@indigoai-us/hq-cli 5.345.55 → 5.345.57

package/dist/commands/members.d.ts

@@ -48,6 +48,8 @@ export interface InviteOptions {
     companyUid: string;
     callerUid: string;
     token: string;
+    /** Reports only whether the request returned a 2xx response. */
+    onRequestResult?: (ok: boolean) => void;
 }
 /**
  * Outcome of `hq members invite`. Two shapes depending on server schema:
@@ -96,6 +98,8 @@ export interface ResendInviteOptions {
     companyUid: string;
     callerUid: string;
     token: string;
+    /** Reports only whether the request returned a 2xx response. */
+    onRequestResult?: (ok: boolean) => void;
 }
 /**
  * Outcome of `hq members invite --resend`. No new membership row was

package/dist/commands/members.js

@@ -3,6 +3,7 @@ import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
+import { queueCliFeatureUsed } from "../utils/cli-telemetry.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/i;
@@ -107,6 +108,7 @@ export async function inviteMember(options) {
         body,
     });
     if (!res.ok) {
+        options.onRequestResult?.(false);
         const err = (await res.json().catch(() => ({})));
         throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
@@ -116,6 +118,7 @@ export async function inviteMember(options) {
         throw new Error(`Invite endpoint returned 2xx with no membership row (response keys: ${keys}). ` +
             "This is a server-side regression — file an issue.");
     }
+    options.onRequestResult?.(true);
     // Two server schemas in the wild:
     //   - Legacy (schemaVersion ≤ 1): response carries a random `inviteToken`
     //     the invitee redeems via `hq://accept/{token}`.
@@ -177,6 +180,7 @@ export async function resendInvite(options) {
         },
     });
     if (!res.ok) {
+        options.onRequestResult?.(false);
         const err = (await res.json().catch(() => ({})));
         throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
@@ -184,6 +188,7 @@ export async function resendInvite(options) {
     if (data.resent !== true) {
         throw new Error("Resend endpoint returned 2xx without `resent: true` — the connected hq-pro likely doesn't support `resend: true` yet. Upgrade hq-pro or re-invite without --resend.");
     }
+    options.onRequestResult?.(true);
     return {
         resent: true,
         emailSent: data.emailSent === true,
@@ -436,6 +441,7 @@ export function registerMembersCommand(program) {
         let token;
         let companyUid;
         let companySlug;
+        let outcome = "failure";
         try {
             token = (await resolveVaultCredential()).token;
             companySlug = members.opts().company;
@@ -448,6 +454,9 @@ export function registerMembersCommand(program) {
                     companyUid,
                     callerUid,
                     token,
+                    onRequestResult: (ok) => {
+                        outcome = ok ? "success" : "failure";
+                    },
                 });
                 console.log(chalk.green(`Re-fired invite email for ${target.toLowerCase()} (existing pending row left untouched)`));
                 console.log();
@@ -472,6 +481,9 @@ export function registerMembersCommand(program) {
                 companyUid,
                 callerUid,
                 token,
+                onRequestResult: (ok) => {
+                    outcome = ok ? "success" : "failure";
+                },
             });
             const agentTarget = detectTarget(target)?.isAgent === true;
             console.log(chalk.green(`Invited ${target} as ${result.membership.role} (status: ${result.membership.status})`));
@@ -612,10 +624,19 @@ export function registerMembersCommand(program) {
             }
             if (err instanceof InviteHttpError) {
                 console.error(chalk.red(formatInviteHttpError(err.status, err.message, err.code)));
-                process.exit(1);
+                process.exitCode = 1;
+                return;
             }
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            process.exitCode = 1;
+            return;
+        }
+        finally {
+            queueCliFeatureUsed({
+                kind: "members_invite",
+                outcome,
+                ...(companyUid ? { companyUid } : {}),
+            });
         }
     });
     members

package/dist/lanes-drain-hook.js

@@ -17,7 +17,7 @@ function parseHookInput(text) {
         throw new Error("invalid_hook_input_shape: expected a JSON object");
     }
     const value = parsed;
-    for (const key of ["transcript_path", "session_id", "hook_event_name"]) {
+    for (const key of ["transcript_path", "session_id", "hook_event_name", "hookEventName"]) {
         if (value[key] !== undefined && value[key] !== null && typeof value[key] !== "string") {
             throw new Error(`invalid_hook_input_field: ${key} must be a string`);
         }
@@ -25,7 +25,11 @@ function parseHookInput(text) {
     return {
         ...(typeof value.transcript_path === "string" ? { transcript_path: value.transcript_path } : {}),
         ...(typeof value.session_id === "string" ? { session_id: value.session_id } : {}),
-        ...(typeof value.hook_event_name === "string" ? { hook_event_name: value.hook_event_name } : {}),
+        ...(typeof value.hook_event_name === "string"
+            ? { hook_event_name: value.hook_event_name }
+            : typeof value.hookEventName === "string"
+                ? { hookEventName: value.hookEventName }
+                : {}),
     };
 }
 function laneIdIsSafe(laneId) {

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -59,6 +59,8 @@ export interface SyncManifestUploadStatus {
     snapshotId: string | null;
     sequence: number;
     baseUsable: boolean;
+    /** Local company slug for company-scoped remediation; absent for personal. */
+    companySlug?: string;
 }
 /** Injectable dependencies — defaults are the real collectors. */
 export interface SyncHealthDeps {

package/dist/lib/doctor/checks/sync-health.js

@@ -32,6 +32,7 @@ import * as path from "node:path";
 // ../../hq-cloud-manifest.js.
 import * as hqCloud from "@indigoai-us/hq-cloud";
 import { loadManifestExports, MANIFEST_UNAVAILABLE_REASON, } from "../../hq-cloud-manifest.js";
+import { readCompaniesManifestMap } from "../../work-context/repo-remote.js";
 import { CLI_VERSION } from "../../../cli-version.js";
 import { readSyncVersion } from "../../../utils/feedback-versions.js";
 import { readHqVersion } from "../../../utils/pack-contributions.js";
@@ -52,9 +53,9 @@ function withDefaults(deps, hqRoot) {
     return {
         ...deps,
         runtime: deps.runtime ?? (() => []),
-        manifestStatuses: deps.manifestStatuses ?? defaultManifestStatuses,
+        manifestStatuses: deps.manifestStatuses ?? ((journals) => defaultManifestStatuses(hqRoot, journals)),
         manifestAvailable: deps.manifestAvailable ?? (() => loadManifestExports() !== null),
-        unresolvedScopes: deps.unresolvedScopes ?? defaultUnresolvedScopes,
+        unresolvedScopes: deps.unresolvedScopes ?? ((journals) => defaultUnresolvedScopes(hqRoot, journals)),
         localCompanyExists: deps.localCompanyExists ??
             ((slug) => defaultLocalCompanyExists(hqRoot, slug)),
     };
@@ -78,15 +79,35 @@ function defaultLocalCompanyExists(hqRoot, slug) {
         return false;
     }
 }
-/**
- * Company journal shards are unresolvable by the default collector: the
- * snapshot store keys company scopes by `companyUid`, which `listJournals()`
- * does not carry. Naming them here keeps them visible.
- */
-function defaultUnresolvedScopes(journals) {
-    return journals
-        .filter((entry) => !NON_COMPANY_JOURNAL_SLUGS.has(entry.slug))
-        .map((entry) => entry.slug);
+/** Resolve locally-known company journal slugs to the UID used by snapshots. */
+function resolvedCompanyScopes(hqRoot, journals) {
+    const companies = readCompaniesManifestMap(hqRoot);
+    const seen = new Set();
+    const scopes = [];
+    for (const { slug } of journals) {
+        if (NON_COMPANY_JOURNAL_SLUGS.has(slug) ||
+            !isSafeCompanySlug(slug) ||
+            !defaultLocalCompanyExists(hqRoot, slug) ||
+            seen.has(slug)) {
+            continue;
+        }
+        seen.add(slug);
+        const uid = companies?.[slug]?.cloud_uid;
+        if (typeof uid === "string" && /^cmp_[A-Za-z0-9]{3,128}$/.test(uid.trim())) {
+            scopes.push({ kind: "company", companyUid: uid.trim(), slug });
+        }
+    }
+    return scopes;
+}
+function defaultUnresolvedScopes(hqRoot, journals) {
+    const resolved = new Set(resolvedCompanyScopes(hqRoot, journals).map((scope) => scope.slug));
+    return [
+        ...new Set(journals
+            .filter((entry) => !NON_COMPANY_JOURNAL_SLUGS.has(entry.slug) &&
+            defaultLocalCompanyExists(hqRoot, entry.slug) &&
+            !resolved.has(entry.slug))
+            .map((entry) => entry.slug)),
+    ];
 }
 function defaultVersions(hqRoot) {
     return {
@@ -119,21 +140,15 @@ const DEFAULT_DEPS = {
     // than no check.
     journals: () => hqCloud.listJournals(),
     now: () => new Date(),
-    manifestStatuses: defaultManifestStatuses,
     runtime: defaultSyncRuntimeResults,
 };
 /**
  * Map the machine's journal shards onto the manifest scopes hq-cloud keys its
- * snapshot store by, then read each one's last upload.
- *
- * The journal slug `personal` is the personal tree; every other slug is a
- * company. Note the snapshot store keys company scopes by `companyUid`, which
- * the journal listing does not carry — so a company whose uid we cannot name
- * is simply not reported here rather than reported wrongly. That is the honest
- * outcome: this check exists to tell an operator when a manifest STOPPED being
- * uploaded, and inventing a scope key would make it lie in both directions.
+ * snapshot store by, then read each one's last upload. Company journal rows
+ * carry only slugs, so resolve their UIDs from the local companies manifest;
+ * a missing or malformed UID stays explicitly unresolved below.
  */
-function defaultManifestStatuses(journals) {
+function defaultManifestStatuses(hqRoot, journals) {
     // Both the legacy `personal` shard and the current personal-vault
     // pseudo-slug name the SAME personal tree; a machine mid-migration has both
     // on disk, so collapse them to a single personal scope rather than asking
@@ -141,6 +156,7 @@ function defaultManifestStatuses(journals) {
     const scopes = journals.some((entry) => NON_COMPANY_JOURNAL_SLUGS.has(entry.slug))
         ? [{ kind: "personal" }]
         : [];
+    scopes.push(...resolvedCompanyScopes(hqRoot, journals));
     if (scopes.length === 0)
         return [];
     // Absent on an older hq-cloud; the NA row is emitted by `manifestResults`
@@ -148,7 +164,15 @@ function defaultManifestStatuses(journals) {
     const exports = loadManifestExports();
     if (!exports)
         return [];
-    return exports.readManifestUploadStatus(exports.getStateDir(), scopes);
+    const companySlugsByUid = new Map(scopes
+        .filter((scope) => scope.kind === "company")
+        .map((scope) => [scope.companyUid, scope.slug]));
+    const statuses = exports.readManifestUploadStatus(exports.getStateDir(), scopes);
+    return statuses.map((status) => {
+        const companyUid = /^company:(cmp_[A-Za-z0-9]{3,128})$/.exec(status.scopeKey)?.[1];
+        const companySlug = companyUid ? companySlugsByUid.get(companyUid) : undefined;
+        return companySlug ? { ...status, companySlug } : status;
+    });
 }
 /** The legacy journal slug that named the personal (non-company) tree. */
 const PERSONAL_SCOPE_SLUG = "personal";
@@ -526,7 +550,7 @@ function manifestResults(deps, journals) {
                 checkId,
                 reasonCode: "stale-threshold",
                 message: `Scope '${entry.scopeKey}' last uploaded a sync manifest ${days} day${days === 1 ? "" : "s"} ago (${entry.lastUploadAt}) — the daily audit pass is not running.`,
-                remediation: "Run `hq sync manifest` and check HQ_SYNC_MANIFEST_DISABLED and the sync runner.",
+                remediation: `Run \`hq sync manifest${entry.companySlug ? ` --scope ${entry.companySlug}` : ""}\` and check HQ_SYNC_MANIFEST_DISABLED and the sync runner.`,
             };
         }
         return {

package/dist/lib/lanes/delivery.d.ts

@@ -144,6 +144,8 @@ export type LaunchTrigger = {
     kind: "resume";
     /** Lane state at the moment of the command; recorded as `last_resume.resumed_from`. */
     from: ResumeCommandState | "failed" | "awaiting_input";
+    /** Loop phases may deliberately start a fresh session at a story boundary. */
+    fresh?: true;
     allowAwaitingInput?: true;
     fromFailed?: true;
     /** Senior that authorized a failed-lane resume, rechecked at the claim CAS. */
@@ -164,6 +166,7 @@ export type LaunchPlan = {
 export declare function resumeCommandRefusal(lane: DeliveryLane, options?: {
     allowFailed?: boolean;
     allowAwaitingInput?: boolean;
+    allowFresh?: boolean;
 }): {
     error: "lane_not_resumable" | "resume_unsupported" | "no_provider_session";
     message: string;

package/dist/lib/lanes/delivery.js

@@ -371,6 +371,8 @@ export function resumeCommandRefusal(lane, options = {}) {
                         : "a lane in this state is not resumed."}`,
         };
     }
+    if (options.allowFresh === true)
+        return null;
     if (!providerSupportsSessionResume(lane.provider)) {
         return {
             error: "resume_unsupported",
@@ -411,7 +413,10 @@ export function planLaneLaunch(lane, trigger) {
             const refusal = resumeCommandRefusal(lane, {
                 allowFailed: trigger.fromFailed === true || isFailedQuotaKeepAliveLane(lane),
                 allowAwaitingInput: trigger.allowAwaitingInput === true,
+                allowFresh: trigger.fresh === true,
             });
+            if (trigger.fresh === true && refusal === null)
+                return { mode: "fresh" };
             if (refusal !== null || !hasRecordedSessionId(lane)) {
                 throw new LanesError(refusal?.error ?? "no_provider_session", refusal?.message ?? `Lane is ${lane.state} and has no recorded provider session`, { state: lane.state, provider: lane.provider });
             }

package/dist/lib/lanes/dropbox.d.ts

@@ -53,12 +53,14 @@ export interface DrainDeps {
 }
 export interface LaneDrainHookInput {
     transcript_path?: string | null;
-    session_id?: string;
     hook_event_name?: string;
+    hookEventName?: string;
+    session_id?: string;
 }
 export interface RunDrainHookDeps {
     readLane?: typeof tryReadLane;
     probeCompactionsSince?: typeof import("./compaction.js").probeProviderCompactionsSince;
+    readLifecycleDeliveryFlag?: () => Promise<boolean>;
 }
 export declare function mintClaimId(): string;
 export declare function assertSafeLaneId(laneId: string): void;
@@ -88,8 +90,11 @@ export interface ToolActivityRecord {
 export declare function recordToolActivity(hqRoot: string, laneId: string, at?: string): ToolActivityRecord;
 export declare function readToolActivity(hqRoot: string, laneId: string): ToolActivityRecord | null;
 export declare function appendDropboxMessage(hqRoot: string, laneId: string, message: DropboxMessage): DropboxMessage;
+export declare function appendDropboxMessageOnce(hqRoot: string, laneId: string, message: DropboxMessage): DropboxMessage;
 /** Append using the same on-disk layout for lane and monitor-session inboxes. */
 export declare function appendDropboxMessageAtPath(box: string, message: DropboxMessage): DropboxMessage;
+/** Append an idempotent message once, including retries after its inbox was archived. */
+export declare function appendDropboxMessageOnceAtPath(box: string, message: DropboxMessage): DropboxMessage;
 /**
  * Drain this lane's inbox exactly once. Concurrent callers: one rename wins;
  * the loser sees ENOENT and returns whatever it separately claimed (usually
@@ -102,7 +107,7 @@ export declare function formatOperatorInstruction(messages: DropboxMessage[]): s
 export declare function formatMonitorEvent(message: DropboxMessage): string;
 /** Keep event order while framing monitor output separately from operator messages. */
 export declare function formatDropboxMessages(messages: DropboxMessage[]): string;
-export declare function hookAdditionalContextJson(messages: DropboxMessage[], hookEventName?: "PreToolUse" | "UserPromptSubmit", leadingNote?: string): string;
+export declare function hookAdditionalContextJson(messages: DropboxMessage[], hookEventName?: "PreToolUse" | "PostToolUse" | "UserPromptSubmit", leadingNote?: string): string;
 export interface DrainHookResult {
     exitCode: number;
     stdout: string;

package/dist/lib/lanes/dropbox.js

@@ -7,13 +7,15 @@
  * A read-then-truncate is not this mechanism and loses or duplicates under
  * overlap.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
 import { MESSAGE_COMPACTION_REPLAY_NOTE, MESSAGE_REPLAY_STATE_NAME, readMessageReplayState, updateMessageReplayTranscript, writeMessageReplayState, } from "./message-replay.js";
 import { LANES_RUNS_REL, readProcStarttime } from "./spawn.js";
 import { tryReadLane } from "./store.js";
+import { readLanesRegistryFlagFailOpen } from "./registry-flag.js";
+import { LANE_DROPBOX_LIFECYCLE_DELIVERY_FLAG } from "./flag-keys.js";
 export const DROPBOX_DIR = "dropbox";
 export const INBOX_NAME = "inbox.jsonl";
 export const DRAINING_DIR = "draining";
@@ -177,6 +179,9 @@ export function readToolActivity(hqRoot, laneId) {
 export function appendDropboxMessage(hqRoot, laneId, message) {
     return appendDropboxMessageAtPath(dropboxDir(hqRoot, laneId), message);
 }
+export function appendDropboxMessageOnce(hqRoot, laneId, message) {
+    return appendDropboxMessageOnceAtPath(dropboxDir(hqRoot, laneId), message);
+}
 /** Append using the same on-disk layout for lane and monitor-session inboxes. */
 export function appendDropboxMessageAtPath(box, message) {
     const inbox = path.join(box, INBOX_NAME);
@@ -184,6 +189,105 @@ export function appendDropboxMessageAtPath(box, message) {
     fs.appendFileSync(inbox, `${JSON.stringify(message)}\n`, "utf8");
     return message;
 }
+/** Append an idempotent message once, including retries after its inbox was archived. */
+export function appendDropboxMessageOnceAtPath(box, message) {
+    const messageId = message.message_id?.trim();
+    if (!messageId) {
+        throw new LanesError("dropbox_message_id_required", "Idempotent dropbox delivery requires a message id");
+    }
+    fs.mkdirSync(box, { recursive: true });
+    const digest = createHash("sha256").update(messageId).digest("hex");
+    const lockDir = path.join(box, `.message-${digest}.lock`);
+    const lockTimeoutAt = Date.now() + 5_000;
+    while (true) {
+        try {
+            fs.mkdirSync(lockDir);
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            try {
+                if (Date.now() - fs.statSync(lockDir).mtimeMs > 30_000) {
+                    fs.rmSync(lockDir, { recursive: true, force: true });
+                    continue;
+                }
+            }
+            catch (statError) {
+                if (statError.code === "ENOENT")
+                    continue;
+                throw statError;
+            }
+            if (Date.now() >= lockTimeoutAt) {
+                throw new LanesError("dropbox_message_claim_busy", `Timed out claiming message ${messageId}`, { message_id: messageId });
+            }
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+        }
+    }
+    try {
+        const inbox = path.join(box, INBOX_NAME);
+        const files = [inbox, ...messageHistoryFiles(box)];
+        for (const file of files) {
+            let content;
+            try {
+                content = fs.readFileSync(file, "utf8");
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    continue;
+                throw error;
+            }
+            for (const line of content.split(/\r?\n/)) {
+                if (!line.trim())
+                    continue;
+                let parsed;
+                try {
+                    parsed = JSON.parse(line);
+                }
+                catch (error) {
+                    throw new LanesError("dropbox_message_history_invalid", `Cannot verify message ${messageId} against ${file}`, {
+                        message_id: messageId,
+                        path: file,
+                        cause: error instanceof Error ? error.message : String(error),
+                    });
+                }
+                if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) &&
+                    parsed.message_id === messageId)
+                    return message;
+            }
+        }
+        fs.appendFileSync(inbox, `${JSON.stringify(message)}\n`, "utf8");
+        return message;
+    }
+    finally {
+        fs.rmSync(lockDir, { recursive: true, force: true });
+    }
+}
+function messageHistoryFiles(box) {
+    const files = [];
+    for (const directory of [DRAINING_DIR, INFLIGHT_DIR, DELIVERED_DIR]) {
+        const root = path.join(box, directory);
+        const visit = (current) => {
+            let entries;
+            try {
+                entries = fs.readdirSync(current, { withFileTypes: true });
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return;
+                throw error;
+            }
+            for (const entry of entries) {
+                if (entry.isDirectory())
+                    visit(path.join(current, entry.name));
+                else if (entry.isFile())
+                    files.push(path.join(current, entry.name));
+            }
+        };
+        visit(root);
+    }
+    return files;
+}
 function listNames(dir, deps) {
     try {
         return deps.readdirSync(dir).filter((name) => !name.startsWith("."));
@@ -426,6 +530,9 @@ export function hookAdditionalContextJson(messages, hookEventName = "PreToolUse"
         },
     })}\n`;
 }
+function hookStopBlockJson(reason) {
+    return `${JSON.stringify({ decision: "block", reason })}\n`;
+}
 function replayStatePath(hqRoot, laneId) {
     return path.join(dropboxDir(hqRoot, laneId), MESSAGE_REPLAY_STATE_NAME);
 }
@@ -465,14 +572,47 @@ export async function runDrainHook(env, input = {}, deps = {}) {
             stderr: "hq-lanes-drain: HQ_ROOT is unset while HQ_LANE_ID is set\n",
         };
     }
-    // Liveness first: a failed drain must still leave proof the worker called
-    // a tool. A failure here is reported, never fatal to delivery.
-    let stderr = "";
-    try {
-        recordToolActivity(hqRoot, laneId);
+    const hookEvent = input.hook_event_name ?? input.hookEventName ?? "PreToolUse";
+    if (hookEvent !== "PreToolUse" && hookEvent !== "PostToolUse" && hookEvent !== "Stop") {
+        return { exitCode: 0, stdout: "", stderr: "" };
     }
-    catch (err) {
-        stderr += `hq-lanes-drain: failed to record tool activity: ${err instanceof Error ? err.message : String(err)}\n`;
+    // Grok invokes lifecycle hooks, but their output cannot reach the model.
+    // Preserve queued messages for its next deliverable PreToolUse event.
+    if (env.HQ_LANE_PROVIDER === "grok" && hookEvent !== "PreToolUse") {
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    const hasQueuedMessages = dropboxInboxHasMessages(hqRoot, laneId);
+    if (hookEvent === "Stop" && !hasQueuedMessages) {
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    if ((hookEvent === "PostToolUse" || hookEvent === "Stop") && hasQueuedMessages) {
+        const lane = (deps.readLane ?? tryReadLane)(hqRoot, laneId);
+        const company = lane?.mesh_company ?? lane?.company ?? undefined;
+        let enabled = true;
+        try {
+            enabled = deps.readLifecycleDeliveryFlag
+                ? await deps.readLifecycleDeliveryFlag()
+                : await readLanesRegistryFlagFailOpen(LANE_DROPBOX_LIFECYCLE_DELIVERY_FLAG, {
+                    ...(company ? { company } : {}),
+                    env,
+                });
+        }
+        catch (err) {
+            process.stderr.write(`hq-lanes-drain: lifecycle delivery flag read failed open: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+        if (!enabled)
+            return { exitCode: 0, stdout: "", stderr: "" };
+    }
+    // PreToolUse remains the tool-activity liveness touch used by watcher.ts.
+    // PostToolUse and Stop add delivery opportunities without extra liveness writes.
+    let stderr = "";
+    if (hookEvent === "PreToolUse") {
+        try {
+            recordToolActivity(hqRoot, laneId);
+        }
+        catch (err) {
+            stderr += `hq-lanes-drain: failed to record tool activity: ${err instanceof Error ? err.message : String(err)}\n`;
+        }
     }
     try {
         const turnId = env.HQ_LANE_TURN_ID ?? "";
@@ -515,15 +655,22 @@ export async function runDrainHook(env, input = {}, deps = {}) {
             }
         }
         if (replayNote && replayed && replayed.length > 0) {
+            const formatted = `${replayNote}\n\n${formatDropboxMessages(replayed)}`;
             return {
                 exitCode: 0,
-                stdout: hookAdditionalContextJson(replayed, "PreToolUse", replayNote),
+                stdout: hookEvent === "Stop"
+                    ? hookStopBlockJson(formatted)
+                    : hookAdditionalContextJson(replayed, hookEvent, replayNote),
                 stderr,
             };
         }
         if (messages.length === 0)
             return { exitCode: 0, stdout: "", stderr };
-        return { exitCode: 0, stdout: hookAdditionalContextJson(messages), stderr };
+        const formatted = formatDropboxMessages(messages);
+        if (hookEvent === "Stop") {
+            return { exitCode: 0, stdout: hookStopBlockJson(formatted), stderr };
+        }
+        return { exitCode: 0, stdout: hookAdditionalContextJson(messages, hookEvent), stderr };
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);

package/dist/lib/lanes/flag-keys.d.ts

@@ -16,6 +16,8 @@ export declare const LANE_HIRE_GRANT_FINISHED_LANES_FLAG = "lanes.hire-grant-cou
 export declare const LANE_LIST_SKIP_REMOTE_REFRESH_FLAG = "lanes.list-skip-remote-refresh";
 /** Enables missed-deadline lead nudges and second-miss operator escalation. */
 export declare const LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = "lanes.autopilot-missed-deadline-escalation";
+/** Enables durable six-hour escalation for lanes that remain blocked. */
+export declare const LANE_BLOCKED_ESCALATION_FLAG = "lanes.blocked-escalation-6h";
 /** Enables company-scoped lookup of a hostless lane ULID across Outpost indexes. */
 export declare const LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG = "lanes.message-route-owner-host";
 /** Enables stale manager-status KPI reporting and one-time lead nudges. */
@@ -30,6 +32,16 @@ export declare const LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG = "lanes.autopilot
 export declare const LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG = "lanes.orphaned-bare-id-dropbox-repair";
 /** Allows a Claude lane to leave an exhausted profile account pin for an eligible account. */
 export declare const LANE_PROFILE_PIN_EXHAUSTED_FALLBACK_FLAG = "lanes.profile-pin-exhausted-fallback";
+/** Kill switch for PostToolUse and Stop drop-box delivery. Default on. */
+export declare const LANE_DROPBOX_LIFECYCLE_DELIVERY_FLAG = "lanes.dropbox-lifecycle-delivery";
+/** Kill switch for bounded local status fields in lane list/show JSON. Default on. */
+export declare const LANE_STATUS_ROW_FIELDS_FLAG = "lanes.status-row-fields";
 /** Enables conduct-mode SessionStart bootstrapping (defaults on; operator kill switch). */
 export declare const LANE_CONDUCT_SESSION_START_FLAG = "lanes.conduct-session-start";
+/** Kill switch for stopping local orphan lane process trees; off means report-only. */
+export declare const LANE_REAP_STOP_FLAG = "lanes.reap-stop";
+/** Enables same-senior worker lane continuity on create; keep ON as the kill switch default. */
+export declare const LANE_WORKER_CONTINUITY_FLAG = "lanes.worker-continuity";
+/** Kill switch for conduct loop lanes; absence or read failure keeps it enabled. */
+export declare const LANE_CONDUCT_LOOP_FLAG = "lanes.conduct-loop";
 //# sourceMappingURL=flag-keys.d.ts.map

package/dist/lib/lanes/flag-keys.js

@@ -16,6 +16,8 @@ export const LANE_HIRE_GRANT_FINISHED_LANES_FLAG = "lanes.hire-grant-count-live-
 export const LANE_LIST_SKIP_REMOTE_REFRESH_FLAG = "lanes.list-skip-remote-refresh";
 /** Enables missed-deadline lead nudges and second-miss operator escalation. */
 export const LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = "lanes.autopilot-missed-deadline-escalation";
+/** Enables durable six-hour escalation for lanes that remain blocked. */
+export const LANE_BLOCKED_ESCALATION_FLAG = "lanes.blocked-escalation-6h";
 /** Enables company-scoped lookup of a hostless lane ULID across Outpost indexes. */
 export const LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG = "lanes.message-route-owner-host";
 /** Enables stale manager-status KPI reporting and one-time lead nudges. */
@@ -30,6 +32,16 @@ export const LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG = "lanes.autopilot-outpost
 export const LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG = "lanes.orphaned-bare-id-dropbox-repair";
 /** Allows a Claude lane to leave an exhausted profile account pin for an eligible account. */
 export const LANE_PROFILE_PIN_EXHAUSTED_FALLBACK_FLAG = "lanes.profile-pin-exhausted-fallback";
+/** Kill switch for PostToolUse and Stop drop-box delivery. Default on. */
+export const LANE_DROPBOX_LIFECYCLE_DELIVERY_FLAG = "lanes.dropbox-lifecycle-delivery";
+/** Kill switch for bounded local status fields in lane list/show JSON. Default on. */
+export const LANE_STATUS_ROW_FIELDS_FLAG = "lanes.status-row-fields";
 /** Enables conduct-mode SessionStart bootstrapping (defaults on; operator kill switch). */
 export const LANE_CONDUCT_SESSION_START_FLAG = "lanes.conduct-session-start";
+/** Kill switch for stopping local orphan lane process trees; off means report-only. */
+export const LANE_REAP_STOP_FLAG = "lanes.reap-stop";
+/** Enables same-senior worker lane continuity on create; keep ON as the kill switch default. */
+export const LANE_WORKER_CONTINUITY_FLAG = "lanes.worker-continuity";
+/** Kill switch for conduct loop lanes; absence or read failure keeps it enabled. */
+export const LANE_CONDUCT_LOOP_FLAG = "lanes.conduct-loop";
 //# sourceMappingURL=flag-keys.js.map