js";
 import { loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
 import { SESSION_MOVE_REASON } from "../lib/lanes/move-account.js";
+import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import { resolveManagerStatusTarget, } from "../lib/lanes/manager-status-gate.js";
 import { blockerFreshnessFingerprint, resolveBlockerFreshnessForLane, } from "../lib/lanes/blocker-freshness.js";
 import { resolveKrFreshnessForShow } from "../lib/lanes/kr-freshness.js";
@@ -496,7 +498,7 @@ function loadAllLanes(hqRoot) {
 function laneHireFields(lane, lanes, aliveChildrenByParent, finishedChildrenDoNotCount = false) {
     const aliveChildCount = aliveChildrenByParent
         ? aliveChildrenByParent.get(lane.lane_id) ?? 0
-        : aliveDirectChildren(lanes, lane.lane_id, finishedChildrenDoNotCount).length;
+        : childrenHoldingHireGrantCarve(lanes, lane.lane_id, finishedChildrenDoNotCount).length;
     const hireGrant = lane.hire_grant ?? 0;
     const hireSummary = `hire ${aliveChildCount}/${hireGrant}`;
     return {
@@ -1046,9 +1048,13 @@ async function withResumeHireAdmission(ctx, lane, fn, grantContext) {
         const seniorLaneId = lane.senior.kind === "lane" ? lane.senior.id : undefined;
         const resumeSenior = seniorLaneId
             ? grantContext?.hierarchy.find((entry) => entry.lane_id === seniorLaneId) ??
-                (listLaneIds(hqRoot).includes(seniorLaneId) ? readLane(hqRoot, seniorLaneId) : lane)
+                (listLaneIds(hqRoot).includes(seniorLaneId) ? readLane(hqRoot, seniorLaneId) : undefined)
             : lane;
-        finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, resumeSenior);
+        if (resumeSenior) {
+            finishedChildrenDoNotCount = await hireGrantFinishedChildrenDoNotCount(ctx, resumeSenior);
+        }
+        // A missing senior record keeps the live-only flag off, so finished
+        // children continue to count. Never borrow the child's company for this gate.
     }
     const shouldCheckGrant = isTerminalLaneState(lane.state) ||
         (finishedChildrenDoNotCount && isFinishedResumableHireChild(lane.state));
@@ -2134,6 +2140,16 @@ function companyBindingFromSessionMeta(meta) {
         return { binding: "none" };
     return { binding: "company", slug, uid };
 }
+function canonicalCompanySlugForUid(hqRoot, uid, senior) {
+    const companies = readCompaniesManifestMap(hqRoot);
+    const matches = companies
+        ? Object.entries(companies).filter(([, entry]) => entry?.cloud_uid === uid).map(([slug]) => slug)
+        : [];
+    if (matches.length !== 1) {
+        throw new LanesError("senior_company_unresolved", `Cannot resolve senior ${seniorKey(senior)} to one company slug from uid ${uid}`, { senior, company_uid: uid, matches });
+    }
+    return matches[0];
+}
 function serializeSeniorCompany(seniorCompany) {
     if (seniorCompany.binding === "unknown")
         return null;
@@ -3064,9 +3080,17 @@ async function runCreate(ctx, opts) {
     }
     const senior = opts.senior ? parseSeniorRef(opts.senior) : defaultSenior(ctx);
     assertSeniorExists(hqRoot, senior, ctx);
-    const company = companyFlag
+    let company = companyFlag
         ? await ctx.resolveCompany(companyFlag)
         : null;
+    const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
+    if (company === null && seniorCompany.binding === "company") {
+        const seniorCompanyIdentifier = seniorCompany.slug ?? (seniorCompany.uid
+            ? canonicalCompanySlugForUid(hqRoot, seniorCompany.uid, senior)
+            : undefined);
+        if (seniorCompanyIdentifier)
+            company = await ctx.resolveCompany(seniorCompanyIdentifier);
+    }
     const callerAuthorization = requestedHireGrant !== undefined || ctx.env.HQ_LANE_ID?.trim()
         ? callerSeniorAuthorization(ctx, senior)
         : { authorized: true };
@@ -3122,7 +3146,6 @@ async function runCreate(ctx, opts) {
     if (requestedPlacement !== undefined || defaultPlacement !== undefined) {
         await assertPlacementEnabled(ctx, resolvePlacementCompany(), placementEnabled);
     }
-    const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     assertSameTenant(company, senior, seniorCompany);
     const createStoryWarnings = [];
     const knownAbsentStories = new Set();
@@ -4333,7 +4356,7 @@ function laneRunsHereForOperatorMutation(ctx, lane) {
 function assertLaneRunsHereForOperatorMutation(ctx, lane, action) {
     if (laneRunsHereForOperatorMutation(ctx, lane))
         return;
-    throw new LanesError("lane_remote", `Cannot ${action} lane ${lane.lane_id} from this host; its state is owned by ${lane.host.kind}:${lane.host.id}`, { lane_id: lane.lane_id, host: lane.host, action });
+    throw new LanesError("lane_remote", `Cannot ${action} lane ${lane.lane_id} from this host; its state is owned by ${lane.host.kind === "outpost" ? `Outpost ${lane.host.id}` : `host ${lane.host.id}`}. Run this command on the owning host.`, { lane_id: lane.lane_id, host: lane.host, action });
 }
 async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior = {}) {
     if (lane.host.kind !== "outpost") {
@@ -4399,9 +4422,11 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
                         ? "reparent-target"
                         : action === "approve"
                             ? "approve-target"
-                            : action,
+                            : action === "repair-company"
+                                ? "repair-company-target"
+                                : action,
                 laneId: lane.lane_id,
-                hqBinary: action === "grant" || action === "reparent"
+                hqBinary: action === "grant" || action === "reparent" || action === "repair-company"
                     ? outpostCliOverride(ctx, outpostId)
                     : undefined,
                 text: options.text,
@@ -4416,6 +4441,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
                 hire: options.hire,
                 senior: options.senior,
                 reason: options.reason,
+                company: options.company,
                 grantContext: contexts.grantContext,
                 profileRepinContext: contexts.profileRepinContext,
                 failedResumeContext: contexts.failedResumeContext,
@@ -4534,23 +4560,28 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
                 : action === "approve"
                     ? remote.checkpoint === options.checkpoint &&
                         remote.lane !== null && typeof remote.lane === "object" && !Array.isArray(remote.lane)
-                    : action === "reparent"
-                        ? remote.lane !== null && typeof remote.lane === "object" &&
-                            Array.isArray(remote.changed_descendant_ids)
-                        : (((remote.delivery_status === "worker_spawned" ||
-                            remote.delivery_status === "queued_on_target_account") &&
-                            remote.lane !== undefined) ||
-                            (remote.delivery_status === "queued_on_admission" &&
-                                remote.lane !== null &&
-                                typeof remote.lane === "object" &&
-                                !Array.isArray(remote.lane) &&
-                                remote.lane.state === "queued") ||
-                            (remote.delivery_status === "queued_for_reconcile" &&
-                                remote.lane !== null &&
-                                typeof remote.lane === "object" &&
-                                !Array.isArray(remote.lane) &&
-                                remote.lane.state === "queued" &&
-                                remote.lane.queued_reason !== "worker_profile_changed")));
+                    : action === "repair-company"
+                        ? remote.lane !== null && typeof remote.lane === "object" && !Array.isArray(remote.lane) &&
+                            remote.lane.company !== null &&
+                            remote.lane.company !== undefined &&
+                            remote.lane.company.slug === options.company
+                        : action === "reparent"
+                            ? remote.lane !== null && typeof remote.lane === "object" &&
+                                Array.isArray(remote.changed_descendant_ids)
+                            : (((remote.delivery_status === "worker_spawned" ||
+                                remote.delivery_status === "queued_on_target_account") &&
+                                remote.lane !== undefined) ||
+                                (remote.delivery_status === "queued_on_admission" &&
+                                    remote.lane !== null &&
+                                    typeof remote.lane === "object" &&
+                                    !Array.isArray(remote.lane) &&
+                                    remote.lane.state === "queued") ||
+                                (remote.delivery_status === "queued_for_reconcile" &&
+                                    remote.lane !== null &&
+                                    typeof remote.lane === "object" &&
+                                    !Array.isArray(remote.lane) &&
