@indigoai-us/hq-cli 5.345.33 → 5.345.35

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.345.35] — 2026-10-07
+- Claude plugin installs now use the HQ packages marketplace by default; local marketplace directory and environment overrides remain available.
+- Pin self-updates to the pnpm version recorded by the global install; preserve store dirs on pnpm 11+ and omit pnpm 10 virtual-store flags.
+
+## [5.345.34] — 2026-10-07
+- Protect live remote-control tmux sessions with socket-scoped creator identity before cleanup.
+
+- Cap the shipped hook health checker at 20 seconds when hq reindex runs from a lifecycle hook while keeping the 60-second interactive bound.
+- Allow each company to configure its lane depth cap from 1 through 8. Invalid values fall back to the default cap of 4 with a stderr warning.
+- Mesh services now use the stable HQ launcher after package updates or relocation. Failed service-file replacement or reload restores the previous unit.
+
 ## [5.345.33] — 2026-10-06
 - Map each PRD ledger state to a Board column and send its original value in `ledgerState`; `hq mesh project reconcile` reports status drift and notes when the Board omits that field.
 

package/dist/commands/cloud-provision.d.ts

@@ -47,6 +47,8 @@ export interface CompanyConfig {
     companySlug: string;
     bucketName: string;
     vaultApiUrl: string;
+    /** Optional per-company worker lane depth limit (1 through 8). */
+    maxLaneDepth?: number;
 }
 /** Final stdout JSON shape. Consumers (designate-team, AppBar) parse this. */
 export interface ProvisionResult {

package/dist/commands/core-resolve-company-native.d.ts

@@ -19,6 +19,8 @@ export type ResolveCompanyDependencies = {
     stdin?: string;
     stdinIsTty?: boolean;
     spawnHq?: (args: string[], env: NodeJS.ProcessEnv, timeoutMs: number, cwd?: string, command?: string) => Promise<HqResult>;
+    onHqSpawn?: (args: readonly string[]) => void;
+    onHqExit?: (args: readonly string[]) => void;
     pid?: number;
     random?: () => number;
 };

package/dist/commands/core-resolve-company-native.js

@@ -1,5 +1,5 @@
 /** Native port of resolve-company.sh. This module stays on the fast import path. */
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { awkCannotOpenFileDiagnostic } from "../lib/core-utils/awk-diagnostics.js";
@@ -272,30 +272,46 @@ function commandOnPath(name, env) {
     }
     return false;
 }
-function runHq(args, env, timeoutMs, cwd, command = "hq") {
+function runHq(args, env, timeoutMs, cwd, command = "hq", onExitObserved) {
     return new Promise((resolve) => {
         let settled = false;
         let stdout = "";
         let child;
         let timeoutKill;
         let timedOut = false;
-        const signalGroup = (signal) => {
-            if (!child?.pid)
+        const signalGroup = (signal, onComplete) => {
+            if (!child?.pid) {
+                onComplete?.();
                 return;
+            }
             try {
                 if (process.platform === "win32") {
                     const taskkill = path.join(env.SystemRoot ?? env.WINDIR ?? "C:\\Windows", "System32", "taskkill.exe");
-                    const result = spawnSync(taskkill, ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true });
-                    if (result.error || result.status !== 0)
-                        child.kill(signal);
+                    let completed = false;
+                    const complete = (code) => {
+                        if (completed)
+                            return;
+                        completed = true;
+                        if (code !== 0)
+                            child?.kill(signal);
+                        onComplete?.();
+                    };
+                    const killer = spawn(taskkill, ["/PID", String(child.pid), "/T", "/F"], {
+                        stdio: "ignore",
+                        windowsHide: true,
+                    });
+                    killer.once("error", () => complete(1));
+                    killer.once("exit", (code) => complete(code));
                 }
                 else {
                     process.kill(-child.pid, signal);
+                    onComplete?.();
                 }
             }
             catch (error) {
                 if (errorCode(error) !== "ESRCH")
                     finish({ code: 1, stdout });
+                onComplete?.();
             }
         };
         const finish = (result) => {
@@ -310,13 +326,13 @@ function runHq(args, env, timeoutMs, cwd, command = "hq") {
         const timer = setTimeout(() => {
             timedOut = true;
             if (child?.pid) {
-                signalGroup("SIGTERM");
-                // The shell wrapper returns shortly after its 2 second deadline. Do
-                // not wait for inherited stdio handles after killing the process group.
-                timeoutKill = setTimeout(() => {
-                    signalGroup("SIGKILL");
-                    finish({ code: 124, stdout });
-                }, 250);
+                signalGroup("SIGTERM", () => {
+                    // The shell wrapper returns shortly after its 2 second deadline. Give
+                    // the tree time to exit, then force-kill and wait for Windows cleanup.
+                    timeoutKill = setTimeout(() => {
+                        signalGroup("SIGKILL", () => finish({ code: 124, stdout }));
+                    }, 250);
+                });
             }
             else {
                 finish({ code: 124, stdout });
@@ -349,9 +365,24 @@ function runHq(args, env, timeoutMs, cwd, command = "hq") {
         child.stdout?.setEncoding("utf8");
         child.stdout?.on("data", (chunk) => { stdout += chunk; });
         child.once("error", () => finish({ code: 127, stdout }));
+        if (onExitObserved)
+            child.once("exit", onExitObserved);
         child.once("exit", (code, signal) => {
-            signalGroup("SIGTERM");
-            finish({ code: timedOut ? 124 : typeof code === "number" ? code : signal ? 128 : 1, stdout });
+            if (timedOut)
+                return;
+            clearTimeout(timer);
+            const result = { code: typeof code === "number" ? code : signal ? 128 : 1, stdout };
+            if (process.platform === "win32") {
+                // Tree cleanup is asynchronous on Windows. Start it after the direct
+                // child exits, but let the resolver advance without waiting for
+                // taskkill; detached descendants must not hold up the next lookup.
+                signalGroup("SIGTERM");
+                finish(result);
+                return;
+            }
+            signalGroup("SIGTERM", () => {
+                finish(result);
+            });
         });
     });
 }
@@ -502,7 +533,13 @@ export async function resolveCompany(args, dependencies) {
         hqEnv.HQ_ROOT = dependencies.hqRoot;
         hqEnv.CLAUDE_PROJECT_DIR = dependencies.hqRoot;
     }
-    const invoke = dependencies.spawnHq ?? runHq;
+    const invokeImplementation = dependencies.spawnHq
+        ? dependencies.spawnHq
+        : (args, childEnv, timeoutMs, cwd, command) => runHq(args, childEnv, timeoutMs, cwd, command, () => dependencies.onHqExit?.(args));
+    const invoke = (args, env, timeoutMs, cwd, command) => {
+        dependencies.onHqSpawn?.(args);
+        return invokeImplementation(args, env, timeoutMs, cwd, command);
+    };
     const defaultResponse = await invoke(["mesh", "context", "default", "get", "--json"], hqEnv, 2_000, root);
     const defaultSlug = defaultSlugFromJson(defaultResponse.stdout, knownSlugs);
     if (!defaultSlug)

package/dist/commands/install-global.d.ts

@@ -39,7 +39,7 @@ export interface ClaudePluginSource {
     pluginName: string;
     pluginId: string;
 }
-/** Resolve the local marketplace source; published hosting remains an operator decision. */
+/** Resolve local overrides first, then the published HQ marketplace. */
 export declare function resolveClaudePluginSource(explicitDir?: string, env?: NodeJS.ProcessEnv, repository?: string): ClaudePluginSource;
 export { AnywhereRuntimeDisabledError as AnywhereDisabledError };
 export declare const isAnywhereEnabled: (_home: string, env?: NodeJS.ProcessEnv) => boolean;

package/dist/commands/install-global.js

@@ -46,14 +46,15 @@ export function hookTargetFor(hqRoot, home, daemonInstalled, env = process.env)
     const daemonMatchesRoot = configuredRoot !== undefined && realpathOrSelf(configuredRoot) === realpathOrSelf(hqRoot);
     return installed && daemonMatchesRoot && fs.existsSync(shimPath(hqRoot)) ? 'shim' : 'master';
 }
-/** Resolve the local marketplace source; published hosting remains an operator decision. */
-export function resolveClaudePluginSource(explicitDir, env = process.env, repository) {
+const HQ_PACKAGES_MARKETPLACE_REPOSITORY = 'indigoai-us/hq-packages';
+/** Resolve local overrides first, then the published HQ marketplace. */
+export function resolveClaudePluginSource(explicitDir, env = process.env, repository = HQ_PACKAGES_MARKETPLACE_REPOSITORY) {
     const configured = explicitDir?.trim() || env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim();
     if (!configured) {
-        if (repository === 'indigoai-us/hq-packages') {
+        if (repository === HQ_PACKAGES_MARKETPLACE_REPOSITORY) {
             return { sourceDir: repository, marketplaceName: 'hq-packages', pluginName: 'hq', pluginId: 'hq@hq-packages' };
         }
-        throw Object.assign(new Error('Published HQ Claude plugin source is not configured; its repository/host awaits an operator decision. Pass --marketplace-dir <dir> or set HQ_CLAUDE_PLUGIN_MARKETPLACE.'), { expected: true });
+        throw Object.assign(new Error(`Unsupported published HQ Claude plugin repository "${repository}". Pass --marketplace-dir <dir> or set HQ_CLAUDE_PLUGIN_MARKETPLACE for a local marketplace.`), { expected: true });
     }
     const sourceDir = path.resolve(configured);
     const manifestPath = path.join(sourceDir, '.claude-plugin', 'marketplace.json');

package/dist/commands/lanes.js

@@ -33,6 +33,7 @@ import { registerLaneReviewCommand } from "./lanes-review.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { laneDepthCap } from "../lib/lanes/depth-cap.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "../lib/lanes/registry-flag.js";
@@ -2070,12 +2071,12 @@ function seniorLaneChain(hqRoot, ref, ctx, visited = new Set(), override) {
     const depth = isOverridden ? override.depth : derivedLaneDepth(hqRoot, lane.senior, ctx, override);
     return [...prefix, { lane_id: lane.lane_id, depth }];
 }
-function maxLaneDepthError(depth, chain, description, extraDetails = {}) {
-    const parentLane = [...chain].reverse().find((entry) => entry.depth < MAX_LANE_DEPTH);
+function maxLaneDepthError(depth, chain, description, cap, extraDetails = {}) {
+    const parentLane = [...chain].reverse().find((entry) => entry.depth < cap.max);
     const nextStep = parentLane
         ? `Ask your senior lane ${parentLane.lane_id} to create this worker instead, or re-parent this lane under a shallower senior.`
         : "Ask a shallower senior to create this lane, or re-parent it to a shallower senior.";
-    return new LanesError("max_lane_depth", `${description}: senior chain length ${depth} exceeds cap ${MAX_LANE_DEPTH}`, { ...extraDetails, depth, max: MAX_LANE_DEPTH, senior_chain: chain, next_step: nextStep });
+    return new LanesError("max_lane_depth", `${description}: senior chain length ${depth} exceeds cap ${cap.max} (${cap.source === "company" ? "company config" : "default config"})`, { ...extraDetails, depth, max: cap.max, source: cap.source, senior_chain: chain, next_step: nextStep });
 }
 function callerDepth(hqRoot, ctx) {
     const laneId = ctx.env.HQ_LANE_ID?.trim();
@@ -3068,21 +3069,22 @@ async function runCreate(ctx, opts) {
         }
         assertKnownOutpost(requested, known);
     }
+    let company = companyFlag
+        ? await ctx.resolveCompany(companyFlag)
+        : null;
+    const depthCap = laneDepthCap(hqRoot, company?.slug);
     const depth = callerDepth(hqRoot, ctx);
-    if (depth >= MAX_LANE_DEPTH) {
+    if (depth >= depthCap.max) {
         const callerLaneId = ctx.env.HQ_LANE_ID?.trim();
         const chain = callerLaneId
             ? seniorLaneChain(hqRoot, { kind: "lane", id: callerLaneId }, ctx)
             : seniorLaneChain(hqRoot, sessionIdFromEnv(ctx.env)
                 ? { kind: "session", id: sessionIdFromEnv(ctx.env) }
                 : { kind: "user" }, ctx);
-        throw maxLaneDepthError(depth + 1, chain, `A depth-${depth} caller may not spawn a depth-${depth + 1} lane`);
+        throw maxLaneDepthError(depth + 1, chain, `A depth-${depth} caller may not spawn a depth-${depth + 1} lane`, depthCap);
     }
     const senior = opts.senior ? parseSeniorRef(opts.senior) : defaultSenior(ctx);
     assertSeniorExists(hqRoot, senior, ctx);
-    let company = companyFlag
-        ? await ctx.resolveCompany(companyFlag)
-        : null;
     const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     if (company === null && seniorCompany.binding === "company") {
         const seniorCompanyIdentifier = seniorCompany.slug ?? (seniorCompany.uid
@@ -3104,8 +3106,8 @@ async function runCreate(ctx, opts) {
     }
     const hireGrant = requestedHireGrant ?? 0;
     const laneDepth = derivedLaneDepth(hqRoot, senior, ctx);
-    if (laneDepth > MAX_LANE_DEPTH) {
-        throw maxLaneDepthError(laneDepth, seniorLaneChain(hqRoot, senior, ctx), `Creating lane at depth ${laneDepth} is refused`);
+    if (laneDepth > depthCap.max) {
+        throw maxLaneDepthError(laneDepth, seniorLaneChain(hqRoot, senior, ctx), `Creating lane at depth ${laneDepth} is refused`, depthCap);
     }
     // A no-company lane must not call company resolution (openMeshTransport).
     if (storyIds.length > 0 && ctx.storyLedgerEnabled()) {
@@ -7249,10 +7251,11 @@ function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false
         throw new LanesError("senior_cycle", `Re-parent would create a cycle through ${laneId}`, { lane_id: laneId, senior: nextSenior });
     }
     const newDepth = derivedLaneDepth(hqRoot, nextSenior, ctx);
-    if (newDepth > MAX_LANE_DEPTH) {
+    const depthCap = laneDepthCap(hqRoot, lane.company?.slug);
+    if (newDepth > depthCap.max) {
         const chain = seniorLaneChain(hqRoot, nextSenior, ctx);
         chain.push({ lane_id: lane.lane_id, depth: newDepth });
-        throw maxLaneDepthError(newDepth, chain, `Re-parent would put lane at depth ${newDepth}`);
+        throw maxLaneDepthError(newDepth, chain, `Re-parent would put lane at depth ${newDepth}`, depthCap);
     }
     const pending = pendingQuestionsForLane(hqRoot, laneId);
     const oldDepth = derivedLaneDepth(hqRoot, lane.senior, ctx);
@@ -7269,10 +7272,11 @@ function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false
         assertLaneRunsHereForOperatorMutation(ctx, other, "reparent descendant of");
         const oldDescendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx);
         const descendantDepth = derivedLaneDepth(hqRoot, other.senior, ctx, override);
-        if (descendantDepth > MAX_LANE_DEPTH) {
+        const descendantCap = laneDepthCap(hqRoot, other.company?.slug);
+        if (descendantDepth > descendantCap.max) {
             const chain = seniorLaneChain(hqRoot, other.senior, ctx, new Set(), override);
             chain.push({ lane_id: other.lane_id, depth: descendantDepth });
-            throw maxLaneDepthError(descendantDepth, chain, `Re-parent would put descendant ${other.lane_id} at depth ${descendantDepth}`, { lane_id: other.lane_id });
+            throw maxLaneDepthError(descendantDepth, chain, `Re-parent would put descendant ${other.lane_id} at depth ${descendantDepth}`, descendantCap, { lane_id: other.lane_id });
         }
         if (descendantDepth > oldDescendantDepth &&
             pendingQuestionsForLane(hqRoot, other.lane_id).length > 0) {

package/dist/commands/pkg-install.js

@@ -72,10 +72,12 @@ export function registerPackageInstallCommand(parent) {
             if (opts.via === 'plugin' &&
                 !marketplaceDir?.trim() &&
                 !process.env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim()) {
-                if (await anywhereRuntimeAllowed(process.env)) {
-                    await runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
-                    return;
+                if (!(await anywhereRuntimeAllowed(process.env))) {
+                    console.error(chalk.red('Install failed:'), 'HQ Anywhere plugin installation requires both the hq-anywhere-runtime flag and your person setting.');
+                    process.exit(1);
                 }
+                await runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
+                return;
             }
             await runInstallGlobal({ ...opts, marketplaceDir });
             return;

package/dist/commands/reindex.js

@@ -47,6 +47,9 @@ const WORKTREE_HOOK_SWEEP_BUDGET_MS = 5_000;
  * bounded, which is the point.
  */
 const HOOK_CHECK_TIMEOUT_MS = 60_000;
+// Leave ten seconds inside the desktop's 30-second package-lease wait for
+// process startup and cleanup when reindex runs from a lifecycle hook.
+const HOOK_CHECK_FROM_HOOK_TIMEOUT_MS = 20_000;
 /** Ceiling override, in milliseconds. Present so tests need not wait a minute. */
 function hookCheckTimeoutMs() {
     const raw = process.env.HQ_HOOK_CHECK_TIMEOUT_MS?.trim();
@@ -367,11 +370,11 @@ function hasCommandHook(value) {
  * an older, unscoped checker — report healthy while the drift only this checker
  * detects goes unseen.
  */
-function runShippedHookCheck(hqRoot) {
+function runShippedHookCheck(hqRoot, timeoutLimitMs) {
     const checker = path.join(hqRoot, HOOK_CHECK_RELATIVE_PATH);
     if (!fs.existsSync(checker))
         return undefined;
-    const budgetMs = hookCheckTimeoutMs();
+    const budgetMs = Math.min(hookCheckTimeoutMs(), timeoutLimitMs ?? Number.POSITIVE_INFINITY);
     try {
         const result = spawnSync('bash', [checker, '--root', hqRoot], {
             encoding: 'utf8',
@@ -406,7 +409,7 @@ function runShippedHookCheck(hqRoot) {
  * reindex fires on every Stop / PostToolUse hook, that was the single most
  * expensive discarded result in the command.
  */
-function inspectHookHealth(hqRoot) {
+function inspectHookHealth(hqRoot, timeoutLimitMs) {
     const settingsPath = path.join(hqRoot, '.claude', 'settings.json');
     if (!fs.existsSync(settingsPath)) {
         return { state: 'extreme', reason: '.claude/settings.json is missing' };
@@ -435,7 +438,7 @@ function inspectHookHealth(hqRoot) {
             reason: `missing command hook wiring for ${HOOK_EVENTS.filter((event) => !commandEvents.includes(event)).join(', ')}`,
         };
     }
-    const checkerResult = runShippedHookCheck(hqRoot);
+    const checkerResult = runShippedHookCheck(hqRoot, timeoutLimitMs);
     if (checkerResult !== undefined && checkerResult.status !== 0) {
         return {
             state: 'minor',
@@ -491,12 +494,12 @@ function runSilently(operation) {
  * configuration is repaired only after a successful reindex; partial and
  * malformed configurations remain untouched and receive recovery guidance.
  */
-function repairExtremeHookDrift(hqRoot, allowRepair = true) {
+function repairExtremeHookDrift(hqRoot, allowRepair = true, timeoutLimitMs) {
     // `hq reindex` can still be invoked from an arbitrary directory. Never turn
     // an absent settings file there into a rescue attempt.
     if (!isHqRoot(hqRoot))
         return;
-    const health = inspectHookHealth(hqRoot);
+    const health = inspectHookHealth(hqRoot, timeoutLimitMs);
     if (health.state === 'healthy')
         return;
     printHookHealthWarning(hqRoot, health.reason);
@@ -510,7 +513,7 @@ function repairExtremeHookDrift(hqRoot, allowRepair = true) {
             paths: ['.claude'],
             assumeYes: true,
         }));
-        const afterRepair = inspectHookHealth(hqRoot);
+        const afterRepair = inspectHookHealth(hqRoot, timeoutLimitMs);
         if (result.status === 0 && afterRepair.state === 'healthy') {
             console.log('reindex: repaired HQ hook config');
             return;
@@ -691,7 +694,7 @@ export function registerReindexCommand(program) {
         const sweepStartedAt = Date.now();
         removeStaleHqWorktrees(hqRoot, sweepStartedAt, opts.fromHook ? sweepStartedAt + WORKTREE_HOOK_SWEEP_BUDGET_MS : Number.POSITIVE_INFINITY);
         const { status } = reindex({ repoRoot: opts.repoRoot });
-        repairExtremeHookDrift(hqRoot, status === 0);
+        repairExtremeHookDrift(hqRoot, status === 0, opts.fromHook ? HOOK_CHECK_FROM_HOOK_TIMEOUT_MS : undefined);
         if (status === 0) {
             // Only safe once reindex actually ran: a refused --from-hook reindex
             // means a sync/rescue holds the shared operation lock and may be

package/dist/lib/daemon/remote-control.js

@@ -24,6 +24,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 const TMUX_SOCKET = "hq-daemon";
+const TMUX_CREATOR_OPTION = "@hq-remote-control-creator";
 export const TMUX_SESSION = "remote-control";
 export const CODEX_TMUX_SESSION = "codex-remote-control";
 export function remoteControlArgs(opts) {
@@ -204,7 +205,56 @@ function safePaneTail(output) {
 }
 export async function runRemoteControlHost(deps) {
     const tmux = (...args) => deps.run(deps.tmux, ["-L", TMUX_SOCKET, ...args]);
-    const killSession = () => tmux("kill-session", "-t", deps.session);
+    const invokerPid = process.pid;
+    const killSession = () => {
+        if (tmux("has-session", "-t", deps.session).status !== 0)
+            return true;
+        const rawCreator = tmux("show-option", "-qv", "-t", deps.session, TMUX_CREATOR_OPTION);
+        let creator = null;
+        let legacyRecordReason = "no creator record";
+        if (rawCreator.status === 0 && rawCreator.stdout.trim() !== "") {
+            try {
+                const value = JSON.parse(rawCreator.stdout);
+                if (Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.cwd === "string") {
+                    creator = { pid: value.pid, cwd: value.cwd };
+                }
+                else {
+                    legacyRecordReason = "malformed creator record";
+                }
+            }
+            catch {
+                legacyRecordReason = "malformed creator record";
+            }
+        }
+        else if (rawCreator.status !== 0) {
+            legacyRecordReason = "malformed creator record";
+        }
+        if (!creator) {
+            deps.log(`remote-control tmux session has ${legacyRecordReason}; using bridge-owner liveness fallback; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            const owner = foreignClaudeOwner(deps);
+            if (owner !== null) {
+                deps.log(`remote-control refused to kill legacy tmux session with live Claude bridge owner pid=${owner}; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+                return false;
+            }
+            const panePid = tmux("display-message", "-p", "-t", deps.session, "#{pane_pid}");
+            const paneCwd = tmux("display-message", "-p", "-t", deps.session, "#{pane_current_path}");
+            const victimPid = panePid.status === 0 && /^\d+$/.test(panePid.stdout.trim())
+                ? panePid.stdout.trim()
+                : "unknown";
+            const victimCwd = paneCwd.status === 0 && paneCwd.stdout.trim() !== ""
+                ? paneCwd.stdout.trim()
+                : "unknown";
+            deps.log(`remote-control kill tmux session victim pid=${victimPid} cwd=${JSON.stringify(victimCwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            return tmux("kill-session", "-t", deps.session).status === 0;
+        }
+        const sameInvoker = creator.pid === invokerPid && creator.cwd === deps.cwd;
+        if (!sameInvoker && (deps.pidAlive ?? processAlive)(creator.pid)) {
+            deps.log(`remote-control refused to kill live tmux session creator pid=${creator.pid} cwd=${JSON.stringify(creator.cwd)}; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+            return false;
+        }
+        deps.log(`remote-control kill tmux session victim pid=${creator.pid} cwd=${JSON.stringify(creator.cwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        return tmux("kill-session", "-t", deps.session).status === 0;
+    };
     /** When the session last printed anything, in ms; null when tmux cannot say. */
     const lastActivity = () => {
         const r = tmux("display-message", "-p", "-t", deps.session, "#{window_activity}");
@@ -213,7 +263,8 @@ export async function runRemoteControlHost(deps) {
     };
     // Remove this daemon's leftover private session before checking the process
     // pointer, so its previous command is not mistaken for a foreign owner.
-    killSession();
+    if (!killSession())
+        return 1;
     let waitingFor = null;
     for (;;) {
         if (deps.signal.aborted)
@@ -233,6 +284,14 @@ export async function runRemoteControlHost(deps) {
         deps.log(`could not create the tmux session: ${created.stderr.trim() || `tmux exited ${created.status}`}`);
         return 1;
     }
+    const creatorRecord = JSON.stringify({ pid: invokerPid, cwd: deps.cwd });
+    const recorded = tmux("set-option", "-t", deps.session, TMUX_CREATOR_OPTION, creatorRecord);
+    if (recorded.status !== 0) {
+        deps.log(`remote-control could not record session creator; invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        deps.log(`remote-control kill tmux session victim pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)} invoker pid=${invokerPid} cwd=${JSON.stringify(deps.cwd)}`);
+        tmux("kill-session", "-t", deps.session);
+        return 1;
+    }
     const retained = tmux("set-window-option", "-t", deps.session, "remain-on-exit", "on");
     const started = retained.status === 0
         ? tmux("respawn-pane", "-k", "-t", deps.session, ...deps.argv)
@@ -242,7 +301,7 @@ export async function runRemoteControlHost(deps) {
         deps.log(`could not start the tmux session: ${started.stderr.trim() || `tmux exited ${started.status}`}`);
         return 1;
     }
-    deps.log(`${deps.label} started in ${deps.cwd}`);
+    deps.log(`${deps.label} started in ${JSON.stringify(deps.cwd)} (creator pid ${invokerPid})`);
     const startedWith = deps.binaryFingerprint();
     let updatedAt = null;
     for (;;) {

package/dist/lib/index-render/shared.d.ts

@@ -28,7 +28,9 @@ export declare function titleize(slug: string): string;
 export declare function date(now?: Date): string;
 export declare function timestamp(now?: Date): string;
 /** Write via a same-directory temporary file, then atomically replace the destination. */
-export declare function atomicWrite(file: string, content: string): void;
+export declare function atomicWrite(file: string, content: string | Buffer, options?: {
+    mode?: number;
+}): void;
 export declare function write(context: RenderContext, relative: string, content: string): string;
 /** Drop keep fences, the generated stamp, and the rolling date so two generated bodies can be compared. */
 export declare function generatedFingerprint(content: string): string;

package/dist/lib/index-render/shared.js

@@ -78,11 +78,14 @@ export function titleize(slug) {
 export function date(now = new Date()) { return now.toISOString().slice(0, 10); }
 export function timestamp(now = new Date()) { return now.toISOString().replace(/\.\d{3}Z$/, "Z"); }
 /** Write via a same-directory temporary file, then atomically replace the destination. */
-export function atomicWrite(file, content) {
+export function atomicWrite(file, content, options = {}) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
     const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
     try {
-        fs.writeFileSync(temporary, content, "utf8");
+        if (typeof content === "string")
+            fs.writeFileSync(temporary, content, { encoding: "utf8", mode: options.mode });
+        else
+            fs.writeFileSync(temporary, content, { mode: options.mode });
         fs.renameSync(temporary, file);
     }
     catch (error) {

package/dist/lib/lanes/depth-cap.d.ts

@@ -0,0 +1,7 @@
+export interface LaneDepthCap {
+    max: number;
+    source: "default" | "company";
+}
+/** Read the optional maxLaneDepth from companies/<slug>/.hq/config.json. */
+export declare function laneDepthCap(hqRoot: string, companySlug?: string | null): LaneDepthCap;
+//# sourceMappingURL=depth-cap.d.ts.map

package/dist/lib/lanes/depth-cap.js

@@ -0,0 +1,41 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { LanesError } from "./errors.js";
+import { MAX_LANE_DEPTH } from "./constants.js";
+/** Read the optional maxLaneDepth from companies/<slug>/.hq/config.json. */
+export function laneDepthCap(hqRoot, companySlug) {
+    if (!companySlug)
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    if (!/^[a-z0-9][a-z0-9_-]*$/.test(companySlug)) {
+        throw new LanesError("lane_depth_config_invalid", `Invalid company slug for lane depth config: ${JSON.stringify(companySlug)}`, { company: companySlug });
+    }
+    const file = path.join(hqRoot, "companies", companySlug, ".hq", "config.json");
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { max: MAX_LANE_DEPTH, source: "default" };
+        throw new LanesError("lane_depth_config_unreadable", `Failed to read company lane depth config ${file}: ${err instanceof Error ? err.message : String(err)}`, { company: companySlug, path: file });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new LanesError("lane_depth_config_invalid", `Invalid JSON in company config ${file}: ${err instanceof Error ? err.message : String(err)}`, { company: companySlug, path: file });
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new LanesError("lane_depth_config_invalid", `Company config ${file} must be a JSON object`, { company: companySlug, path: file });
+    }
+    const value = parsed.maxLaneDepth;
+    if (value === undefined)
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 8) {
+        process.stderr.write(`hq lanes: lane_depth_cap_invalid company=${companySlug} maxLaneDepth=${JSON.stringify(value)}; using default ${MAX_LANE_DEPTH}\n`);
+        return { max: MAX_LANE_DEPTH, source: "default" };
+    }
+    return { max: value, source: "company" };
+}
+//# sourceMappingURL=depth-cap.js.map

package/dist/lib/lanes/reconcile.d.ts

@@ -132,7 +132,7 @@ export declare function timeoutPath(hqRoot: string, laneId: string): string;
 export declare function laneRunsHere(lane: LaneRecord, host: ReconcileHost): boolean;
 export declare function agedAdvanceCount(question: QuestionRecord): number;
 export declare function currentHopStartedAtMs(question: QuestionRecord): number;
-export declare function shouldAgeQuestion(question: QuestionRecord, audience: SeniorRef, nowMs: number, ageWindowMs?: number): boolean;
+export declare function shouldAgeQuestion(question: QuestionRecord, audience: SeniorRef, nowMs: number, ageWindowMs?: number, maxAgedAdvances?: number): boolean;
 export declare function shouldAdvanceAudienceEnded(audience: SeniorRef, liveness: LivenessState | null): boolean;
 export declare function readTimeoutDeadline(hqRoot: string, laneId: string): {
     deadline_at: string;

package/dist/lib/lanes/reconcile.js

@@ -14,6 +14,7 @@ import { effectiveAccountHome } from "./account-home.js";
 import { enforceRegistryApprovalGate } from "./approval-gate.js";
 import { loadLanesConfig, providerQuotaDefaultHoldMs } from "./config.js";
 import { MAX_LANE_DEPTH } from "./constants.js";
+import { laneDepthCap } from "./depth-cap.js";
 import { AccountResolutionError, LanesError, isLaneVersionConflict } from "./errors.js";
 import { loadWorkerProfile } from "./profile.js";
 import { terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
@@ -155,12 +156,12 @@ export function currentHopStartedAtMs(question) {
     const ms = Date.parse(raw);
     return Number.isFinite(ms) ? ms : Number.NEGATIVE_INFINITY;
 }
-export function shouldAgeQuestion(question, audience, nowMs, ageWindowMs = QUESTION_AGE_MS) {
+export function shouldAgeQuestion(question, audience, nowMs, ageWindowMs = QUESTION_AGE_MS, maxAgedAdvances = MAX_AGED_ADVANCES) {
     if (question.status !== "pending")
         return false;
     if (audience.kind === "user")
         return false;
-    if (agedAdvanceCount(question) >= MAX_AGED_ADVANCES)
+    if (agedAdvanceCount(question) >= maxAgedAdvances)
         return false;
     const started = currentHopStartedAtMs(question);
     if (started === Number.NEGATIVE_INFINITY)
@@ -1121,16 +1122,26 @@ export async function runPassBody(hqRoot, deps) {
                 }
                 continue;
             }
-            if (shouldAgeQuestion(question, audience, nowMs, questionAgeWindowMs(audience))) {
+            let maxAgedAdvances;
+            try {
+                maxAgedAdvances = laneDepthCap(hqRoot, question.company?.slug).max * 2;
+            }
+            catch (err) {
+                if (!(err instanceof LanesError))
+                    throw err;
+                maxAgedAdvances = MAX_AGED_ADVANCES;
+                process.stderr.write(`hq lanes reconcile: lane depth config failed for company=${JSON.stringify(question.company?.slug)}; using default ${MAX_LANE_DEPTH}: ${err.message}\n`);
+            }
+            if (shouldAgeQuestion(question, audience, nowMs, questionAgeWindowMs(audience), maxAgedAdvances)) {
                 const nextHop = question.hop + 1;
                 const nextAudience = resolveQuestionAudience({ ...question, hop: nextHop }, readLaneSenior, readSessionSenior);
                 const result = casQuestionIf(hqRoot, question.question_id, (current) => {
                     if (current.status !== "pending" ||
-                        agedAdvanceCount(current) >= MAX_AGED_ADVANCES) {
+                        agedAdvanceCount(current) >= maxAgedAdvances) {
                         return false;
                     }
                     const currentAudience = resolveQuestionAudience(current, readLaneSenior, readSessionSenior);
-                    return shouldAgeQuestion(current, currentAudience, nowMs, questionAgeWindowMs(currentAudience));
+                    return shouldAgeQuestion(current, currentAudience, nowMs, questionAgeWindowMs(currentAudience), maxAgedAdvances);
                 }, (current) => {
                     const entry = {
                         hop: current.hop + 1,