@indigoai-us/hq-cli 5.345.54 → 5.345.56

package/dist/lib/lanes/status-fields.js

@@ -0,0 +1,189 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { assertNoSecretText } from "./text-scan.js";
+import { compareEnvelopeNames } from "./envelope-sequence.js";
+import { isTerminalLaneState } from "./types.js";
+const OUTPUT_TAIL_BYTES = 64 * 1024;
+const INBOX_TAIL_BYTES = 32 * 1024;
+const PR_URL = /https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+/g;
+function readTail(filePath, maxBytes) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+        const stat = fs.fstatSync(fd);
+        const size = stat.size;
+        const start = Math.max(0, size - maxBytes);
+        const buffer = Buffer.alloc(size - start);
+        fs.readSync(fd, buffer, 0, buffer.length, start);
+        return { text: buffer.toString("utf8"), size, mtimeMs: stat.mtimeMs };
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            process.stderr.write(`hq lanes: could not read status tail ${filePath}: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+function candidateLines(value, depth = 0) {
+    if (depth > 4 || value === null || value === undefined)
+        return [];
+    if (typeof value === "string")
+        return value.split(/\r?\n/);
+    if (Array.isArray(value))
+        return value.flatMap((item) => candidateLines(item, depth + 1));
+    if (typeof value !== "object")
+        return [];
+    const record = value;
+    const direct = ["text", "content", "message", "last_assistant_message", "lastAssistantMessage"]
+        .flatMap((key) => candidateLines(record[key], depth + 1));
+    return direct.length > 0 ? direct : ["item", "message", "response", "result"]
+        .flatMap((key) => candidateLines(record[key], depth + 1));
+}
+function meaningfulLines(text) {
+    const lines = [];
+    for (const raw of text.split(/\r?\n/)) {
+        // eslint-disable-next-line no-control-regex
+        const line = raw.replace(/\x1b\[[0-9;]*m/g, "").trim();
+        if (!line || line.startsWith("{") || line.startsWith("[") || line.includes("cache_read_input_tokens"))
+            continue;
+        lines.push(line);
+    }
+    return lines;
+}
+function linesFromOutput(text) {
+    const output = [];
+    for (const raw of text.split(/\r?\n/)) {
+        if (!raw.trim())
+            continue;
+        try {
+            const parsed = JSON.parse(raw);
+            output.push(...meaningfulLines(candidateLines(parsed).join("\n")));
+        }
+        catch {
+            output.push(...meaningfulLines(raw));
+        }
+    }
+    return output;
+}
+function safeLastLine(lines) {
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+        const line = lines[i].trim();
+        if (!line)
+            continue;
+        const clipped = line.length > 160 ? `${line.slice(0, 157)}…` : line;
+        try {
+            // Same secret detector used by the lane question flow. Drop unsafe output.
+            assertNoSecretText("last_line", clipped);
+            return clipped;
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
+function lastPr(text) {
+    const matches = [...text.matchAll(PR_URL)];
+    return matches.length ? matches[matches.length - 1][0] : null;
+}
+function terminalExit(lane, runDir) {
+    if (!isTerminalLaneState(lane.state))
+        return null;
+    const exitRecord = readTail(path.join(runDir, "logs", "worker-exit.json"), 4 * 1024);
+    if (exitRecord !== null) {
+        try {
+            const parsed = JSON.parse(exitRecord.text);
+            if (typeof parsed.exit_code === "number" && Number.isInteger(parsed.exit_code))
+                return parsed.exit_code;
+        }
+        catch {
+            process.stderr.write(`hq lanes: worker exit record is invalid for ${lane.lane_id}\n`);
+        }
+    }
+    const row = lane;
+    const candidates = [row.worker_exit_code, row.exit_code, row.terminal_details?.exit_code];
+    return candidates.find((value) => Number.isInteger(value)) ?? null;
+}
+function startTimeMs(lane, runDir) {
+    const row = lane;
+    for (const value of [row.worker_started_at, row.started_at]) {
+        const parsed = typeof value === "number" ? value * 1000 : typeof value === "string" ? Date.parse(value) : NaN;
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    try {
+        return fs.statSync(path.join(runDir, "worker.pid")).mtimeMs;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            process.stderr.write(`hq lanes: could not read worker start time ${runDir}: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+        return null;
+    }
+}
+/** Bounded, local-only status data. Remote-owned lanes report null for file-backed fields. */
+export function readLaneStatusRowFields(hqRoot, lane, nowMs = Date.now(), local = true) {
+    if (!local)
+        return { last_line: null, pr: null, inbox_pending: null, elapsed_s: null, exit: null };
+    const runDir = path.join(hqRoot, "workspace", "lanes-runs", lane.lane_id);
+    const logsDir = path.join(runDir, "logs");
+    const outTail = readTail(path.join(logsDir, "worker.out"), OUTPUT_TAIL_BYTES);
+    const messageTail = readTail(path.join(logsDir, "last-message.txt"), OUTPUT_TAIL_BYTES);
+    const outputTails = [outTail, messageTail]
+        .filter((value) => value !== null)
+        .sort((left, right) => left.mtimeMs - right.mtimeMs);
+    const lines = outputTails.flatMap(({ text }) => linesFromOutput(text));
+    let envelopeTail = null;
+    try {
+        const names = fs.readdirSync(path.join(runDir, "envelopes"))
+            .filter((name) => name.endsWith(".json"))
+            .sort(compareEnvelopeNames);
+        const latest = names.at(-1);
+        if (latest)
+            envelopeTail = readTail(path.join(runDir, "envelopes", latest), OUTPUT_TAIL_BYTES);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            process.stderr.write(`hq lanes: could not read status envelopes for ${lane.lane_id}: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+    }
+    const prSources = [
+        ...outputTails.map(({ text, mtimeMs }) => ({ text, mtimeMs })),
+        ...(envelopeTail ? [{ text: envelopeTail.text, mtimeMs: envelopeTail.mtimeMs }] : []),
+    ].sort((left, right) => left.mtimeMs - right.mtimeMs);
+    const pr = lastPr(prSources.map(({ text }) => text).join("\n"));
+    const inboxTail = readTail(path.join(runDir, "dropbox", "inbox.jsonl"), INBOX_TAIL_BYTES);
+    const inboxPending = inboxTail === null ? 0
+        : inboxTail.size > INBOX_TAIL_BYTES ? null
+            : inboxTail.text.split(/\r?\n/).filter((line) => {
+                if (!line.trim())
+                    return false;
+                try {
+                    return JSON.parse(line) !== null;
+                }
+                catch {
+                    return false;
+                }
+            }).length;
+    const startedAt = startTimeMs(lane, runDir);
+    const terminal = isTerminalLaneState(lane.state);
+    const terminalEndAt = [lane.ended_at, lane.updated_at]
+        .map((value) => typeof value === "string" ? Date.parse(value) : NaN)
+        .find(Number.isFinite);
+    const endedAt = terminal ? terminalEndAt ?? nowMs : nowMs;
+    const elapsed = startedAt === null || !Number.isFinite(endedAt)
+        ? null
+        : Math.max(0, Math.floor((endedAt - startedAt) / 1000));
+    return {
+        last_line: safeLastLine(lines),
+        pr,
+        inbox_pending: inboxPending,
+        elapsed_s: elapsed,
+        exit: terminalExit(lane, runDir),
+    };
+}
+//# sourceMappingURL=status-fields.js.map

package/dist/lib/lanes/types.js

@@ -238,7 +238,7 @@ export const LANE_FIELD_WRITERS = {
     provider: ["creator", "command"], provider_source: ["creator", "command"], account: ["creator", "spawn", "command", "watcher", "reconcile"], account_source: ["creator", "command"], profile_settings_pinned: ["command"], account_selection: ["creator", "command"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], failed_resume_history: ["command"], fallback_question_cancellation_failures: ["command"], pending_resume: ["command", "spawn", "watcher", "reconcile"], placement_default: ["creator"], host: ["creator", "command"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], ended_at: ["reconcile"], envelope_summary: ["reconcile"], attribution_history: ["command", "watcher", "reconcile"], story_switch_pending: ["command", "watcher", "reconcile"], story_switch_unacknowledged: ["watcher", "reconcile"],
     last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], model_source: ["creator", "spawn", "command"], effort: ["creator", "spawn", "command"], effort_source: ["creator", "spawn", "command"], fast_mode: ["spawn"],
-    last_message_at: ["command"], status_gate: ["spawn", "watcher"], status_gate_history: ["watcher", "reconcile"], blocker_freshness_state: ["watcher"], kr_freshness_state: ["watcher"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
+    last_message_at: ["creator", "command"], status_gate: ["spawn", "watcher"], status_gate_history: ["watcher", "reconcile"], blocker_freshness_state: ["watcher"], kr_freshness_state: ["watcher"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
     overdue: ["reconcile"], overdue_at: ["reconcile"], last_host_report_at: ["watcher", "spawn", "reconcile"], stalled: ["watcher"], stalled_at: ["watcher"], stalled_reason: ["watcher"],
     admitted_reason: ["command", "reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], stop_history: ["command", "reconcile"], settings_history: ["command"], pending_settings: ["command", "spawn"], interrupted_at: ["command", "watcher", "reconcile", "spawn"], terminal_details: ["command", "spawn", "watcher", "reconcile"],
     quota_reset_at: ["watcher", "reconcile", "spawn", "command"], model_quota_marker: ["watcher", "reconcile"], outpost_command_id: ["command"],

package/dist/lib/lanes/worker-continuity.d.ts

@@ -0,0 +1,18 @@
+import { type LaneRecord, type LaneProvider, type SeniorRef } from "./types.js";
+export interface WorkerContinuityLookup {
+    senior: SeniorRef;
+    worker: string;
+    provider: LaneProvider;
+    company: LaneRecord["company"];
+    freshThread?: boolean;
+}
+export interface WorkerContinuityResult {
+    previous?: LaneRecord;
+    resumable: boolean;
+    fallbackReason?: "provider_unsupported" | "session_id_missing" | "state_unsafe" | "host_mismatch";
+}
+export declare function sameLaneHost(left: LaneRecord["host"], right: LaneRecord["host"]): boolean;
+/** Select the prior worker lane within exactly one senior/company/provider scope. */
+export declare function findWorkerContinuityLane(lanes: readonly LaneRecord[], lookup: WorkerContinuityLookup): WorkerContinuityResult;
+export declare function workerContinuityPrompt(previous: LaneRecord, resultSummary?: string, resultRef?: string): string;
+//# sourceMappingURL=worker-continuity.d.ts.map

package/dist/lib/lanes/worker-continuity.js

@@ -0,0 +1,81 @@
+import { LanesError } from "./errors.js";
+import { providerSupportsSessionResume } from "./delivery.js";
+import { isTerminalLaneState } from "./types.js";
+function seniorKey(senior) {
+    return `${senior.kind}:${senior.id ?? ""}`;
+}
+function sameCompany(left, right) {
+    if (left?.uid && right?.uid)
+        return left.uid === right.uid;
+    if (left?.slug && right?.slug)
+        return left.slug === right.slug;
+    return left == null && right == null;
+}
+function compareNewest(left, right) {
+    return right.created_at.localeCompare(left.created_at) || right.lane_id.localeCompare(left.lane_id);
+}
+export function sameLaneHost(left, right) {
+    return left.kind === right.kind && left.id === right.id;
+}
+/** Select the prior worker lane within exactly one senior/company/provider scope. */
+export function findWorkerContinuityLane(lanes, lookup) {
+    const scoped = lanes
+        .filter((lane) => lane.worker === lookup.worker && lane.provider === lookup.provider &&
+        seniorKey(lane.senior) === seniorKey(lookup.senior) && sameCompany(lane.company ?? lane.mesh_company, lookup.company))
+        .sort(compareNewest);
+    const live = scoped.find((lane) => !isTerminalLaneState(lane.state));
+    if (live) {
+        throw new LanesError("worker_lane_busy", `Worker ${lookup.worker} already has live lane ${live.lane_id}`, {
+            worker: lookup.worker,
+            lane_id: live.lane_id,
+            state: live.state,
+        });
+    }
+    const previous = scoped[0];
+    if (!previous)
+        return { resumable: false };
+    if (lookup.freshThread)
+        return { previous, resumable: false };
+    const previousSessionId = previous.provider_session_id?.trim();
+    if (previousSessionId) {
+        const liveDescendant = lanes
+            .filter((lane) => lane.lane_id !== previous.lane_id && lane.provider === lookup.provider &&
+            sameCompany(lane.company ?? lane.mesh_company, lookup.company) &&
+            lane.provider_session_id === previousSessionId &&
+            (lane.state === "queued" || lane.state === "running"))
+            .sort(compareNewest)[0];
+        if (liveDescendant) {
+            throw new LanesError("worker_lane_busy", `Provider thread lineage is active in lane ${liveDescendant.lane_id}`, {
+                worker: lookup.worker,
+                lane_id: liveDescendant.lane_id,
+                state: liveDescendant.state,
+                provider_session_id: previousSessionId,
+            });
+        }
+    }
+    // Only clean, resumable terminal outcomes are safe for automatic reuse.
+    if (previous.state !== "done" && previous.state !== "interrupted") {
+        return { previous, resumable: false, fallbackReason: "state_unsafe" };
+    }
+    if (!providerSupportsSessionResume(lookup.provider)) {
+        return { previous, resumable: false, fallbackReason: "provider_unsupported" };
+    }
+    if (!previous.provider_session_id?.trim()) {
+        return { previous, resumable: false, fallbackReason: "session_id_missing" };
+    }
+    return { previous, resumable: true };
+}
+export function workerContinuityPrompt(previous, resultSummary, resultRef) {
+    const summary = resultSummary?.trim();
+    const resultPath = resultRef?.trim()
+        ? `workspace/lanes-runs/${previous.lane_id}/${resultRef.trim()}`
+        : `workspace/lanes-runs/${previous.lane_id}/envelopes/`;
+    return [
+        "## Previous worker lane",
+        `Continue the provider session from lane ${previous.lane_id}. Its latest result is recorded at ${resultPath}; read that result before acting.`,
+        ...(summary ? [`Previous result summary: ${summary}`] : []),
+        "The current brief below is the instruction for this turn.",
+        "",
+    ].join("\n");
+}
+//# sourceMappingURL=worker-continuity.js.map

package/dist/lib/lanes/worker-process.d.ts

@@ -0,0 +1,4 @@
+export declare const LANE_WORKER_EXIT_PATH_ENV = "HQ_LANE_WORKER_EXIT_PATH";
+/** Runs one lane worker process and persists its terminal process status. */
+export declare function runLaneWorkerProcess(command: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string): Promise<number>;
+//# sourceMappingURL=worker-process.d.ts.map

package/dist/lib/lanes/worker-process.js

@@ -0,0 +1,77 @@
+import * as childProcess from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+export const LANE_WORKER_EXIT_PATH_ENV = "HQ_LANE_WORKER_EXIT_PATH";
+function exitCodeFor(code, signal) {
+    if (code !== null)
+        return code;
+    return signal ? 128 + (os.constants.signals[signal] ?? 0) : 1;
+}
+function recordExit(pathname, code, signal) {
+    const tempPath = `${pathname}.${process.pid}.tmp`;
+    fs.writeFileSync(tempPath, `${JSON.stringify({
+        exit_code: exitCodeFor(code, signal),
+        ...(signal ? { signal } : {}),
+        ended_at: new Date().toISOString(),
+    })}\n`, { mode: 0o600 });
+    fs.renameSync(tempPath, pathname);
+}
+/** Runs one lane worker process and persists its terminal process status. */
+export function runLaneWorkerProcess(command, args, env = process.env, cwd = process.cwd()) {
+    const exitPath = env[LANE_WORKER_EXIT_PATH_ENV];
+    const childEnv = { ...env };
+    delete childEnv[LANE_WORKER_EXIT_PATH_ENV];
+    const child = childProcess.spawn(command, args, { cwd, env: childEnv, stdio: "inherit" });
+    let settled = false;
+    const finish = (code, signal) => {
+        if (!settled && exitPath) {
+            try {
+                recordExit(exitPath, code, signal);
+            }
+            catch (error) {
+                process.stderr.write(`hq lanes: could not persist worker exit status: ${error instanceof Error ? error.message : String(error)}\n`);
+            }
+        }
+        settled = true;
+        return exitCodeFor(code, signal);
+    };
+    return new Promise((resolve) => {
+        const signals = ["SIGINT", "SIGTERM", "SIGHUP", "SIGQUIT"];
+        const handlers = new Map();
+        const cleanup = () => {
+            for (const [signal, handler] of handlers)
+                process.removeListener(signal, handler);
+        };
+        for (const signal of signals) {
+            const handler = () => child.kill(signal);
+            handlers.set(signal, handler);
+            process.on(signal, handler);
+        }
+        child.once("error", (error) => {
+            process.stderr.write(`hq lanes: worker process could not start: ${error.message}\n`);
+            if (!settled) {
+                cleanup();
+                resolve(finish(127, null));
+            }
+        });
+        child.once("exit", (code, signal) => {
+            if (!settled) {
+                cleanup();
+                resolve(finish(code, signal));
+            }
+        });
+    });
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    const [command, ...args] = process.argv.slice(2);
+    if (!command) {
+        process.stderr.write("hq lanes: worker process command is missing\n");
+        process.exitCode = 2;
+    }
+    else {
+        process.exitCode = await runLaneWorkerProcess(command, args);
+    }
+}
+//# sourceMappingURL=worker-process.js.map

package/dist/main.js

@@ -47,7 +47,7 @@ import { enforceVersionGate, getVersionGatePhase, isLocalDependencyInstall, reso
 import { autoUpdateAndReexec } from "./utils/self-update.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { findLazyCommand, registerCommandCatalog } from "./lazy-commands.js";
-import { emitCliFirstSyncNextStepOutcome, emitCliLimitNoticeEngagement, emitCliLimitNoticeExposure, emitCliInviteNudgeEvent, emitCliSessionStarted, emitPlanLimitInviteTeammateExposure, isCliLimitResourceKind, queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, takeFirstSyncStepOutcomes, takeCliLimitNoticeEngagements, takeCliLimitNoticeExposures, takeCliInviteNudgeEvents, takePlanLimitInviteTeammateExposures, maybeShowFirstSyncNextStep, } from "./utils/cli-telemetry.js";
+import { emitCliFirstSyncNextStepOutcome, emitCliFeatureUsed, emitCliLimitNoticeEngagement, emitCliLimitNoticeExposure, emitCliInviteNudgeEvent, emitCliSessionStarted, emitPlanLimitInviteTeammateExposure, isCliLimitResourceKind, queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, takeFirstSyncStepOutcomes, takeCliFeatureUsages, takeCliLimitNoticeEngagements, takeCliLimitNoticeExposures, takeCliInviteNudgeEvents, takePlanLimitInviteTeammateExposures, maybeShowFirstSyncNextStep, } from "./utils/cli-telemetry.js";
 import { reportCliClientHealthInvocation } from "./utils/client-health.js";
 import { settleWithin } from "./utils/settle-with-timeout.js";
 import { isVersionRequest } from "./version-request.js";
@@ -298,7 +298,9 @@ export async function runCli() {
         await releasePackageUseLeaseAfterCommandLoad(process.argv);
         await program.parseAsync();
         commandParsed = true;
-        maybeShowFirstSyncNextStep();
+        if (process.exitCode === undefined || process.exitCode === 0) {
+            maybeShowFirstSyncNextStep();
+        }
     }
     catch (err) {
         await handleTopLevelError(err);
@@ -316,7 +318,10 @@ export async function runCli() {
             // lifecycle boundary for this invocation. The budget reserves this 500 ms
             // slice even when the command itself was long-running.
             const releaseHealthTimeoutMs = foregroundNetworkBudget.timeoutFor(FINALIZATION_FOREGROUND_WAIT_MS);
-            const firstSyncOutcomeFlushes = takeFirstSyncStepOutcomes().map((outcome) => emitCliFirstSyncNextStepOutcome(outcome, releaseHealthTimeoutMs));
+            const firstSyncOutcomeFlushes = process.exitCode === undefined || process.exitCode === 0
+                ? takeFirstSyncStepOutcomes().map((outcome) => emitCliFirstSyncNextStepOutcome(outcome, releaseHealthTimeoutMs))
+                : [];
+            const featureUsageFlushes = takeCliFeatureUsages().map((usage) => emitCliFeatureUsed(usage, releaseHealthTimeoutMs));
             const inviteNudgeOutcomeFlushes = takeCliInviteNudgeEvents().map((event) => emitCliInviteNudgeEvent(event, releaseHealthTimeoutMs));
             const inviteTeammateExposureFlushes = takePlanLimitInviteTeammateExposures().map((companyUid) => emitPlanLimitInviteTeammateExposure(companyUid, releaseHealthTimeoutMs));
             const limitNoticeExposureFlushes = takeCliLimitNoticeExposures().map((exposure) => emitCliLimitNoticeExposure(exposure, releaseHealthTimeoutMs));
@@ -343,6 +348,7 @@ export async function runCli() {
                 ...(cachedVersionNudge ? [cachedVersionNudge] : []),
                 Sentry.flush(releaseHealthTimeoutMs),
                 ...firstSyncOutcomeFlushes,
+                ...featureUsageFlushes,
                 ...inviteNudgeOutcomeFlushes,
                 ...inviteTeammateExposureFlushes,
                 ...limitNoticeExposureFlushes,

package/dist/utils/cli-telemetry.d.ts

@@ -46,7 +46,7 @@ export declare function queueCliInviteNudgeEvent(companyUid: string, outcome: Cl
 export declare function takeCliInviteNudgeEvents(): CliInviteNudgeEvent[];
 /** Emit a bounded CLI session fact through the existing product-telemetry path. */
 export declare function emitCliInviteNudgeEvent(event: CliInviteNudgeEvent, timeoutMs?: number): Promise<void>;
-export type CliFeatureKind = "secret_read" | "lane_create" | "lane_resume";
+export type CliFeatureKind = "secret_read" | "lane_create" | "lane_resume" | "members_invite";
 export type CliFeatureOutcome = "success" | "failure";
 export interface CliFeatureUsage {
     kind: CliFeatureKind;
@@ -54,6 +54,9 @@ export interface CliFeatureUsage {
     /** Only company UIDs are accepted; names and slugs are never telemetry fields. */
     companyUid?: string;
 }
+/** Queue privacy-limited feature telemetry for the bounded CLI finalization flush. */
+export declare function queueCliFeatureUsed(usage: CliFeatureUsage): void;
+export declare function takeCliFeatureUsages(): CliFeatureUsage[];
 export declare function isCliLimitResourceKind(value: string): value is CliLimitResourceKind;
 /**
  * Emit one bounded, privacy-limited feature-use event with a cached identity.

package/dist/utils/cli-telemetry.js

@@ -142,6 +142,14 @@ export async function emitCliInviteNudgeEvent(event, timeoutMs = TELEMETRY_TIMEO
         console.error(`hq: Could not prepare invite prompt telemetry (${errorClass}).`);
     }
 }
+const pendingCliFeatureUsages = [];
+/** Queue privacy-limited feature telemetry for the bounded CLI finalization flush. */
+export function queueCliFeatureUsed(usage) {
+    pendingCliFeatureUsages.push({ ...usage });
+}
+export function takeCliFeatureUsages() {
+    return pendingCliFeatureUsages.splice(0, pendingCliFeatureUsages.length);
+}
 const COMPANY_UID_PATTERN = /^cmp_[A-Za-z0-9_-]{1,128}$/;
 export function isCliLimitResourceKind(value) {
     return ["users", "integrations", "secrets", "agents", "deployments", "storageBytes"].includes(value);

package/dist/utils/jq-windows-compat.d.ts

@@ -0,0 +1,13 @@
+export type JqResult = {
+    code: number;
+    stdout?: string;
+    stderr?: string;
+    stdoutBytes?: Buffer;
+    stderrBytes?: Buffer;
+};
+export type JqInvoke = (args: string[], input: Buffer | string | undefined, cwd: string, options: {
+    stdout?: "capture" | "ignore";
+    stderr?: "pipe" | "ignore";
+}) => JqResult;
+export declare function createShellCompatibleJqInvoker(invoke: JqInvoke, platform: NodeJS.Platform, env: NodeJS.ProcessEnv, resolveShellType: (cwd: string) => string | undefined): JqInvoke;
+//# sourceMappingURL=jq-windows-compat.d.ts.map

package/dist/utils/jq-windows-compat.js

@@ -0,0 +1,48 @@
+function stripCarriageReturnBeforeLineFeed(bytes) {
+    const output = Buffer.allocUnsafe(bytes.length);
+    let length = 0;
+    for (let index = 0; index < bytes.length; index += 1) {
+        const byte = bytes[index];
+        if (byte === 0x0d && bytes[index + 1] === 0x0a)
+            continue;
+        output[length] = byte ?? 0;
+        length += 1;
+    }
+    return output.subarray(0, length);
+}
+function normalizeResult(result) {
+    const stdoutBytes = stripCarriageReturnBeforeLineFeed(result.stdoutBytes ?? Buffer.from(result.stdout ?? ""));
+    const stderrBytes = stripCarriageReturnBeforeLineFeed(result.stderrBytes ?? Buffer.from(result.stderr ?? ""));
+    return {
+        ...result,
+        stdoutBytes,
+        stderrBytes,
+        stdout: stdoutBytes.toString("utf8"),
+        stderr: stderrBytes.toString("utf8"),
+    };
+}
+export function createShellCompatibleJqInvoker(invoke, platform, env, resolveShellType) {
+    let binaryOptionSupported;
+    let shellTypeResolved = false;
+    let shellType;
+    return (args, input, cwd, options) => {
+        if (platform !== "win32")
+            return invoke(args, input, cwd, options);
+        if (!shellTypeResolved) {
+            shellType = resolveShellType(cwd);
+            shellTypeResolved = true;
+        }
+        const msysMode = /^msys/i.test(shellType ?? "") || /^MINGW/i.test(env.MSYSTEM ?? "");
+        if (!msysMode)
+            return invoke(args, input, cwd, options);
+        if (binaryOptionSupported === undefined) {
+            binaryOptionSupported = invoke(["--binary", "-n", "null"], undefined, cwd, {
+                stdout: "ignore",
+                stderr: "ignore",
+            }).code === 0;
+        }
+        const result = invoke(binaryOptionSupported ? ["--binary", ...args] : args, input, cwd, options);
+        return binaryOptionSupported ? result : normalizeResult(result);
+    };
+}
+//# sourceMappingURL=jq-windows-compat.js.map

package/dist/utils/run-bundled-script.d.ts

@@ -29,6 +29,7 @@
  *   - signals are surfaced as the conventional 128+n. A caller that kills a
  *     script needs to see termination, not a success code.
  */
+export { resolveWindowsBash } from "./windows-bash.js";
 /**
  * Which interpreter runs a bundled asset, chosen by extension.
  *
@@ -57,6 +58,8 @@ export type RunBundledScriptOptions = {
     captureOutput?: boolean;
     /** Bytes supplied on stdin. With no value, stdin is inherited as before. */
     stdin?: string | Buffer;
+    /** Start the bundled Bash script with descriptor 0 closed. */
+    closeStdin?: boolean;
     /** Optional child-process deadline for callers that need bounded script execution. */
     timeoutMs?: number;
 };

package/dist/utils/run-bundled-script.js

@@ -34,6 +34,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "path";
 import { resolveBundledAsset } from "./hq-roots-core.js";
+import { resolveWindowsBash } from "./windows-bash.js";
+export { resolveWindowsBash } from "./windows-bash.js";
 /**
  * Which interpreter runs a bundled asset, chosen by extension.
  *
@@ -52,85 +54,6 @@ function scriptPathForBash(script) {
     const drivePath = normalized.match(/^([A-Za-z]):\/(.*)$/);
     return drivePath ? `/${drivePath[1].toLowerCase()}/${drivePath[2]}` : normalized;
 }
-function envValue(env, name) {
-    const key = Object.keys(env).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
-    return key ? env[key] : undefined;
-}
-function isFile(file, lookupErrors) {
-    try {
-        return fs.statSync(file).isFile();
-    }
-    catch (error) {
-        // Missing PATH candidates are expected during lookup; retain the cause so
-        // the final actionable error can expose why no interpreter was resolved.
-        lookupErrors.push(error);
-        return false;
-    }
-}
-function isWithinWindowsDirectory(file, directory) {
-    const normalizedFile = path.win32.resolve(file).toLowerCase();
-    const normalizedDirectory = path.win32.resolve(directory).toLowerCase();
-    return (normalizedFile === normalizedDirectory ||
-        normalizedFile.startsWith(`${normalizedDirectory}${path.win32.sep}`));
-}
-function isExcludedWindowsBash(file, env) {
-    if (path.win32.basename(file).toLowerCase() !== "bash.exe")
-        return false;
-    const windowsDir = envValue(env, "SystemRoot") ?? envValue(env, "WINDIR") ?? "C:\\Windows";
-    const systemBash = path.win32.resolve(windowsDir, "System32", "bash.exe");
-    if (path.win32.resolve(file).toLowerCase() === systemBash.toLowerCase())
-        return true;
-    const localAppData = envValue(env, "LOCALAPPDATA");
-    return Boolean(localAppData &&
-        isWithinWindowsDirectory(file, path.win32.resolve(localAppData, "Microsoft", "WindowsApps")));
-}
-function findOnWindowsPath(executable, env, lookupErrors) {
-    const pathValue = envValue(env, "PATH") ?? "";
-    const extensions = executable.includes(".")
-        ? [""]
-        : (envValue(env, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD")
-            .split(";")
-            .filter(Boolean)
-            .map((ext) => ext.toLowerCase());
-    for (const entry of pathValue.split(";").filter(Boolean)) {
-        const directory = entry.trim().replace(/^"|"$/g, "");
-        for (const extension of extensions) {
-            const candidate = path.win32.join(directory, `${executable}${extension}`);
-            if (!isExcludedWindowsBash(candidate, env) && isFile(candidate, lookupErrors))
-                return candidate;
-        }
-    }
-    return undefined;
-}
-function resolveWindowsBash(env) {
-    const lookupErrors = [];
-    const configured = envValue(env, "CLAUDE_CODE_GIT_BASH_PATH");
-    if (configured && !isExcludedWindowsBash(configured, env) && isFile(configured, lookupErrors)) {
-        return { executable: configured, cause: lookupErrors.at(-1) };
-    }
-    const pathBash = findOnWindowsPath("bash", env, lookupErrors);
-    if (pathBash)
-        return { executable: pathBash, cause: lookupErrors.at(-1) };
-    const gitExe = findOnWindowsPath("git.exe", env, lookupErrors);
-    if (gitExe) {
-        const derived = path.win32.resolve(path.win32.dirname(gitExe), "..", "bin", "bash.exe");
-        if (!isExcludedWindowsBash(derived, env) && isFile(derived, lookupErrors)) {
-            return { executable: derived, cause: lookupErrors.at(-1) };
-        }
-    }
-    const programFiles = envValue(env, "ProgramFiles") ?? "C:\\Program Files";
-    const localAppData = envValue(env, "LOCALAPPDATA");
-    const standardPaths = [
-        path.win32.join(programFiles, "Git", "bin", "bash.exe"),
-        ...(localAppData ? [path.win32.join(localAppData, "Programs", "Git", "bin", "bash.exe")] : []),
-    ];
-    const executable = standardPaths.find((candidate) => !isExcludedWindowsBash(candidate, env) && isFile(candidate, lookupErrors));
-    return {
-        executable,
-        cause: lookupErrors.at(-1) ??
-            Object.assign(new Error("Bash was not found (ENOENT)"), { code: "ENOENT" }),
-    };
-}
 function bashNotFoundError(asset, cause) {
     const isHandoff = asset.replaceAll("\\", "/").endsWith("core/scripts/handoff-finalize.sh");
     const recovery = isHandoff
@@ -185,7 +108,13 @@ export function runBundledScript(opts) {
                 ? [stdinStdio, "inherit", "inherit"]
                 : "inherit";
         const scriptArg = interpreter === "bash" && opts.msysScriptPath ? scriptPathForBash(script) : script;
-        result = spawnSync(executable, [scriptArg, ...(opts.args ?? [])], {
+        if (opts.closeStdin && (interpreter !== "bash" || inputDescriptor !== undefined)) {
+            throw new Error("closeStdin requires a Bash asset without supplied stdin");
+        }
+        const commandArgs = opts.closeStdin
+            ? ["-c", 'exec 0<&-; exec "$BASH" "$@"', "hq-bundled-script", scriptArg, ...(opts.args ?? [])]
+            : [scriptArg, ...(opts.args ?? [])];
+        result = spawnSync(executable, commandArgs, {
             cwd: opts.cwd,
             env,
             stdio,

package/dist/utils/windows-bash.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveWindowsBash(env: Record<string, string | undefined>): {
+    executable?: string;
+    cause: unknown;
+};
+//# sourceMappingURL=windows-bash.d.ts.map