@indigoai-us/hq-cli 5.345.31 → 5.345.33

package/dist/commands/db-sql.js

@@ -7,7 +7,12 @@
 import { Option } from "commander";
 import chalk from "chalk";
 import fs from "node:fs";
+import { safeErrorMessage } from "../lib/db/redact.js";
+import { formatRemoteResults, openRemoteAppConnection, runRemoteSql, } from "../lib/db/remote-engine.js";
 import { formatSqlResult, runLocalSql } from "../lib/db/sql.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
+import { defaultRemoteDeps, describeRemoteError, remoteEngineDeps, } from "./db-remote-deps.js";
+import { describeSessionGap } from "./db-dump.js";
 function readSqlArg(sqlArgs, stdinFlag) {
     if (stdinFlag || sqlArgs.length === 0) {
         if (process.stdin.isTTY && sqlArgs.length === 0) {
@@ -17,10 +22,11 @@ function readSqlArg(sqlArgs, stdinFlag) {
     }
     return sqlArgs.join(" ");
 }
-export function registerDbSqlCommand(db) {
+export function registerDbSqlCommand(db, remoteDepsFactory = defaultRemoteDeps) {
     db.command("sql")
-        .description("Run SQL against the company vault DB (local; read-only by default)")
+        .description("Run SQL against the company vault DB (local) or an app's remote database (--app); read-only by default")
         .requiredOption("--company <slug>", "Company slug (tenant scope; required)")
+        .option("--app <app>", "Run against this app's remote database schema")
         .option("--write", "Allow write/DDL statements (discouraged for ad-hoc DDL)", false)
         .addOption(new Option("--remote", "Remote SQL is not available in this CLI build yet; local queries work without --remote").hideHelp())
         .option("--db-path <path>", "Dangerous: open a non-canonical DB path (denied unless --allow-cross-company-path)")
@@ -37,13 +43,17 @@ export function registerDbSqlCommand(db) {
                 process.exitCode = 1;
                 return;
             }
-            if (opts.remote) {
-                console.error(chalk.red("Error: Remote SQL is not available in this CLI build yet. Local queries work without --remote."));
+            if (opts.remote && !opts.app) {
+                console.error(chalk.red("Error: Remote SQL needs --app <app>. Local queries work without --remote."));
                 process.exitCode = 1;
                 return;
             }
             const sql = readSqlArg(sqlParts, !!opts.stdin).trim();
             const format = opts.format === "table" ? "table" : "jsonl";
+            if (opts.app) {
+                await runRemote(remoteDepsFactory(), company, opts.app, sql, !!opts.write);
+                return;
+            }
             const result = runLocalSql({
                 company,
                 sql,
@@ -56,9 +66,24 @@ export function registerDbSqlCommand(db) {
             console.log(formatSqlResult(result, format));
         }
         catch (error) {
-            console.error(chalk.red("Error:"), error instanceof Error ? error.message : "Unknown error");
+            if (isPlanGateError(error))
+                throw error;
+            console.error(chalk.red("Error:"), describeSessionGap(error) ?? describeRemoteError(error) ?? safeErrorMessage(error));
             process.exitCode = 1;
         }
     });
 }
+async function runRemote(deps, company, app, sql, write) {
+    const resolved = await deps.resolveCompany(company);
+    const conn = await openRemoteAppConnection(remoteEngineDeps(deps), {
+        companyUid: resolved.companyUid,
+        appId: app,
+    });
+    try {
+        console.log(formatRemoteResults(await runRemoteSql(conn, sql, write)));
+    }
+    finally {
+        await conn.close();
+    }
+}
 //# sourceMappingURL=db-sql.js.map

package/dist/commands/db-usage.d.ts

@@ -0,0 +1,7 @@
+/**
+ * hq db usage — month-to-date remote database usage against both caps.
+ */
+import { Command } from "commander";
+import { type DbRemoteCommandDeps } from "./db-remote-deps.js";
+export declare function registerDbUsageCommand(db: Command, depsFactory?: () => DbRemoteCommandDeps): void;
+//# sourceMappingURL=db-usage.d.ts.map

package/dist/commands/db-usage.js

@@ -0,0 +1,28 @@
+/**
+ * hq db usage — month-to-date remote database usage against both caps.
+ */
+import chalk from "chalk";
+import { safeErrorMessage } from "../lib/db/redact.js";
+import { formatUsage } from "../lib/db/usage-format.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
+import { controlPlaneClient, defaultRemoteDeps, describeRemoteError, } from "./db-remote-deps.js";
+export function registerDbUsageCommand(db, depsFactory = defaultRemoteDeps) {
+    db.command("usage")
+        .description("Show this month's remote database usage against the compute and storage caps")
+        .requiredOption("--company <slug>", "Company slug")
+        .action(async (opts) => {
+        try {
+            const deps = depsFactory();
+            const resolved = await deps.resolveCompany(String(opts.company ?? "").trim());
+            const usage = await controlPlaneClient(deps).usage(resolved.companyUid);
+            console.log(formatUsage(usage));
+        }
+        catch (error) {
+            if (isPlanGateError(error))
+                throw error;
+            console.error(chalk.red("Error:"), describeRemoteError(error) ?? safeErrorMessage(error));
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=db-usage.js.map

package/dist/commands/db.js

@@ -1,10 +1,12 @@
 /**
  * hq db — vault database commands (local + remote tiers).
  */
+import { registerDbDumpCommand } from "./db-dump.js";
 import { registerDbMigrateCommand } from "./db-migrate.js";
 import { registerDbProvisionCommand } from "./db-provision.js";
 import { registerDbSqlCommand } from "./db-sql.js";
 import { registerDbStatusCommand } from "./db-status.js";
+import { registerDbUsageCommand } from "./db-usage.js";
 /**
  * Register the `hq db` command group and its subcommands.
  */
@@ -16,5 +18,7 @@ export function registerDbCommand(program) {
     registerDbSqlCommand(db);
     registerDbMigrateCommand(db);
     registerDbProvisionCommand(db);
+    registerDbUsageCommand(db);
+    registerDbDumpCommand(db);
 }
 //# sourceMappingURL=db.js.map

package/dist/commands/files.js

@@ -64,7 +64,9 @@ function formatAclPatternConflict(prefix, serverMessage) {
     const sharedPattern = `${privatePattern}*`;
     const detail = serverMessage ? `${serverMessage}. ` : "";
     return (`${detail}A private folder '${privatePattern}' and shared folder glob ` +
-        `'${sharedPattern}' cannot both exist. Remove the conflicting ACL pattern and retry.`);
+        `'${sharedPattern}' cannot both exist. If the shared glob has no grants, run ` +
+        `hq files unshare '${sharedPattern}'. If it has grants, remove them first with ` +
+        `hq files unshare '${sharedPattern}' --with <principal>.`);
 }
 /**
  * POST /files/{companyUid}/share-session — mint a browser-launch share
@@ -265,8 +267,8 @@ export function registerFilesCommand(program) {
     });
     files
         .command("unshare <prefix>")
-        .description("Remove a file access grant. A trailing slash targets the private-folder row exactly.")
-        .requiredOption("--with <principal>", "Person uid, agent uid, email address, group id, or '@all' to remove the grant")
+        .description("Remove a named file access grant, or remove an empty ACL row without --with.")
+        .option("--with <principal>", "Person uid, agent uid, email address, group id, or '@all' to remove the grant")
         .action(async (prefix, opts) => {
         try {
             // Unshare MUTATES access with no preview. Anchored content paths remain
@@ -279,13 +281,13 @@ export function registerFilesCommand(program) {
                     ? { companySlug: files.opts().company }
                     : {}),
             });
-            const principal = opts.with;
+            const principal = opts.with ?? "";
             const isAll = principal === "@all";
             const isEmail = !isAll && EMAIL_PATTERN.test(principal);
             const isGroup = !isAll && GROUP_ID_PATTERN.test(principal);
             const isAgent = !isAll && !isEmail && !isGroup && AGENT_UID_PATTERN.test(principal);
             const isPerson = !isAll && !isEmail && !isGroup && !isAgent && PERSON_UID_PATTERN.test(principal);
-            if (!isAll && !isEmail && !isGroup && !isPerson && !isAgent) {
+            if (opts.with && !isAll && !isEmail && !isGroup && !isPerson && !isAgent) {
                 console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a person uid matching prs_<alphanumeric>, an agent uid matching agt_<alphanumeric>, or a group id matching grp_<alphanumeric>`));
                 process.exit(1);
             }
@@ -313,6 +315,32 @@ export function registerFilesCommand(program) {
                 explicit: explicitCompanySlug,
                 anchorSlug: companyRootSlug,
             });
+            if (!opts.with) {
+                const res = await vaultApiFetch({
+                    token,
+                    path: `/files/${encodeURIComponent(companyUid)}/acl?prefix=${encodeURIComponent(canonicalPrefix)}`,
+                    method: "DELETE",
+                });
+                const body = await res.json().catch(() => ({}));
+                if (res.status === 404 && body.code === "ACL_NOT_FOUND") {
+                    console.log(chalk.dim(`Nothing to remove — '${canonicalPrefix}' has no ACL row.`));
+                    return;
+                }
+                if (!res.ok) {
+                    if (res.status === 403) {
+                        console.error(chalk.red("Not authorized to remove this ACL row"));
+                        await offerAccessLadder(canonicalPrefix, {
+                            company: files.opts().company,
+                        });
+                    }
+                    else {
+                        console.error(chalk.red(body.error ?? "Unable to remove ACL row"));
+                    }
+                    process.exit(1);
+                }
+                console.log(chalk.green(`Removed empty ACL pattern '${canonicalPrefix}'. It now follows its parent folder's access, so anyone who can see that parent can see this folder.`));
+                return;
+            }
             const res = await vaultApiFetch({
                 token,
                 path: `/files/${encodeURIComponent(companyUid)}/acl/revoke`,

package/dist/commands/integrations-core.d.ts

@@ -225,6 +225,46 @@ export declare function toolPrefixForProvider(provider: string): string;
  */
 export declare function fetchAdminSurface(token: string, companyUid: string): Promise<AdminSurface>;
 export declare function fetchConnections(token: string, companyUid: string): Promise<AdminConnection[]>;
+/**
+ * One app the caller can use right now through the HQ gateway. Field names
+ * follow the bot `company_apps` projection (name, provider, domain, status),
+ * so session context and bot context describe an app the same way. No
+ * endpoint URLs, credentials, scopes, or creator identities.
+ */
+export interface UsableApp {
+    connectionId: string;
+    /** Display name, stripped of control characters and capped in length. */
+    name: string;
+    provider: string;
+    domain: string | null;
+    status: string;
+    /** Bare provider slug, e.g. `notion`. */
+    providerArg: string;
+    /**
+     * The flag that resolves to exactly this connection in `hq integrations
+     * tools|call`: `--provider <slug>` when no other active row shares the
+     * provider, else `--connection <id>`.
+     */
+    selector: string;
+}
+export interface UsableAppsResult {
+    companyUid: string;
+    /**
+     * False when the server ignored `view=summary` (an older deploy). Its rows
+     * carry no `viewerAccess`, so nothing can be confirmed usable and `apps` is
+     * empty rather than guessed.
+     */
+    viewerAccessKnown: boolean;
+    apps: UsableApp[];
+}
+/**
+ * The apps the caller may use, from `GET /v1/integrations/admin?view=summary`.
+ * A row counts only when all of these hold, mirroring the gateway's checks:
+ * the server's per-caller ACL decision (`viewerAccess.usable`) is true, the
+ * status is one the gateway serves, and the gateway has a provider registered
+ * for it. Fails closed: a row without `viewerAccess` is not listed.
+ */
+export declare function fetchUsableApps(token: string, companyUid: string): Promise<UsableAppsResult>;
 /**
  * Resolve one connection by `--connection acct_…` or `--provider linear`
  * (matches `factory:<slug>`, bare provider ids, and an installation's human

package/dist/commands/integrations-core.js

@@ -355,6 +355,96 @@ export async function fetchAdminSurface(token, companyUid) {
 export async function fetchConnections(token, companyUid) {
     return (await fetchAdminSurface(token, companyUid)).connections;
 }
+/**
+ * Statuses the gateway serves. `needs-attention` is derived by the summary
+ * view from a stored `connected` row whose token renewal is failing, so the
+ * gateway still dispatches to it.
+ */
+const GATEWAY_SERVED_STATUSES = new Set(["connected", "needs-attention"]);
+/**
+ * Providers hq-pro registers statically (`createIntegrationProviderRegistry`).
+ * Every other provider is registered per company from a factory installation
+ * keyed by its `runtimeProviderId`; a connection with neither is refused by the
+ * gateway as `ProviderUnsupported`.
+ */
+const STATIC_GATEWAY_PROVIDERS = new Set(["google-workspace", "linear", "slack"]);
+const MAX_APP_NAME_LENGTH = 60;
+/**
+ * Display names are set by whoever installed the app and end up in agent
+ * context, so keep them to one short line of printable text.
+ */
+function safeAppName(raw, fallback) {
+    const cleaned = (raw ?? "")
+        .replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!cleaned)
+        return fallback;
+    const chars = Array.from(cleaned);
+    return chars.length > MAX_APP_NAME_LENGTH
+        ? `${chars.slice(0, MAX_APP_NAME_LENGTH - 1).join("").trimEnd()}…`
+        : cleaned;
+}
+/** Case-insensitive code-point order, so the list reads the same in every locale. */
+function compareNames(a, b) {
+    const x = a.toLowerCase();
+    const y = b.toLowerCase();
+    return x < y ? -1 : x > y ? 1 : 0;
+}
+function gatewayHasProvider(row) {
+    if (STATIC_GATEWAY_PROVIDERS.has(row.provider))
+        return true;
+    return row.installation?.runtimeProviderId === row.provider;
+}
+/**
+ * The apps the caller may use, from `GET /v1/integrations/admin?view=summary`.
+ * A row counts only when all of these hold, mirroring the gateway's checks:
+ * the server's per-caller ACL decision (`viewerAccess.usable`) is true, the
+ * status is one the gateway serves, and the gateway has a provider registered
+ * for it. Fails closed: a row without `viewerAccess` is not listed.
+ */
+export async function fetchUsableApps(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/admin",
+        query: { companyUid, view: "summary" },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to list integrations");
+    const data = (await res.json());
+    const viewerAccessKnown = data.view === "summary";
+    const rows = Array.isArray(data.connections) ? data.connections : [];
+    // `--provider` picks the first non-revoked row with that provider, whoever
+    // may use it, so a shared provider needs `--connection` to be exact.
+    const activeByProvider = new Map();
+    for (const row of rows) {
+        if (row.status === "revoked")
+            continue;
+        const key = bareProvider(row.provider).toLowerCase();
+        activeByProvider.set(key, (activeByProvider.get(key) ?? 0) + 1);
+    }
+    const apps = viewerAccessKnown
+        ? rows
+            .filter((row) => row.viewerAccess?.usable === true &&
+            GATEWAY_SERVED_STATUSES.has(row.status) &&
+            gatewayHasProvider(row))
+            .map((row) => {
+            const providerArg = bareProvider(row.provider);
+            const shared = (activeByProvider.get(providerArg.toLowerCase()) ?? 0) > 1;
+            return {
+                connectionId: row.id,
+                name: safeAppName(row.installation?.displayName, providerArg),
+                provider: row.provider,
+                domain: typeof row.domain === "string" && row.domain ? row.domain : null,
+                status: row.status,
+                providerArg,
+                selector: shared ? `--connection ${row.id}` : `--provider ${providerArg}`,
+            };
+        })
+            .sort((a, b) => compareNames(a.name, b.name))
+        : [];
+    return { companyUid: data.companyUid ?? companyUid, viewerAccessKnown, apps };
+}
 /**
  * Resolve one connection by `--connection acct_…` or `--provider linear`
  * (matches `factory:<slug>`, bare provider ids, and an installation's human

package/dist/commands/integrations.d.ts

@@ -51,8 +51,8 @@
  */
 import { Command } from "commander";
 import { type PendingApproval } from "./integrations-api.js";
-export { IntegrationsCliError, callGateway, fetchConnections, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
-export type { AdminConnection } from "./integrations-core.js";
+export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
+export type { AdminConnection, UsableApp, UsableAppsResult } from "./integrations-core.js";
 /** Wait for a decided queue item without resending the approve request. */
 export declare function waitForApprovalTerminal(token: string, companyUid: string, queueId: string, options?: {
     timeoutMs?: number;

package/dist/commands/integrations.js

@@ -54,12 +54,12 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { fetchPendingApprovals } from "./integrations-api.js";
-export { IntegrationsCliError, callGateway, fetchConnections, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
+export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 /**
  * Gateway metadata is additive and may be absent when talking to an older
  * gateway. Parse it defensively so an unknown or malformed value never breaks
@@ -220,9 +220,33 @@ export function registerIntegrationsCommand(program) {
         .description("List the company's connected apps")
         .option("--company <slug>", "Company slug, e.g. indigo (defaults to your single active company)")
         .option("--json", "Machine-readable output")
+        .option("--usable", "Only apps you can use right now (connected and shared with you), with the --provider value to call them")
+        .option("--no-login", "Fail instead of opening a browser sign-in when there is no HQ session")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken();
+        const token = await ensureCognitoIdToken(opts.login === false ? { interactive: false } : {});
         const companyUid = await getCompanyUid(token, opts.company);
+        if (opts.usable) {
+            const result = await fetchUsableApps(token, companyUid);
+            if (opts.json) {
+                printJson(result);
+                return;
+            }
+            if (!result.viewerAccessKnown) {
+                console.log("This HQ server cannot report which apps are shared with you yet. Run `hq integrations list` to see every connected app.");
+                return;
+            }
+            if (result.apps.length === 0) {
+                console.log("No connected apps are available to you in this company. Run `hq integrations list` to see what is connected, or ask an admin to share one.");
+                return;
+            }
+            for (const app of result.apps) {
+                const where = app.domain ? ` (${app.domain})` : "";
+                const flag = app.status === "needs-attention" ? chalk.yellow("  needs attention") : "";
+                console.log(`${chalk.bold(app.name)}${chalk.dim(where)}${flag}`);
+                console.log(chalk.dim(`  hq integrations tools ${app.selector}`));
+            }
+            return;
+        }
         const connections = await fetchConnections(token, companyUid);
         if (opts.json) {
             printJson(connections);

package/dist/commands/lanes-message.js

@@ -11,7 +11,8 @@ import { isPidAlive, runWatcherLoop, WATCHER_OUT_MAX_BYTES, watcherOutLogPath, w
 import { laneStories, laneStory, storyWarning } from "../lib/lanes/stories.js";
 import { artifactIdentityKeys, rollbackStorySwitchAttribution, storySwitchNotice } from "../lib/lanes/story-switch.js";
 import { laneRunDir, probePidRecord, readPidRecord, readProcStarttime, spawnLaneWorker } from "../lib/lanes/spawn.js";
-import { keepAliveExclusion, keepAliveSupersededBy, LANE_RUNNING_SUPERSEDED_MESSAGE_DELIVERY_FLAG, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds } from "../lib/lanes/keep-alive.js";
+import { findRetiredLaneEntry, keepAliveExclusion, keepAliveSupersededBy, LANE_RUNNING_SUPERSEDED_MESSAGE_DELIVERY_FLAG, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds } from "../lib/lanes/keep-alive.js";
+import { isTerminalLaneState } from "../lib/lanes/types.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
 import { accountMoveSummary, accountRequestKeepsCurrentLane, assertCurrentResumeAccountAvailable, callerMatchesSessionSenior, recordedResumeEffort, resetKeepAliveProgress, resolveResumeEffort } from "./lanes-shared.js";
@@ -136,6 +137,14 @@ export function createLaneMessageHandlers(deps) {
             ...(snapshot.hire_grant === undefined ? {} : { hire_grant: snapshot.hire_grant }),
         };
     }
+    function activeRetiredRegistryWarning(hqRoot, lane) {
+        if (lane.keep_alive !== true || isTerminalLaneState(lane.state))
+            return undefined;
+        const entry = findRetiredLaneEntry(hqRoot, lane.lane_id);
+        if (entry === undefined)
+            return undefined;
+        return `The active keep-alive lane record takes precedence over ${entry.path} retired[${entry.index}] (lane ${entry.lane}, retired_at ${entry.retired_at ?? "not recorded"}); remove the stale registry row from workspace/lane-briefs/juniors.json.`;
+    }
     async function messageLaneExclusion(ctx, lane, grantContext) {
         if (lane.state === "killed" || lane.state === "cancelled") {
             return { lane, exclusion: lane.state };
@@ -172,6 +181,14 @@ export function createLaneMessageHandlers(deps) {
             lanes = [...merged.values()];
         }
         let exclusion = keepAliveExclusion(currentLane, lanes, retiredLaneIds, lineageAware, companyForLane);
+        let retiredRegistryWarning = exclusion === "retired"
+            ? activeRetiredRegistryWarning(ctx.hqRoot(), currentLane)
+            : undefined;
+        if (retiredRegistryWarning !== undefined) {
+            exclusion = keepAliveSupersededBy(currentLane, lanes, lineageAware, companyForLane) === undefined
+                ? undefined
+                : "superseded";
+        }
         if (exclusion === "superseded" && currentLane.state !== "done" && currentLane.state !== "interrupted") {
             const runningSupersededMessageDeliveryEnabled = await readLanesRegistryFlag(LANE_RUNNING_SUPERSEDED_MESSAGE_DELIVERY_FLAG, { company: companyForLane(currentLane), env: ctx.env });
             if (runningSupersededMessageDeliveryEnabled) {
@@ -203,6 +220,14 @@ export function createLaneMessageHandlers(deps) {
                 lanes = latestLanes;
                 retiredLaneIds = loadRetiredLaneIds(ctx.hqRoot());
                 exclusion = keepAliveExclusion(currentLane, lanes, retiredLaneIds, lineageAware, companyForLane);
+                retiredRegistryWarning = exclusion === "retired"
+                    ? activeRetiredRegistryWarning(ctx.hqRoot(), currentLane)
+                    : undefined;
+                if (retiredRegistryWarning !== undefined) {
+                    exclusion = keepAliveSupersededBy(currentLane, lanes, lineageAware, companyForLane) === undefined
+                        ? undefined
+                        : "superseded";
+                }
                 if (exclusion === "superseded" && currentLane.state !== "done" && currentLane.state !== "interrupted") {
                     const callerLaneId = dispatchedContextBound ? dispatchedCallerId : undefined;
                     const callerSessionId = dispatchedContextBound
@@ -222,6 +247,7 @@ export function createLaneMessageHandlers(deps) {
                             ? { supersededMessageSessionId: currentLane.senior.id }
                             : {}),
                         supersededMessageWarning: `A newer lead supersedes this ${currentLane.state} lane; message delivery is allowed while the lane remains active.`,
+                        ...(retiredRegistryWarning === undefined ? {} : { retiredRegistryWarning }),
                     };
                 }
             }
@@ -234,6 +260,7 @@ export function createLaneMessageHandlers(deps) {
             return {
                 lane: currentLane,
                 exclusion: undefined,
+                ...(retiredRegistryWarning === undefined ? {} : { retiredRegistryWarning }),
                 ...(!dispatchedContextAuthorized && ctx.env.HQ_LANE_ID?.trim()
                     ? { supersededMessageCallerId: ctx.env.HQ_LANE_ID.trim() }
                     : {}),
@@ -245,7 +272,7 @@ export function createLaneMessageHandlers(deps) {
                     : {}),
             };
         }
-        return { lane: currentLane, exclusion };
+        return { lane: currentLane, exclusion, ...(retiredRegistryWarning === undefined ? {} : { retiredRegistryWarning }) };
     }
     function recordMessageUndeliverable(ctx, lane, reason, messageCount) {
         writeWatcherDecision(watcherOutLogPath(ctx.hqRoot(), lane.lane_id), {
@@ -450,19 +477,23 @@ export function createLaneMessageHandlers(deps) {
             if (opts.account !== undefined && !keepCurrentAccount && !providerSessionPortable(lane.provider)) {
                 throw new LanesError("provider_session_not_portable", sessionNotPortableMessage(lane.provider), { lane_id: laneId, provider: lane.provider });
             }
-            const pendingAnswerableQuestion = lane.state === "awaiting_input"
-                ? await deps.hasPendingQuestionForLane(ctx, lane)
-                : false;
-            if (pendingAnswerableQuestion) {
-                const message = deliveryRefusalReason(lane);
+            const pendingQuestions = lane.state === "awaiting_input"
+                ? await deps.pendingQuestionsForLane(ctx, lane)
+                : [];
+            if (pendingQuestions.length > 0) {
+                const companySlug = lane.company?.slug ?? lane.mesh_company ?? "<company-slug>";
+                const instructions = pendingQuestions.map(({ question_id, audience }) => `question ${question_id} awaits ${audience.kind}:${audience.id}; answer it with hq lanes questions answer ${question_id} --company ${companySlug} --freeform <answer>`);
+                const message = `Lane ${laneId} is awaiting input. ${instructions.join("; ")}`;
                 throw new LanesError("lane_not_accepting_messages", message, {
                     lane_id: laneId,
                     state: lane.state,
+                    pending_questions: pendingQuestions,
+                    answer_commands: pendingQuestions.map(({ question_id }) => `hq lanes questions answer ${question_id} --company ${companySlug} --freeform <answer>`),
                     provider: lane.provider,
                     message,
                 });
             }
-            const awaitingInputFallback = lane.state === "awaiting_input" && !pendingAnswerableQuestion;
+            const awaitingInputFallback = lane.state === "awaiting_input";
             // One decision point for how a follow-up reaches this lane (delivery.ts).
             // `none` refuses before anything is written: no inbox append, no spawn.
             const mechanism = laneDeliveryMechanism(lane);
@@ -915,6 +946,7 @@ export function createLaneMessageHandlers(deps) {
                             : "worker_spawned";
             const warning = [
                 eligibility.supersededMessageWarning,
+                eligibility.retiredRegistryWarning,
                 mechanism === "dropbox" && drainHook !== null && !drainHook.registered
                     ? `The drain hook is not registered in ${drainHook.path}; the running worker will not receive this message. It stays in the inbox and is delivered on the lane's next start.`
                     : mechanism === "dropbox" && next.stalled === true

package/dist/commands/lanes-questions.d.ts

@@ -1,8 +1,13 @@
-import { type QuestionBody, type LaneRecord, type QuestionRecord } from "../lib/lanes/index.js";
+import { type QuestionBody, type LaneRecord, type QuestionRecord, type SeniorRef } from "../lib/lanes/index.js";
 import type { Ctx, FallbackQuestionCancellationResult, LaneQuestionsHandlerDeps } from "./lanes-shared.js";
 export declare function resolveAnswerChoice(choice: string, options: string[], freeform: boolean): string;
 export declare function createLaneQuestionsHandlers(deps: LaneQuestionsHandlerDeps): {
     hasPendingQuestionForLane: (ctx: Ctx, lane: LaneRecord) => Promise<boolean>;
+    pendingQuestionsForLane: (ctx: Ctx, lane: LaneRecord) => Promise<Array<{
+        question_id: string;
+        asked_at: string;
+        audience: SeniorRef;
+    }>>;
     cancelFallbackQuestionsForLane: (ctx: Ctx, lane: LaneRecord, trigger: "message" | "resume", at: string) => Promise<FallbackQuestionCancellationResult>;
     runQuestionsList: (ctx: Ctx, opts: {
         allHosts?: boolean;

package/dist/commands/lanes-questions.js

@@ -488,21 +488,32 @@ export function createLaneQuestionsHandlers(deps) {
         }
         return { cancelled_question_ids: cancelledQuestionIds, failures };
     }
-    async function hasPendingQuestionForLane(ctx, lane) {
+    async function pendingQuestionsForLane(ctx, lane) {
         const hqRoot = ctx.hqRoot();
-        const local = loadAllQuestions(hqRoot).some((question) => question.lane_id === lane.lane_id &&
+        const local = loadAllQuestions(hqRoot).filter((question) => question.lane_id === lane.lane_id &&
             question.status === "pending" &&
             questionAudienceMatchesSenior(resolveAudience(hqRoot, question, ctx), lane, ctx));
-        if (local)
-            return true;
+        const localRows = local.map((question) => ({
+            question_id: question.question_id,
+            asked_at: question.asked_at,
+            audience: resolveAudience(hqRoot, question, ctx),
+        }));
         if (lane.host.kind !== "outpost" || laneIsHostedHere(ctx, lane))
-            return false;
+            return localRows;
         // Reuse the owner lookup used by questions list/answer. An unreachable
         // owner leaves no answerable question, so the message/resume path can recover.
         const lookup = await loadPrimaryOwnedOutpostQuestions(ctx, hqRoot);
-        return lookup.questions.some(({ question, lane: ownerLane, audience }) => ownerLane.lane_id === lane.lane_id &&
+        const remoteRows = lookup.questions.filter(({ question, lane: ownerLane, audience }) => ownerLane.lane_id === lane.lane_id &&
             question.status === "pending" &&
-            questionAudienceMatchesSenior(audience, ownerLane, ctx));
+            questionAudienceMatchesSenior(audience, ownerLane, ctx)).map(({ question, audience }) => ({
+            question_id: question.question_id,
+            asked_at: question.asked_at,
+            audience,
+        }));
+        return [...localRows, ...remoteRows];
+    }
+    async function hasPendingQuestionForLane(ctx, lane) {
+        return (await pendingQuestionsForLane(ctx, lane)).length > 0;
     }
     function syncPrimaryQuestionDelivery(hqRoot, owner) {
         const deliveredAt = owner.question.delivered_at;
@@ -991,6 +1002,7 @@ export function createLaneQuestionsHandlers(deps) {
     }
     return {
         hasPendingQuestionForLane,
+        pendingQuestionsForLane,
         cancelFallbackQuestionsForLane,
         runQuestionsList,
         runQuestionsShow,

package/dist/commands/lanes-resume.js

@@ -181,9 +181,20 @@ export function createLaneResumeHandlers(deps) {
             opts.compact === false)) {
             throw new LanesError("worker_profile_recovery_options_invalid", "Queued worker-profile recovery accepts only --worker; rerun hq lanes resume after reconcile admits the lane", { lane_id: laneId });
         }
-        const pendingQuestion = lane.state === "awaiting_input"
-            ? await deps.hasPendingQuestionForLane(ctx, lane)
-            : false;
+        const pendingQuestions = lane.state === "awaiting_input"
+            ? await deps.pendingQuestionsForLane(ctx, lane)
+            : [];
+        if (pendingQuestions.length > 0) {
+            const companySlug = lane.company?.slug ?? lane.mesh_company ?? "<company-slug>";
+            const instructions = pendingQuestions.map(({ question_id, audience }) => `question ${question_id} awaits ${audience.kind}:${audience.id}; answer it with hq lanes questions answer ${question_id} --company ${companySlug} --freeform <answer>`);
+            const message = `Lane ${laneId} is awaiting input. ${instructions.join("; ")}`;
+            throw new LanesError("lane_pending_questions", message, {
+                lane_id: laneId,
+                state: lane.state,
+                pending_questions: pendingQuestions,
+                answer_commands: pendingQuestions.map(({ question_id }) => `hq lanes questions answer ${question_id} --company ${companySlug} --freeform <answer>`),
+            });
+        }
         const projectId = opts.project?.trim() || lane.project_id;
         const storyId = opts.story?.trim() || lane.story_id;
         if (opts.story !== undefined && !opts.story.trim()) {
@@ -206,7 +217,7 @@ export function createLaneResumeHandlers(deps) {
                 throw new LanesError("profile_provider_changed", `Worker profile now selects ${effectiveProvider}; this lane runs ${lane.provider}; create a new lane`, { lane_id: lane.lane_id, lane_provider: lane.provider, profile_provider: effectiveProvider });
             }
         }
-        const refusal = queuedProfileRecovery || (lane.state === "awaiting_input" && !pendingQuestion)
+        const refusal = queuedProfileRecovery || lane.state === "awaiting_input"
             ? null
             : resumeCommandRefusal(lane, { allowFailed: opts.fromFailed === true });
         if (refusal !== null) {
@@ -510,7 +521,7 @@ export function createLaneResumeHandlers(deps) {
                             trigger: {
                                 kind: "resume",
                                 from: resumedFrom,
-                                ...(resumedFrom === "awaiting_input" && !pendingQuestion ? { allowAwaitingInput: true } : {}),
+                                ...(resumedFrom === "awaiting_input" && pendingQuestions.length === 0 ? { allowAwaitingInput: true } : {}),
                                 ...(opts.fromFailed === true ? { fromFailed: true } : {}),
                                 ...(failedResumeExpectedSenior !== undefined
                                     ? { expectedSenior: failedResumeExpectedSenior }
@@ -527,7 +538,7 @@ export function createLaneResumeHandlers(deps) {
                     }, hireGrantContext);
                 }, ctx.sleep);
             }
-            const questionCancellation = resumedFrom === "awaiting_input" && !pendingQuestion
+            const questionCancellation = resumedFrom === "awaiting_input" && pendingQuestions.length === 0
                 ? await deps.cancelFallbackQuestionsForLane(ctx, lane, "resume", at)
                 : null;
             if (deliveryText !== undefined && messageId !== undefined) {