@indigoai-us/hq-cli 5.345.74 → 5.345.75

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.345.75] — 2026-10-10
+
+- Native delegate manifest updates now use mode 0600 on POSIX, matching the
+  shell commands and preventing the manifest from becoming readable by other
+  local users.
+- Lane lifecycle delivery, worker continuity, status-row fields, and operator-requested orphan stopping now stay enabled when their hq-flags registry rows are missing or unavailable.
+- `hq uninstall --global --runtime codex` is now idempotent: on a machine with
+  no global Codex installation it reports that there is nothing to remove and
+  exits successfully.
+- Delegate send now stops before DM delivery and reports the shell-compatible
+  error when saving the `sending` state fails.
+
 ## [5.345.74] — 2026-10-10
 
 - Lane envelope repair prompts now identify parser locations and schema fields,

package/assets/scaffold/core/scripts/hq-delegate-pickup.sh

@@ -59,9 +59,13 @@ case "$STATUS" in
 esac
 
 record_pickup() { # <kind> <detail>
-  jq --arg now "$NOW" --arg k "$1" --arg d "$2" \
+  local TMP_MANIFEST
+  TMP_MANIFEST="$(mktemp "${MANIFEST}.tmp.XXXXXX")" || exit 1
+  if ! jq --arg now "$NOW" --arg k "$1" --arg d "$2" \
     '.status = "picked-up" | .pickedUpAt = $now | .pickup = {kind: $k, detail: $d, recordedAt: $now}' \
-    "$MANIFEST" > "$MANIFEST.tmp" && mv "$MANIFEST.tmp" "$MANIFEST"
+    "$MANIFEST" > "$TMP_MANIFEST" || ! mv "$TMP_MANIFEST" "$MANIFEST"; then
+    rm -f "$TMP_MANIFEST"
+  fi
   echo "hq-delegate-pickup: $NAME picked up the delegation ($1) — status advanced to 'picked-up'"
   exit 0
 }
@@ -93,7 +97,10 @@ if [ "$age_h" -lt "$WINDOW" ]; then
   exit 6
 fi
 reason="no pickup evidence from $NAME within ${WINDOW}h of send (${SENT_AT:-unknown}): no acknowledgement, no commit by $TO on ${BRANCH:-the branch}"
-jq --arg now "$NOW" --arg r "$reason" '.status = "failed" | .failedAt = $now | .failure = {reason: $r, recordedAt: $now}' \
-  "$MANIFEST" > "$MANIFEST.tmp" && mv "$MANIFEST.tmp" "$MANIFEST"
+TMP_MANIFEST="$(mktemp "${MANIFEST}.tmp.XXXXXX")" || exit 1
+if ! jq --arg now "$NOW" --arg r "$reason" '.status = "failed" | .failedAt = $now | .failure = {reason: $r, recordedAt: $now}' \
+  "$MANIFEST" > "$TMP_MANIFEST" || ! mv "$TMP_MANIFEST" "$MANIFEST"; then
+  rm -f "$TMP_MANIFEST"
+fi
 echo "hq-delegate-pickup: FAILED — $reason. Re-send with a direct ask, or hand it to someone else." >&2
 exit 5

package/dist/commands/core-delegate-w1b.js

@@ -174,6 +174,23 @@ function parseFlags(args, allowed) {
 }
 function usage(name) { return USAGE[name] ?? ""; }
 function usageFailure(name) { err(usage(name)); return 1; }
+function grantHasDanglingManifestFlag(args) {
+    for (let i = 0; i < args.length;) {
+        const key = args[i] ?? "";
+        if (key === "--yes") {
+            i += 1;
+            continue;
+        }
+        if (key === "--manifest") {
+            if (i + 1 >= args.length)
+                return true;
+            i += 2;
+            continue;
+        }
+        return false;
+    }
+    return false;
+}
 function bashPath(value) {
     if (process.platform !== "win32")
         return value;
@@ -205,6 +222,10 @@ function runBundle(args, context, onMalformedWhoami) {
     const root = context.root ?? context.cwd;
     if (args[0] !== "build")
         return usageFailure("bundle");
+    // The shell uses `shift 2` for these options. With no value at end of argv,
+    // Bash exits nonzero before it reaches the required-field diagnostics.
+    if (["--company", "--project", "--to", "--to-kind", "--to-name", "--mode"].includes(args.at(-1) ?? ""))
+        return 1;
     const parsed = parseFlags(args.slice(1), ["--company", "--project", "--to", "--to-kind", "--to-name", "--mode", "--dry-run"]);
     if (parsed.help) {
         out(usage("bundle"));
@@ -326,7 +347,7 @@ function runBundle(args, context, onMalformedWhoami) {
     const next = stories.filter((story) => !isRecord(story) || story.passes !== true)
         .sort((a, b) => Number(getPath(a, "priority", 0)) - Number(getPath(b, "priority", 0))).slice(0, 3);
     const doneList = done.map((story) => `- ${text(getPath(story, "id"))}: ${text(getPath(story, "title"))}`).join("\n");
-    const nextList = next.map((story) => `### ${text(getPath(story, "id"))}: ${text(getPath(story, "title"))}\n\n${text(getPath(story, "description"))}\n`).join("\n");
+    const nextList = next.map((story) => `### ${text(getPath(story, "id"))}: ${text(getPath(story, "title"))}\n\n${text(getPath(story, "description"))}\n`).join("\n").replace(/\n+$/, "");
     const questions = list(getPath(prd, "metadata.openQuestions", [])).map((entry) => `- ${text(entry)}`).join("\n");
     const traps = [
         ...list(getPath(prd, "metadata.securityNotes", [])),
@@ -410,6 +431,10 @@ const ACL_FILTER = `
     (.direct | type == "array") and (.exists | type == "boolean")
   `;
 function runGrant(args, context) {
+    // The shell companion's `shift 2` runs under `set -e`; a final bare
+    // --manifest exits 1 without diagnostics. Preserve that observable contract.
+    if (grantHasDanglingManifestFlag(args))
+        return 1;
     const parsed = parseFlags(args, ["--manifest", "--yes"]);
     if (parsed.help) {
         out(usage("grant"));
@@ -618,10 +643,14 @@ function runGrant(args, context) {
     out(`hq-delegate-grant: all ${prefixes.length} grants verified — manifest status advanced to 'granted'\n`);
     return 0;
 }
-function atomicCopy(source, target) {
+function atomicCopy(source, target, mode) {
     const temporary = `${target}.tmp.${process.pid}.${Math.random().toString(16).slice(2)}`;
     try {
-        fs.copyFileSync(source, temporary);
+        const contents = fs.readFileSync(source);
+        if (mode === undefined)
+            fs.writeFileSync(temporary, contents, { flag: "wx" });
+        else
+            fs.writeFileSync(temporary, contents, { flag: "wx", mode });
         moveFile(temporary, target);
     }
     catch (error) {
@@ -745,9 +774,9 @@ function runPublish(args, context) {
         if (shareSession.test(fs.readFileSync(stagedManifest, "utf8")) || shareSession.test(fs.readFileSync(stagedBrief, "utf8")))
             return fail("publish", "share-session capability in dossier; nothing published");
         fs.mkdirSync(dest, { recursive: true });
-        atomicCopy(stagedBrief, path.join(dest, "BRIEF.md"));
-        atomicCopy(stagedManifest, path.join(dest, "manifest.json"));
-        atomicCopy(stagedManifest, manifestPath);
+        atomicCopy(stagedBrief, path.join(dest, "BRIEF.md"), 0o600);
+        atomicCopy(stagedManifest, path.join(dest, "manifest.json"), 0o600);
+        atomicCopy(stagedManifest, manifestPath, 0o600);
         const push = runHq(["sync", "push", `${relative}/`, "--company", company, "--on-conflict", "keep"], context, "inherit");
         if (push.code !== 0)
             return fail("publish", "final dossier push failed; resume publication");
@@ -775,7 +804,7 @@ function runPublish(args, context) {
         const publication = { verifiedAt: currentTime(), manifestPath: `${relative}/delegation/${id}/manifest.json`, files: receipts };
         const updated = { ...canonical, publication, recipientAccess: "unconfirmed" };
         fs.writeFileSync(stagedManifest, jsonText(updated));
-        atomicCopy(stagedManifest, manifestPath);
+        atomicCopy(stagedManifest, manifestPath, 0o600);
         out("hq-delegate-publish: canonical dossier bytes verified as sender; recipient access unconfirmed\n");
         return 0;
     }
@@ -794,6 +823,10 @@ function sortedJson(value) {
     return serializeJqJson(sort(value), "compact").replace(/\n+$/, "");
 }
 function runSend(args, context) {
+    // The shell shifts two arguments for value options. Under `set -e`, a
+    // trailing option without its value exits 1 before printing diagnostics.
+    if (["--manifest", "--headline", "--note"].includes(args.at(-1) ?? ""))
+        return 1;
     const parsed = parseFlags(args, ["--manifest", "--send", "--headline", "--note"]);
     if (parsed.help) {
         out(usage("send"));
@@ -884,7 +917,7 @@ function runSend(args, context) {
             const access = jqRawPath(manifest, "repo.accessNote");
             const branchCheck = branch ? subprocess("git", ["check-ref-format", "--branch", branch], context.cwd, { stdout: "ignore", stderr: "ignore" }) : { code: 1 };
             if (branch && branchCheck.code === 0 && sha) {
-                repoSection = `## Get the code\n\nThe work lives on branch \`${branch}\` (base: \`${base}\`) at \`${sha}\`.\n\n\`\`\`bash\n# From your HQ root; clone first if the repo is not present${remote ? ` (remote: ${remote})` : ""}:\ngit -C ${quoteBash(repoPath)} fetch origin\ngit -C ${quoteBash(repoPath)} switch -- ${quoteBash(branch)}\n\`\`\`${access ? `\n\n> ${access}` : ""}`;
+                repoSection = `## Get the code\n\nThe work lives on branch \`${branch}\` (base: \`${base}\`) at \`${sha}\`.\n\n\`\`\`bash\n# From your HQ root; clone first if the repo is not present${remote ? ` (remote: ${remote})` : ""}:\ngit -C ${quoteBash(repoPath)} fetch origin\ngit -C ${quoteBash(repoPath)} switch -- ${quoteBash(branch)}\n\`\`\`${access ? `\n\n> ${access}` : "\n"}`;
             }
         }
         const secretNames = list(getPath(manifest, "secrets", [])).map((entry) => text(entry)).join(",");
@@ -906,7 +939,7 @@ function runSend(args, context) {
         if (repoSection)
             body += `${repoSection}\n\n`;
         if (secretsSection)
-            body += `${secretsSection}\n`;
+            body += `${secretsSection}\n\n`;
         if (nextSteps)
             body += `## Your next three steps\n\n${nextSteps}\n\n`;
         body += `## If something is off\n\nThe manifest and BRIEF.md are published under \`delegation/${delegationId}/\` within \`companies/${company}/projects/${project}/\`. If a pull fails or a path looks empty, report it to ${from}.\n`;
@@ -956,7 +989,12 @@ function runSend(args, context) {
         if (checksum(brief) !== checksum(path.join(path.dirname(publishedManifestPath), "BRIEF.md")))
             return fail("send", "brief changed since publication; run verification again");
         manifest.status = "sending";
-        writeJsonAtomically(manifestPath, manifest, true);
+        try {
+            writeJsonAtomically(manifestPath, manifest, true, context.atomicWriteFileSystem);
+        }
+        catch {
+            return fail("send", "could not persist sending state; no DM attempted");
+        }
         const dm = runHq(["dm", principal, headline, "--prompt-file", prompt, "--details-file", brief], context);
         if (dm.code !== 0)
             return fail("send", "hq dm delivery outcome is uncertain; status is sending, inspect DM history before retrying");
@@ -994,6 +1032,10 @@ function captureRun(run) {
     }
 }
 function runVerify(args, context) {
+    // The shell shifts a value-taking option and its value under `set -e`.
+    // A trailing option therefore exits 1 before any diagnostic is printed.
+    if (["--manifest", "--company", "--project", "--to", "--mode"].includes(args.at(-1) ?? ""))
+        return 1;
     const parsed = parseFlags(args, ["--manifest", "--dry-run", "--company", "--project", "--to", "--mode"]);
     if (parsed.help) {
         out(usage("verify"));
@@ -1051,7 +1093,7 @@ function runVerify(args, context) {
         out(`  Recipient:  ${recipient}\n  Mode:       ${mode}\n  Company:    ${company}\n  Project:    ${project}\n\n`);
         out("  Vault grants that would be written:\n");
         for (const entry of list(getPath(manifest, "vaultPrefixes", [])))
-            out(`    ${jqRawPath(entry, "permission")}\t on ${jqRawPath(entry, "prefix")}\t(${jqRawPath(entry, "reason")})\n`);
+            out(`    ${jqRawPath(entry, "permission")}\ton ${jqRawPath(entry, "prefix")}\t(${jqRawPath(entry, "reason")})\n`);
         out(`\n  Secret names that would be granted (read): ${secretNames}\n\n`);
         const repoValue = getPath(manifest, "repo");
         if (repoValue !== null && repoValue !== undefined)

package/dist/commands/core-delegate.d.ts

@@ -1,11 +1,14 @@
 /** Native implementations of the five `hq core delegate` shell companions. */
+import * as fs from "node:fs";
 import { Command } from "commander";
 import { type SpawnPlan } from "../utils/windows-spawn.js";
 export declare const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
 export type DelegateContext = {
     cwd: string;
     root?: string;
+    atomicWriteFileSystem?: DelegateAtomicWriteFileSystem;
 };
+export type DelegateAtomicWriteFileSystem = Pick<typeof fs, "openSync" | "writeFileSync" | "closeSync" | "renameSync" | "copyFileSync" | "unlinkSync" | "rmSync">;
 type CommandResult = {
     code: number;
     stdout?: string;
@@ -38,8 +41,8 @@ export declare function rawJsonValue(value: unknown): string;
 export declare function jqRawPath(value: unknown, dottedPath: string, fallback?: unknown): string;
 export declare function jqRawPaths(value: unknown, dottedPaths: string[], fallback?: unknown): string;
 export declare function requireRecord(value: unknown, property: string): JsonRecord;
-export declare function moveFile(source: string, target: string): void;
-export declare function writeJsonAtomically(target: string, value: unknown, siblingTemp?: boolean): void;
+export declare function moveFile(source: string, target: string, fileSystem?: Pick<DelegateAtomicWriteFileSystem, "renameSync" | "copyFileSync" | "unlinkSync">): void;
+export declare function writeJsonAtomically(target: string, value: unknown, siblingTemp?: boolean, fileSystem?: DelegateAtomicWriteFileSystem): void;
 export declare function delegateDiagnosticPath(argument: string): string;
 export declare function scanSecretFiles(file: string): string[] | undefined;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */

package/dist/commands/core-delegate.js

@@ -1,5 +1,6 @@
 /** Native implementations of the five `hq core delegate` shell companions. */
 import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -174,25 +175,59 @@ export function requireRecord(value, property) {
         throw new TypeError(`Cannot update non-object field ${property}`);
     return result;
 }
-export function moveFile(source, target) {
+export function moveFile(source, target, fileSystem = fs) {
     try {
-        fs.renameSync(source, target);
+        fileSystem.renameSync(source, target);
     }
     catch (error) {
         if (error.code !== "EXDEV")
             throw error;
         // The shell companion uses `mv`, which copies across filesystem boundaries.
-        fs.copyFileSync(source, target);
-        fs.unlinkSync(source);
+        fileSystem.copyFileSync(source, target);
+        fileSystem.unlinkSync(source);
     }
 }
-export function writeJsonAtomically(target, value, siblingTemp = false) {
+export function writeJsonAtomically(target, value, siblingTemp = false, fileSystem = fs) {
     const serialized = serializeJqJson(value, "pretty");
     // Native delegate JSON writers use LF on every platform.
     if (siblingTemp) {
-        const temporary = `${target}.tmp`;
-        fs.writeFileSync(temporary, serialized);
-        moveFile(temporary, target);
+        const temporary = `${target}.tmp.${randomBytes(6).toString("hex")}`;
+        let fd;
+        let descriptorOpen = false;
+        let temporaryCreated = false;
+        try {
+            fd = fileSystem.openSync(temporary, "wx", 0o600);
+            descriptorOpen = true;
+            temporaryCreated = true;
+            fileSystem.writeFileSync(fd, serialized);
+            fileSystem.closeSync(fd);
+            descriptorOpen = false;
+            moveFile(temporary, target, fileSystem);
+        }
+        catch (error) {
+            const failures = [error];
+            if (descriptorOpen && fd !== undefined) {
+                try {
+                    fileSystem.closeSync(fd);
+                    descriptorOpen = false;
+                }
+                catch (closeError) {
+                    failures.push(closeError);
+                }
+            }
+            if (temporaryCreated) {
+                try {
+                    fileSystem.rmSync(temporary, { force: true });
+                }
+                catch (cleanupError) {
+                    failures.push(cleanupError);
+                }
+            }
+            if (failures.length > 1) {
+                throw new AggregateError(failures, "Failed to write and clean up delegate manifest temporary file");
+            }
+            throw error;
+        }
         return;
     }
     const temporaryDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-delegate-"));

package/dist/commands/install-global.js

@@ -919,8 +919,10 @@ export function uninstallGlobalCodex(opts = {}) {
     const hqPointer = claudeTargets(home).hqPointer;
     const state = readCodexState(t);
     const hqRoot = state?.hqRoot ?? opts.hqRoot ?? readOrNull(hqPointer)?.trim();
-    if (!hqRoot)
-        throw new Error('No HQ global install found (no install state and no ~/.hq/root).');
+    if (!hqRoot) {
+        log('No HQ global Codex install found; nothing to remove.');
+        return [];
+    }
     const regFile = opts.registryFile ?? registryFile(registryDir(home, env));
     const claudeStillInstalled = fs.existsSync(claudeTargets(home).stateFile);
     const providerBin = path.join(home, '.hq', 'bin');

package/dist/commands/lanes.d.ts

@@ -158,5 +158,6 @@ export declare function pickupFailureUpdater(reasonRaw: string, details: Record<
 export declare function applyOutpostAccountPickup(hqRoot: string, laneId: string, modelDeps?: KnownModelsDeps): LaneRecord;
 export declare function cancelPendingQuestionsForLane(hqRoot: string, laneId: string, nowIso: string, operatorReason?: string): QuestionRecord[];
 export declare function stopCommittedState(state: LaneRecord["state"]): "cancelled" | "killed";
+export declare function readLaneReapStopEnabled(hqRoot: string, lane: LaneRecord, env: NodeJS.ProcessEnv): Promise<boolean>;
 export declare function registerLanesCommand(parent: Command, deps?: LanesCommandDeps): Command;
 //# sourceMappingURL=lanes.d.ts.map

package/dist/commands/lanes.js

@@ -3392,7 +3392,7 @@ async function runCreate(ctx, opts) {
     const provider = explicitProvider ??
         profile?.meta.provider ??
         parseLaneProvider("codex");
-    const continuityEnabled = opts.worker !== undefined && await readLanesRegistryFlagFailOpen(LANE_WORKER_CONTINUITY_FLAG, { company: company ?? meshCompany, env: ctx.env });
+    const continuityEnabled = opts.worker !== undefined && await readLanesRegistryFlagFailOpen(LANE_WORKER_CONTINUITY_FLAG, { company: company ?? meshCompany, env: ctx.env, defaultValue: true });
     let workerContinuity = continuityEnabled
         ? findWorkerContinuityLane(loadAllLanes(hqRoot), {
             senior,
@@ -5456,6 +5456,7 @@ async function laneStatusFieldsForCommand(ctx, hqRoot, lane, now) {
         enabled = await readLanesRegistryFlagFailOpen(LANE_STATUS_ROW_FIELDS_FLAG, {
             ...(resolved ? { company: resolved } : {}),
             env: ctx.env,
+            defaultValue: true,
         });
     }
     catch (err) {
@@ -9365,6 +9366,16 @@ function attachJsonNoop(cmd) {
     for (const child of cmd.commands)
         attachJsonNoop(child);
 }
+export async function readLaneReapStopEnabled(hqRoot, lane, env) {
+    const resolution = resolveLaneCompany(hqRoot, lane);
+    const company = resolution.company ?? undefined;
+    return readLanesRegistryFlagFailOpen(LANE_REAP_STOP_FLAG, {
+        company,
+        ...(company ? { companyUidSource: laneCompanyUidSource(resolution.source) } : {}),
+        env,
+        defaultValue: true,
+    });
+}
 export function registerLanesCommand(parent, deps = {}) {
     const ctx = resolveDeps(deps);
     const storyHandlers = createLaneStoryHandlers({
@@ -9566,15 +9577,7 @@ export function registerLanesCommand(parent, deps = {}) {
             presenceConnected: ctx.presenceConnected ?? false,
             deps: ctx.livenessDeps,
         }),
-        stopEnabled: (lane) => {
-            const resolution = resolveLaneCompany(ctx.hqRoot(), lane);
-            const company = resolution.company ?? undefined;
-            return readLanesRegistryFlag(LANE_REAP_STOP_FLAG, {
-                company,
-                ...(company ? { companyUidSource: laneCompanyUidSource(resolution.source) } : {}),
-                env: ctx.env,
-            });
-        },
+        stopEnabled: (lane) => readLaneReapStopEnabled(ctx.hqRoot(), lane, ctx.env),
     }, wrap);
     registerLaneDropboxRepairCommand(lanes, {
         hqRoot: ctx.hqRoot,

package/dist/lib/lanes/dropbox.js

@@ -595,6 +595,7 @@ export async function runDrainHook(env, input = {}, deps = {}) {
                 : await readLanesRegistryFlagFailOpen(LANE_DROPBOX_LIFECYCLE_DELIVERY_FLAG, {
                     ...(company ? { company } : {}),
                     env,
+                    defaultValue: true,
                 });
         }
         catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.74",
+  "version": "5.345.75",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {