@indigoai-us/hq-cli 5.345.84 → 5.345.86

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.345.86] — 2026-10-11
+- New `hq scan secrets`: an offline secret scanner for the pre-commit gate. It
+  checks the staged changes (or given files) against the gitleaks default rule
+  set, vendored from gitleaks v8.30.1 under its MIT license, plus HQ's own
+  token patterns. It needs no network, account or API quota, and reports the
+  rule, file and line without printing the value. Exit codes: 0 clean, 1
+  possible secret, 2 the scan could not run.
+
+## [5.345.85] — 2026-10-11
+- Session-start orphan reports and reap leases are keyed by HQ root, report ended-session waiting lanes, and surface the latest completed orphan count in startup context even after a skipped sweep. `hq lanes reap --legacy` also identifies abandoned legacy conduct pool loops and only stops verified process identities when `--stop --reason` is supplied.
+
 ## [5.345.84] — 2026-10-11
 - `hq secrets exec` and `hq secrets env` with `HQ_API_KEY` now refuse a
   `--company` (or `HQ_COMPANY_UID`) that the key was not minted for. They

package/dist/command-catalog.generated.d.ts

@@ -5375,6 +5375,43 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly subcommands: readonly [];
     }];
+}, {
+    readonly name: "scan";
+    readonly description: "Local, offline scanners";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly helpOption: true;
+    readonly helpCommand: true;
+    readonly usage: "[options] [command]";
+    readonly helpText: readonly [];
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "secrets";
+        readonly description: "Scan staged changes (or files) for secrets; exits 1 on a finding";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] [files...]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "files";
+            readonly required: false;
+            readonly variadic: true;
+            readonly description: "Scan these files instead of the staged changes";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--staged";
+            readonly description: "Scan the staged changes (default when no files are given)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print findings as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }];
 }, {
     readonly name: "reindex";
     readonly description: "Surface namespaced skills, materialize legacy knowledge repos, regenerate the workers registry, and trust HQ hooks for Codex, Grok, and Claude Code";
@@ -11941,6 +11978,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--stop";
             readonly description: "Stop candidate process trees when the hq-flags stop key is enabled";
             readonly hidden: false;
+        }, {
+            readonly flags: "--legacy";
+            readonly description: "Include legacy conduct pool loop lanes in the report";
+            readonly hidden: false;
         }, {
             readonly flags: "--reason <text>";
             readonly description: "Required audit reason when --stop is set";

package/dist/command-catalog.generated.js

@@ -6535,6 +6535,51 @@ export const COMMAND_CATALOG = [
             }
         ]
     },
+    {
+        "name": "scan",
+        "description": "Local, offline scanners",
+        "aliases": [],
+        "hidden": false,
+        "helpOption": true,
+        "helpCommand": true,
+        "usage": "[options] [command]",
+        "helpText": [],
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "secrets",
+                "description": "Scan staged changes (or files) for secrets; exits 1 on a finding",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] [files...]",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "files",
+                        "required": false,
+                        "variadic": true,
+                        "description": "Scan these files instead of the staged changes"
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--staged",
+                        "description": "Scan the staged changes (default when no files are given)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print findings as JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            }
+        ]
+    },
     {
         "name": "reindex",
         "description": "Surface namespaced skills, materialize legacy knowledge repos, regenerate the workers registry, and trust HQ hooks for Codex, Grok, and Claude Code",
@@ -14522,6 +14567,11 @@ export const COMMAND_CATALOG = [
                         "description": "Stop candidate process trees when the hq-flags stop key is enabled",
                         "hidden": false
                     },
+                    {
+                        "flags": "--legacy",
+                        "description": "Include legacy conduct pool loop lanes in the report",
+                        "hidden": false
+                    },
                     {
                         "flags": "--reason <text>",
                         "description": "Required audit reason when --stop is set",

package/dist/command-registration-plan.d.ts

@@ -358,6 +358,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/import-scan.js";
     readonly exportName: "registerImportCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "scan";
+    readonly parent: "program";
+    readonly module: "./commands/scan.js";
+    readonly exportName: "registerScanCommand";
 }, {
     readonly type: "registrar";
     readonly root: "reindex";

package/dist/command-registration-plan.js

@@ -62,6 +62,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "signals", parent: "program", module: "./commands/signals.js", exportName: "registerSignalsCommand" },
     { type: "registrar", root: "integrations", parent: "program", module: "./commands/integrations.js", exportName: "registerIntegrationsCommand" },
     { type: "registrar", root: "import", parent: "program", module: "./commands/import-scan.js", exportName: "registerImportCommand" },
+    { type: "registrar", root: "scan", parent: "program", module: "./commands/scan.js", exportName: "registerScanCommand" },
     { type: "registrar", root: "reindex", parent: "program", module: "./commands/reindex.js", exportName: "registerReindexCommand" },
     { type: "registrar", root: "rescue", parent: "program", module: "./commands/rescue.js", exportName: "registerRescueCommand" },
     { type: "registrar", root: "mcp", parent: "program", module: "./commands/mcp-status.js", exportName: "registerMcpCommand" },

package/dist/commands/lanes-checks.js

@@ -14,6 +14,9 @@ import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { checkCompanyPath } from "../lib/lanes/checked-company-path.js";
 import { findOrphanedBareIdDropboxes } from "../lib/lanes/orphaned-dropbox.js";
 import { parseReapMinAge, reapLocalLanes } from "../lib/lanes/reaper.js";
+import { readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
+import { LANE_REAP_STOP_FLAG, LANE_ORPHAN_SWEEP_LEGACY_FLAG, LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG, LANE_ORPHAN_SWEEP_WAITING_FLAG } from "../lib/lanes/flag-keys.js";
+import { findLegacyPoolLanes } from "../lib/lanes/legacy-pool.js";
 export function mappingIncludesStory(mapping, storyId) {
     return (mapping.storyPrefix === undefined || storyId.startsWith(mapping.storyPrefix))
         && (mapping.excludePrefix === undefined || !storyId.startsWith(mapping.excludePrefix));
@@ -849,6 +852,24 @@ async function orphanReport(root, company, now, minAgeMinutes, userIdleHours, de
         assertNoSecretText("stop reason", reason);
     const unscoped = options.unscoped === true;
     const orphans = orphanFindings(root, company, now, minAgeMinutes, deps, undefined, unscoped, userIdleHours);
+    const legacyEnabled = await readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_LEGACY_FLAG, { env: process.env, defaultValue: true });
+    const legacyOrphans = legacyEnabled
+        ? findLegacyPoolLanes(root, { ...deps.reaperDeps, sessionState: deps.sessionState, now: () => now }).filter((finding) => unscoped ? !finding.company_slug : !company || finding.company_slug === company.slug)
+        : [];
+    const legacyRows = legacyOrphans.map((finding) => ({
+        lane_id: finding.lane_id,
+        senior: { kind: "session", id: finding.session_id },
+        senior_state: "ended",
+        reason: finding.reason,
+        company_source: "legacy_conduct_pool",
+        ...(finding.company_slug ? { company: finding.company_slug } : {}),
+        age_minutes: finding.age_minutes,
+        host: { kind: "local", id: "legacy" },
+        legacy: true,
+        pid: finding.pid,
+        run_dir: finding.run_dir,
+        stoppable: finding.reason === "legacy_conduct_session_gone",
+    }));
     const output = (action, stopped) => {
         if (options.human) {
             const companyText = unscoped ? "unscoped" : company?.slug ?? "unknown";
@@ -866,7 +887,10 @@ async function orphanReport(root, company, now, minAgeMinutes, userIdleHours, de
                     `${finding.host.kind}:${finding.host.id}`,
                 ].join("\t"));
             }
-            if (orphans.length === 0)
+            for (const finding of legacyOrphans) {
+                console.log([finding.lane_id, `session:${finding.session_id}`, "ended", finding.reason, "legacy_conduct_pool", finding.age_minutes, "", "local:legacy"].join("\t"));
+            }
+            if (orphans.length + legacyOrphans.length === 0)
                 console.log("(none)");
             if (stopped !== undefined) {
                 console.log("stopped:");
@@ -884,7 +908,7 @@ async function orphanReport(root, company, now, minAgeMinutes, userIdleHours, de
             min_age_minutes: minAgeMinutes,
             user_idle_hours: userIdleHours,
             ...(reason === undefined ? {} : { reason }),
-            orphans,
+            orphans: [...orphans, ...legacyRows],
             ...(stopped === undefined ? {} : { stopped }),
         }, null, 2));
     };
@@ -913,6 +937,7 @@ export function registerLaneChecksCommand(parent, deps, wrap) {
         .option("--min-age <minutes>", "Minimum lane age in minutes (default: 120)")
         .option("--apply-stale-state", "Remove stale worker and watcher pid markers")
         .option("--stop", "Stop candidate process trees when the hq-flags stop key is enabled")
+        .option("--legacy", "Include legacy conduct pool loop lanes in the report")
         .option("--reason <text>", "Required audit reason when --stop is set")
         .option("--json", "Print machine-readable JSON (default)")
         .action(wrap(async (options) => {
@@ -928,6 +953,7 @@ export function registerLaneChecksCommand(parent, deps, wrap) {
             minAgeMinutes,
             stop: options.stop === true,
             applyStaleState: options.applyStaleState === true,
+            legacy: options.legacy === true,
             reason: reason ?? "Orphaned lane: owning session is confirmed ended",
             json: true,
         }, {
@@ -936,6 +962,10 @@ export function registerLaneChecksCommand(parent, deps, wrap) {
             sessionState: deps.sessionState,
             stopEnabled: deps.stopEnabled,
             stopLane: deps.stopLane,
+            rootScopedStateEnabled: () => readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG, { env: process.env, defaultValue: true }),
+            waitingSeniorEnabled: () => readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_WAITING_FLAG, { env: process.env, defaultValue: true }),
+            legacyEnabled: () => readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_LEGACY_FLAG, { env: process.env, defaultValue: true }),
+            legacyStopEnabled: () => readLanesRegistryFlagFailOpen(LANE_REAP_STOP_FLAG, { env: process.env, defaultValue: true }),
         });
         console.log(JSON.stringify(report, null, 2));
     }));

package/dist/commands/lanes-session-start.d.ts

@@ -10,7 +10,7 @@ export interface SessionStartOptions {
     startSweep?: (root: string, env: NodeJS.ProcessEnv) => void;
 }
 /** Starts the CL-4 read-only orphan report once per host, without holding SessionStart open. */
-export declare function startSessionStartOrphanSweep(root: string, env?: NodeJS.ProcessEnv, spawnDetached?: typeof spawn): void;
+export declare function startSessionStartOrphanSweep(root: string, env?: NodeJS.ProcessEnv, spawnDetached?: typeof spawn, rootScoped?: boolean): void;
 /** SessionStart-compatible, fail-open conduct bootstrap. */
 export declare function runLaneSessionStart(options?: SessionStartOptions): Promise<void>;
 export declare function registerLaneSessionStartCommand(lanes: Command): void;

package/dist/commands/lanes-session-start.js

@@ -2,10 +2,10 @@ import fs from "node:fs";
 import { spawn } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
-import { LANE_CONDUCT_SESSION_START_FLAG } from "../lib/lanes/flag-keys.js";
+import { LANE_CONDUCT_SESSION_START_FLAG, LANE_ORPHAN_SWEEP_CONTEXT_FLAG, LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG } from "../lib/lanes/flag-keys.js";
 const CODEX_DEFAULT_KEYS = ["conduct_engine", "conduct_child_model", "conduct_child_effort", "conduct_default_source"];
 function readSessionMetaValue(text, key) {
     const line = text.split(/\r?\n/).find((entry) => new RegExp(`^\\s*${key}:`).test(entry));
@@ -115,12 +115,55 @@ function extractConductorBlock(core) {
     return core.slice(start + "<!-- inject:start -->".length, end).replace(/^\r?\n/, "").replace(/\r?\n$/, "");
 }
 const ORPHAN_SWEEP_LOCK_TTL_MS = 15 * 60_000;
+function rootKeyFor(root) {
+    let resolved = path.resolve(root);
+    try {
+        resolved = fs.realpathSync(root);
+    }
+    catch { /* the canonicalized path remains the fallback */ }
+    return createHash("sha256").update(resolved).digest("hex").slice(0, 12);
+}
+function readOrphanCount(root, env, rootScoped, onError) {
+    try {
+        const stateRoot = env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
+        const host = os.hostname().replace(/[^A-Za-z0-9._-]/g, "_") || "unknown-host";
+        const rootKey = rootKeyFor(root);
+        const prefix = rootScoped ? `orphans-${rootKey}-` : "orphans-";
+        const dir = path.join(stateRoot, "hq-cli", "lanes-orphan-reports", host);
+        const candidates = fs.readdirSync(dir)
+            .filter((name) => name.startsWith(prefix) && name.endsWith(".json"))
+            .map((name) => ({ name, mtime: fs.statSync(path.join(dir, name)).mtimeMs }))
+            .sort((a, b) => b.mtime - a.mtime);
+        // Reports accumulate, so read newest first and stop at the first one that
+        // actually swept; skipped and unreadable reports are passed over.
+        for (const candidate of candidates) {
+            let report;
+            try {
+                report = JSON.parse(fs.readFileSync(path.join(dir, candidate.name), "utf8"));
+            }
+            catch (error) {
+                onError?.(error);
+                continue;
+            }
+            if (report.skipped)
+                continue;
+            return Array.isArray(report.lanes) ? report.lanes.filter((lane) => lane && typeof lane === "object" && lane.orphaned === true).length : 0;
+        }
+        return 0;
+    }
+    catch (error) {
+        onError?.(error);
+        return 0;
+    }
+}
 /** Starts the CL-4 read-only orphan report once per host, without holding SessionStart open. */
-export function startSessionStartOrphanSweep(root, env = process.env, spawnDetached = spawn) {
+export function startSessionStartOrphanSweep(root, env = process.env, spawnDetached = spawn, rootScoped = true) {
     const stateRoot = env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
     const host = os.hostname().replace(/[^A-Za-z0-9._-]/g, "_") || "unknown-host";
+    const rootKey = rootKeyFor(root);
+    const rootSuffix = rootScoped ? `-${rootKey}` : "";
     const stateDir = path.join(stateRoot, "hq-cli", "lanes-session-start", host);
-    const lockPath = path.join(stateDir, "orphan-sweep.lock");
+    const lockPath = path.join(stateDir, `orphan-sweep${rootSuffix}.lock`);
     const reportDir = path.join(stateRoot, "hq-cli", "lanes-orphan-reports", host);
     const ownerToken = randomUUID();
     try {
@@ -174,11 +217,11 @@ export function startSessionStartOrphanSweep(root, env = process.env, spawnDetac
             "const start=()=>{let lease;try{lease=JSON.parse(fs.readFileSync(lock,'utf8'))}catch{}if(lease?.owner_token!==token){if(Date.now()<Number(lease?.started_at||0)+1000)return setTimeout(start,10);process.exit(0)}",
             "try{fs.writeFileSync(lock,JSON.stringify({...lease,pid:process.pid}))}catch{}",
             "const tmp=report+'.tmp';let output;try{output=fs.createWriteStream(tmp,{flags:'wx',mode:0o600})}catch{cleanup();process.exit(0)}",
-            "const child=cp.spawn(process.execPath,[cli,'lanes','_reap','--json'],{stdio:['ignore','pipe','ignore'],env:{...process.env,HQ_ROOT:root,HQ_NO_UPDATE_CHECK:'1'}});",
+            "const child=cp.spawn(process.execPath,[cli,'lanes','_reap','--json','--legacy'],{stdio:['ignore','pipe','ignore'],env:{...process.env,HQ_ROOT:root,HQ_NO_UPDATE_CHECK:'1'}});",
             "child.stdout.pipe(output);child.on('error',()=>{output.destroy();try{fs.rmSync(tmp,{force:true})}catch{}cleanup()});",
             "child.on('exit',(code)=>output.end(()=>{try{if(code===0)fs.renameSync(tmp,report);else fs.rmSync(tmp,{force:true})}catch{}cleanup()}));};start();",
         ].join("");
-        const reportPath = path.join(reportDir, `orphans-${startedAt}-${ownerToken}.json`);
+        const reportPath = path.join(reportDir, `orphans-${rootScoped ? `${rootKey}-` : ""}${startedAt}-${ownerToken}.json`);
         const launcher = spawnDetached(process.execPath, ["-e", wrapper, cli, lockPath, root, ownerToken, reportPath], {
             detached: true,
             stdio: "ignore",
@@ -245,7 +288,14 @@ export async function runLaneSessionStart(options = {}) {
         });
         if (!flagEnabled)
             return;
-        (options.startSweep ?? ((r, e) => startSessionStartOrphanSweep(r, e, spawn)))(root, env);
+        const rootScoped = await readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG, { env, defaultValue: true });
+        (options.startSweep ?? ((r, e) => startSessionStartOrphanSweep(r, e, spawn, rootScoped)))(root, env);
+        const contextEnabled = await readLanesRegistryFlagFailOpen(LANE_ORPHAN_SWEEP_CONTEXT_FLAG, { env, defaultValue: true });
+        if (contextEnabled) {
+            const count = readOrphanCount(root, env, rootScoped, (error) => debug(`hq lanes session-start: orphan report read failed (${error instanceof Error ? error.name : "Error"})`));
+            if (count > 0)
+                stdout.write(`HQ orphaned lanes: ${count}; inspect with hq lanes orphans\n`);
+        }
         if (sessionWasDisabled(root, env, payload.session_id ?? payload.sessionId))
             return;
         const autoConduct = env.HQ_AUTO_CONDUCT ?? "";

package/dist/commands/scan.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `hq scan secrets` — offline secret scanner (the HQ pre-commit gate).
+ *
+ *   hq scan secrets               scan the staged changes of the current repo
+ *   hq scan secrets <file...>     scan whole files instead
+ *   hq scan secrets --json        findings as JSON
+ *
+ * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
+ * HQ's own token patterns. No network, no account, no quota.
+ *
+ * Exit codes: 0 clean, 1 possible secret found, 2 the scan could not run.
+ * A pre-commit hook blocks on any non-zero exit, so the gate fails closed.
+ * Output names the rule, file and line; secret values are never printed.
+ */
+import { Command } from "commander";
+interface ScanSecretsOptions {
+    json?: boolean;
+    staged?: boolean;
+}
+export declare function runScanSecrets(paths: string[], opts: ScanSecretsOptions, cwd?: string): number;
+export declare function registerScanCommand(program: Command): void;
+export {};
+//# sourceMappingURL=scan.d.ts.map

package/dist/commands/scan.js

@@ -0,0 +1,59 @@
+/**
+ * `hq scan secrets` — offline secret scanner (the HQ pre-commit gate).
+ *
+ *   hq scan secrets               scan the staged changes of the current repo
+ *   hq scan secrets <file...>     scan whole files instead
+ *   hq scan secrets --json        findings as JSON
+ *
+ * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
+ * HQ's own token patterns. No network, no account, no quota.
+ *
+ * Exit codes: 0 clean, 1 possible secret found, 2 the scan could not run.
+ * A pre-commit hook blocks on any non-zero exit, so the gate fails closed.
+ * Output names the rule, file and line; secret values are never printed.
+ */
+import { ScanInputError, scanFiles, scanStaged } from "../lib/secret-scan/staged.js";
+function report(findings, scope) {
+    if (!findings.length)
+        return;
+    const n = findings.length;
+    process.stderr.write(`HQ secret scan: ${n} possible secret${n === 1 ? "" : "s"} in ${scope} (values hidden)\n`);
+    for (const f of findings) {
+        process.stderr.write(`  ${f.file}:${f.line}  ${f.ruleId}  ${f.description}\n`);
+    }
+    process.stderr.write("\nRemove the secret from the change, then stage it again. Keep real credentials in the HQ vault\n" +
+        "(hq secrets, hq run). A known false positive can carry a `gitleaks:allow` comment on that line.\n");
+}
+export function runScanSecrets(paths, opts, cwd = process.cwd()) {
+    let findings;
+    try {
+        findings = paths.length && !opts.staged ? scanFiles(paths) : scanStaged(cwd);
+    }
+    catch (err) {
+        const msg = err instanceof ScanInputError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
+        if (opts.json)
+            process.stdout.write(`${JSON.stringify({ ok: false, error: msg })}\n`);
+        process.stderr.write(`HQ secret scan: ${msg}\n`);
+        return 2;
+    }
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: findings.length === 0, findings })}\n`);
+    }
+    else {
+        report(findings, paths.length && !opts.staged ? "the given files" : "staged changes");
+    }
+    return findings.length ? 1 : 0;
+}
+export function registerScanCommand(program) {
+    const scan = program.command("scan").description("Local, offline scanners");
+    scan
+        .command("secrets")
+        .description("Scan staged changes (or files) for secrets; exits 1 on a finding")
+        .argument("[files...]", "Scan these files instead of the staged changes")
+        .option("--staged", "Scan the staged changes (default when no files are given)")
+        .option("--json", "Print findings as JSON")
+        .action((files, opts) => {
+        process.exitCode = runScanSecrets(files ?? [], opts);
+    });
+}
+//# sourceMappingURL=scan.js.map

package/dist/lib/lanes/flag-keys.d.ts

@@ -46,4 +46,12 @@ export declare const LANE_WORKER_CONTINUITY_FLAG = "lanes.worker-continuity";
 export declare const LANE_CONDUCT_LOOP_FLAG = "lanes.conduct-loop";
 export declare const LANE_ENVELOPE_REPAIR_GUIDANCE_FLAG = "lanes.envelope-repair-guidance";
 export declare const LANE_LOOP_HANDOFF_REPAIR_FLAG = "lanes.loop-handoff-repair";
+/** Adds the latest root-scoped orphan count to SessionStart context. */
+export declare const LANE_ORPHAN_SWEEP_CONTEXT_FLAG = "lanes.orphan-sweep-context-line";
+/** Separates lane reap leases and reports by resolved HQ root. */
+export declare const LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG = "lanes.orphan-sweep-root-keying";
+/** Reports awaiting-input lanes whose owning session ended. */
+export declare const LANE_ORPHAN_SWEEP_WAITING_FLAG = "lanes.orphan-sweep-waiting-senior";
+/** Reports and optionally stops abandoned legacy conduct pool loops. */
+export declare const LANE_ORPHAN_SWEEP_LEGACY_FLAG = "lanes.orphan-sweep-legacy-pool";
 //# sourceMappingURL=flag-keys.d.ts.map

package/dist/lib/lanes/flag-keys.js

@@ -46,4 +46,12 @@ export const LANE_WORKER_CONTINUITY_FLAG = "lanes.worker-continuity";
 export const LANE_CONDUCT_LOOP_FLAG = "lanes.conduct-loop";
 export const LANE_ENVELOPE_REPAIR_GUIDANCE_FLAG = "lanes.envelope-repair-guidance";
 export const LANE_LOOP_HANDOFF_REPAIR_FLAG = "lanes.loop-handoff-repair";
+/** Adds the latest root-scoped orphan count to SessionStart context. */
+export const LANE_ORPHAN_SWEEP_CONTEXT_FLAG = "lanes.orphan-sweep-context-line";
+/** Separates lane reap leases and reports by resolved HQ root. */
+export const LANE_ORPHAN_SWEEP_ROOT_KEYING_FLAG = "lanes.orphan-sweep-root-keying";
+/** Reports awaiting-input lanes whose owning session ended. */
+export const LANE_ORPHAN_SWEEP_WAITING_FLAG = "lanes.orphan-sweep-waiting-senior";
+/** Reports and optionally stops abandoned legacy conduct pool loops. */
+export const LANE_ORPHAN_SWEEP_LEGACY_FLAG = "lanes.orphan-sweep-legacy-pool";
 //# sourceMappingURL=flag-keys.js.map

package/dist/lib/lanes/legacy-pool.d.ts

@@ -0,0 +1,35 @@
+export interface LegacyPoolFinding {
+    lane_id: string;
+    legacy: true;
+    orphaned: boolean;
+    reason: string;
+    age_minutes: number;
+    session_id: string;
+    company_slug?: string;
+    pid: number;
+    process_starttime: number | null;
+    loop_started_at: string;
+    run_dir: string;
+    would_stop?: boolean;
+    stopped?: boolean;
+    stop_error?: string;
+}
+export interface LegacyPoolDeps {
+    processes?: () => Array<{
+        pid: number;
+        ppid: number;
+        args: string;
+    }>;
+    isAlive?: (pid: number) => boolean;
+    readStarttime?: (pid: number) => number | null;
+    signal?: (pid: number, signal: NodeJS.Signals) => void;
+    snapshotProcess?: (pid: number) => {
+        args: string;
+        startedAt: number | null;
+    } | null;
+    sessionState?: (root: string, sessionId: string, now: Date) => string | null;
+    now?: () => Date;
+}
+export declare function findLegacyPoolLanes(root: string, deps?: LegacyPoolDeps): LegacyPoolFinding[];
+export declare function stopLegacyPoolLane(root: string, finding: LegacyPoolFinding, deps?: LegacyPoolDeps): boolean;
+//# sourceMappingURL=legacy-pool.d.ts.map