+                                    remote.lane.state === "queued" &&
+                                    remote.lane.queued_reason !== "worker_profile_changed")));
     if (!resultConfirmed) {
         throw new LanesError("outpost_delivery_unconfirmed", `Outpost ${outpostId} completed exec without a confirmed ${action} result for lane ${lane.lane_id}`, {
             lane_id: lane.lane_id,
@@ -4609,7 +4640,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options, behavior =
             printJson(response);
         return response;
     }
-    if (action === "approve" || action === "reparent" || action === "resume") {
+    if (action === "approve" || action === "reparent" || action === "resume" || action === "repair-company") {
         const ownerLane = dispatchedOwnerLane(ctx, lane.lane_id, outpostId, remote.lane, behavior);
         const descendants = [];
         if (action === "reparent") {
@@ -6198,7 +6229,7 @@ async function runBackfillGrants(ctx, opts) {
     const allLanes = loadAllLanes(hqRoot);
     const profileIds = new Set(allLanes
         .filter((lane) => !isTerminalLaneState(lane.state) &&
-        (aliveDirectChildren(allLanes, lane.lane_id).length > 0 ||
+        (childrenHoldingHireGrantCarve(allLanes, lane.lane_id).length > 0 ||
             lane.worker_profile === "hq-lanes-manager"))
         .map((lane) => lane.worker_profile)
         .filter((id) => Boolean(id)));
@@ -7121,6 +7152,10 @@ function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false
         throw new LanesError("lane_terminal", `Cannot re-parent a lane in terminal state ${lane.state}`, { lane_id: laneId, state: lane.state });
     }
     const seniorCompany = companyOfSenior(hqRoot, nextSenior, ctx);
+    if (lane.company === null && seniorCompany.binding === "company") {
+        const company = seniorCompany.slug ?? seniorCompany.uid ?? "<company>";
+        throw new LanesError("lane_company_missing", `Lane ${laneId} has no company attribution. Repair it with hq lanes repair-company ${laneId} --company ${company}, then retry reparent.`, { lane_id: laneId, senior: nextSenior, senior_company: serializeSeniorCompany(seniorCompany) });
+    }
     assertSameTenant(lane.company, nextSenior, seniorCompany, { lane_id: laneId });
     if (nextSenior.kind === "lane" && seniorKey(lane.senior) !== seniorKey(nextSenior)) {
         const parent = readLane(hqRoot, nextSenior.id);
@@ -7239,6 +7274,108 @@ function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false
             .map((descendant) => descendant.laneId),
     };
 }
+async function runRepairCompany(ctx, laneId, opts) {
+    const lane = readLane(ctx.hqRoot(), laneId);
+    if (lane.host.kind === "outpost" && !laneRunsHere(lane, reconcileHostFromCtx(ctx))) {
+        const companySlug = opts.company?.trim();
+        if (!companySlug)
+            throw new LanesError("missing_company", "--company is required", {});
+        const company = await ctx.resolveCompany(companySlug);
+        await dispatchOutpostLaneCommand(ctx, lane, "repair-company", { company: company.slug });
+        return;
+    }
+    await repairCompanyOnOwner(ctx, laneId, opts);
+}
+async function repairCompanyOnOwner(ctx, laneId, opts) {
+    const hqRoot = ctx.hqRoot();
+    const companySlug = opts.company?.trim();
+    if (!companySlug) {
+        throw new LanesError("missing_company", "--company is required", {});
+    }
+    const company = await ctx.resolveCompany(companySlug);
+    const initial = readLane(hqRoot, laneId);
+    assertLaneRunsHereForOperatorMutation(ctx, initial, "repair company for");
+    const initialSeniorCompany = companyOfSenior(hqRoot, initial.senior, ctx);
+    if (initialSeniorCompany.binding === "company" && !sameTenant(company, initial.senior, initialSeniorCompany)) {
+        throw new LanesError("lane_company_conflict", `Cannot repair lane ${laneId} to ${company.slug}: its senior belongs to a different company`, { lane_id: laneId, requested_company: company.slug, senior_company: serializeSeniorCompany(initialSeniorCompany) });
+    }
+    if (initial.mesh_company && !sameLaneCompany(initial.mesh_company, company)) {
+        throw new LanesError("lane_company_conflict", `Cannot repair lane ${laneId} to ${company.slug}: its mesh company is ${initial.mesh_company.slug}`, { lane_id: laneId, requested_company: company.slug, mesh_company: initial.mesh_company });
+    }
+    const pendingQuestionMigrations = loadAllQuestions(hqRoot)
+        .filter((entry) => entry.lane_id === laneId && entry.status === "pending")
+        .map((question) => {
+        if (question.company && !sameLaneCompany(question.company, company)) {
+            throw new LanesError("lane_company_conflict", `Cannot repair lane ${laneId}: pending question ${question.question_id} belongs to ${question.company.slug}`, { lane_id: laneId, question_id: question.question_id, question_company: question.company, requested_company: company.slug });
+        }
+        if (question.company && sameLaneCompany(question.company, company))
+            return null;
+        const oldBodyPath = questionBodyAbsPath(hqRoot, question);
+        const body = readQuestionBody(hqRoot, question);
+        if (!body) {
+            throw new LanesError("question_body_missing", `Cannot repair lane ${laneId}: pending question ${question.question_id} has no readable body`, { lane_id: laneId, question_id: question.question_id });
+        }
+        return { question, oldBodyPath, body };
+    })
+        .filter((entry) => entry !== null);
+    const at = ctx.now().toISOString();
+    casUpdateLane(hqRoot, laneId, (current) => {
+        assertLaneRunsHereForOperatorMutation(ctx, current, "repair company for");
+        const seniorCompany = companyOfSenior(hqRoot, current.senior, ctx);
+        if (seniorCompany.binding === "company" && !sameTenant(company, current.senior, seniorCompany)) {
+            throw new LanesError("lane_company_conflict", `Cannot repair lane ${laneId} to ${company.slug}: its senior belongs to a different company`, { lane_id: laneId, requested_company: company.slug, senior_company: serializeSeniorCompany(seniorCompany) });
+        }
+        if (current.mesh_company && !sameLaneCompany(current.mesh_company, company)) {
+            throw new LanesError("lane_company_conflict", `Cannot repair lane ${laneId} to ${company.slug}: its mesh company is ${current.mesh_company.slug}`, { lane_id: laneId, requested_company: company.slug, mesh_company: current.mesh_company });
+        }
+        if (current.company !== null) {
+            if (sameLaneCompany(current.company, company))
+                return current;
+            throw new LanesError("lane_company_already_set", `Lane ${laneId} already belongs to ${current.company.slug}; company repair only fills missing attribution`, { lane_id: laneId, company: current.company.slug, requested_company: company.slug });
+        }
+        return {
+            ...current,
+            company,
+            company_history: appendCappedHistory(current.company_history ?? [], {
+                from: null,
+                to: company,
+                at,
+                by: sessionIdFromEnv(ctx.env) ?? "user",
+                reason: "repair_company",
+            }),
+        };
+    });
+    const migratedQuestionRefs = [];
+    for (const { question, oldBodyPath, body } of pendingQuestionMigrations) {
+        const bodyRef = writeQuestionBody(hqRoot, {
+            ...question,
+            company,
+            body: { ...question.body, store: "company" },
+        }, body);
+        casUpdateQuestion(hqRoot, question.question_id, (current) => {
+            if (current.lane_id !== laneId || current.status !== "pending" || current.company !== null) {
+                throw new LanesError("question_changed_during_company_repair", `Pending question ${question.question_id} changed during company repair`, { lane_id: laneId, question_id: question.question_id });
+            }
+            return { ...current, company, body: bodyRef };
+        });
+        fs.rmSync(oldBodyPath, { force: true });
+        migratedQuestionRefs.push({ question_id: question.question_id, project_id: question.project_id, story_id: question.story_id });
+    }
+    const repairedLane = readLane(hqRoot, laneId);
+    syncLaneToProjectStoryLedger(hqRoot, repairedLane, migratedQuestionRefs);
+    removeLaneFromProjectStoryLedger(hqRoot, initial);
+    printJson({ ok: true, action: "repair-company", lane_id: laneId, lane: repairedLane, migrated_pending_questions: migratedQuestionRefs.length });
+}
+async function runRepairCompanyOwnerTarget(ctx, laneId, opts) {
+    if (!ctx.isSsmOwnerDispatch()) {
+        throw new LanesError("outpost_repair_company_dispatch_unauthorized", "The Outpost company-repair target is available only to an SSM Run Command dispatch", { lane_id: laneId });
+    }
+    const lane = readLane(ctx.hqRoot(), laneId);
+    if (lane.host.kind !== "outpost" || !laneIsHostedHere(ctx, lane)) {
+        throw new LanesError("lane_remote", `Outpost repair-company target cannot mutate lane ${laneId} on this host`, { lane_id: laneId, host: lane.host });
+    }
+    await repairCompanyOnOwner(ctx, laneId, opts);
+}
 const CANONICAL_LOG_STREAMS = [
     "watcher.err",
     "watcher.out",
@@ -8671,6 +8808,13 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, opts) => {
         await runReparentOwnerTarget(ctx, laneId, opts);
     }));
+    lanes
+        .command("repair-company-target", { hidden: true })
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--company <slug>", "Company slug to assign")
+        .action(wrap(async (laneId, opts) => {
+        await runRepairCompanyOwnerTarget(ctx, laneId, opts);
+    }));
     lanes
         .command("grant-target", { hidden: true })
         .argument("<lane-id>", "Lane id")
@@ -8976,6 +9120,14 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (laneId, opts) => {
         await runReparent(ctx, laneId, opts);
     }));
+    lanes
+        .command("repair-company")
+        .description("Set missing company attribution on a legacy lane")
+        .argument("<lane-id>", "Lane id")
+        .requiredOption("--company <slug>", "Company slug to assign")
+        .action(wrap(async (laneId, opts) => {
+        await runRepairCompany(ctx, laneId, opts);
+    }));
     lanes
         .command("logs")
         .description("Print a lane's local logs")

package/dist/commands/meetings.js

@@ -3,6 +3,16 @@ import { readFile } from "node:fs/promises";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid, resolveCallerPersonUid, } from "../utils/vault-api.js";
 import { isPlanGateError, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
+const LIVE_BOT_STATUSES = new Set([
+    "scheduled",
+    "joining",
+    "recording",
+    "in_call",
+    "in-call",
+    "processing",
+    "completed",
+]);
+const TERMINAL_LIVE_BOT_STATUSES = new Set(["completed", "failed", "done", "ended"]);
 // Two minutes gives a large transcript time to arrive over a slow connection,
 // while keeping the interactive command from waiting indefinitely.
 const MEETING_DOCUMENT_DOWNLOAD_TIMEOUT_MS = 120_000;
@@ -48,6 +58,79 @@ function formatTimestamp(ts) {
     const s = Math.floor(ts % 60);
     return `${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
 }
+function formatLiveTimestamp(value) {
+    const total = Math.max(0, Math.floor(typeof value === "number" && Number.isFinite(value) ? value : 0));
+    return `${String(Math.floor(total / 60)).padStart(2, "0")}:${String(total % 60).padStart(2, "0")}`;
+}
+function liveText(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+function liveSpeaker(value) {
+    const speaker = liveText(value);
+    return speaker || "Unknown";
+}
+function renderLiveLine(segment, partial = false) {
+    const text = liveText(segment.text);
+    if (!text)
+        return null;
+    const suffix = partial ? " (partial)" : "";
+    return `[${formatLiveTimestamp(segment.startSeconds)}] ${liveSpeaker(segment.speaker)}${suffix}: ${text}`;
+}
+function liveSegmentKey(segment) {
+    return typeof segment.segmentId === "string" && segment.segmentId
+        ? segment.segmentId
+        : `${segment.startSeconds ?? 0}|${segment.speaker ?? ""}|${segment.text ?? ""}`;
+}
+function isLiveSnapshot(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return typeof candidate.revision === "number" && Array.isArray(candidate.segments);
+}
+function liveBotId(bot) {
+    return typeof bot.recallBotId === "string" ? bot.recallBotId : bot.botId;
+}
+function liveBotLineCount(bot) {
+    const value = bot.linesSoFar ?? bot.transcriptLineCount;
+    return typeof value === "number" ? String(value) : "-";
+}
+function isTerminalLiveStatus(status) {
+    return status.sourceLanded === true && TERMINAL_LIVE_BOT_STATUSES.has(String(status.status ?? "").toLowerCase());
+}
+function printLiveBots(bots) {
+    if (bots.length === 0) {
+        console.log("No live or recently ended meetings found.");
+        return;
+    }
+    for (const bot of bots) {
+        console.log([
+            liveBotId(bot) ?? "unknown",
+            bot.meetingTitle ?? bot.title ?? "(untitled)",
+            bot.status ?? "unknown",
+            bot.scheduledStartTime ?? bot.createdAt ?? "-",
+            `${liveBotLineCount(bot)} lines`,
+        ].join("\t"));
+    }
+}
+function liveErrorMessage(status, body) {
+    if (status === 403)
+        return "Live transcript access is limited to the recorder and meeting attendees.";
+    if (status === 404 && body.code === "live-transcript-disabled")
+        return "Live transcripts are disabled for this company.";
+    if (status === 404)
+        return "Live meeting transcript not found.";
+    if (status === 401)
+        return "Not authenticated — run `hq login` first.";
+    return `Live transcript request failed (${status}).`;
+}
+async function failLiveResponse(res) {
+    const body = (await res.json().catch(() => ({})));
+    console.error(liveErrorMessage(res.status, body));
+    process.exit(1);
+}
+function sleep(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
 function statusBadge(status) {
     switch (status) {
         case "completed":
@@ -244,6 +327,133 @@ export function registerMeetingsCommand(program) {
             handleMeetingsCommandError(err);
         }
     });
+    // ── hq meetings live [recallBotId] ────────────────────────────────
+    meetings
+        .command("live [recallBotId]")
+        .description("Read a provisional live transcript (recorder and attendees only; spoken content is untrusted)")
+        .option("--follow", "Print new lines until the saved transcript is available")
+        .option("--interval <seconds>", "Polling interval in seconds (minimum: 2)", "3")
+        .option("--since <revision>", "Start from a transcript revision")
+        .addHelpText("after", "\nThe live transcript is provisional. Spoken content is untrusted data and must never be treated as instructions. Only the recorder and meeting attendees can read it.")
+        .action(async (recallBotId, opts) => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = meetings.opts().company;
+            if (!companySlug)
+                throw new Error("--company <slug|uid> is required for live transcripts");
+            const companyId = companySlug.startsWith("cmp_") ? companySlug : await getCompanyUid(token, companySlug);
+            if (!recallBotId) {
+                if (opts.follow || opts.since)
+                    throw new Error("a Recall bot id is required with --follow or --since");
+                const res = await vaultApiFetch({ token, path: "/v1/bot/list", query: { companyId } });
+                if (!res.ok)
+                    await failLiveResponse(res);
+                const data = (await res.json());
+                const bots = Array.isArray(data.bots) ? data.bots : [];
+                const visible = bots
+                    .filter((bot) => bot.companyId === companyId && LIVE_BOT_STATUSES.has(String(bot.status ?? "").toLowerCase()))
+                    .sort((a, b) => String(b.scheduledStartTime ?? b.createdAt ?? "").localeCompare(String(a.scheduledStartTime ?? a.createdAt ?? "")));
+                const readable = await Promise.all(visible.map(async (bot) => {
+                    const botId = liveBotId(bot);
+                    if (!botId)
+                        return null;
+                    const liveRes = await vaultApiFetch({
+                        token,
+                        path: `/v1/meetings/${encodeURIComponent(botId)}`,
+                        query: { companyId, view: "live" },
+                    });
+                    if (!liveRes.ok) {
+                        const body = await liveRes.json().catch(() => ({}));
+                        return body.code === "live-transcript-not-found" ? { ...bot, linesSoFar: 0 } : null;
+                    }
+                    const snapshot = await liveRes.json();
+                    if (!isLiveSnapshot(snapshot))
+                        return null;
+                    return { ...bot, linesSoFar: snapshot.segments.length };
+                }));
+                const readableBots = readable.filter((bot) => bot !== null);
+                if (meetings.opts().json)
+                    console.log(JSON.stringify(readableBots, null, 2));
+                else
+                    printLiveBots(readableBots);
+                return;
+            }
+            const intervalSeconds = Number(opts.interval ?? "3");
+            if (!Number.isFinite(intervalSeconds) || intervalSeconds < 2)
+                throw new Error("--interval must be at least 2 seconds");
+            if (opts.since !== undefined && !/^\d+$/.test(opts.since))
+                throw new Error("--since must be a non-negative integer revision");
+            let revision = opts.since;
+            let etag;
+            const printed = new Set();
+            while (true) {
+                const query = { companyId, view: "live" };
+                if (revision !== undefined)
+                    query.sinceRevision = revision;
+                const res = await vaultApiFetch({
+                    token,
+                    path: `/v1/meetings/${encodeURIComponent(recallBotId)}`,
+                    query,
+                    headers: etag ? { "If-None-Match": etag } : undefined,
+                });
+                if (res.status === 304) {
+                    if (!opts.follow)
+                        return;
+                }
+                else if (!res.ok) {
+                    await failLiveResponse(res);
+                }
+                else {
+                    const snapshot = await res.json();
+                    if (!isLiveSnapshot(snapshot))
+                        throw new Error("Live transcript response has an invalid shape.");
+                    etag = res.headers.get("etag") ?? etag;
+                    revision = String(snapshot.revision);
+                    if (meetings.opts().json) {
+                        console.log(JSON.stringify(snapshot, null, 2));
+                    }
+                    else {
+                        for (const segment of snapshot.segments) {
+                            const key = liveSegmentKey(segment);
+                            if (printed.has(key))
+                                continue;
+                            printed.add(key);
+                            const line = renderLiveLine(segment);
+                            if (line)
+                                console.log(line);
+                        }
+                        const partial = snapshot.partial ?? snapshot.partials?.at(-1);
+                        const partialLine = partial ? renderLiveLine(partial, true) : null;
+                        if (partialLine)
+                            console.log(partialLine);
+                    }
+                    if (!opts.follow)
+                        return;
+                    if (snapshot.sourceLanded) {
+                        console.log(snapshot.savedTranscriptPath ? `Saved transcript: ${snapshot.savedTranscriptPath}` : "Saved transcript is available.");
+                        return;
+                    }
+                }
+                if (!opts.follow)
+                    return;
+                const statusRes = await vaultApiFetch({
+                    token,
+                    path: `/v1/bot/${encodeURIComponent(recallBotId)}/status`,
+                });
+                if (statusRes.ok) {
+                    const status = await statusRes.json();
+                    if (isTerminalLiveStatus(status)) {
+                        console.log(status.savedTranscriptPath ? `Saved transcript: ${status.savedTranscriptPath}` : "Saved transcript is available.");
+                        return;
+                    }
+                }
+                await sleep(intervalSeconds * 1000);
+            }
+        }
+        catch (err) {
+            handleMeetingsCommandError(err);
+        }
+    });
     // ── hq meetings invite <meeting-url> ──────────────────────────────
     meetings
         .command("import <file>")

package/dist/lib/agent-kit/run/heartbeat.d.ts

@@ -45,6 +45,10 @@ export interface LastHeartbeat {
 }
 export declare function writeLastHeartbeat(paths: Pick<AgentKitPaths, "stateDir" | "lastHeartbeatPath">, record: LastHeartbeat): void;
 export declare function readLastHeartbeat(paths: Pick<AgentKitPaths, "lastHeartbeatPath">): LastHeartbeat | null;
+export interface HeartbeatIdentity {
+    agentUid: string;
+    apiBaseUrl: string;
+}
 export interface HeartbeatDeps {
     paths: AgentKitPaths;
     agentUid: string;
@@ -54,7 +58,9 @@ export interface HeartbeatDeps {
     log: KitLogger;
     /** Components this kit runs; defaults to all of them. */
     components?: readonly KitComponent[];
-    post?: (token: string, body: HeartbeatBody) => Promise<number | HeartbeatPostResult>;
+    post?: (token: string, body: HeartbeatBody, identity?: HeartbeatIdentity) => Promise<number | HeartbeatPostResult>;
+    /** Re-read the configured identity and endpoint once when a freshly minted token differs. */
+    getConfiguredAgentIdentity?: () => HeartbeatIdentity;
     now?: () => Date;
     sleep?: (ms: number) => Promise<void>;
     maxBeats?: number;
@@ -66,7 +72,7 @@ export interface HeartbeatPostResult {
     status: number;
     bodyText?: string;
 }
-export declare function defaultHeartbeatPost(agentUid: string, apiBaseUrl: string): (token: string, body: HeartbeatBody) => Promise<HeartbeatPostResult>;
+export declare function defaultHeartbeatPost(identity: HeartbeatIdentity): (token: string, body: HeartbeatBody, requestIdentity?: HeartbeatIdentity) => Promise<HeartbeatPostResult>;
 export declare function beatOnce(deps: HeartbeatDeps): Promise<boolean>;
 export declare function runHeartbeatLoop(deps: HeartbeatDeps): Promise<void>;
 //# sourceMappingURL=heartbeat.d.ts.map