@indigoai-us/hq-cli 5.345.67 → 5.345.69

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.345.69] — 2026-10-10
+- Supported native core handlers now run by default without a flag snapshot. Explicit false values still turn them off; delegate and worker-skills remain default-off pending parity.
+
+## [5.345.68] — 2026-10-09
+
+- Marketplace pack installs now require a signature from a pinned platform key. `--allow-unsigned` is limited to local directory sources; `HQ_PACK_PUBLIC_KEY` is development-only.
+
 ## [5.345.67] — 2026-10-09
 
 - Persist the Codex SessionStart model and effort for conduct lanes, with safe fallback defaults.

package/README.md

@@ -7,6 +7,19 @@ npm install -g @indigoai-us/hq-cli
 hq --help
 ```
 
+## Marketplace package verification
+
+Marketplace packages must include an Ed25519 signature made with a platform
+key embedded in the CLI. The installer rejects unsigned listings, unknown key
+ids, and a listing public key that does not match the pinned platform key before
+extracting any archive. `HQ_PACK_PUBLIC_KEY` is a development-only override for
+the current platform key id; it is honored only with `NODE_ENV=development` or
+`NODE_ENV=test` and is ignored in production.
+
+`hq install --allow-unsigned ./local-pack` is accepted only for local directory
+sources. Marketplace installs always require a platform signature, and the flag
+is rejected for them.
+
 The global HQ runtime installs hooks for supported agent runtimes. When the
 `hq-anywhere-runtime` flag is enabled, the hooks use hqd and a per-user folder
 registry. The flag defaults on when its registry row cannot be read, and an

package/assets/scaffold/core/scripts/hq-dm-bind.sh

@@ -53,6 +53,11 @@
 #   Need from you: line
 set -euo pipefail
 
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  sed -n '2,/^set -euo pipefail$/ { /^set -euo pipefail$/!p; }' "$0"
+  exit 0
+fi
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 SESSION_SH="$HQ_ROOT/core/scripts/hq-session.sh"
 

package/dist/command-catalog.generated.d.ts

@@ -157,6 +157,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--allow-mcp";
             readonly description: "Skip the MCP server confirmation prompt (content-pack flow)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--allow-unsigned";
+            readonly description: "Acknowledge an unsigned local directory source; marketplace installs always require a signature";
+            readonly hidden: false;
         }, {
             readonly flags: "--branch";
             readonly description: "Follow a ref instead of SHA-pinning (git content-pack flow)";
@@ -543,6 +547,10 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly flags: "--allow-mcp";
         readonly description: "Skip the MCP server confirmation prompt (content-pack flow)";
         readonly hidden: false;
+    }, {
+        readonly flags: "--allow-unsigned";
+        readonly description: "Acknowledge an unsigned local directory source; marketplace installs always require a signature";
+        readonly hidden: false;
     }, {
         readonly flags: "--branch";
         readonly description: "Follow a ref instead of SHA-pinning (git content-pack flow)";

package/dist/command-catalog.generated.js

@@ -157,6 +157,11 @@ export const COMMAND_CATALOG = [
                         "description": "Skip the MCP server confirmation prompt (content-pack flow)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--allow-unsigned",
+                        "description": "Acknowledge an unsigned local directory source; marketplace installs always require a signature",
+                        "hidden": false
+                    },
                     {
                         "flags": "--branch",
                         "description": "Follow a ref instead of SHA-pinning (git content-pack flow)",
@@ -641,6 +646,11 @@ export const COMMAND_CATALOG = [
                 "description": "Skip the MCP server confirmation prompt (content-pack flow)",
                 "hidden": false
             },
+            {
+                "flags": "--allow-unsigned",
+                "description": "Acknowledge an unsigned local directory source; marketplace installs always require a signature",
+                "hidden": false
+            },
             {
                 "flags": "--branch",
                 "description": "Follow a ref instead of SHA-pinning (git content-pack flow)",

package/dist/commands/core-checkpoint-stop-gate-native.js

@@ -1,5 +1,6 @@
 /** Native fast-route implementation of checkpoint-stop-gate.sh. */
 import * as childProcess from "node:child_process";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -85,7 +86,18 @@ const defaults = () => ({
         return false;
     },
     spawnHqDetached: (args, env) => {
-        const child = childProcess.spawn("hq", args, { detached: true, stdio: "ignore", env: env ?? process.env });
+        const childEnv = env ?? process.env;
+        const spawnPlan = planHqSpawn(args, childEnv, process.cwd());
+        const child = childProcess.spawn(spawnPlan.cmd, spawnPlan.args, {
+            detached: true,
+            stdio: "ignore",
+            env: childEnv,
+            shell: spawnPlan.shell,
+            ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+        });
+        child.once("error", (error) => {
+            process.stderr.write(`${error.message}\n`);
+        });
         child.unref();
     },
 });

package/dist/commands/core-delegate-w1b.js

@@ -1215,8 +1215,8 @@ export function registerCoreDelegateW1b(delegate, core) {
             const options = core.opts();
             const root = resolveLiveRoot({ hqRoot: options.hqRoot });
             const context = { cwd: root, root };
-            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-            if (!resolveProcessFlagGate(FLAG, { fallback: false }, () => false)) {
+            const { coreNativeDelegateEnabled } = await import("./core-native-family-flag.js");
+            if (!await coreNativeDelegateEnabled()) {
                 const result = runBundledScript({ asset: ASSETS[name], args, cwd: root, hqRoot: root });
                 if (result.code !== 0)
                     process.exit(result.code);

package/dist/commands/core-delegate.js

@@ -1022,8 +1022,8 @@ export function registerCoreDelegateCommand(core, registerWave1b) {
             const context = rootMode === "cwd"
                 ? { cwd: process.cwd() }
                 : (() => { const root = resolveLiveRoot({ hqRoot: scope.hqRoot }); return { cwd: root, root }; })();
-            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-            if (!resolveProcessFlagGate(CORE_NATIVE_DELEGATE_FLAG, { fallback: false }, () => false)) {
+            const { coreNativeDelegateEnabled } = await import("./core-native-family-flag.js");
+            if (!await coreNativeDelegateEnabled()) {
                 const result = runBundledScript({ asset: SCRIPT_ASSETS[name], args, cwd: context.cwd, hqRoot: context.root });
                 if (result.code !== 0)
                     process.exit(result.code);

package/dist/commands/core-dm-bind-native.d.ts

@@ -3,7 +3,7 @@ import * as fs from "node:fs";
 import type { Command } from "commander";
 import { type UtilityOutput } from "./core-native-utilities.js";
 export declare const DM_BIND_ASSET = "core/scripts/hq-dm-bind.sh";
-export declare const DM_BIND_HELP = "# hq-dm-bind.sh \u2014 bind the current session to one HQ DM channel, post\n# structured updates to it, and listen for replies (feedback / requests).\n#\n# Usage:\n#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to \"now\"\n#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor\n#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]\n#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)\n#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)\n#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention\n#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it\n#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]\n#                                                             # block until a new message arrives (or timeout)\n#   core/scripts/hq-dm-bind.sh unbind\n#\n# The binding lives in the session's meta.yaml (`dm_channel`) via hq-session.sh;\n# the cursor is `workspace/sessions/<sid>/dm-bind.cursor` (the last seen sort\n# key from `hq dm channel --json`). `listen` is meant to run detached\n# (Bash run_in_background): it exits 0 and prints the new messages the moment\n# one lands, exits 3 on timeout with nothing new.\n#\n# Every post opens with an @-mention of every other member of the channel, so\n# the update reaches people (HQ mentions are structured: the `hq` CLI resolves\n# the `@\"Display Name\"` tokens against the roster and sends the real mention\n";
+export declare const DM_BIND_HELP = "# hq-dm-bind.sh \u2014 bind the current session to one HQ DM channel, post\n# structured updates to it, and listen for replies (feedback / requests).\n#\n# Usage:\n#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to \"now\"\n#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor\n#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]\n#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)\n#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)\n#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention\n#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it\n#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]\n#                                                             # block until a new message arrives (or timeout)\n#   core/scripts/hq-dm-bind.sh unbind\n#\n# The binding lives in the session's meta.yaml (`dm_channel`) via hq-session.sh;\n# the cursor is `workspace/sessions/<sid>/dm-bind.cursor` (the last seen sort\n# key from `hq dm channel --json`). `listen` is meant to run detached\n# (Bash run_in_background): it exits 0 and prints the new messages the moment\n# one lands, exits 3 on timeout with nothing new.\n#\n# Every post opens with an @-mention of every other member of the channel, so\n# the update reaches people (HQ mentions are structured: the `hq` CLI resolves\n# the `@\"Display Name\"` tokens against the roster and sends the real mention\n# list; an unresolvable name fails the post rather than posting text that looks\n# addressed but is not). The CLI rewrites a resolved `@\"Display Name\"` token to\n# `@Display Name`, so the room never shows the quotes.\n#\n# Posts thread by topic. The first post on a topic (`--topic`, else the title)\n# is a top-level root; every later post on the same topic in this session goes\n# out as a reply under it. `--under <id>` replies under an existing thread that\n# someone else (or an earlier session) started \u2014 a top-level post is only for a\n# subject the channel has no thread for yet. `--new-thread` starts a fresh root. The topic \u2192 root\n# map is `workspace/sessions/<sid>/dm-bind.threads`.\n#\n# A post ALWAYS mentions someone. `--to <name>` (repeatable) narrows the line to\n# the named members, for a reply to one person; without it the line names every\n# other human member (bots are left out unless named with --to, because a tagged\n# bot wakes and replies). There is no way to post unmentioned: an update nobody is\n# notified about does not get read. `post` refuses when the roster cannot be\n# read rather than sending a silent update.\n#\n# Post format (kept deliberately plain \u2014 see .claude/skills/dm-bind/SKILL.md):\n#   @\"Ada Lovelace\" @\"Grace Hopper\"\n#\n#   <title> \u2014 <state>\n#\n#   \u2022 line\n#   \u2022 line\n#\n#   Next: line\n#   Need from you: line\n";
 export type DmBindDeps = {
     root: string;
     cwd: string;

package/dist/commands/core-dm-bind-native.js

@@ -3,54 +3,50 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 import { bundledShellUnboundValue, registerNativeUtility, utilityError } from "./core-native-utilities.js";
 export const DM_BIND_ASSET = "core/scripts/hq-dm-bind.sh";
-export const DM_BIND_HELP = `# hq-dm-bind.sh — bind the current session to one HQ DM channel, post
-# structured updates to it, and listen for replies (feedback / requests).
-#
-# Usage:
-#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to "now"
-#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor
-#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]
-#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)
-#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)
-#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention
-#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it
-#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]
-#                                                             # block until a new message arrives (or timeout)
-#   core/scripts/hq-dm-bind.sh unbind
-#
-# The binding lives in the session's meta.yaml (\`dm_channel\`) via hq-session.sh;
-# the cursor is \`workspace/sessions/<sid>/dm-bind.cursor\` (the last seen sort
-# key from \`hq dm channel --json\`). \`listen\` is meant to run detached
-# (Bash run_in_background): it exits 0 and prints the new messages the moment
-# one lands, exits 3 on timeout with nothing new.
-#
-# Every post opens with an @-mention of every other member of the channel, so
-# the update reaches people (HQ mentions are structured: the \`hq\` CLI resolves
-# the \`@"Display Name"\` tokens against the roster and sends the real mention
-`;
-export const createDmBindDeps = (root, cwd, env, now, home = env.HOME || os.homedir()) => ({
-    root, cwd, env, home, now, fs,
-    runHq: (args, childEnv) => {
-        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
-        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
-    },
-    runHqSession: (args, childEnv) => {
-        const result = spawnSync("bash", [path.join(root, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
-        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
-    },
-    fetch: globalThis.fetch,
-    readStdin: () => new Promise((resolve, reject) => {
-        let data = "";
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk) => { data += chunk; });
-        process.stdin.on("end", () => resolve(data));
-        process.stdin.on("error", reject);
-    }),
-    sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-});
+export const DM_BIND_HELP = "# hq-dm-bind.sh \u2014 bind the current session to one HQ DM channel, post\n# structured updates to it, and listen for replies (feedback / requests).\n#\n# Usage:\n#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to \"now\"\n#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor\n#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]\n#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)\n#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)\n#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention\n#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it\n#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]\n#                                                             # block until a new message arrives (or timeout)\n#   core/scripts/hq-dm-bind.sh unbind\n#\n# The binding lives in the session's meta.yaml (`dm_channel`) via hq-session.sh;\n# the cursor is `workspace/sessions/<sid>/dm-bind.cursor` (the last seen sort\n# key from `hq dm channel --json`). `listen` is meant to run detached\n# (Bash run_in_background): it exits 0 and prints the new messages the moment\n# one lands, exits 3 on timeout with nothing new.\n#\n# Every post opens with an @-mention of every other member of the channel, so\n# the update reaches people (HQ mentions are structured: the `hq` CLI resolves\n# the `@\"Display Name\"` tokens against the roster and sends the real mention\n# list; an unresolvable name fails the post rather than posting text that looks\n# addressed but is not). The CLI rewrites a resolved `@\"Display Name\"` token to\n# `@Display Name`, so the room never shows the quotes.\n#\n# Posts thread by topic. The first post on a topic (`--topic`, else the title)\n# is a top-level root; every later post on the same topic in this session goes\n# out as a reply under it. `--under <id>` replies under an existing thread that\n# someone else (or an earlier session) started \u2014 a top-level post is only for a\n# subject the channel has no thread for yet. `--new-thread` starts a fresh root. The topic \u2192 root\n# map is `workspace/sessions/<sid>/dm-bind.threads`.\n#\n# A post ALWAYS mentions someone. `--to <name>` (repeatable) narrows the line to\n# the named members, for a reply to one person; without it the line names every\n# other human member (bots are left out unless named with --to, because a tagged\n# bot wakes and replies). There is no way to post unmentioned: an update nobody is\n# notified about does not get read. `post` refuses when the roster cannot be\n# read rather than sending a silent update.\n#\n# Post format (kept deliberately plain \u2014 see .claude/skills/dm-bind/SKILL.md):\n#   @\"Ada Lovelace\" @\"Grace Hopper\"\n#\n#   <title> \u2014 <state>\n#\n#   \u2022 line\n#   \u2022 line\n#\n#   Next: line\n#   Need from you: line\n";
+export const createDmBindDeps = (root, cwd, env, now, home = env.HOME || os.homedir()) => {
+    const d = {
+        root, cwd, env, home, now, fs,
+        runHq: (args, childEnv) => {
+            const envWithRoot = { ...childEnv, HQ_ROOT: root };
+            const spawnPlan = planHqSpawn(args, envWithRoot, cwd, d.platform ?? process.platform, (candidate) => {
+                try {
+                    return d.fs.statSync(candidate).isFile();
+                }
+                catch {
+                    return false;
+                }
+            });
+            const result = spawnSync(spawnPlan.cmd, spawnPlan.args, {
+                cwd,
+                env: envWithRoot,
+                encoding: "utf8",
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+            });
+            return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+        },
+        runHqSession: (args, childEnv) => {
+            const result = spawnSync("bash", [path.join(root, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
+            return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+        },
+        fetch: globalThis.fetch,
+        readStdin: () => new Promise((resolve, reject) => {
+            let data = "";
+            process.stdin.setEncoding("utf8");
+            process.stdin.on("data", (chunk) => { data += chunk; });
+            process.stdin.on("end", () => resolve(data));
+            process.stdin.on("error", reject);
+        }),
+        sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+    };
+    return d;
+};
 const DM_BIND_API_TIMEOUT_MS = 15_000;
 const fail = (message, code = 2) => utilityError(`hq-dm-bind: ${message}`, code);
 const sessionDirectory = (d, sid) => path.join(d.root, "workspace/sessions", sid);
@@ -89,19 +85,24 @@ function ensureDir(d, sid) {
     return directory;
 }
 function hasHqOnPath(d) {
+    if ((d.platform ?? process.platform) === "win32") {
+        return resolveWindowsExecutable("hq", d.env, (candidate) => {
+            try {
+                return d.fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        }, d.cwd) !== null;
+    }
     for (const directory of (d.env.PATH ?? "").split(path.delimiter)) {
         if (!directory)
             continue;
-        // runHq spawns "hq" without a shell. On Windows that resolves only .exe and
-        // .com files, and Windows file modes carry no execute bits, so accept exactly
-        // what the spawn can launch. npm's hq.cmd shim needs a shell and is not
-        // accepted here.
-        const windows = (d.platform ?? process.platform) === "win32";
-        const names = windows ? ["hq.exe", "hq.com"] : ["hq"];
+        const names = ["hq"];
         for (const name of names) {
             try {
                 const stat = d.fs.statSync(path.join(directory, name));
-                if (stat.isFile() && (windows || (stat.mode & 0o111) !== 0))
+                if (stat.isFile() && (stat.mode & 0o111) !== 0)
                     return true;
             }
             catch { /* PATH entry is absent */ }
@@ -646,6 +647,8 @@ async function listen(d, args) {
     return { code: 3, stdout: output, stderr: "" };
 }
 export async function runDmBind(args, deps) {
+    if (args[0] === "-h" || args[0] === "--help")
+        return { code: 0, stdout: DM_BIND_HELP, stderr: "" };
     if (!hasHqOnPath(deps))
         return fail("missing dependency: hq");
     const [command = "", ...rest] = args;

package/dist/commands/core-handoff-fast.js

@@ -2,6 +2,7 @@
 import { spawn, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 /**
  * `handoff finalize --help` is historically an unknown-argument error. Keep
  * that fast error path out of the large handoff implementation module.
@@ -48,20 +49,24 @@ export function handoffFinalizeHelpResult(args, root, tmpRoot = "/tmp") {
     return { code: 2, stdout: "", stderr: "Unknown arg: --help\n" };
 }
 async function launchHandoffPost(args, root) {
+    const childEnv = {
+        ...process.env,
+        HQ_ROOT: root,
+        CLAUDE_PROJECT_DIR: root,
+        PWD: root,
+        HQ_NATIVE_HANDOFF_POST_CHILD: "1",
+    };
+    const spawnPlan = planHqSpawn(["core", "--hq-root", root, "handoff", "post", ...args], childEnv, root);
     return await new Promise((resolve) => {
         try {
-            const child = spawn("hq", ["core", "--hq-root", root, "handoff", "post", ...args], {
+            const child = spawn(spawnPlan.cmd, spawnPlan.args, {
                 cwd: root,
-                env: {
-                    ...process.env,
-                    HQ_ROOT: root,
-                    CLAUDE_PROJECT_DIR: root,
-                    PWD: root,
-                    HQ_NATIVE_HANDOFF_POST_CHILD: "1",
-                },
+                env: childEnv,
                 detached: true,
                 windowsHide: true,
                 stdio: "ignore",
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
             });
             child.once("error", (error) => {
                 process.stderr.write(`${error.message}\n`);

package/dist/commands/core-handoff.js

@@ -1,5 +1,6 @@
 /** Native implementations of the handoff scaffold command family. */
 import { spawn, spawnSync } from "node:child_process";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -876,14 +877,17 @@ async function launchHandoffPost(args, root) {
                 delete childEnv[key];
         childEnv.PWD = shellDisplayPath(root);
     }
+    const spawnPlan = planHqSpawn(["core", "--hq-root", root, "handoff", "post", ...args], childEnv, root);
     return await new Promise((resolve) => {
         try {
-            const child = spawn("hq", ["core", "--hq-root", root, "handoff", "post", ...args], {
+            const child = spawn(spawnPlan.cmd, spawnPlan.args, {
                 cwd: root,
                 env: childEnv,
                 detached: true,
                 windowsHide: true,
                 stdio: "ignore",
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
             });
             child.once("error", (error) => resolve({ code: 127, stdout: "", stderr: `${error.message}\n` }));
             child.once("spawn", () => {
@@ -1036,11 +1040,15 @@ export function runHandoffPostWorker(args, context) {
                 log(`workspace-sync: skipped (thread mirror missing for ${company})`);
                 continue;
             }
-            const pushed = spawnSync("hq", ["sync", "push", "--company", company, `companies/${company}/workspace`], {
+            const syncArgs = ["sync", "push", "--company", company, `companies/${company}/workspace`];
+            const spawnPlan = planHqSpawn(syncArgs, process.env, root);
+            const pushed = spawnSync(spawnPlan.cmd, spawnPlan.args, {
                 cwd: root,
                 env: process.env,
                 encoding: "utf8",
                 stdio: ["ignore", "pipe", "pipe"],
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
             });
             recordCommand(logMain, {
                 code: pushed.status ?? 1,

package/dist/commands/core-native-family-flag.d.ts

@@ -0,0 +1,7 @@
+/** Shared fail-safe readers for shipped native core families. */
+export declare function coreNativeFamilyEnabled(flagKey: string): Promise<boolean>;
+export declare const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
+export declare const CORE_NATIVE_ONTOLOGY_FLAG = "core-native-ontology";
+export declare function coreNativeDelegateEnabled(): Promise<boolean>;
+export declare function coreNativeOntologyEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-native-family-flag.d.ts.map

package/dist/commands/core-native-family-flag.js

@@ -0,0 +1,21 @@
+/** Shared fail-safe readers for shipped native core families. */
+import { readLocalOverride } from "@indigoai-us/hq-flags-client";
+export async function coreNativeFamilyEnabled(flagKey) {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    const override = readLocalOverride(flagKey, process.env);
+    if (override !== null)
+        return override;
+    return resolveProcessFlagGate(flagKey, { fallback: true }, () => true, undefined, {
+        acceptStaleSnapshot: true,
+        killSwitchWithoutCompany: true,
+    });
+}
+export const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
+export const CORE_NATIVE_ONTOLOGY_FLAG = "core-native-ontology";
+export function coreNativeDelegateEnabled() {
+    return import("../lib/flag-registry.js").then(({ resolveProcessFlagGate }) => resolveProcessFlagGate(CORE_NATIVE_DELEGATE_FLAG, { fallback: false }, () => false));
+}
+export function coreNativeOntologyEnabled() {
+    return coreNativeFamilyEnabled(CORE_NATIVE_ONTOLOGY_FLAG);
+}
+//# sourceMappingURL=core-native-family-flag.js.map

package/dist/commands/core-native-handoff-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for the native Wave 2 worktree/resume helpers. */
 export const CORE_NATIVE_HANDOFF_FLAG = "core-native-handoff";
 export async function coreNativeHandoffEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_HANDOFF_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_HANDOFF_FLAG);
 }
 //# sourceMappingURL=core-native-handoff-flag.js.map

package/dist/commands/core-native-hook-helpers-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for Wave 8 hook-time helper commands. */
 export const CORE_NATIVE_HOOK_HELPERS_FLAG = "core-native-hook-helpers";
 export async function coreNativeHookHelpersEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_HOOK_HELPERS_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_HOOK_HELPERS_FLAG);
 }
 //# sourceMappingURL=core-native-hook-helpers-flag.js.map

package/dist/commands/core-native-jobs-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for the native scheduled-jobs helpers. */
 export const CORE_NATIVE_JOBS_FLAG = "core-native-jobs";
 export async function coreNativeJobsEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_JOBS_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_JOBS_FLAG);
 }
 //# sourceMappingURL=core-native-jobs-flag.js.map

package/dist/commands/core-native-policy-flag.js

@@ -6,7 +6,7 @@
  */
 export const CORE_NATIVE_POLICY_FLAG = 'core-native-policy';
 export async function coreNativePolicyEnabled() {
-    const { resolveProcessFlagGate } = await import('../lib/flag-registry.js');
-    return resolveProcessFlagGate(CORE_NATIVE_POLICY_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import('./core-native-family-flag.js');
+    return coreNativeFamilyEnabled(CORE_NATIVE_POLICY_FLAG);
 }
 //# sourceMappingURL=core-native-policy-flag.js.map

package/dist/commands/core-native-session-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for native session and Stop-hook plumbing. */
 export const CORE_NATIVE_SESSION_FLAG = "core-native-session";
 export async function coreNativeSessionEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_SESSION_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_SESSION_FLAG);
 }
 //# sourceMappingURL=core-native-session-flag.js.map

package/dist/commands/core-native-utilities-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for native operator utility commands. */
 export const CORE_NATIVE_UTILITIES_FLAG = "core-native-utilities";
 export async function coreNativeUtilitiesEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_UTILITIES_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_UTILITIES_FLAG);
 }
 //# sourceMappingURL=core-native-utilities-flag.js.map

package/dist/commands/core-ontology-native.js

@@ -1170,8 +1170,8 @@ export function registerCoreOntologyNativeCommands(ontology, rootFor) {
             const forwarded = commandIndex >= 0 ? argv.slice(commandIndex + 1)
                 : commandContext.args.length > 0 ? commandContext.args : args;
             const liveRoot = entry.root === "live" ? rootFor() : process.cwd();
-            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-            if (!resolveProcessFlagGate(FLAG, { fallback: false }, () => false)) {
+            const { coreNativeOntologyEnabled } = await import("./core-native-family-flag.js");
+            if (!await coreNativeOntologyEnabled()) {
                 const result = runBundledScript({
                     asset: `${ASSET}${entry.asset}`,
                     args: forwarded,

package/dist/commands/core-refresh-vault-access-native.js

@@ -2,8 +2,10 @@
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
 import { registerNativeUtility } from "./core-native-utilities.js";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 export const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
 export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
 # refresh-vault-access.sh — build/refresh the local vault-access manifest that
@@ -39,7 +41,15 @@ export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
 #
 `.replace(/^# ?/gm, "");
 function defaultHq(args, cwd, env) {
-    const result = spawnSync("hq", args, { cwd, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const spawnPlan = planHqSpawn(args, env, cwd);
+    const result = spawnSync(spawnPlan.cmd, spawnPlan.args, {
+        cwd,
+        env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: spawnPlan.shell,
+        ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    });
     if (result.error)
         return { code: 127, stdout: "", stderr: result.error.message, missing: result.error.code === "ENOENT" };
     return { code: result.status ?? 128, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "") };
@@ -47,6 +57,9 @@ function defaultHq(args, cwd, env) {
 function executableOnPath(name, value) {
     if (!value)
         return false;
+    if (process.platform === "win32" && name === "hq") {
+        return resolveWindowsExecutable(name, { PATH: value }) !== null;
+    }
     for (const directory of value.split(path.delimiter)) {
         if (!directory)
             continue;

package/dist/commands/pack-install.d.ts

@@ -178,11 +178,10 @@ export declare function defaultMarketplaceDeps(): MarketplaceDeps;
  * resolves the tarball from the marketplace and ALWAYS verifies it against the
  * listing's approved hash/signature BEFORE extraction (US-021 → US-020).
  *
- * @param requireSignature production posture once signing keys exist; during
- *        the key-deferral window callers pass false (hash still always checked).
+ * Marketplace listings are always signature-verified. Legacy unsigned
+ * listings deliberately fail before any bytes are extracted.
  */
 export declare function fetchMarketplace(source: string, tmpDir: string, deps: MarketplaceDeps, opts?: {
-    requireSignature?: boolean;
     company?: string;
 }): Promise<FetchResult>;
 export interface LatestResult {
@@ -446,11 +445,10 @@ export interface InstallPackOptions {
      */
     marketplaceDeps?: MarketplaceDeps;
     /**
-     * US-006: require a valid signature for marketplace artifacts. Default false
-     * during the signing-key-deferral window (the content hash is still ALWAYS
-     * verified); set true once platform signing keys are provisioned.
+     * Acknowledge that a local directory source is unsigned. This has no effect
+     * for marketplace sources, which always require a platform signature.
      */
-    requireSignature?: boolean;
+    allowUnsigned?: boolean;
 }
 export declare function runPackInstallWithLease<T>(run: () => Promise<T>, leaseOptions?: ResidentCommandLeaseOptions): Promise<T>;
 export declare function installPack(source: string, opts?: InstallPackOptions): Promise<void>;

package/dist/commands/pack-install.js

@@ -39,6 +39,7 @@ import * as path from 'path';
 import * as readline from 'readline';
 import { parseUserYaml } from '../utils/user-yaml-error.js';
 import { createHash, createPublicKey, verify as cryptoVerify, } from 'node:crypto';
+import { trustedMarketplaceSigningKey } from '../lib/pack-signing-keys.js';
 import { execFileSync, spawnSync } from 'child_process';
 import chalk from 'chalk';
 import semverSatisfies from 'semver/functions/satisfies.js';
@@ -414,8 +415,8 @@ export function defaultMarketplaceDeps() {
  * resolves the tarball from the marketplace and ALWAYS verifies it against the
  * listing's approved hash/signature BEFORE extraction (US-021 → US-020).
  *
- * @param requireSignature production posture once signing keys exist; during
- *        the key-deferral window callers pass false (hash still always checked).
+ * Marketplace listings are always signature-verified. Legacy unsigned
+ * listings deliberately fail before any bytes are extracted.
  */
 export async function fetchMarketplace(source, tmpDir, deps, opts = {}) {
     const { slug, version } = parseMarketplaceSource(source);
@@ -448,12 +449,13 @@ export async function fetchMarketplace(source, tmpDir, deps, opts = {}) {
     // downloaded bytes BEFORE extraction. A hash/signature mismatch throws
     // `ArtifactVerificationError` and nothing is unpacked or wired. The hash is
     // ALWAYS verified when present; signature is enforced when requireSignature.
+    const publicKey = trustedMarketplaceSigningKey(listing.signingKeyId, listing.publicKey);
     verifyArtifact({
         tarballBytes,
         expectedHash: listing.contentHash,
         signature: listing.signature,
-        publicKey: listing.publicKey,
-        requireSignature: opts.requireSignature ?? false,
+        publicKey,
+        requireSignature: true,
     });
     // Write to a tmp tarball and run it through the SAME hardened extractor
     // (US-020) as every other tarball transport.
@@ -1697,6 +1699,9 @@ async function installPackWithoutLease(source, opts) {
     // entrypoint keeps `hq packs update` fail-closed at its own call site
     // instead (checked before it un-wires anything).
     const transport = classify(source);
+    if (opts.allowUnsigned && transport !== 'local') {
+        throw new Error('--allow-unsigned is only valid for local directory sources; marketplace installs always require a platform signature.');
+    }
     const hqRoot = findHqRoot();
     // `readHqVersion` (shared with `hq packs`) reads the CANONICAL
     // `core/core.yaml` (hq-core ≥v14), falling back to the legacy
@@ -1724,7 +1729,6 @@ async function installPackWithoutLease(source, opts) {
                 break;
             case 'marketplace':
                 fetched = await fetchMarketplace(source, tmpDir, opts.marketplaceDeps ?? defaultMarketplaceDeps(), {
-                    requireSignature: opts.requireSignature,
                     ...(opts.company !== undefined ? { company: opts.company } : {}),
                 });
                 break;

package/dist/commands/pkg-install.js

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import { peekHqApiKey, requireApiKeyCapability, } from '../utils/resolve-vault-credential.js';
-import { MARKETPLACE_PREFIX, PINNED_HQ_ANYWHERE_SOURCE, installPack, sourceMatchesPackPattern, } from './pack-install.js';
+import { MARKETPLACE_PREFIX, PINNED_HQ_ANYWHERE_SOURCE, classify, installPack, sourceMatchesPackPattern, } from './pack-install.js';
 import { anywhereRuntimeAllowed } from '../lib/anywhere-person-setting.js';
 /**
  * True when `source` installs through the marketplace — an explicit
@@ -43,6 +43,7 @@ export function registerPackageInstallCommand(parent) {
         .option('--company <co>', 'Scope package secret authorization to a specific company')
         .option('--allow-hooks', 'Skip the hooks confirmation prompt (content-pack flow)')
         .option('--allow-mcp', 'Skip the MCP server confirmation prompt (content-pack flow)')
+        .option('--allow-unsigned', 'Acknowledge an unsigned local directory source; marketplace installs always require a signature')
         .option('--branch', 'Follow a ref instead of SHA-pinning (git content-pack flow)')
         .option('--global', 'Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)')
         .option('--runtime <runtime>', 'Runtime for --global (claude | codex | chatgpt | grok)', 'claude')
@@ -87,6 +88,21 @@ export function registerPackageInstallCommand(parent) {
             process.exitCode = 1;
             return;
         }
+        if (opts.allowUnsigned) {
+            let transport;
+            try {
+                transport = classify(source);
+            }
+            catch {
+                // Bare slugs resolve through the marketplace below, where this
+                // option is never permitted.
+            }
+            if (transport !== 'local') {
+                console.error('error: --allow-unsigned is only valid for local directory sources; marketplace installs always require a platform signature.');
+                process.exitCode = 1;
+                return;
+            }
+        }
         try {
             // Gate the top-level `hq install` entrypoint only — `installPack`
             // itself is also called by `hq packs update` (packs.ts), which must
@@ -106,6 +122,7 @@ export function registerPackageInstallCommand(parent) {
                     company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
+                    allowUnsigned: opts.allowUnsigned,
                     followBranch: opts.branch,
                     allowPinnedHqAnywhereName: true,
                 });
@@ -116,6 +133,7 @@ export function registerPackageInstallCommand(parent) {
                     company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
+                    allowUnsigned: opts.allowUnsigned,
                     followBranch: opts.branch,
                 });
             }
@@ -128,6 +146,7 @@ export function registerPackageInstallCommand(parent) {
                     company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
+                    allowUnsigned: opts.allowUnsigned,
                     followBranch: opts.branch,
                 });
             }

package/dist/fast-core.js

@@ -9,7 +9,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { parseFastCore } from "./fast-scaffold.js";
+import { isDefaultOnFastFamily, parseFastCore } from "./fast-scaffold.js";
 const FAST_ROUTE_PROFILE_TOKEN = "hq-fast-route";
 function wantsFastRouteProfile(env) {
     return env.NODE_DEBUG === FAST_ROUTE_PROFILE_TOKEN;
@@ -50,7 +50,16 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     let familyEnabled = true;
     if (entry.kind === "native" && entry.familyFlagKey) {
         const envOverride = localBooleanFlagOverride(entry.familyFlagKey, process.env);
-        familyEnabled = envOverride ?? await (await import("./native-fast-route.js")).fastFlagEnabled(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
+        if (envOverride !== null) {
+            familyEnabled = envOverride;
+        }
+        else {
+            const { fastFlagEnabled, fastFlagEnabledDefaultOn } = await import("./native-fast-route.js");
+            const readFamilyFlag = isDefaultOnFastFamily(entry.familyFlagKey)
+                ? fastFlagEnabledDefaultOn
+                : fastFlagEnabled;
+            familyEnabled = await readFamilyFlag(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
+        }
     }
     if (entry.kind === "native" && entry.fallbackToCommandGraph && !familyEnabled) {
         const { runCli } = await import("./main.js");
@@ -164,6 +173,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         args: parsed.args,
         cwd,
         ...(injectRoot ? { hqRoot } : {}),
+        msysScriptPath: process.platform === "win32",
         ...(Object.keys(childEnv).length ? { env: childEnv } : {}),
     });
     // Propagate verbatim: these scripts use their exit code as their interface.

package/dist/fast-scaffold.d.ts

@@ -49,6 +49,9 @@ export type FastScaffoldScript = {
     /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
     requiresNodeNetworkCompatibility?: boolean;
 };
+/** Family kill switches whose owner-approved default is enabled. */
+export declare const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS: readonly ["core-native-session", "core-native-hook-helpers", "core-native-policy", "core-native-utilities", "core-native-jobs", "core-native-ontology", "core-native-handoff"];
+export declare function isDefaultOnFastFamily(flagKey: string): boolean;
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export declare const FAST_SCAFFOLD_SCRIPTS: readonly FastScaffoldScript[];
 export type ParsedFastCore = {

package/dist/fast-scaffold.js

@@ -9,6 +9,20 @@
  * on every turn's Stop. The entrypoint routes eligible commands before loading
  * the graph, and this module holds the parser + table that routing needs.
  */
+/** Family kill switches whose owner-approved default is enabled. */
+export const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS = [
+    "core-native-session",
+    "core-native-hook-helpers",
+    "core-native-policy",
+    "core-native-utilities",
+    "core-native-jobs",
+    "core-native-ontology",
+    "core-native-handoff",
+];
+const defaultOnFamilyFlags = new Set(CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS);
+export function isDefaultOnFastFamily(flagKey) {
+    return defaultOnFamilyFlags.has(flagKey);
+}
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export const FAST_SCAFFOLD_SCRIPTS = [
     {

package/dist/lib/flag-registry.d.ts

@@ -67,7 +67,10 @@ export declare function resolveFlagGate(reader: FlagReader | null | undefined, f
 /** Resolve one explicit company's flag without relying on process-wide binding. */
 export declare function resolveCompanyFlagGate(companyUid: string, idToken: string, flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, dependencies?: CompanyFlagGateDependencies): Promise<boolean>;
 /** Resolve a process gate against the shared snapshot reader, when configured. */
-export declare function resolveProcessFlagGate(flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, companyUid?: string): boolean;
+export declare function resolveProcessFlagGate(flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, companyUid?: string, options?: {
+    acceptStaleSnapshot?: boolean;
+    killSwitchWithoutCompany?: boolean;
+}): boolean;
 /**
  * The registry snapshot held by this process, or null when none has arrived
  * (no endpoint configured, offline, or still fetching). Callers that must

package/dist/lib/flag-registry.js

@@ -9,9 +9,9 @@ import { Worker } from "node:worker_threads";
 import { createFlagClient, isFlagSnapshot, readLocalOverride, resolveFlag, } from "@indigoai-us/hq-flags-client";
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
-import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { resolveFlagSnapshotCompanyUid, resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 import { registerFlagRegistryRefreshWaiter } from "./flag-registry-refresh-wait.js";
-import { flagSnapshotWriteFailureTags, readFlagSnapshotFile, writePersonFlagSnapshotFile, writeFlagSnapshotFile, } from "./flag-snapshot-file.js";
+import { flagSnapshotWriteFailureTags, readDefaultOnFlagSnapshot, readFlagSnapshotFile, writePersonFlagSnapshotFile, writeFlagSnapshotFile, } from "./flag-snapshot-file.js";
 function captureFlagRegistryException(error, tags, sentry) {
     if (!sentry)
         return;
@@ -348,10 +348,20 @@ export async function resolveCompanyFlagGate(companyUid, idToken, flagKey, looku
     }
 }
 /** Resolve a process gate against the shared snapshot reader, when configured. */
-export function resolveProcessFlagGate(flagKey, lookup, legacyFallback, companyUid) {
+export function resolveProcessFlagGate(flagKey, lookup, legacyFallback, companyUid, options = {}) {
+    const defaultOnKillSwitch = options.killSwitchWithoutCompany === true;
+    const resolvedCompanyUid = defaultOnKillSwitch
+        ? resolveFlagSnapshotCompanyUid()
+        : resolveProcessFlagCompanyContext().companyUid;
     const targetCompanyUid = companyUid ?? (processReader
-        ? refreshCompanyUid
-        : resolveProcessFlagCompanyContext().companyUid);
+        ? refreshCompanyUid ?? (defaultOnKillSwitch ? resolvedCompanyUid : undefined)
+        : resolvedCompanyUid);
+    if (!targetCompanyUid && defaultOnKillSwitch) {
+        const override = readLocalOverride(flagKey, process.env);
+        if (override !== null)
+            return override;
+        return readDefaultOnFlagSnapshot(flagKey);
+    }
     const processSnapshotMatchesTarget = refreshCompanyUid === targetCompanyUid;
     if (processReader && heldSnapshot && processSnapshotMatchesTarget) {
         return resolveFlagGate(processReader, flagKey, lookup, legacyFallback);
@@ -360,7 +370,9 @@ export function resolveProcessFlagGate(flagKey, lookup, legacyFallback, companyU
     // Use the last validated, fresh company snapshot in that window, and when
     // the process reader was initialized for a different company scope.
     if (targetCompanyUid) {
-        const cached = readFlagSnapshotFile(targetCompanyUid);
+        const cached = readFlagSnapshotFile(targetCompanyUid, options.acceptStaleSnapshot
+            ? { maxAgeMs: Number.POSITIVE_INFINITY }
+            : {});
         if (cached) {
             const snapshot = { version: 0, flags: cached.flags };
             const reader = createProcessSnapshotReader([targetCompanyUid], () => snapshot);

package/dist/lib/flag-snapshot-file.d.ts

@@ -37,4 +37,6 @@ export declare function readFlagSnapshotFile(companyUid: string, options?: {
     now?: number;
     maxAgeMs?: number;
 }): PersistedFlagSnapshot | null;
+/** Resolve a default-on kill switch from offline snapshots, allowing stale decisions. */
+export declare function readDefaultOnFlagSnapshot(flagKey: string, companyUid?: string, env?: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=flag-snapshot-file.d.ts.map

package/dist/lib/flag-snapshot-file.js

@@ -372,4 +372,34 @@ export function readFlagSnapshotFile(companyUid, options = {}) {
     }
     return primary;
 }
+/** Resolve a default-on kill switch from offline snapshots, allowing stale decisions. */
+export function readDefaultOnFlagSnapshot(flagKey, companyUid, env = process.env) {
+    const options = { env, maxAgeMs: Number.POSITIVE_INFINITY };
+    if (companyUid)
+        return readFlagSnapshotFile(companyUid, options)?.flags[flagKey] !== false;
+    const directories = new Set([path.dirname(personFlagSnapshotPath(env))]);
+    const fallbackProbe = fallbackSnapshotPath("cmp_000", false, env);
+    if (fallbackProbe)
+        directories.add(path.dirname(fallbackProbe));
+    for (const directory of directories) {
+        let names;
+        try {
+            names = fs.readdirSync(directory);
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            if (name === "snapshot-person.json") {
+                if (readPersonFlagSnapshotFile(options)?.flags[flagKey] === false)
+                    return false;
+                continue;
+            }
+            const match = /^snapshot-(cmp_[A-Za-z0-9]{3,128})\.json$/.exec(name);
+            if (match?.[1] && readFlagSnapshotFile(match[1], options)?.flags[flagKey] === false)
+                return false;
+        }
+    }
+    return true;
+}
 //# sourceMappingURL=flag-snapshot-file.js.map

package/dist/lib/pack-signing-keys.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Marketplace artifact signing keys trusted by the CLI.
+ *
+ * Public keys are intentionally embedded: authenticity must not depend on the
+ * marketplace response that carries the artifact. Add old keys here during a
+ * rotation so installs of previously signed listings continue to verify.
+ *
+ * `HQ_PACK_PUBLIC_KEY` is a development-only override for the current key id.
+ * It exists for local integration tests and non-production marketplace stacks;
+ * production installs must use the embedded platform key below.
+ */
+export declare const MARKETPLACE_SIGNING_KEYS: {
+    readonly "mkt-sign-v1": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEALmDnMFl0vMytdx/TdP8+SmZjW2oES6B1nOESioUNc6k=\n-----END PUBLIC KEY-----";
+};
+export type MarketplaceSigningKeyId = keyof typeof MARKETPLACE_SIGNING_KEYS;
+/**
+ * Return the trusted public key only when the listing names a pinned key and
+ * echoes the same public key. The echoed key is checked for API-contract drift,
+ * never trusted as the source of authenticity.
+ */
+export declare function trustedMarketplaceSigningKey(signingKeyId: unknown, listingPublicKey: unknown): string;
+//# sourceMappingURL=pack-signing-keys.d.ts.map

package/dist/lib/pack-signing-keys.js

@@ -0,0 +1,53 @@
+/**
+ * Marketplace artifact signing keys trusted by the CLI.
+ *
+ * Public keys are intentionally embedded: authenticity must not depend on the
+ * marketplace response that carries the artifact. Add old keys here during a
+ * rotation so installs of previously signed listings continue to verify.
+ *
+ * `HQ_PACK_PUBLIC_KEY` is a development-only override for the current key id.
+ * It exists for local integration tests and non-production marketplace stacks;
+ * production installs must use the embedded platform key below.
+ */
+export const MARKETPLACE_SIGNING_KEYS = {
+    "mkt-sign-v1": `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEALmDnMFl0vMytdx/TdP8+SmZjW2oES6B1nOESioUNc6k=
+-----END PUBLIC KEY-----`,
+};
+function normalizedPem(pem) {
+    return pem.replace(/\r\n/g, "\n").trim();
+}
+function developmentPublicKeyOverride() {
+    // Packaged production CLIs always use the embedded key. The override exists
+    // only for local development and test stacks.
+    if (process.env.NODE_ENV !== "development" && process.env.NODE_ENV !== "test") {
+        return undefined;
+    }
+    const override = process.env.HQ_PACK_PUBLIC_KEY;
+    return typeof override === "string" && override.trim().length > 0
+        ? override
+        : undefined;
+}
+/**
+ * Return the trusted public key only when the listing names a pinned key and
+ * echoes the same public key. The echoed key is checked for API-contract drift,
+ * never trusted as the source of authenticity.
+ */
+export function trustedMarketplaceSigningKey(signingKeyId, listingPublicKey) {
+    if (typeof signingKeyId !== "string" || signingKeyId.length === 0) {
+        throw new Error("Marketplace listing did not provide a signing key id — refusing to install unsigned or legacy listings.");
+    }
+    if (!Object.hasOwn(MARKETPLACE_SIGNING_KEYS, signingKeyId)) {
+        throw new Error(`Marketplace listing uses unpinned signing key "${signingKeyId}" — refusing to install.`);
+    }
+    if (typeof listingPublicKey !== "string" || listingPublicKey.trim().length === 0) {
+        throw new Error("Marketplace listing did not provide the public key for its signing key id — refusing to install.");
+    }
+    const keyId = signingKeyId;
+    const pinnedKey = developmentPublicKeyOverride() ?? MARKETPLACE_SIGNING_KEYS[keyId];
+    if (normalizedPem(listingPublicKey) !== normalizedPem(pinnedKey)) {
+        throw new Error(`Marketplace listing public key does not match pinned signing key "${keyId}" — refusing to install.`);
+    }
+    return pinnedKey;
+}
+//# sourceMappingURL=pack-signing-keys.js.map

package/dist/lib/process-flag-company-context.d.ts

@@ -3,4 +3,6 @@ import { type ProcessFlagCompanyContext } from "./process-flag-company-context-l
 export type { ProcessFlagCompanyContext } from "./process-flag-company-context-light.js";
 /** Resolve the same company identity the process-wide flag reader uses. */
 export declare function resolveProcessFlagCompanyContext(env?: NodeJS.ProcessEnv): ProcessFlagCompanyContext;
+/** Resolve the process scope, then the explicitly selected device default, without network access. */
+export declare function resolveFlagSnapshotCompanyUid(env?: NodeJS.ProcessEnv): string | undefined;
 //# sourceMappingURL=process-flag-company-context.d.ts.map

package/dist/lib/process-flag-company-context.js

@@ -1,5 +1,7 @@
 /** Company scope shared by the full flag registry and its fast-path reader. */
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
+import { readDeviceConfig } from "./work-context/config.js";
+import { workContextRoot } from "./work-context/paths.js";
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
 import { normalizedCompanyUid, resolveLightProcessFlagCompanyContext, } from "./process-flag-company-context-light.js";
 function companyUidForContext(context, env = process.env) {
@@ -20,4 +22,17 @@ export function resolveProcessFlagCompanyContext(env = process.env) {
         ...(context.companySlug ? { companySlug: context.companySlug } : {}),
     };
 }
+/** Resolve the process scope, then the explicitly selected device default, without network access. */
+export function resolveFlagSnapshotCompanyUid(env = process.env) {
+    const contextUid = resolveProcessFlagCompanyContext(env).companyUid;
+    if (contextUid)
+        return contextUid;
+    try {
+        const defaultCompany = readDeviceConfig({ root: workContextRoot(undefined, env) }).defaultCompany;
+        return defaultCompany?.enabled ? normalizedCompanyUid(defaultCompany.uid) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=process-flag-company-context.js.map

package/dist/native-fast-route.d.ts

@@ -1,10 +1,10 @@
-/** Default-off flag check for native entrypoint routes. */
+/** Fast-route flag check for native entrypoint routes. */
 export declare function nativeFastRouteEnabled(argv: readonly string[], env?: NodeJS.ProcessEnv): Promise<boolean>;
 /** Reads a default-off fast-route gate from its local override or fresh snapshot. */
 export declare function fastFlagEnabled(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
     numericEnvironmentOverride?: boolean;
 }): Promise<boolean>;
-/** Reads a fail-safe flag that stays enabled unless a fresh value disables it. */
+/** Reads an enabled-by-default flag; any validated explicit false stays a kill switch, even when stale. */
 export declare function fastFlagEnabledDefaultOn(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
     numericEnvironmentOverride?: boolean;
 }): Promise<boolean>;

package/dist/native-fast-route.js

@@ -1,11 +1,11 @@
-/** Default-off flag check for native entrypoint routes. */
+/** Fast-route flag check for native entrypoint routes. */
 import { localOverrideEnvVar, readLocalOverride } from "@indigoai-us/hq-flags-client";
 import { parseFastCore } from "./fast-scaffold.js";
 export async function nativeFastRouteEnabled(argv, env = process.env) {
     const parsed = parseFastCore(argv);
     if (!parsed || parsed.entry.kind !== "native")
         return false;
-    return fastFlagEnabled(parsed.entry.flagKey, env);
+    return fastFlagEnabledDefaultOn(parsed.entry.flagKey, env);
 }
 /** Reads a default-off fast-route gate from its local override or fresh snapshot. */
 export async function fastFlagEnabled(flagKey, env = process.env, options = {}) {
@@ -28,20 +28,18 @@ export async function fastFlagEnabled(flagKey, env = process.env, options = {})
         return false;
     }
 }
-/** Reads a fail-safe flag that stays enabled unless a fresh value disables it. */
+/** Reads an enabled-by-default flag; any validated explicit false stays a kill switch, even when stale. */
 export async function fastFlagEnabledDefaultOn(flagKey, env = process.env, options = {}) {
     try {
         const override = nativeRouteOverride(flagKey, env, options.numericEnvironmentOverride !== false);
         if (override !== null)
             return override;
-        const [{ resolveProcessFlagCompanyContext }, { readFlagSnapshotFile }] = await Promise.all([
+        const [{ resolveFlagSnapshotCompanyUid }, { readDefaultOnFlagSnapshot }] = await Promise.all([
             import("./lib/process-flag-company-context.js"),
             import("./lib/flag-snapshot-file.js"),
         ]);
-        const { companyUid } = resolveProcessFlagCompanyContext(env);
-        if (!companyUid)
-            return true;
-        return readFlagSnapshotFile(companyUid, { env })?.flags[flagKey] !== false;
+        const companyUid = resolveFlagSnapshotCompanyUid(env);
+        return readDefaultOnFlagSnapshot(flagKey, companyUid, env);
     }
     catch {
         // This flag is a kill switch: missing scope or cache data must leave the feature enabled.

package/dist/utils/hq-spawn.d.ts

@@ -0,0 +1,4 @@
+import { type SpawnPlan } from "./windows-spawn.js";
+/** Resolve the installed hq executable before applying the platform spawn plan. */
+export declare function planHqSpawn(args: readonly string[], env: NodeJS.ProcessEnv, cwd: string, platform?: NodeJS.Platform, existsSync?: (candidate: string) => boolean): SpawnPlan;
+//# sourceMappingURL=hq-spawn.d.ts.map

package/dist/utils/hq-spawn.js

@@ -0,0 +1,11 @@
+import * as fs from "node:fs";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { planResolvedCommandSpawn } from "./windows-spawn.js";
+/** Resolve the installed hq executable before applying the platform spawn plan. */
+export function planHqSpawn(args, env, cwd, platform = process.platform, existsSync = fs.existsSync) {
+    const executable = platform === "win32"
+        ? resolveWindowsExecutable("hq", env, existsSync, cwd) ?? "hq"
+        : "hq";
+    return planResolvedCommandSpawn(executable, args, env, platform);
+}
+//# sourceMappingURL=hq-spawn.js.map

package/dist/utils/resident-package-preload.js

@@ -42,7 +42,7 @@ export const RESIDENT_PACKAGE_MODULES = {
     "bot-logs-follow": [],
     mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../lib/anywhere-person-setting.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client"],
     childWrapper: ["../main.js", "../lib/service-manager/startup-migration.js"],
-    coreJobRun: ["../lib/flag-registry.js"],
+    coreJobRun: ["../commands/core-native-jobs-flag.js", "../commands/core-native-family-flag.js", "../lib/flag-registry.js", "../lib/flag-snapshot-file.js"],
     "daemon-call": ["../lib/daemon/protocol.js"],
     daemon: [
         "../sentry.js",
@@ -203,7 +203,10 @@ const LOADERS = {
         () => import("../lib/service-manager/startup-migration.js"),
     ],
     coreJobRun: [
+        () => import("../commands/core-native-jobs-flag.js"),
+        () => import("../commands/core-native-family-flag.js"),
         () => import("../lib/flag-registry.js"),
+        () => import("../lib/flag-snapshot-file.js"),
     ],
     "daemon-call": [
         () => import("../lib/daemon/protocol.js"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.67",
+  "version": "5.345.69",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {