@indigoai-us/hq-cli 5.345.83 → 5.345.85

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.345.85] — 2026-10-11
+- Session-start orphan reports and reap leases are keyed by HQ root, report ended-session waiting lanes, and surface the latest completed orphan count in startup context even after a skipped sweep. `hq lanes reap --legacy` also identifies abandoned legacy conduct pool loops and only stops verified process identities when `--stop --reason` is supplied.
+
+## [5.345.84] — 2026-10-11
+- `hq secrets exec` and `hq secrets env` with `HQ_API_KEY` now refuse a
+  `--company` (or `HQ_COMPANY_UID`) that the key was not minted for. They
+  exit 1 with "HQ_API_KEY belongs to a different company than <uid>". They
+  used to ignore the flag and inject the key company's same-named secret.
+  A company slug under an API key is also refused, with a request for the
+  `cmp_` uid. Without `--company`, the key's own company is used as before.
+
 ## [5.345.83] — 2026-10-11
 - HQ-root scaffolds now package the shared runtime used by generated shell forwarders.
 - Lanes hook installation now replaces stale hq-cli drain registrations across

package/dist/command-catalog.generated.d.ts

@@ -11941,6 +11941,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--stop";
             readonly description: "Stop candidate process trees when the hq-flags stop key is enabled";
             readonly hidden: false;
+        }, {
+            readonly flags: "--legacy";
+            readonly description: "Include legacy conduct pool loop lanes in the report";
+            readonly hidden: false;
         }, {
             readonly flags: "--reason <text>";
             readonly description: "Required audit reason when --stop is set";

package/dist/command-catalog.generated.js

@@ -14522,6 +14522,11 @@ export const COMMAND_CATALOG = [
                         "description": "Stop candidate process trees when the hq-flags stop key is enabled",
                         "hidden": false
                     },
+                    {
+                        "flags": "--legacy",
+                        "description": "Include legacy conduct pool loop lanes in the report",
+                        "hidden": false
+                    },
                     {
                         "flags": "--reason <text>",
                         "description": "Required audit reason when --stop is set",

package/dist/commands/lanes-checks.js

@@ -14,6 +14,9 @@ import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { checkCompanyPath } from "../lib/lanes/checked-company-path.js";
 import { findOrphanedBareIdDropboxes } from "../lib/lanes/orphaned-dropbox.js";
 import { parseReapMinAge, reapLocalLanes } from "../lib/lanes/reaper.js";
+import { readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
+import { LANE_REAP_STOP_FLAG, LANE_ORPHAN_SWEEP_LEGACY_FLAG, LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG, LANE_ORPHAN_SWEEP_WAITING_FLAG } from "../lib/lanes/flag-keys.js";
+import { findLegacyPoolLanes } from "../lib/lanes/legacy-pool.js";
 export function mappingIncludesStory(mapping, storyId) {
     return (mapping.storyPrefix === undefined || storyId.startsWith(mapping.storyPrefix))
         && (mapping.excludePrefix === undefined || !storyId.startsWith(mapping.excludePrefix));
@@ -849,6 +852,24 @@ async function orphanReport(root, company, now, minAgeMinutes, userIdleHours, de
         assertNoSecretText("stop reason", reason);
     const unscoped = options.unscoped === true;
     const orphans = orphanFindings(root, company, now, minAgeMinutes, deps, undefined, unscoped, userIdleHours);
+    const legacyEnabled = await readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_LEGACY_FLAG, { env: process.env, defaultValue: true });
+    const legacyOrphans = legacyEnabled
+        ? findLegacyPoolLanes(root, { ...deps.reaperDeps, sessionState: deps.sessionState, now: () => now }).filter((finding) => unscoped ? !finding.company_slug : !company || finding.company_slug === company.slug)
+        : [];
+    const legacyRows = legacyOrphans.map((finding) => ({
+        lane_id: finding.lane_id,
+        senior: { kind: "session", id: finding.session_id },
+        senior_state: "ended",
+        reason: finding.reason,
+        company_source: "legacy_conduct_pool",
+        ...(finding.company_slug ? { company: finding.company_slug } : {}),
+        age_minutes: finding.age_minutes,
+        host: { kind: "local", id: "legacy" },
+        legacy: true,
+        pid: finding.pid,
+        run_dir: finding.run_dir,
+        stoppable: finding.reason === "legacy_conduct_session_gone",
+    }));
     const output = (action, stopped) => {
         if (options.human) {
             const companyText = unscoped ? "unscoped" : company?.slug ?? "unknown";
@@ -866,7 +887,10 @@ async function orphanReport(root, company, now, minAgeMinutes, userIdleHours, de
                     `${finding.host.kind}:${finding.host.id}`,
                 ].join("\t"));
             }
-            if (orphans.length === 0)
+            for (const finding of legacyOrphans) {
+                console.log([finding.lane_id, `session:${finding.session_id}`, "ended", finding.reason, "legacy_conduct_pool", finding.age_minutes, "", "local:legacy"].join("\t"));
+            }
+            if (orphans.length + legacyOrphans.length === 0)
                 console.log("(none)");
             if (stopped !== undefined) {
                 console.log("stopped:");
@@ -884,7 +908,7 @@ async function orphanReport(root, company, now, minAgeMinutes, userIdleHours, de
             min_age_minutes: minAgeMinutes,
             user_idle_hours: userIdleHours,
             ...(reason === undefined ? {} : { reason }),
-            orphans,
+            orphans: [...orphans, ...legacyRows],
             ...(stopped === undefined ? {} : { stopped }),
         }, null, 2));
     };
@@ -913,6 +937,7 @@ export function registerLaneChecksCommand(parent, deps, wrap) {
         .option("--min-age <minutes>", "Minimum lane age in minutes (default: 120)")
         .option("--apply-stale-state", "Remove stale worker and watcher pid markers")
         .option("--stop", "Stop candidate process trees when the hq-flags stop key is enabled")
+        .option("--legacy", "Include legacy conduct pool loop lanes in the report")
         .option("--reason <text>", "Required audit reason when --stop is set")
         .option("--json", "Print machine-readable JSON (default)")
         .action(wrap(async (options) => {
@@ -928,6 +953,7 @@ export function registerLaneChecksCommand(parent, deps, wrap) {
             minAgeMinutes,
             stop: options.stop === true,
             applyStaleState: options.applyStaleState === true,
+            legacy: options.legacy === true,
             reason: reason ?? "Orphaned lane: owning session is confirmed ended",
             json: true,
         }, {
@@ -936,6 +962,10 @@ export function registerLaneChecksCommand(parent, deps, wrap) {
             sessionState: deps.sessionState,
             stopEnabled: deps.stopEnabled,
             stopLane: deps.stopLane,
+            rootScopedStateEnabled: () => readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG, { env: process.env, defaultValue: true }),
+            waitingSeniorEnabled: () => readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_WAITING_FLAG, { env: process.env, defaultValue: true }),
+            legacyEnabled: () => readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_LEGACY_FLAG, { env: process.env, defaultValue: true }),
+            legacyStopEnabled: () => readLanesRegistryFlagFailOpen(LANE_REAP_STOP_FLAG, { env: process.env, defaultValue: true }),
         });
         console.log(JSON.stringify(report, null, 2));
     }));

package/dist/commands/lanes-session-start.d.ts

@@ -10,7 +10,7 @@ export interface SessionStartOptions {
     startSweep?: (root: string, env: NodeJS.ProcessEnv) => void;
 }
 /** Starts the CL-4 read-only orphan report once per host, without holding SessionStart open. */
-export declare function startSessionStartOrphanSweep(root: string, env?: NodeJS.ProcessEnv, spawnDetached?: typeof spawn): void;
+export declare function startSessionStartOrphanSweep(root: string, env?: NodeJS.ProcessEnv, spawnDetached?: typeof spawn, rootScoped?: boolean): void;
 /** SessionStart-compatible, fail-open conduct bootstrap. */
 export declare function runLaneSessionStart(options?: SessionStartOptions): Promise<void>;
 export declare function registerLaneSessionStartCommand(lanes: Command): void;

package/dist/commands/lanes-session-start.js

@@ -2,10 +2,10 @@ import fs from "node:fs";
 import { spawn } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
-import { LANE_CONDUCT_SESSION_START_FLAG } from "../lib/lanes/flag-keys.js";
+import { LANE_CONDUCT_SESSION_START_FLAG, LANE_ORPHAN_SWEEP_CONTEXT_FLAG, LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG } from "../lib/lanes/flag-keys.js";
 const CODEX_DEFAULT_KEYS = ["conduct_engine", "conduct_child_model", "conduct_child_effort", "conduct_default_source"];
 function readSessionMetaValue(text, key) {
     const line = text.split(/\r?\n/).find((entry) => new RegExp(`^\\s*${key}:`).test(entry));
@@ -115,12 +115,55 @@ function extractConductorBlock(core) {
     return core.slice(start + "<!-- inject:start -->".length, end).replace(/^\r?\n/, "").replace(/\r?\n$/, "");
 }
 const ORPHAN_SWEEP_LOCK_TTL_MS = 15 * 60_000;
+function rootKeyFor(root) {
+    let resolved = path.resolve(root);
+    try {
+        resolved = fs.realpathSync(root);
+    }
+    catch { /* the canonicalized path remains the fallback */ }
+    return createHash("sha256").update(resolved).digest("hex").slice(0, 12);
+}
+function readOrphanCount(root, env, rootScoped, onError) {
+    try {
+        const stateRoot = env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
+        const host = os.hostname().replace(/[^A-Za-z0-9._-]/g, "_") || "unknown-host";
+        const rootKey = rootKeyFor(root);
+        const prefix = rootScoped ? `orphans-${rootKey}-` : "orphans-";
+        const dir = path.join(stateRoot, "hq-cli", "lanes-orphan-reports", host);
+        const candidates = fs.readdirSync(dir)
+            .filter((name) => name.startsWith(prefix) && name.endsWith(".json"))
+            .map((name) => ({ name, mtime: fs.statSync(path.join(dir, name)).mtimeMs }))
+            .sort((a, b) => b.mtime - a.mtime);
+        // Reports accumulate, so read newest first and stop at the first one that
+        // actually swept; skipped and unreadable reports are passed over.
+        for (const candidate of candidates) {
+            let report;
+            try {
+                report = JSON.parse(fs.readFileSync(path.join(dir, candidate.name), "utf8"));
+            }
+            catch (error) {
+                onError?.(error);
+                continue;
+            }
+            if (report.skipped)
+                continue;
+            return Array.isArray(report.lanes) ? report.lanes.filter((lane) => lane && typeof lane === "object" && lane.orphaned === true).length : 0;
+        }
+        return 0;
+    }
+    catch (error) {
+        onError?.(error);
+        return 0;
+    }
+}
 /** Starts the CL-4 read-only orphan report once per host, without holding SessionStart open. */
-export function startSessionStartOrphanSweep(root, env = process.env, spawnDetached = spawn) {
+export function startSessionStartOrphanSweep(root, env = process.env, spawnDetached = spawn, rootScoped = true) {
     const stateRoot = env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
     const host = os.hostname().replace(/[^A-Za-z0-9._-]/g, "_") || "unknown-host";
+    const rootKey = rootKeyFor(root);
+    const rootSuffix = rootScoped ? `-${rootKey}` : "";
     const stateDir = path.join(stateRoot, "hq-cli", "lanes-session-start", host);
-    const lockPath = path.join(stateDir, "orphan-sweep.lock");
+    const lockPath = path.join(stateDir, `orphan-sweep${rootSuffix}.lock`);
     const reportDir = path.join(stateRoot, "hq-cli", "lanes-orphan-reports", host);
     const ownerToken = randomUUID();
     try {
@@ -174,11 +217,11 @@ export function startSessionStartOrphanSweep(root, env = process.env, spawnDetac
             "const start=()=>{let lease;try{lease=JSON.parse(fs.readFileSync(lock,'utf8'))}catch{}if(lease?.owner_token!==token){if(Date.now()<Number(lease?.started_at||0)+1000)return setTimeout(start,10);process.exit(0)}",
             "try{fs.writeFileSync(lock,JSON.stringify({...lease,pid:process.pid}))}catch{}",
             "const tmp=report+'.tmp';let output;try{output=fs.createWriteStream(tmp,{flags:'wx',mode:0o600})}catch{cleanup();process.exit(0)}",
-            "const child=cp.spawn(process.execPath,[cli,'lanes','_reap','--json'],{stdio:['ignore','pipe','ignore'],env:{...process.env,HQ_ROOT:root,HQ_NO_UPDATE_CHECK:'1'}});",
+            "const child=cp.spawn(process.execPath,[cli,'lanes','_reap','--json','--legacy'],{stdio:['ignore','pipe','ignore'],env:{...process.env,HQ_ROOT:root,HQ_NO_UPDATE_CHECK:'1'}});",
             "child.stdout.pipe(output);child.on('error',()=>{output.destroy();try{fs.rmSync(tmp,{force:true})}catch{}cleanup()});",
             "child.on('exit',(code)=>output.end(()=>{try{if(code===0)fs.renameSync(tmp,report);else fs.rmSync(tmp,{force:true})}catch{}cleanup()}));};start();",
         ].join("");
-        const reportPath = path.join(reportDir, `orphans-${startedAt}-${ownerToken}.json`);
+        const reportPath = path.join(reportDir, `orphans-${rootScoped ? `${rootKey}-` : ""}${startedAt}-${ownerToken}.json`);
         const launcher = spawnDetached(process.execPath, ["-e", wrapper, cli, lockPath, root, ownerToken, reportPath], {
             detached: true,
             stdio: "ignore",
@@ -245,7 +288,14 @@ export async function runLaneSessionStart(options = {}) {
         });
         if (!flagEnabled)
             return;
-        (options.startSweep ?? ((r, e) => startSessionStartOrphanSweep(r, e, spawn)))(root, env);
+        const rootScoped = await readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG, { env, defaultValue: true });
+        (options.startSweep ?? ((r, e) => startSessionStartOrphanSweep(r, e, spawn, rootScoped)))(root, env);
+        const contextEnabled = await readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_CONTEXT_FLAG, { env, defaultValue: true });
+        if (contextEnabled) {
+            const count = readOrphanCount(root, env, rootScoped, (error) => debug(`hq lanes session-start: orphan report read failed (${error instanceof Error ? error.name : "Error"})`));
+            if (count > 0)
+                stdout.write(`HQ orphaned lanes: ${count}; inspect with hq lanes orphans\n`);
+        }
         if (sessionWasDisabled(root, env, payload.session_id ?? payload.sessionId))
             return;
         const autoConduct = env.HQ_AUTO_CONDUCT ?? "";

package/dist/commands/secrets.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
-import { buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
+import { assertApiKeyCompany, buildSecretUsage, extractApiMessage, highSecuritySandboxOnlyMessage, loadRevealedSecrets, normalizeScriptLockMode, normalizeSecretTier, parseSecretNameList, requestedApiKeyCompany, runSecretsEnvCommand, scopeOpts, secretsCredentialOptions, } from "../secrets-env-action.js";
 export { buildSecretUsage, emitEnvExportsAndExit, loadRevealedSecrets, parseSecretNameList, runSecretsEnvCommand, } from "../secrets-env-action.js";
 export function readSessionCompanyLock(env = process.env) {
     const root = resolveDefaultHqRoot({ env });
@@ -1284,8 +1284,17 @@ export function registerSecretsCommand(program) {
                     ...(requestedCompany ? { requestedCompany } : {}),
                 })
                 : undefined;
+            // Without a session lock, an explicit --company / HQ_COMPANY_UID must
+            // still match the key's company: it used to be ignored, and the key's
+            // own same-named secret was injected instead.
+            const unlockedApiKeyCompanyRef = cred.kind === "api-key" && !hasLockedCompanies
+                ? requestedApiKeyCompany(requestedCompany)
+                : undefined;
             const companyUid = cred.kind === "api-key"
-                ? (apiKeyCompany?.companyUid ?? "__api_key__")
+                ? (apiKeyCompany?.companyUid
+                    ?? (unlockedApiKeyCompanyRef
+                        ? await assertApiKeyCompany(cred.token, unlockedApiKeyCompanyRef, "secrets exec")
+                        : "__api_key__"))
                 : await getEntityUid(cred.token, secretScope, { allowOfflineScopeFallback: true });
             const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)

package/dist/lib/lanes/flag-keys.d.ts

@@ -46,4 +46,12 @@ export declare const LANE_WORKER_CONTINUITY_FLAG = "lanes.worker-continuity";
 export declare const LANE_CONDUCT_LOOP_FLAG = "lanes.conduct-loop";
 export declare const LANE_ENVELOPE_REPAIR_GUIDANCE_FLAG = "lanes.envelope-repair-guidance";
 export declare const LANE_LOOP_HANDOFF_REPAIR_FLAG = "lanes.loop-handoff-repair";
+/** Adds the latest root-scoped orphan count to SessionStart context. */
+export declare const LANE_ORPHAN_SWEEP_CONTEXT_FLAG = "lanes.orphan-sweep-context-line";
+/** Separates lane reap leases and reports by resolved HQ root. */
+export declare const LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG = "lanes.orphan-sweep-root-keying";
+/** Reports awaiting-input lanes whose owning session ended. */
+export declare const LANE_ORPHAN_SWEEP_WAITING_FLAG = "lanes.orphan-sweep-waiting-senior";
+/** Reports and optionally stops abandoned legacy conduct pool loops. */
+export declare const LANE_ORPHAN_SWEEP_LEGACY_FLAG = "lanes.orphan-sweep-legacy-pool";
 //# sourceMappingURL=flag-keys.d.ts.map

package/dist/lib/lanes/flag-keys.js

@@ -46,4 +46,12 @@ export const LANE_WORKER_CONTINUITY_FLAG = "lanes.worker-continuity";
 export const LANE_CONDUCT_LOOP_FLAG = "lanes.conduct-loop";
 export const LANE_ENVELOPE_REPAIR_GUIDANCE_FLAG = "lanes.envelope-repair-guidance";
 export const LANE_LOOP_HANDOFF_REPAIR_FLAG = "lanes.loop-handoff-repair";
+/** Adds the latest root-scoped orphan count to SessionStart context. */
+export const LANE_ORPHAN_SWEEP_CONTEXT_FLAG = "lanes.orphan-sweep-context-line";
+/** Separates lane reap leases and reports by resolved HQ root. */
+export const LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG = "lanes.orphan-sweep-root-keying";
+/** Reports awaiting-input lanes whose owning session ended. */
+export const LANE_ORPHAN_SWEEP_WAITING_FLAG = "lanes.orphan-sweep-waiting-senior";
+/** Reports and optionally stops abandoned legacy conduct pool loops. */
+export const LANE_ORPHAN_SWEEP_LEGACY_FLAG = "lanes.orphan-sweep-legacy-pool";
 //# sourceMappingURL=flag-keys.js.map

package/dist/lib/lanes/legacy-pool.d.ts

@@ -0,0 +1,35 @@
+export interface LegacyPoolFinding {
+    lane_id: string;
+    legacy: true;
+    orphaned: boolean;
+    reason: string;
+    age_minutes: number;
+    session_id: string;
+    company_slug?: string;
+    pid: number;
+    process_starttime: number | null;
+    loop_started_at: string;
+    run_dir: string;
+    would_stop?: boolean;
+    stopped?: boolean;
+    stop_error?: string;
+}
+export interface LegacyPoolDeps {
+    processes?: () => Array<{
+        pid: number;
+        ppid: number;
+        args: string;
+    }>;
+    isAlive?: (pid: number) => boolean;
+    readStarttime?: (pid: number) => number | null;
+    signal?: (pid: number, signal: NodeJS.Signals) => void;
+    snapshotProcess?: (pid: number) => {
+        args: string;
+        startedAt: number | null;
+    } | null;
+    sessionState?: (root: string, sessionId: string, now: Date) => string | null;
+    now?: () => Date;
+}
+export declare function findLegacyPoolLanes(root: string, deps?: LegacyPoolDeps): LegacyPoolFinding[];
+export declare function stopLegacyPoolLane(root: string, finding: LegacyPoolFinding, deps?: LegacyPoolDeps): boolean;
+//# sourceMappingURL=legacy-pool.d.ts.map

package/dist/lib/lanes/legacy-pool.js

@@ -0,0 +1,209 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { readProcStarttime } from "./spawn.js";
+// The runner writes loop.json after node start-up and a CPU sample, measured at
+// 0.8 to 1.8 s past the whole second `ps lstart` reports. A process that reused
+// the pid started after the recorded runner was alive at started_at, so its
+// lstart cannot fall a full second before started_at; the upper bound only
+// caps how slow a start-up is believed.
+const LOOP_START_WINDOW_MS = 60_000;
+function loopStartMatches(processStartedAt, loopStartedAt) {
+    if (processStartedAt === null || !Number.isFinite(loopStartedAt))
+        return false;
+    const delta = loopStartedAt - processStartedAt;
+    return delta > -1_000 && delta < LOOP_START_WINDOW_MS;
+}
+function poolSlots(text) {
+    const slots = [];
+    let inBlock = false;
+    let current;
+    const save = () => {
+        if (current?.workerId && current.status && current.pid && current.runDir)
+            slots.push(current);
+        current = undefined;
+    };
+    for (const line of text.split(/\r?\n/)) {
+        if (!inBlock) {
+            if (line === "conduct_pool:")
+                inBlock = true;
+            continue;
+        }
+        if (/^[^ \t]/.test(line)) {
+            save();
+            break;
+        }
+        const worker = /^ {2}- worker_id:\s*"?([^"\s]+)"?\s*$/.exec(line);
+        if (worker) {
+            save();
+            current = { workerId: worker[1] };
+            continue;
+        }
+        if (!current)
+            continue;
+        const field = /^ {4}(status|pid|run_dir):\s*(.*?)\s*$/.exec(line);
+        if (!field)
+            continue;
+        const value = field[2].replace(/^"|"$/g, "");
+        if (field[1] === "status")
+            current.status = value;
+        if (field[1] === "pid" && /^\d+$/.test(value))
+            current.pid = Number(value);
+        if (field[1] === "run_dir")
+            current.runDir = value;
+    }
+    save();
+    return slots;
+}
+function processSnapshot(pid) {
+    const argsResult = spawnSync("ps", ["-ww", "-p", String(pid), "-o", "args="], { encoding: "utf8", windowsHide: true });
+    if (argsResult.status !== 0)
+        return null;
+    const startResult = spawnSync("ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", windowsHide: true });
+    const startedAt = startResult.status === 0 ? Date.parse(startResult.stdout.trim()) : NaN;
+    return { args: argsResult.stdout.trim(), startedAt: Number.isFinite(startedAt) ? startedAt : null };
+}
+function readProcessList() {
+    const result = spawnSync("ps", ["-ww", "-axo", "pid=,ppid=,args="], { encoding: "utf8", windowsHide: true });
+    if (result.status !== 0)
+        return [];
+    return result.stdout.split("\n").flatMap((line) => {
+        const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+        return match ? [{ pid: Number(match[1]), ppid: Number(match[2]), args: match[3] ?? "" }] : [];
+    });
+}
+function hasLiveSessionAncestor(pid, processes) {
+    const byPid = new Map(processes.map((proc) => [proc.pid, proc]));
+    let current = byPid.get(pid);
+    const seen = new Set();
+    for (let hops = 0; current && current.pid > 1 && hops < 64; hops++) {
+        if (seen.has(current.pid))
+            return true;
+        seen.add(current.pid);
+        const argv = current.args.trim().split(/\s+/);
+        const base = (arg) => arg?.split(/[\\/]/).at(-1)?.toLowerCase();
+        const names = new Set(["claude", "codex", "codex-code-mode-host", "grok", "grok-cli"]);
+        if (names.has(base(argv[0]) ?? "") || ((["bash", "sh", "zsh", "dash", "ksh", "node", "env"].includes(base(argv[0]) ?? "")) && names.has(base(argv[1]) ?? "")))
+            return true;
+        current = byPid.get(current.ppid);
+    }
+    return false;
+}
+function sessionCompany(meta) {
+    return /^company_slug:\s*["']?([A-Za-z0-9._-]+)["']?\s*$/m.exec(meta)?.[1];
+}
+function loopRecords(root) {
+    const sessions = path.join(root, "workspace", "sessions");
+    const runnerRoot = path.resolve(root, "workspace", "tmp", "workflow-runner");
+    let sessionIds;
+    try {
+        sessionIds = fs.readdirSync(sessions);
+    }
+    catch {
+        return [];
+    }
+    const records = [];
+    for (const sessionId of sessionIds) {
+        const metaPath = path.join(sessions, sessionId, "meta.yaml");
+        let slots;
+        let meta;
+        try {
+            meta = fs.readFileSync(metaPath, "utf8");
+            slots = poolSlots(meta);
+        }
+        catch {
+            continue;
+        }
+        const companySlug = sessionCompany(meta);
+        for (const slot of slots) {
+            if (!Number.isSafeInteger(slot.pid) || slot.pid <= 1 || !["running", "waiting"].includes(slot.status))
+                continue;
+            const runDir = path.resolve(slot.runDir);
+            if (!runDir.startsWith(`${runnerRoot}${path.sep}`))
+                continue;
+            let loop;
+            try {
+                loop = JSON.parse(fs.readFileSync(path.join(runDir, "loop.json"), "utf8"));
+            }
+            catch {
+                continue;
+            }
+            if (loop.pid !== slot.pid || path.resolve(loop.run_dir ?? "") !== runDir)
+                continue;
+            records.push({ sessionId, ...(companySlug ? { companySlug } : {}), slot, loop });
+        }
+    }
+    return records;
+}
+export function findLegacyPoolLanes(root, deps = {}) {
+    const processes = (deps.processes ?? (() => {
+        const result = spawnSync("ps", ["-ww", "-axo", "pid=,ppid=,args="], { encoding: "utf8", windowsHide: true });
+        if (result.status !== 0)
+            return [];
+        return result.stdout.split("\n").flatMap((line) => {
+            const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+            return match ? [{ pid: Number(match[1]), ppid: Number(match[2]), args: match[3] ?? "" }] : [];
+        });
+    }))();
+    const alive = deps.isAlive ?? ((pid) => { try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    } });
+    const readStart = deps.readStarttime ?? readProcStarttime;
+    const now = deps.now?.() ?? new Date();
+    return loopRecords(root).flatMap(({ sessionId, companySlug, slot, loop }) => {
+        if (!alive(slot.pid))
+            return [];
+        const proc = (deps.snapshotProcess ?? processSnapshot)(slot.pid);
+        if (!proc)
+            return [];
+        const argsMatch = /(?:^|[\\/])workflow-runner\.mjs(?:\s|$)/.test(proc.args) && /(?:^|\s)--loop(?:\s|$)/.test(proc.args);
+        const identityMatches = argsMatch && loopStartMatches(proc.startedAt, Date.parse(loop.started_at ?? ""));
+        const ownerState = deps.sessionState?.(root, sessionId, now) ?? null;
+        if (deps.sessionState ? ownerState !== "ended" && ownerState !== "lost" : hasLiveSessionAncestor(slot.pid, processes))
+            return [];
+        const laneId = `legacy-${sessionId}-${slot.workerId}`;
+        return [{
+                lane_id: laneId,
+                legacy: true,
+                orphaned: true,
+                reason: identityMatches ? "legacy_conduct_session_gone" : "legacy_pid_reused_or_identity_unproven",
+                age_minutes: Number.isFinite(Date.parse(loop.started_at ?? ""))
+                    ? Math.max(0, Math.floor((now.getTime() - Date.parse(loop.started_at)) / 60_000))
+                    : 0,
+                session_id: sessionId,
+                ...(companySlug ? { company_slug: companySlug } : {}),
+                pid: slot.pid,
+                process_starttime: readStart(slot.pid),
+                loop_started_at: loop.started_at ?? "",
+                run_dir: slot.runDir,
+                ...(!identityMatches ? { would_stop: false } : {}),
+            }];
+    }).sort((a, b) => a.lane_id.localeCompare(b.lane_id));
+}
+export function stopLegacyPoolLane(root, finding, deps = {}) {
+    const processes = (deps.processes ?? readProcessList)();
+    const proc = (deps.snapshotProcess ?? processSnapshot)(finding.pid);
+    const readStart = deps.readStarttime ?? readProcStarttime;
+    if (!proc || finding.process_starttime === null || readStart(finding.pid) !== finding.process_starttime || !loopStartMatches(proc.startedAt, Date.parse(finding.loop_started_at)) || !/(?:^|[\\/])workflow-runner\.mjs(?:\s|$)/.test(proc.args) || !/(?:^|\s)--loop(?:\s|$)/.test(proc.args))
+        return false;
+    const signal = deps.signal ?? ((pid, value) => process.kill(pid, value));
+    if (processes.length > 0 && hasLiveSessionAncestor(finding.pid, processes))
+        return false;
+    if (deps.sessionState) {
+        const ownerState = deps.sessionState(root, finding.session_id, deps.now?.() ?? new Date());
+        if (ownerState !== "ended" && ownerState !== "lost")
+            return false;
+    }
+    try {
+        signal(finding.pid, "SIGTERM");
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=legacy-pool.js.map

package/dist/lib/lanes/reaper.d.ts

@@ -1,4 +1,5 @@
 import type { LaneRecord } from "./types.js";
+import { type LegacyPoolFinding } from "./legacy-pool.js";
 export declare const DEFAULT_REAP_MIN_AGE_MINUTES = 120;
 export declare const REAP_SINGLE_FLIGHT_LOCK_STALE_MS: number;
 export declare const REAP_RECENT_SWEEP_MS: number;
@@ -20,6 +21,8 @@ export interface ReapFinding {
     stop_complete?: boolean;
     stop_error?: string;
     stale_state?: string[];
+    legacy?: true;
+    run_dir?: string;
 }
 export interface ReapDeps {
     now?: () => Date;
@@ -31,6 +34,15 @@ export interface ReapDeps {
     stopEnabled?: (lane: LaneRecord) => Promise<boolean> | boolean;
     stopLane?: (laneId: string, reason: string) => Promise<void>;
     sleep?: (ms: number) => void;
+    rootScopedStateEnabled?: () => Promise<boolean> | boolean;
+    waitingSeniorEnabled?: () => Promise<boolean> | boolean;
+    legacyEnabled?: () => Promise<boolean> | boolean;
+    legacyStopEnabled?: () => Promise<boolean> | boolean;
+    stopLegacy?: (finding: LegacyPoolFinding) => boolean;
+    snapshotProcess?: (pid: number) => {
+        args: string;
+        startedAt: number | null;
+    } | null;
 }
 export declare function parseReapMinAge(value: string | undefined): number;
 export declare function isProcessRunning(pid: number): boolean;
@@ -39,6 +51,7 @@ export interface ReapOptions {
     minAgeMinutes: number;
     stop: boolean;
     applyStaleState: boolean;
+    legacy?: boolean;
     reason: string;
     json: boolean;
 }

package/dist/lib/lanes/reaper.js

@@ -1,5 +1,6 @@
 /** Session-start orphan lane sweep. Every destructive action is opt-in and gated. */
 import * as fs from "node:fs";
+import { createHash } from "node:crypto";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -7,6 +8,7 @@ import { laneRunsOnHost } from "./admission.js";
 import { laneRunDir, isPidRecordAlive, readPidRecord, readProcStarttime } from "./spawn.js";
 import { readAllLanes, readLane } from "./store.js";
 import { LanesError } from "./errors.js";
+import { findLegacyPoolLanes, stopLegacyPoolLane } from "./legacy-pool.js";
 export const DEFAULT_REAP_MIN_AGE_MINUTES = 120;
 export const REAP_SINGLE_FLIGHT_LOCK_STALE_MS = 60 * 60 * 1000;
 export const REAP_RECENT_SWEEP_MS = 30 * 60 * 1000;
@@ -15,6 +17,14 @@ const staleMarkerSnapshots = new WeakMap();
 function safeHostComponent(hostname) {
     return hostname.replace(/[^A-Za-z0-9._-]/g, "_") || "unknown-host";
 }
+function resolvedRootKey(root) {
+    let resolved = path.resolve(root);
+    try {
+        resolved = fs.realpathSync(root);
+    }
+    catch { /* use the normalized input path */ }
+    return createHash("sha256").update(resolved).digest("hex").slice(0, 12);
+}
 function reaperStateDirectory() {
     const stateRoot = process.env.HQ_LANES_REAPER_STATE_HOME?.trim() ||
         process.env.XDG_STATE_HOME?.trim() || path.join(os.homedir(), ".local", "state");
@@ -231,8 +241,15 @@ export async function classifyLocalLanes(root, now, minAgeMinutes, deps = {}) {
             const sessionState = deps.sessionState?.(root, lane.senior.id, now) ?? null;
             if (sessionState !== "ended" && sessionState !== "lost")
                 finding.reason = sessionState === "live" ? "senior_session_alive" : "senior_session_not_proven_dead";
-            else if (lane.state !== "running")
-                finding.reason = "lane_not_running";
+            else if (lane.state !== "running") {
+                const waitingEnabled = deps.waitingSeniorEnabled ? await deps.waitingSeniorEnabled() : true;
+                if (waitingEnabled && ["queued", "awaiting_input", "blocked"].includes(lane.state)) {
+                    finding.orphaned = true;
+                    finding.reason = "senior_ended_while_waiting";
+                }
+                else
+                    finding.reason = "lane_not_running";
+            }
             else if (lane.keep_alive === true || lane.keep_alive_standing === true)
                 finding.reason = "keep_alive";
             else if (lane.senior_history.some((entry) => entry.reason === "reparented"))
@@ -276,7 +293,10 @@ export async function reapLocalLanes(root, options, deps = {}) {
     const stateDir = reaperStateDirectory();
     fs.mkdirSync(stateDir, { recursive: true });
     const host = safeHostComponent(deps.hostname?.() ?? os.hostname());
-    const lockDir = path.join(stateDir, `.lock-${host}`);
+    const rootScoped = deps.rootScopedStateEnabled ? await deps.rootScopedStateEnabled() : true;
+    const rootKey = resolvedRootKey(root);
+    const stateKey = rootScoped ? `${host}-${rootKey}` : host;
+    const lockDir = path.join(stateDir, `.lock-${stateKey}`);
     try {
         fs.mkdirSync(lockDir);
     }
@@ -301,7 +321,7 @@ export async function reapLocalLanes(root, options, deps = {}) {
             return { ok: true, action: "lanes.reap", generated_at: now.toISOString(), min_age_minutes: options.minAgeMinutes, mode: "report", stop_enabled: false, skipped: "already_running", lanes: [] };
         }
     }
-    const stamp = path.join(stateDir, `.last-sweep-${host}`);
+    const stamp = path.join(stateDir, `.last-sweep-${stateKey}`);
     if (!options.stop && !options.applyStaleState) {
         try {
             const stampText = fs.readFileSync(stamp, "utf8").trim();
@@ -319,6 +339,9 @@ export async function reapLocalLanes(root, options, deps = {}) {
     }
     try {
         const findings = await classifyLocalLanes(root, now, options.minAgeMinutes, deps);
+        const legacyEnabled = options.legacy && (deps.legacyEnabled ? await deps.legacyEnabled() : true);
+        const legacyFindings = legacyEnabled ? findLegacyPoolLanes(root, deps) : [];
+        findings.push(...legacyFindings);
         const isAlive = deps.isAlive ?? isProcessRunning;
         const readStart = deps.readStarttime ?? readProcStarttime;
         const clearStaleMarkerIfUnchanged = (finding, marker) => {
@@ -341,10 +364,25 @@ export async function reapLocalLanes(root, options, deps = {}) {
                         clearStaleMarkerIfUnchanged(finding, marker);
             }
             if (!finding.orphaned || !options.stop || finding.pid === undefined) {
-                if (finding.orphaned && options.stop)
+                if (finding.orphaned && options.stop && finding.pid !== undefined)
                     finding.would_stop = true;
                 continue;
             }
+            if (finding.legacy) {
+                const enabled = await (deps.legacyEnabled?.() ?? true) && await (deps.legacyStopEnabled?.() ?? false);
+                stopEnabled ||= enabled;
+                if (!enabled || finding.reason === "legacy_pid_reused_or_identity_unproven") {
+                    finding.would_stop = false;
+                    continue;
+                }
+                const legacy = finding;
+                const stopped = (deps.stopLegacy ?? ((item) => stopLegacyPoolLane(root, item, deps)))(legacy);
+                finding.stopped = stopped;
+                finding.would_stop = !stopped;
+                if (!stopped)
+                    finding.reason = "legacy_identity_changed_before_stop";
+                continue;
+            }
             const lane = readLane(root, finding.lane_id);
             const enabled = await (deps.stopEnabled?.(lane) ?? false);
             stopEnabled ||= enabled;

package/dist/secrets-env-action.d.ts

@@ -57,6 +57,23 @@ export declare function normalizeScriptLockMode(mode?: string): SecretScriptLock
 export declare function extractApiMessage(body: Record<string, unknown>, fallback: string): string;
 export declare function buildSecretUsage(channel: SecretUsageChannel, scriptPath?: string, scriptId?: string, attestationLevel?: string): Promise<SecretUsage>;
 export declare function parseSecretNameList(input: string[] | undefined): string[];
+/**
+ * The company a caller explicitly asked for while authenticating with
+ * HQ_API_KEY: `--company`, else HQ_COMPANY_UID. Undefined means "the key's own
+ * company", which needs no check.
+ */
+export declare function requestedApiKeyCompany(flagCompany: string | undefined): string | undefined;
+/**
+ * Refuse an explicitly requested company that the API key is not bound to.
+ *
+ * A vault API key can only read its own company's secrets. Before this check,
+ * `hq secrets exec --company <other>` under HQ_API_KEY ignored the flag and
+ * injected the key company's same-named secret with exit 0, which read as a
+ * cross-company leak (P0 triage, 2026-10-11). The probe is the keyed list
+ * route, which the server 403s with "not scoped to this company" on mismatch.
+ * Returns the verified uid; throws before any secret is fetched otherwise.
+ */
+export declare function assertApiKeyCompany(token: string, requested: string, commandLabel: string): Promise<string>;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
     allowOfflineFallback?: boolean;
 }): Promise<Map<string, string>>;

package/dist/secrets-env-action.js

@@ -7,7 +7,7 @@ import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntr
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
 import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
-import { getEntityUid, vaultApiFetch } from "./utils/vault-api.js";
+import { getEntityUid, looksLikeCompanyUid, vaultApiFetch } from "./utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
 const MAX_BATCH_NAMES = 100;
@@ -124,16 +124,22 @@ export function parseSecretNameList(input) {
 // Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
 // with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
 // path used — never swallows a failure.
-async function loadRevealedSecretsViaApiKey(token, keys) {
+//
+// When the caller names a company uid, it rides in the body so the server can
+// refuse a key bound to a different company. Without it the fetch route reads
+// from the key's own company, which made `--company <other>` silently return
+// the key company's same-named secret (P0 triage, 2026-10-11).
+async function loadRevealedSecretsViaApiKey(token, keys, companyUid) {
     const resolved = new Map();
     const requested = [...new Set(keys)];
     const cacheScope = "__api_key__";
+    const scopedCompanyUid = companyUid && looksLikeCompanyUid(companyUid) ? companyUid : undefined;
     for (const name of requested) {
         const res = await vaultApiFetch({
             token,
             path: "/v1/keys/secrets/fetch",
             method: "POST",
-            body: { name },
+            body: scopedCompanyUid ? { name, companyUid: scopedCompanyUid } : { name },
             signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
         });
         const body = (await res.json().catch(() => ({})));
@@ -168,9 +174,52 @@ async function loadRevealedSecretsViaApiKey(token, keys) {
     }
     return resolved;
 }
+/**
+ * The company a caller explicitly asked for while authenticating with
+ * HQ_API_KEY: `--company`, else HQ_COMPANY_UID. Undefined means "the key's own
+ * company", which needs no check.
+ */
+export function requestedApiKeyCompany(flagCompany) {
+    const ref = flagCompany?.trim() || process.env.HQ_COMPANY_UID?.trim();
+    return ref ? ref : undefined;
+}
+/**
+ * Refuse an explicitly requested company that the API key is not bound to.
+ *
+ * A vault API key can only read its own company's secrets. Before this check,
+ * `hq secrets exec --company <other>` under HQ_API_KEY ignored the flag and
+ * injected the key company's same-named secret with exit 0, which read as a
+ * cross-company leak (P0 triage, 2026-10-11). The probe is the keyed list
+ * route, which the server 403s with "not scoped to this company" on mismatch.
+ * Returns the verified uid; throws before any secret is fetched otherwise.
+ */
+export async function assertApiKeyCompany(token, requested, commandLabel) {
+    if (!looksLikeCompanyUid(requested)) {
+        throw new Error(`HQ_API_KEY is set; '${commandLabel}' --company must be the company uid (cmp_…) the key ` +
+            `was minted for (resolving a slug needs a Cognito session). Got '${requested}'. ` +
+            `Omit --company to use the key's own company.`);
+    }
+    const response = await vaultApiFetch({
+        token,
+        path: `/v1/keys/secrets/${encodeURIComponent(requested)}`,
+    });
+    if (response.ok)
+        return requested;
+    if (response.status === 401)
+        throw new Error("HQ_API_KEY is invalid or no longer active.");
+    const body = (await response.json().catch(() => ({})));
+    const message = typeof body.error === "string" ? body.error : "";
+    if (response.status === 403 && /not scoped to this company/i.test(message)) {
+        throw new Error(`HQ_API_KEY belongs to a different company than ${requested}. An API key can only read ` +
+            `its own company's secrets. Omit --company (and HQ_COMPANY_UID) to use the key's company, ` +
+            `or use a key minted for ${requested}.`);
+    }
+    throw new Error(`Could not verify that HQ_API_KEY belongs to ${requested} (HTTP ${response.status}` +
+        `${message ? `: ${message}` : ""}).`);
+}
 export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
     if (token.startsWith(HQ_API_KEY_PREFIX)) {
-        return loadRevealedSecretsViaApiKey(token, keys);
+        return loadRevealedSecretsViaApiKey(token, keys, companyUid);
     }
     const resolved = new Map();
     const requested = [...new Set(keys)];
@@ -416,8 +465,13 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
         }
         const keys = parseSecretNameList(opts.only);
         const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
+        const apiKeyCompanyRef = cred.kind === "api-key"
+            ? requestedApiKeyCompany(parentScope.company)
+            : undefined;
         const companyUid = cred.kind === "api-key"
-            ? "__api_key__"
+            ? (apiKeyCompanyRef
+                ? await assertApiKeyCompany(cred.token, apiKeyCompanyRef, "secrets env")
+                : "__api_key__")
             : await getEntityUid(cred.token, scopeOpts(parentScope), {
                 allowOfflineScopeFallback: true,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.83",
+  "version": "5.345.85",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {