@indigoai-us/hq-cli 5.345.68 → 5.345.70

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.345.70] — 2026-10-10
+- Native `hq core` fast-route imports now use the bounded torn-install recovery path. If an update temporarily removes a route module, the CLI waits for the package tree to settle and re-executes once; a module that remains missing prints the reinstall remedy.
+
+## [5.345.69] — 2026-10-10
+- Supported native core handlers now run by default without a flag snapshot. Explicit false values still turn them off; delegate and worker-skills remain default-off pending parity.
+
 ## [5.345.68] — 2026-10-09
 
 - Marketplace pack installs now require a signature from a pinned platform key. `--allow-unsigned` is limited to local directory sources; `HQ_PACK_PUBLIC_KEY` is development-only.

package/assets/scaffold/core/scripts/hq-dm-bind.sh

@@ -53,6 +53,11 @@
 #   Need from you: line
 set -euo pipefail
 
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  sed -n '2,/^set -euo pipefail$/ { /^set -euo pipefail$/!p; }' "$0"
+  exit 0
+fi
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 SESSION_SH="$HQ_ROOT/core/scripts/hq-session.sh"
 

package/dist/commands/core-checkpoint-stop-gate-native.js

@@ -1,5 +1,6 @@
 /** Native fast-route implementation of checkpoint-stop-gate.sh. */
 import * as childProcess from "node:child_process";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -85,7 +86,18 @@ const defaults = () => ({
         return false;
     },
     spawnHqDetached: (args, env) => {
-        const child = childProcess.spawn("hq", args, { detached: true, stdio: "ignore", env: env ?? process.env });
+        const childEnv = env ?? process.env;
+        const spawnPlan = planHqSpawn(args, childEnv, process.cwd());
+        const child = childProcess.spawn(spawnPlan.cmd, spawnPlan.args, {
+            detached: true,
+            stdio: "ignore",
+            env: childEnv,
+            shell: spawnPlan.shell,
+            ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+        });
+        child.once("error", (error) => {
+            process.stderr.write(`${error.message}\n`);
+        });
         child.unref();
     },
 });

package/dist/commands/core-delegate-w1b.js

@@ -1215,8 +1215,8 @@ export function registerCoreDelegateW1b(delegate, core) {
             const options = core.opts();
             const root = resolveLiveRoot({ hqRoot: options.hqRoot });
             const context = { cwd: root, root };
-            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-            if (!resolveProcessFlagGate(FLAG, { fallback: false }, () => false)) {
+            const { coreNativeDelegateEnabled } = await import("./core-native-family-flag.js");
+            if (!await coreNativeDelegateEnabled()) {
                 const result = runBundledScript({ asset: ASSETS[name], args, cwd: root, hqRoot: root });
                 if (result.code !== 0)
                     process.exit(result.code);

package/dist/commands/core-delegate.js

@@ -1022,8 +1022,8 @@ export function registerCoreDelegateCommand(core, registerWave1b) {
             const context = rootMode === "cwd"
                 ? { cwd: process.cwd() }
                 : (() => { const root = resolveLiveRoot({ hqRoot: scope.hqRoot }); return { cwd: root, root }; })();
-            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-            if (!resolveProcessFlagGate(CORE_NATIVE_DELEGATE_FLAG, { fallback: false }, () => false)) {
+            const { coreNativeDelegateEnabled } = await import("./core-native-family-flag.js");
+            if (!await coreNativeDelegateEnabled()) {
                 const result = runBundledScript({ asset: SCRIPT_ASSETS[name], args, cwd: context.cwd, hqRoot: context.root });
                 if (result.code !== 0)
                     process.exit(result.code);

package/dist/commands/core-dm-bind-native.d.ts

@@ -3,7 +3,7 @@ import * as fs from "node:fs";
 import type { Command } from "commander";
 import { type UtilityOutput } from "./core-native-utilities.js";
 export declare const DM_BIND_ASSET = "core/scripts/hq-dm-bind.sh";
-export declare const DM_BIND_HELP = "# hq-dm-bind.sh \u2014 bind the current session to one HQ DM channel, post\n# structured updates to it, and listen for replies (feedback / requests).\n#\n# Usage:\n#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to \"now\"\n#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor\n#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]\n#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)\n#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)\n#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention\n#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it\n#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]\n#                                                             # block until a new message arrives (or timeout)\n#   core/scripts/hq-dm-bind.sh unbind\n#\n# The binding lives in the session's meta.yaml (`dm_channel`) via hq-session.sh;\n# the cursor is `workspace/sessions/<sid>/dm-bind.cursor` (the last seen sort\n# key from `hq dm channel --json`). `listen` is meant to run detached\n# (Bash run_in_background): it exits 0 and prints the new messages the moment\n# one lands, exits 3 on timeout with nothing new.\n#\n# Every post opens with an @-mention of every other member of the channel, so\n# the update reaches people (HQ mentions are structured: the `hq` CLI resolves\n# the `@\"Display Name\"` tokens against the roster and sends the real mention\n";
+export declare const DM_BIND_HELP = "# hq-dm-bind.sh \u2014 bind the current session to one HQ DM channel, post\n# structured updates to it, and listen for replies (feedback / requests).\n#\n# Usage:\n#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to \"now\"\n#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor\n#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]\n#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)\n#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)\n#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention\n#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it\n#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]\n#                                                             # block until a new message arrives (or timeout)\n#   core/scripts/hq-dm-bind.sh unbind\n#\n# The binding lives in the session's meta.yaml (`dm_channel`) via hq-session.sh;\n# the cursor is `workspace/sessions/<sid>/dm-bind.cursor` (the last seen sort\n# key from `hq dm channel --json`). `listen` is meant to run detached\n# (Bash run_in_background): it exits 0 and prints the new messages the moment\n# one lands, exits 3 on timeout with nothing new.\n#\n# Every post opens with an @-mention of every other member of the channel, so\n# the update reaches people (HQ mentions are structured: the `hq` CLI resolves\n# the `@\"Display Name\"` tokens against the roster and sends the real mention\n# list; an unresolvable name fails the post rather than posting text that looks\n# addressed but is not). The CLI rewrites a resolved `@\"Display Name\"` token to\n# `@Display Name`, so the room never shows the quotes.\n#\n# Posts thread by topic. The first post on a topic (`--topic`, else the title)\n# is a top-level root; every later post on the same topic in this session goes\n# out as a reply under it. `--under <id>` replies under an existing thread that\n# someone else (or an earlier session) started \u2014 a top-level post is only for a\n# subject the channel has no thread for yet. `--new-thread` starts a fresh root. The topic \u2192 root\n# map is `workspace/sessions/<sid>/dm-bind.threads`.\n#\n# A post ALWAYS mentions someone. `--to <name>` (repeatable) narrows the line to\n# the named members, for a reply to one person; without it the line names every\n# other human member (bots are left out unless named with --to, because a tagged\n# bot wakes and replies). There is no way to post unmentioned: an update nobody is\n# notified about does not get read. `post` refuses when the roster cannot be\n# read rather than sending a silent update.\n#\n# Post format (kept deliberately plain \u2014 see .claude/skills/dm-bind/SKILL.md):\n#   @\"Ada Lovelace\" @\"Grace Hopper\"\n#\n#   <title> \u2014 <state>\n#\n#   \u2022 line\n#   \u2022 line\n#\n#   Next: line\n#   Need from you: line\n";
 export type DmBindDeps = {
     root: string;
     cwd: string;

package/dist/commands/core-dm-bind-native.js

@@ -3,54 +3,50 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 import { bundledShellUnboundValue, registerNativeUtility, utilityError } from "./core-native-utilities.js";
 export const DM_BIND_ASSET = "core/scripts/hq-dm-bind.sh";
-export const DM_BIND_HELP = `# hq-dm-bind.sh — bind the current session to one HQ DM channel, post
-# structured updates to it, and listen for replies (feedback / requests).
-#
-# Usage:
-#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to "now"
-#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor
-#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]
-#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)
-#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)
-#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention
-#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it
-#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]
-#                                                             # block until a new message arrives (or timeout)
-#   core/scripts/hq-dm-bind.sh unbind
-#
-# The binding lives in the session's meta.yaml (\`dm_channel\`) via hq-session.sh;
-# the cursor is \`workspace/sessions/<sid>/dm-bind.cursor\` (the last seen sort
-# key from \`hq dm channel --json\`). \`listen\` is meant to run detached
-# (Bash run_in_background): it exits 0 and prints the new messages the moment
-# one lands, exits 3 on timeout with nothing new.
-#
-# Every post opens with an @-mention of every other member of the channel, so
-# the update reaches people (HQ mentions are structured: the \`hq\` CLI resolves
-# the \`@"Display Name"\` tokens against the roster and sends the real mention
-`;
-export const createDmBindDeps = (root, cwd, env, now, home = env.HOME || os.homedir()) => ({
-    root, cwd, env, home, now, fs,
-    runHq: (args, childEnv) => {
-        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
-        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
-    },
-    runHqSession: (args, childEnv) => {
-        const result = spawnSync("bash", [path.join(root, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
-        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
-    },
-    fetch: globalThis.fetch,
-    readStdin: () => new Promise((resolve, reject) => {
-        let data = "";
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk) => { data += chunk; });
-        process.stdin.on("end", () => resolve(data));
-        process.stdin.on("error", reject);
-    }),
-    sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-});
+export const DM_BIND_HELP = "# hq-dm-bind.sh \u2014 bind the current session to one HQ DM channel, post\n# structured updates to it, and listen for replies (feedback / requests).\n#\n# Usage:\n#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to \"now\"\n#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor\n#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]\n#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)\n#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)\n#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention\n#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it\n#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]\n#                                                             # block until a new message arrives (or timeout)\n#   core/scripts/hq-dm-bind.sh unbind\n#\n# The binding lives in the session's meta.yaml (`dm_channel`) via hq-session.sh;\n# the cursor is `workspace/sessions/<sid>/dm-bind.cursor` (the last seen sort\n# key from `hq dm channel --json`). `listen` is meant to run detached\n# (Bash run_in_background): it exits 0 and prints the new messages the moment\n# one lands, exits 3 on timeout with nothing new.\n#\n# Every post opens with an @-mention of every other member of the channel, so\n# the update reaches people (HQ mentions are structured: the `hq` CLI resolves\n# the `@\"Display Name\"` tokens against the roster and sends the real mention\n# list; an unresolvable name fails the post rather than posting text that looks\n# addressed but is not). The CLI rewrites a resolved `@\"Display Name\"` token to\n# `@Display Name`, so the room never shows the quotes.\n#\n# Posts thread by topic. The first post on a topic (`--topic`, else the title)\n# is a top-level root; every later post on the same topic in this session goes\n# out as a reply under it. `--under <id>` replies under an existing thread that\n# someone else (or an earlier session) started \u2014 a top-level post is only for a\n# subject the channel has no thread for yet. `--new-thread` starts a fresh root. The topic \u2192 root\n# map is `workspace/sessions/<sid>/dm-bind.threads`.\n#\n# A post ALWAYS mentions someone. `--to <name>` (repeatable) narrows the line to\n# the named members, for a reply to one person; without it the line names every\n# other human member (bots are left out unless named with --to, because a tagged\n# bot wakes and replies). There is no way to post unmentioned: an update nobody is\n# notified about does not get read. `post` refuses when the roster cannot be\n# read rather than sending a silent update.\n#\n# Post format (kept deliberately plain \u2014 see .claude/skills/dm-bind/SKILL.md):\n#   @\"Ada Lovelace\" @\"Grace Hopper\"\n#\n#   <title> \u2014 <state>\n#\n#   \u2022 line\n#   \u2022 line\n#\n#   Next: line\n#   Need from you: line\n";
+export const createDmBindDeps = (root, cwd, env, now, home = env.HOME || os.homedir()) => {
+    const d = {
+        root, cwd, env, home, now, fs,
+        runHq: (args, childEnv) => {
+            const envWithRoot = { ...childEnv, HQ_ROOT: root };
+            const spawnPlan = planHqSpawn(args, envWithRoot, cwd, d.platform ?? process.platform, (candidate) => {
+                try {
+                    return d.fs.statSync(candidate).isFile();
+                }
+                catch {
+                    return false;
+                }
+            });
+            const result = spawnSync(spawnPlan.cmd, spawnPlan.args, {
+                cwd,
+                env: envWithRoot,
+                encoding: "utf8",
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+            });
+            return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+        },
+        runHqSession: (args, childEnv) => {
+            const result = spawnSync("bash", [path.join(root, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
+            return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+        },
+        fetch: globalThis.fetch,
+        readStdin: () => new Promise((resolve, reject) => {
+            let data = "";
+            process.stdin.setEncoding("utf8");
+            process.stdin.on("data", (chunk) => { data += chunk; });
+            process.stdin.on("end", () => resolve(data));
+            process.stdin.on("error", reject);
+        }),
+        sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+    };
+    return d;
+};
 const DM_BIND_API_TIMEOUT_MS = 15_000;
 const fail = (message, code = 2) => utilityError(`hq-dm-bind: ${message}`, code);
 const sessionDirectory = (d, sid) => path.join(d.root, "workspace/sessions", sid);
@@ -89,19 +85,24 @@ function ensureDir(d, sid) {
     return directory;
 }
 function hasHqOnPath(d) {
+    if ((d.platform ?? process.platform) === "win32") {
+        return resolveWindowsExecutable("hq", d.env, (candidate) => {
+            try {
+                return d.fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        }, d.cwd) !== null;
+    }
     for (const directory of (d.env.PATH ?? "").split(path.delimiter)) {
         if (!directory)
             continue;
-        // runHq spawns "hq" without a shell. On Windows that resolves only .exe and
-        // .com files, and Windows file modes carry no execute bits, so accept exactly
-        // what the spawn can launch. npm's hq.cmd shim needs a shell and is not
-        // accepted here.
-        const windows = (d.platform ?? process.platform) === "win32";
-        const names = windows ? ["hq.exe", "hq.com"] : ["hq"];
+        const names = ["hq"];
         for (const name of names) {
             try {
                 const stat = d.fs.statSync(path.join(directory, name));
-                if (stat.isFile() && (windows || (stat.mode & 0o111) !== 0))
+                if (stat.isFile() && (stat.mode & 0o111) !== 0)
                     return true;
             }
             catch { /* PATH entry is absent */ }
@@ -646,6 +647,8 @@ async function listen(d, args) {
     return { code: 3, stdout: output, stderr: "" };
 }
 export async function runDmBind(args, deps) {
+    if (args[0] === "-h" || args[0] === "--help")
+        return { code: 0, stdout: DM_BIND_HELP, stderr: "" };
     if (!hasHqOnPath(deps))
         return fail("missing dependency: hq");
     const [command = "", ...rest] = args;

package/dist/commands/core-handoff-fast.js

@@ -2,6 +2,7 @@
 import { spawn, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 /**
  * `handoff finalize --help` is historically an unknown-argument error. Keep
  * that fast error path out of the large handoff implementation module.
@@ -48,20 +49,24 @@ export function handoffFinalizeHelpResult(args, root, tmpRoot = "/tmp") {
     return { code: 2, stdout: "", stderr: "Unknown arg: --help\n" };
 }
 async function launchHandoffPost(args, root) {
+    const childEnv = {
+        ...process.env,
+        HQ_ROOT: root,
+        CLAUDE_PROJECT_DIR: root,
+        PWD: root,
+        HQ_NATIVE_HANDOFF_POST_CHILD: "1",
+    };
+    const spawnPlan = planHqSpawn(["core", "--hq-root", root, "handoff", "post", ...args], childEnv, root);
     return await new Promise((resolve) => {
         try {
-            const child = spawn("hq", ["core", "--hq-root", root, "handoff", "post", ...args], {
+            const child = spawn(spawnPlan.cmd, spawnPlan.args, {
                 cwd: root,
-                env: {
-                    ...process.env,
-                    HQ_ROOT: root,
-                    CLAUDE_PROJECT_DIR: root,
-                    PWD: root,
-                    HQ_NATIVE_HANDOFF_POST_CHILD: "1",
-                },
+                env: childEnv,
                 detached: true,
                 windowsHide: true,
                 stdio: "ignore",
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
             });
             child.once("error", (error) => {
                 process.stderr.write(`${error.message}\n`);

package/dist/commands/core-handoff.js

@@ -1,5 +1,6 @@
 /** Native implementations of the handoff scaffold command family. */
 import { spawn, spawnSync } from "node:child_process";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -876,14 +877,17 @@ async function launchHandoffPost(args, root) {
                 delete childEnv[key];
         childEnv.PWD = shellDisplayPath(root);
     }
+    const spawnPlan = planHqSpawn(["core", "--hq-root", root, "handoff", "post", ...args], childEnv, root);
     return await new Promise((resolve) => {
         try {
-            const child = spawn("hq", ["core", "--hq-root", root, "handoff", "post", ...args], {
+            const child = spawn(spawnPlan.cmd, spawnPlan.args, {
                 cwd: root,
                 env: childEnv,
                 detached: true,
                 windowsHide: true,
                 stdio: "ignore",
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
             });
             child.once("error", (error) => resolve({ code: 127, stdout: "", stderr: `${error.message}\n` }));
             child.once("spawn", () => {
@@ -1036,11 +1040,15 @@ export function runHandoffPostWorker(args, context) {
                 log(`workspace-sync: skipped (thread mirror missing for ${company})`);
                 continue;
             }
-            const pushed = spawnSync("hq", ["sync", "push", "--company", company, `companies/${company}/workspace`], {
+            const syncArgs = ["sync", "push", "--company", company, `companies/${company}/workspace`];
+            const spawnPlan = planHqSpawn(syncArgs, process.env, root);
+            const pushed = spawnSync(spawnPlan.cmd, spawnPlan.args, {
                 cwd: root,
                 env: process.env,
                 encoding: "utf8",
                 stdio: ["ignore", "pipe", "pipe"],
+                shell: spawnPlan.shell,
+                ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
             });
             recordCommand(logMain, {
                 code: pushed.status ?? 1,

package/dist/commands/core-native-family-flag.d.ts

@@ -0,0 +1,7 @@
+/** Shared fail-safe readers for shipped native core families. */
+export declare function coreNativeFamilyEnabled(flagKey: string): Promise<boolean>;
+export declare const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
+export declare const CORE_NATIVE_ONTOLOGY_FLAG = "core-native-ontology";
+export declare function coreNativeDelegateEnabled(): Promise<boolean>;
+export declare function coreNativeOntologyEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-native-family-flag.d.ts.map

package/dist/commands/core-native-family-flag.js

@@ -0,0 +1,21 @@
+/** Shared fail-safe readers for shipped native core families. */
+import { readLocalOverride } from "@indigoai-us/hq-flags-client";
+export async function coreNativeFamilyEnabled(flagKey) {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    const override = readLocalOverride(flagKey, process.env);
+    if (override !== null)
+        return override;
+    return resolveProcessFlagGate(flagKey, { fallback: true }, () => true, undefined, {
+        acceptStaleSnapshot: true,
+        killSwitchWithoutCompany: true,
+    });
+}
+export const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
+export const CORE_NATIVE_ONTOLOGY_FLAG = "core-native-ontology";
+export function coreNativeDelegateEnabled() {
+    return import("../lib/flag-registry.js").then(({ resolveProcessFlagGate }) => resolveProcessFlagGate(CORE_NATIVE_DELEGATE_FLAG, { fallback: false }, () => false));
+}
+export function coreNativeOntologyEnabled() {
+    return coreNativeFamilyEnabled(CORE_NATIVE_ONTOLOGY_FLAG);
+}
+//# sourceMappingURL=core-native-family-flag.js.map

package/dist/commands/core-native-handoff-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for the native Wave 2 worktree/resume helpers. */
 export const CORE_NATIVE_HANDOFF_FLAG = "core-native-handoff";
 export async function coreNativeHandoffEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_HANDOFF_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_HANDOFF_FLAG);
 }
 //# sourceMappingURL=core-native-handoff-flag.js.map

package/dist/commands/core-native-hook-helpers-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for Wave 8 hook-time helper commands. */
 export const CORE_NATIVE_HOOK_HELPERS_FLAG = "core-native-hook-helpers";
 export async function coreNativeHookHelpersEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_HOOK_HELPERS_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_HOOK_HELPERS_FLAG);
 }
 //# sourceMappingURL=core-native-hook-helpers-flag.js.map

package/dist/commands/core-native-jobs-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for the native scheduled-jobs helpers. */
 export const CORE_NATIVE_JOBS_FLAG = "core-native-jobs";
 export async function coreNativeJobsEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_JOBS_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_JOBS_FLAG);
 }
 //# sourceMappingURL=core-native-jobs-flag.js.map

package/dist/commands/core-native-policy-flag.js

@@ -6,7 +6,7 @@
  */
 export const CORE_NATIVE_POLICY_FLAG = 'core-native-policy';
 export async function coreNativePolicyEnabled() {
-    const { resolveProcessFlagGate } = await import('../lib/flag-registry.js');
-    return resolveProcessFlagGate(CORE_NATIVE_POLICY_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import('./core-native-family-flag.js');
+    return coreNativeFamilyEnabled(CORE_NATIVE_POLICY_FLAG);
 }
 //# sourceMappingURL=core-native-policy-flag.js.map

package/dist/commands/core-native-session-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for native session and Stop-hook plumbing. */
 export const CORE_NATIVE_SESSION_FLAG = "core-native-session";
 export async function coreNativeSessionEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_SESSION_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_SESSION_FLAG);
 }
 //# sourceMappingURL=core-native-session-flag.js.map

package/dist/commands/core-native-utilities-flag.js

@@ -1,7 +1,7 @@
 /** Default-off rollout gate for native operator utility commands. */
 export const CORE_NATIVE_UTILITIES_FLAG = "core-native-utilities";
 export async function coreNativeUtilitiesEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_UTILITIES_FLAG, { fallback: false }, () => false);
+    const { coreNativeFamilyEnabled } = await import("./core-native-family-flag.js");
+    return coreNativeFamilyEnabled(CORE_NATIVE_UTILITIES_FLAG);
 }
 //# sourceMappingURL=core-native-utilities-flag.js.map

package/dist/commands/core-ontology-native.js

@@ -1170,8 +1170,8 @@ export function registerCoreOntologyNativeCommands(ontology, rootFor) {
             const forwarded = commandIndex >= 0 ? argv.slice(commandIndex + 1)
                 : commandContext.args.length > 0 ? commandContext.args : args;
             const liveRoot = entry.root === "live" ? rootFor() : process.cwd();
-            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-            if (!resolveProcessFlagGate(FLAG, { fallback: false }, () => false)) {
+            const { coreNativeOntologyEnabled } = await import("./core-native-family-flag.js");
+            if (!await coreNativeOntologyEnabled()) {
                 const result = runBundledScript({
                     asset: `${ASSET}${entry.asset}`,
                     args: forwarded,

package/dist/commands/core-refresh-vault-access-native.js

@@ -2,8 +2,10 @@
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
 import { registerNativeUtility } from "./core-native-utilities.js";
+import { planHqSpawn } from "../utils/hq-spawn.js";
 export const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
 export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
 # refresh-vault-access.sh — build/refresh the local vault-access manifest that
@@ -39,7 +41,15 @@ export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
 #
 `.replace(/^# ?/gm, "");
 function defaultHq(args, cwd, env) {
-    const result = spawnSync("hq", args, { cwd, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const spawnPlan = planHqSpawn(args, env, cwd);
+    const result = spawnSync(spawnPlan.cmd, spawnPlan.args, {
+        cwd,
+        env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: spawnPlan.shell,
+        ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    });
     if (result.error)
         return { code: 127, stdout: "", stderr: result.error.message, missing: result.error.code === "ENOENT" };
     return { code: result.status ?? 128, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "") };
@@ -47,6 +57,9 @@ function defaultHq(args, cwd, env) {
 function executableOnPath(name, value) {
     if (!value)
         return false;
+    if (process.platform === "win32" && name === "hq") {
+        return resolveWindowsExecutable(name, { PATH: value }) !== null;
+    }
     for (const directory of value.split(path.delimiter)) {
         if (!directory)
             continue;

package/dist/fast-core.d.ts

@@ -7,17 +7,26 @@
  * module. The registration in `core.ts` remains the complete fallback path.
  */
 import { parseFastCore } from "./fast-scaffold.js";
+type RecoveredModule<T> = {
+    module?: T;
+    reexecStatus?: number;
+};
+type RecoverFastImportOptions = {
+    reexecOnSettled?: boolean;
+};
+type RecoverFastImport = <T>(load: () => Promise<T>, options?: RecoverFastImportOptions) => Promise<RecoveredModule<T>>;
 export declare function readStdinIfPiped(stream: NodeJS.ReadStream, maxBytes?: number): Promise<string>;
 /**
  * Run the fast-path core command named in `argv` and exit with its code.
  * Only call when {@link isFastCoreRequest} is true; a non-match returns without
  * doing anything.
  */
-export declare function runFastCore(argv: readonly string[], parsed?: ReturnType<typeof parseFastCore>): Promise<void>;
+export declare function runFastCore(argv: readonly string[], parsed?: ReturnType<typeof parseFastCore>, recoverImport?: RecoverFastImport): Promise<void>;
 /**
  * Resolve valid explicit roots for the two measured hook routes without loading
  * the general root resolver. Anything uncertain falls through to that resolver,
  * which retains its diagnostics and cwd-discovery behavior.
  */
 export declare function resolveExplicitFastLiveRoot(hqRootArg: string | undefined, env: NodeJS.ProcessEnv): string | undefined;
+export {};
 //# sourceMappingURL=fast-core.d.ts.map

package/dist/fast-core.js

@@ -9,7 +9,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { parseFastCore } from "./fast-scaffold.js";
+import { isDefaultOnFastFamily, parseFastCore } from "./fast-scaffold.js";
 const FAST_ROUTE_PROFILE_TOKEN = "hq-fast-route";
 function wantsFastRouteProfile(env) {
     return env.NODE_DEBUG === FAST_ROUTE_PROFILE_TOKEN;
@@ -33,7 +33,7 @@ export async function readStdinIfPiped(stream, maxBytes) {
  * Only call when {@link isFastCoreRequest} is true; a non-match returns without
  * doing anything.
  */
-export async function runFastCore(argv, parsed = parseFastCore(argv)) {
+export async function runFastCore(argv, parsed = parseFastCore(argv), recoverImport = async (load) => ({ module: await load() })) {
     if (!parsed)
         return;
     const profile = wantsFastRouteProfile(process.env);
@@ -50,18 +50,47 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     let familyEnabled = true;
     if (entry.kind === "native" && entry.familyFlagKey) {
         const envOverride = localBooleanFlagOverride(entry.familyFlagKey, process.env);
-        familyEnabled = envOverride ?? await (await import("./native-fast-route.js")).fastFlagEnabled(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
+        if (envOverride !== null) {
+            familyEnabled = envOverride;
+        }
+        else {
+            const loaded = await recoverImport(() => import("./native-fast-route.js"));
+            if (loaded.reexecStatus !== undefined) {
+                process.exitCode = loaded.reexecStatus;
+                return;
+            }
+            if (!loaded.module)
+                throw new Error("Native fast-route module did not load");
+            const { fastFlagEnabled, fastFlagEnabledDefaultOn } = loaded.module;
+            const readFamilyFlag = isDefaultOnFastFamily(entry.familyFlagKey)
+                ? fastFlagEnabledDefaultOn
+                : fastFlagEnabled;
+            familyEnabled = await readFamilyFlag(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
+        }
     }
     if (entry.kind === "native" && entry.fallbackToCommandGraph && !familyEnabled) {
-        const { runCli } = await import("./main.js");
-        await runCli();
+        const loaded = await recoverImport(() => import("./main.js"));
+        if (loaded.reexecStatus !== undefined) {
+            process.exitCode = loaded.reexecStatus;
+            return;
+        }
+        if (!loaded.module)
+            throw new Error("Main command graph did not load");
+        await loaded.module.runCli();
         return;
     }
     familyFlagMs = profileElapsed(profileStart, profileMark());
     const useShell = entry.kind === "native" && Boolean(entry.familyFlagKey) && !familyEnabled;
     let worktreeScopeFixEnabled;
     if (entry.name === "repo-run-registry") {
-        const { coreRrrWorktreeScopeFixFastFlagEnabled } = await import("./commands/core-rrr-worktree-scope-fix-fast-flag.js");
+        const loaded = await recoverImport(() => import("./commands/core-rrr-worktree-scope-fix-fast-flag.js"));
+        if (loaded.reexecStatus !== undefined) {
+            process.exitCode = loaded.reexecStatus;
+            return;
+        }
+        if (!loaded.module)
+            throw new Error("Repo-run-registry flag module did not load");
+        const { coreRrrWorktreeScopeFixFastFlagEnabled } = loaded.module;
         worktreeScopeFixEnabled = await coreRrrWorktreeScopeFixFastFlagEnabled(process.env);
     }
     const shouldInjectRoot = useShell
@@ -87,14 +116,27 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
             hqRoot = shortcutRoot;
         }
         else {
-            const { resolveLiveRoot } = await import("./utils/hq-roots-core.js");
+            const loaded = await recoverImport(() => import("./utils/hq-roots-core.js"));
+            if (loaded.reexecStatus !== undefined) {
+                process.exitCode = loaded.reexecStatus;
+                return;
+            }
+            if (!loaded.module)
+                throw new Error("HQ root resolver did not load");
+            const { resolveLiveRoot } = loaded.module;
             try {
                 hqRoot = resolveLiveRoot(parsed.hqRootArg ? { hqRoot: parsed.hqRootArg } : {});
             }
             catch {
                 if (entry.kind === "native") {
-                    const { runCli } = await import("./main.js");
-                    await runCli();
+                    const loaded = await recoverImport(() => import("./main.js"));
+                    if (loaded.reexecStatus !== undefined) {
+                        process.exitCode = loaded.reexecStatus;
+                        return;
+                    }
+                    if (!loaded.module)
+                        throw new Error("Main command graph did not load");
+                    await loaded.module.runCli();
                     return;
                 }
                 hqRoot = undefined;
@@ -104,9 +146,22 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     rootResolutionMs = profileElapsed(rootResolutionStartedAt, profileMark());
     if (entry.kind === "native" && !useShell) {
         const handlerImportStartedAt = profileMark();
-        const { installFastPathStreamErrorHandlers } = await import("./utils/fast-stream-errors.js");
-        installFastPathStreamErrorHandlers();
-        const handlerModule = await import(entry.modulePath);
+        const errorHandlers = await recoverImport(() => import("./utils/fast-stream-errors.js"));
+        if (errorHandlers.reexecStatus !== undefined) {
+            process.exitCode = errorHandlers.reexecStatus;
+            return;
+        }
+        if (!errorHandlers.module)
+            throw new Error("Fast-path stream error handlers did not load");
+        errorHandlers.module.installFastPathStreamErrorHandlers();
+        const loadedHandler = await recoverImport(() => import(entry.modulePath));
+        if (loadedHandler.reexecStatus !== undefined) {
+            process.exitCode = loadedHandler.reexecStatus;
+            return;
+        }
+        if (!loadedHandler.module)
+            throw new Error("Native fast handler module did not load");
+        const handlerModule = loadedHandler.module;
         const handler = handlerModule[entry.exportName];
         if (typeof handler !== "function") {
             throw new Error(`Native fast handler ${entry.exportName} was not exported`);
@@ -131,8 +186,16 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
             if (!entry.fallbackToCommandGraph) {
                 throw new Error(`Native fast handler ${entry.exportName} requested an unavailable command-graph fallback`);
             }
-            const { runCli } = await import("./main.js");
-            await runCli();
+            // The fast handler has already run (and may have consumed stdin). If a
+            // torn main import is detected now, report it without replaying the command.
+            const loaded = await recoverImport(() => import("./main.js"), { reexecOnSettled: false });
+            if (loaded.reexecStatus !== undefined) {
+                process.exitCode = loaded.reexecStatus;
+                return;
+            }
+            if (!loaded.module)
+                throw new Error("Main command graph did not load");
+            await loaded.module.runCli();
             return;
         }
         // Let Node drain handler output before terminating. The timeout guard's
@@ -158,12 +221,20 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         ...(entry.name === "repo-run-registry" ? { HQ_FLAG_CORE_RRR_WORKTREE_SCOPE_FIX: String(worktreeScopeFixEnabled) } : {}),
     };
     // Keep the rollback runner off native commands' import path.
-    const { runBundledScript } = await import("./utils/run-bundled-script.js");
+    const runner = await recoverImport(() => import("./utils/run-bundled-script.js"));
+    if (runner.reexecStatus !== undefined) {
+        process.exitCode = runner.reexecStatus;
+        return;
+    }
+    if (!runner.module)
+        throw new Error("Bundled-script runner did not load");
+    const { runBundledScript } = runner.module;
     const { code } = runBundledScript({
         asset,
         args: parsed.args,
         cwd,
         ...(injectRoot ? { hqRoot } : {}),
+        msysScriptPath: process.platform === "win32",
         ...(Object.keys(childEnv).length ? { env: childEnv } : {}),
     });
     // Propagate verbatim: these scripts use their exit code as their interface.

package/dist/fast-scaffold.d.ts

@@ -49,6 +49,9 @@ export type FastScaffoldScript = {
     /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
     requiresNodeNetworkCompatibility?: boolean;
 };
+/** Family kill switches whose owner-approved default is enabled. */
+export declare const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS: readonly ["core-native-session", "core-native-hook-helpers", "core-native-policy", "core-native-utilities", "core-native-jobs", "core-native-ontology", "core-native-handoff"];
+export declare function isDefaultOnFastFamily(flagKey: string): boolean;
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export declare const FAST_SCAFFOLD_SCRIPTS: readonly FastScaffoldScript[];
 export type ParsedFastCore = {

package/dist/fast-scaffold.js

@@ -9,6 +9,20 @@
  * on every turn's Stop. The entrypoint routes eligible commands before loading
  * the graph, and this module holds the parser + table that routing needs.
  */
+/** Family kill switches whose owner-approved default is enabled. */
+export const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS = [
+    "core-native-session",
+    "core-native-hook-helpers",
+    "core-native-policy",
+    "core-native-utilities",
+    "core-native-jobs",
+    "core-native-ontology",
+    "core-native-handoff",
+];
+const defaultOnFamilyFlags = new Set(CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS);
+export function isDefaultOnFastFamily(flagKey) {
+    return defaultOnFamilyFlags.has(flagKey);
+}
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export const FAST_SCAFFOLD_SCRIPTS = [
     {

package/dist/index.js

@@ -59,6 +59,80 @@ async function runMainWithInstallTreeRecovery() {
         throw error;
     }
 }
+/**
+ * Fast-route imports happen before main.ts command registration, so the
+ * registration recovery seam cannot see a torn fast module unless each import
+ * is run through the same bounded recovery boundary. Imports before handler
+ * execution may re-exec after a settled repair; the post-handler fallback passes
+ * reexecOnSettled=false so a torn main import is reported without replaying the
+ * handler or losing the stdin it already consumed.
+ */
+const recoverFastImport = async (load, options = {}) => {
+    try {
+        return { module: await load() };
+    }
+    catch {
+        // Keep the clean hook path free of startup-registration's update-lock and
+        // package-root imports. Only a failed import pays for the recovery seam.
+        const { registerCommandsWithRecovery } = await import("./startup-registration.js");
+        let module;
+        try {
+            const result = await registerCommandsWithRecovery({
+                register: async () => {
+                    module = await load();
+                },
+                argv: process.argv,
+                env: process.env,
+                entryPath: fileURLToPath(import.meta.url),
+                stderr: process.stderr,
+                reexecOnSettled: options.reexecOnSettled,
+            });
+            return result.reexecStatus === undefined
+                ? { module }
+                : { reexecStatus: result.reexecStatus };
+        }
+        catch (error) {
+            // Fast-route imports precede main.ts/Sentry initialization. When recovery
+            // cannot repair a still-absent module, report it here as the registration
+            // path does instead of relying on the later unhandled-rejection boundary.
+            const installTree = await import("./utils/install-tree-torn.js");
+            if (!installTree.isInstallTreeTornError(error))
+                throw error;
+            process.stderr.write(`${installTree.installTreeTornStderrLine(error)}\n`);
+            const sentry = await import("./sentry.js");
+            sentry.initSentry();
+            sentry.Sentry.captureException(error, installTree.installTreeTornCaptureContext(error));
+            sentry.finishSentrySession();
+            await sentry.Sentry.flush(2_000);
+            return { reexecStatus: 1 };
+        }
+    }
+};
+async function runFastCoreWithRecovery(parsed) {
+    const loaded = await recoverFastImport(() => import("./fast-core.js"));
+    if (loaded.reexecStatus !== undefined) {
+        process.exitCode = loaded.reexecStatus;
+        return;
+    }
+    if (!loaded.module)
+        throw new Error("Fast core module did not load");
+    await loaded.module.runFastCore(process.argv, parsed, recoverFastImport);
+}
+async function runNativeFastRouteWithRecovery(parsed) {
+    const loaded = await recoverFastImport(() => import("./native-fast-route.js"));
+    if (loaded.reexecStatus !== undefined) {
+        process.exitCode = loaded.reexecStatus;
+        return;
+    }
+    if (!loaded.module)
+        throw new Error("Native fast-route module did not load");
+    if (await loaded.module.nativeFastRouteEnabled(process.argv)) {
+        await runFastCoreWithRecovery(parsed);
+    }
+    else {
+        await runMainWithInstallTreeRecovery();
+    }
+}
 function dispatchCliEntry() {
     const versionRequest = isVersionRequest(process.argv);
     const helpRequest = !versionRequest && isCommandHelpRequest(process.argv);
@@ -99,21 +173,13 @@ function dispatchCliEntry() {
         // An explicit enabled override has already decided the global gate. Skip the
         // snapshot reader import on hot native plumbing paths; runFastCore still
         // checks the command-family flag before choosing native or shell rollback.
-        void import("./fast-core.js").then(({ runFastCore }) => runFastCore(process.argv, parsedFastCore));
+        void runFastCoreWithRecovery(parsedFastCore);
     }
     else if (parsedFastCore?.entry.kind === "native") {
         // Native routes are default-off. Resolve the company-scoped persisted flag
         // without loading the command graph; a miss or stale snapshot takes the
         // existing full-graph route.
-        void import("./native-fast-route.js").then(async ({ nativeFastRouteEnabled }) => {
-            if (await nativeFastRouteEnabled(process.argv)) {
-                const { runFastCore } = await import("./fast-core.js");
-                await runFastCore(process.argv, parsedFastCore);
-            }
-            else {
-                await runMainWithInstallTreeRecovery();
-            }
-        });
+        void runNativeFastRouteWithRecovery(parsedFastCore);
     }
     else if (parseSecretsEnvFastRequest(process.argv)) {
         const request = parseSecretsEnvFastRequest(process.argv);
@@ -138,7 +204,7 @@ function dispatchCliEntry() {
         // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
         // dispatches straight to the bundled-script runner, so it never pays for the
         // ~60-module command graph main.ts imports. See src/fast-scaffold.ts.
-        void import("./fast-core.js").then(({ runFastCore }) => runFastCore(process.argv, parsedFastCore));
+        void runFastCoreWithRecovery(parsedFastCore);
     }
     else {
         // Keep the command lifecycle detached from module evaluation, as it was

package/dist/lib/flag-registry.d.ts

@@ -67,7 +67,10 @@ export declare function resolveFlagGate(reader: FlagReader | null | undefined, f
 /** Resolve one explicit company's flag without relying on process-wide binding. */
 export declare function resolveCompanyFlagGate(companyUid: string, idToken: string, flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, dependencies?: CompanyFlagGateDependencies): Promise<boolean>;
 /** Resolve a process gate against the shared snapshot reader, when configured. */
-export declare function resolveProcessFlagGate(flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, companyUid?: string): boolean;
+export declare function resolveProcessFlagGate(flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, companyUid?: string, options?: {
+    acceptStaleSnapshot?: boolean;
+    killSwitchWithoutCompany?: boolean;
+}): boolean;
 /**
  * The registry snapshot held by this process, or null when none has arrived
  * (no endpoint configured, offline, or still fetching). Callers that must

package/dist/lib/flag-registry.js

@@ -9,9 +9,9 @@ import { Worker } from "node:worker_threads";
 import { createFlagClient, isFlagSnapshot, readLocalOverride, resolveFlag, } from "@indigoai-us/hq-flags-client";
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
-import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { resolveFlagSnapshotCompanyUid, resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 import { registerFlagRegistryRefreshWaiter } from "./flag-registry-refresh-wait.js";
-import { flagSnapshotWriteFailureTags, readFlagSnapshotFile, writePersonFlagSnapshotFile, writeFlagSnapshotFile, } from "./flag-snapshot-file.js";
+import { flagSnapshotWriteFailureTags, readDefaultOnFlagSnapshot, readFlagSnapshotFile, writePersonFlagSnapshotFile, writeFlagSnapshotFile, } from "./flag-snapshot-file.js";
 function captureFlagRegistryException(error, tags, sentry) {
     if (!sentry)
         return;
@@ -348,10 +348,20 @@ export async function resolveCompanyFlagGate(companyUid, idToken, flagKey, looku
     }
 }
 /** Resolve a process gate against the shared snapshot reader, when configured. */
-export function resolveProcessFlagGate(flagKey, lookup, legacyFallback, companyUid) {
+export function resolveProcessFlagGate(flagKey, lookup, legacyFallback, companyUid, options = {}) {
+    const defaultOnKillSwitch = options.killSwitchWithoutCompany === true;
+    const resolvedCompanyUid = defaultOnKillSwitch
+        ? resolveFlagSnapshotCompanyUid()
+        : resolveProcessFlagCompanyContext().companyUid;
     const targetCompanyUid = companyUid ?? (processReader
-        ? refreshCompanyUid
-        : resolveProcessFlagCompanyContext().companyUid);
+        ? refreshCompanyUid ?? (defaultOnKillSwitch ? resolvedCompanyUid : undefined)
+        : resolvedCompanyUid);
+    if (!targetCompanyUid && defaultOnKillSwitch) {
+        const override = readLocalOverride(flagKey, process.env);
+        if (override !== null)
+            return override;
+        return readDefaultOnFlagSnapshot(flagKey);
+    }
     const processSnapshotMatchesTarget = refreshCompanyUid === targetCompanyUid;
     if (processReader && heldSnapshot && processSnapshotMatchesTarget) {
         return resolveFlagGate(processReader, flagKey, lookup, legacyFallback);
@@ -360,7 +370,9 @@ export function resolveProcessFlagGate(flagKey, lookup, legacyFallback, companyU
     // Use the last validated, fresh company snapshot in that window, and when
     // the process reader was initialized for a different company scope.
     if (targetCompanyUid) {
-        const cached = readFlagSnapshotFile(targetCompanyUid);
+        const cached = readFlagSnapshotFile(targetCompanyUid, options.acceptStaleSnapshot
+            ? { maxAgeMs: Number.POSITIVE_INFINITY }
+            : {});
         if (cached) {
             const snapshot = { version: 0, flags: cached.flags };
             const reader = createProcessSnapshotReader([targetCompanyUid], () => snapshot);

package/dist/lib/flag-snapshot-file.d.ts

@@ -37,4 +37,6 @@ export declare function readFlagSnapshotFile(companyUid: string, options?: {
     now?: number;
     maxAgeMs?: number;
 }): PersistedFlagSnapshot | null;
+/** Resolve a default-on kill switch from offline snapshots, allowing stale decisions. */
+export declare function readDefaultOnFlagSnapshot(flagKey: string, companyUid?: string, env?: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=flag-snapshot-file.d.ts.map

package/dist/lib/flag-snapshot-file.js

@@ -372,4 +372,34 @@ export function readFlagSnapshotFile(companyUid, options = {}) {
     }
     return primary;
 }
+/** Resolve a default-on kill switch from offline snapshots, allowing stale decisions. */
+export function readDefaultOnFlagSnapshot(flagKey, companyUid, env = process.env) {
+    const options = { env, maxAgeMs: Number.POSITIVE_INFINITY };
+    if (companyUid)
+        return readFlagSnapshotFile(companyUid, options)?.flags[flagKey] !== false;
+    const directories = new Set([path.dirname(personFlagSnapshotPath(env))]);
+    const fallbackProbe = fallbackSnapshotPath("cmp_000", false, env);
+    if (fallbackProbe)
+        directories.add(path.dirname(fallbackProbe));
+    for (const directory of directories) {
+        let names;
+        try {
+            names = fs.readdirSync(directory);
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            if (name === "snapshot-person.json") {
+                if (readPersonFlagSnapshotFile(options)?.flags[flagKey] === false)
+                    return false;
+                continue;
+            }
+            const match = /^snapshot-(cmp_[A-Za-z0-9]{3,128})\.json$/.exec(name);
+            if (match?.[1] && readFlagSnapshotFile(match[1], options)?.flags[flagKey] === false)
+                return false;
+        }
+    }
+    return true;
+}
 //# sourceMappingURL=flag-snapshot-file.js.map

package/dist/lib/process-flag-company-context.d.ts

@@ -3,4 +3,6 @@ import { type ProcessFlagCompanyContext } from "./process-flag-company-context-l
 export type { ProcessFlagCompanyContext } from "./process-flag-company-context-light.js";
 /** Resolve the same company identity the process-wide flag reader uses. */
 export declare function resolveProcessFlagCompanyContext(env?: NodeJS.ProcessEnv): ProcessFlagCompanyContext;
+/** Resolve the process scope, then the explicitly selected device default, without network access. */
+export declare function resolveFlagSnapshotCompanyUid(env?: NodeJS.ProcessEnv): string | undefined;
 //# sourceMappingURL=process-flag-company-context.d.ts.map

package/dist/lib/process-flag-company-context.js

@@ -1,5 +1,7 @@
 /** Company scope shared by the full flag registry and its fast-path reader. */
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
+import { readDeviceConfig } from "./work-context/config.js";
+import { workContextRoot } from "./work-context/paths.js";
 import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
 import { normalizedCompanyUid, resolveLightProcessFlagCompanyContext, } from "./process-flag-company-context-light.js";
 function companyUidForContext(context, env = process.env) {
@@ -20,4 +22,17 @@ export function resolveProcessFlagCompanyContext(env = process.env) {
         ...(context.companySlug ? { companySlug: context.companySlug } : {}),
     };
 }
+/** Resolve the process scope, then the explicitly selected device default, without network access. */
+export function resolveFlagSnapshotCompanyUid(env = process.env) {
+    const contextUid = resolveProcessFlagCompanyContext(env).companyUid;
+    if (contextUid)
+        return contextUid;
+    try {
+        const defaultCompany = readDeviceConfig({ root: workContextRoot(undefined, env) }).defaultCompany;
+        return defaultCompany?.enabled ? normalizedCompanyUid(defaultCompany.uid) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=process-flag-company-context.js.map

package/dist/native-fast-route.d.ts

@@ -1,10 +1,10 @@
-/** Default-off flag check for native entrypoint routes. */
+/** Fast-route flag check for native entrypoint routes. */
 export declare function nativeFastRouteEnabled(argv: readonly string[], env?: NodeJS.ProcessEnv): Promise<boolean>;
 /** Reads a default-off fast-route gate from its local override or fresh snapshot. */
 export declare function fastFlagEnabled(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
     numericEnvironmentOverride?: boolean;
 }): Promise<boolean>;
-/** Reads a fail-safe flag that stays enabled unless a fresh value disables it. */
+/** Reads an enabled-by-default flag; any validated explicit false stays a kill switch, even when stale. */
 export declare function fastFlagEnabledDefaultOn(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
     numericEnvironmentOverride?: boolean;
 }): Promise<boolean>;

package/dist/native-fast-route.js

@@ -1,11 +1,11 @@
-/** Default-off flag check for native entrypoint routes. */
+/** Fast-route flag check for native entrypoint routes. */
 import { localOverrideEnvVar, readLocalOverride } from "@indigoai-us/hq-flags-client";
 import { parseFastCore } from "./fast-scaffold.js";
 export async function nativeFastRouteEnabled(argv, env = process.env) {
     const parsed = parseFastCore(argv);
     if (!parsed || parsed.entry.kind !== "native")
         return false;
-    return fastFlagEnabled(parsed.entry.flagKey, env);
+    return fastFlagEnabledDefaultOn(parsed.entry.flagKey, env);
 }
 /** Reads a default-off fast-route gate from its local override or fresh snapshot. */
 export async function fastFlagEnabled(flagKey, env = process.env, options = {}) {
@@ -28,20 +28,18 @@ export async function fastFlagEnabled(flagKey, env = process.env, options = {})
         return false;
     }
 }
-/** Reads a fail-safe flag that stays enabled unless a fresh value disables it. */
+/** Reads an enabled-by-default flag; any validated explicit false stays a kill switch, even when stale. */
 export async function fastFlagEnabledDefaultOn(flagKey, env = process.env, options = {}) {
     try {
         const override = nativeRouteOverride(flagKey, env, options.numericEnvironmentOverride !== false);
         if (override !== null)
             return override;
-        const [{ resolveProcessFlagCompanyContext }, { readFlagSnapshotFile }] = await Promise.all([
+        const [{ resolveFlagSnapshotCompanyUid }, { readDefaultOnFlagSnapshot }] = await Promise.all([
             import("./lib/process-flag-company-context.js"),
             import("./lib/flag-snapshot-file.js"),
         ]);
-        const { companyUid } = resolveProcessFlagCompanyContext(env);
-        if (!companyUid)
-            return true;
-        return readFlagSnapshotFile(companyUid, { env })?.flags[flagKey] !== false;
+        const companyUid = resolveFlagSnapshotCompanyUid(env);
+        return readDefaultOnFlagSnapshot(flagKey, companyUid, env);
     }
     catch {
         // This flag is a kill switch: missing scope or cache data must leave the feature enabled.

package/dist/startup-registration.d.ts

@@ -88,6 +88,8 @@ export interface RegisterCommandsWithRecoveryArgs {
     /** The RUNNING install's own `dist/index.js` — the safe re-exec target. */
     entryPath: string;
     stderr: Pick<typeof process.stderr, "write">;
+    /** False when command execution already happened and must not be replayed. */
+    reexecOnSettled?: boolean;
     deps?: RegisterRecoveryDeps;
 }
 export interface RegisterCommandsWithRecoveryResult {

package/dist/startup-registration.js

@@ -179,6 +179,26 @@ export async function registerCommandsWithRecovery(args) {
         const treeState = result.sawLock || result.sawRetired || result.sawTreeChange
             ? "in_flight"
             : "stale";
+        if (args.reexecOnSettled === false) {
+            throw new InstallTreeTornError({
+                cause: err,
+                classified,
+                packageRoot,
+                versionGatePhase: readVersionGatePhase(deps),
+                outcome: "replay-unsafe",
+                treeState,
+                attempt: 1,
+                waitedMs: result.waitedMs,
+                sawLock: result.sawLock,
+                sawRetired: result.sawRetired,
+                retiredSiblingPresent: result.retiredSiblingPresent,
+                retiredSiblingKind: result.retiredSiblingKind,
+                installTargetState: result.installTargetState,
+                updaterPidAlive: result.updaterPidAlive,
+                sawTreeChange: result.sawTreeChange,
+                lockTool: result.lockTool,
+            });
+        }
         const child = spawn(process.execPath, [...execArgv, entryPath, ...argv.slice(2)], {
             stdio: "inherit",
             env: {

package/dist/utils/hq-spawn.d.ts

@@ -0,0 +1,4 @@
+import { type SpawnPlan } from "./windows-spawn.js";
+/** Resolve the installed hq executable before applying the platform spawn plan. */
+export declare function planHqSpawn(args: readonly string[], env: NodeJS.ProcessEnv, cwd: string, platform?: NodeJS.Platform, existsSync?: (candidate: string) => boolean): SpawnPlan;
+//# sourceMappingURL=hq-spawn.d.ts.map

package/dist/utils/hq-spawn.js

@@ -0,0 +1,11 @@
+import * as fs from "node:fs";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { planResolvedCommandSpawn } from "./windows-spawn.js";
+/** Resolve the installed hq executable before applying the platform spawn plan. */
+export function planHqSpawn(args, env, cwd, platform = process.platform, existsSync = fs.existsSync) {
+    const executable = platform === "win32"
+        ? resolveWindowsExecutable("hq", env, existsSync, cwd) ?? "hq"
+        : "hq";
+    return planResolvedCommandSpawn(executable, args, env, platform);
+}
+//# sourceMappingURL=hq-spawn.js.map

package/dist/utils/install-tree-torn.d.ts

@@ -336,7 +336,7 @@ export interface InstallRewriteSignalArgs {
  */
 export declare function installRewriteInProgress(args: InstallRewriteSignalArgs): boolean;
 /** The recovery OUTCOME, which — not the dialect — decides capture. */
-export type InstallTreeTornOutcome = "guarded" | "unsettled" | "reexec-failed" | "lock-held" | "stale_tree" | "retired_unverified";
+export type InstallTreeTornOutcome = "guarded" | "replay-unsafe" | "unsettled" | "reexec-failed" | "lock-held" | "stale_tree" | "retired_unverified";
 type InstallTreeState = "in_flight" | "stale";
 export type InstallTreeTornDiagnostics = {
     dialect: ModuleErrorDialect;

package/dist/utils/resident-package-preload.js

@@ -42,7 +42,7 @@ export const RESIDENT_PACKAGE_MODULES = {
     "bot-logs-follow": [],
     mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../lib/anywhere-person-setting.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client"],
     childWrapper: ["../main.js", "../lib/service-manager/startup-migration.js"],
-    coreJobRun: ["../lib/flag-registry.js"],
+    coreJobRun: ["../commands/core-native-jobs-flag.js", "../commands/core-native-family-flag.js", "../lib/flag-registry.js", "../lib/flag-snapshot-file.js"],
     "daemon-call": ["../lib/daemon/protocol.js"],
     daemon: [
         "../sentry.js",
@@ -203,7 +203,10 @@ const LOADERS = {
         () => import("../lib/service-manager/startup-migration.js"),
     ],
     coreJobRun: [
+        () => import("../commands/core-native-jobs-flag.js"),
+        () => import("../commands/core-native-family-flag.js"),
         () => import("../lib/flag-registry.js"),
+        () => import("../lib/flag-snapshot-file.js"),
     ],
     "daemon-call": [
         () => import("../lib/daemon/protocol.js"),

package/dist/utils/sentry-fingerprint.js

@@ -185,6 +185,7 @@ const KNOWN_INSTALL_TREE_UPDATERS = new Map([
 ]);
 const KNOWN_INSTALL_TREE_OUTCOMES = new Set([
     "guarded",
+    "replay-unsafe",
     "unsettled",
     "reexec-failed",
     "lock-held",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.68",
+  "version": "5.345.70",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {