@indigoai-us/hq-cli 5.167.0 → 5.168.0

package/dist/lib/daemon/run.js

@@ -15,14 +15,17 @@ import { isLocalDependencyInstall, resolveRunningInstall } from "../../utils/ver
 import { agentKitPaths } from "../agent-kit/paths.js";
 import { readBotConfig } from "../bot/config.js";
 import { botsRoot } from "../bot/paths.js";
-import { enabledServices, planUnits } from "./catalog.js";
+import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
 import { readDaemonConfig } from "./config.js";
 import { findLegacyUnits, legacyOwnerLookup } from "./legacy.js";
 import { acquireDaemonLock, releaseDaemonLock } from "./lock.js";
+import { daemonRootRefusal } from "./install.js";
 import { detectMachineType } from "./machine-type.js";
 import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
 import { takeControlRequests } from "./requests.js";
+import { runnerSessionName } from "./remote-control.js";
 import { STOP_ESCALATION_MS, createSupervisor } from "./supervisor.js";
+import { userToolDirs } from "./tools.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export const RESTART_EXIT_CODE = 75;
@@ -79,6 +82,35 @@ export function findOnPath(name, env = process.env) {
     }
     return null;
 }
+/**
+ * A tool the login user installed (~/.local/bin, ~/.npm-global/bin,
+ * ~/.grok/bin) before anything on PATH, so a box runs and updates the user's
+ * own copy instead of one root installed under /usr.
+ */
+export function findUserBinary(name, env, home) {
+    if (process.platform !== "win32") {
+        for (const dir of userToolDirs(home)) {
+            const candidate = path.join(dir, name);
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                if (fs.statSync(candidate).isFile())
+                    return candidate;
+            }
+            catch {
+                // not here
+            }
+        }
+    }
+    return findOnPath(name, env);
+}
+function readIfExists(file) {
+    try {
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
 /** This CLI is a global package install the updater can replace (not a dev checkout or a project dependency). */
 export function cliSelfUpdatable() {
     const install = resolveRunningInstall();
@@ -191,6 +223,12 @@ export async function runDaemon(opts) {
     const machineType = detected.type;
     for (const w of detected.warnings ?? [])
         log("warn", w);
+    const refusal = daemonRootRefusal(typeof process.getuid === "function" && process.getuid() === 0, machineType);
+    if (refusal) {
+        log("error", refusal);
+        releaseDaemonLock(paths.lockPath);
+        return 1;
+    }
     log("info", `starting hq daemon (pid ${process.pid}) as ${machineType} (${detected.detail})`);
     const syncRunnerPath = resolveSyncRunnerPath();
     if (!syncRunnerPath)
@@ -223,7 +261,10 @@ export async function runDaemon(opts) {
             legacyOwner: legacyOwnerLookup(legacy),
             cliSelfUpdatable: updatable,
             jobsReconcileScript: jobsReconcileScript(hqRoot),
-            claudePath: findOnPath("claude", env),
+            claudePath: findUserBinary("claude", env, home),
+            codexPath: findUserBinary("codex", env, home),
+            codexRunnerScript: platform === "linux" && fs.existsSync(CODEX_RUNNER_SCRIPT) ? CODEX_RUNNER_SCRIPT : null,
+            remoteControlName: runnerSessionName(readIfExists(CLAUDE_RUNNER_SCRIPT) ?? ""),
             tmuxPath: findOnPath("tmux", env),
             hostName,
         });

package/dist/lib/daemon/tools.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The AI CLIs the daemon keeps current (Claude, Codex, Grok): where the login
+ * user's copy is, which version it is, and how to update it.
+ *
+ * Boxes can carry two copies of a tool: one root installed under /usr during
+ * provisioning, and the login user's own under ~/.npm-global or ~/.local. The
+ * daemon runs as the login user, so it always prefers that user's copy (which
+ * it can update) and never updates a copy it cannot write.
+ */
+export declare const TOOL_NAMES: readonly ["claude", "codex", "grok"];
+export type ToolName = (typeof TOOL_NAMES)[number];
+export interface ToolProbeDeps {
+    home: string;
+    /** Defaults to this process's platform. */
+    platform?: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+    exists: (p: string) => boolean;
+    realpath: (p: string) => string;
+    /** Whether this user can write the directory. */
+    writable: (dir: string) => boolean;
+    /** `<bin> --version`. */
+    version: (bin: string) => {
+        status: number | null;
+        stdout: string;
+    };
+}
+export interface ToolInstall {
+    /** The command as found (for example ~/.npm-global/bin/claude). */
+    path: string;
+    /** Where that resolves to on disk. */
+    realPath: string;
+    version: string | null;
+    /** False for a copy this user cannot update (for example root's under /usr). */
+    writable: boolean;
+}
+/** The login user's own install folders, searched before PATH. */
+export declare function userToolDirs(home: string): string[];
+export declare function findUserTool(name: ToolName, deps: ToolProbeDeps): string | null;
+export declare function parseToolVersion(output: string): string | null;
+export declare function locateTool(name: ToolName, deps: ToolProbeDeps): ToolInstall | null;
+export interface ToolUpdateCommand {
+    file: string;
+    args: string[];
+    env: Record<string, string>;
+}
+/**
+ * An npm install is updated through npm, into the prefix it was found in (the
+ * npm on PATH may be configured for another one); anything else through the
+ * CLI's own `update`.
+ */
+export declare function toolUpdateCommand(name: ToolName, install: Pick<ToolInstall, "path" | "realPath">, platform?: NodeJS.Platform): ToolUpdateCommand;
+//# sourceMappingURL=tools.d.ts.map

package/dist/lib/daemon/tools.js

@@ -0,0 +1,95 @@
+/**
+ * The AI CLIs the daemon keeps current (Claude, Codex, Grok): where the login
+ * user's copy is, which version it is, and how to update it.
+ *
+ * Boxes can carry two copies of a tool: one root installed under /usr during
+ * provisioning, and the login user's own under ~/.npm-global or ~/.local. The
+ * daemon runs as the login user, so it always prefers that user's copy (which
+ * it can update) and never updates a copy it cannot write.
+ */
+import * as path from "node:path";
+export const TOOL_NAMES = ["claude", "codex", "grok"];
+/** npm package for tools that can be installed with npm. */
+const NPM_PACKAGES = {
+    claude: "@anthropic-ai/claude-code",
+    codex: "@openai/codex",
+    grok: "@vibe-kit/grok-cli",
+};
+/** Environment each tool's own `update` command needs to run unattended. */
+const UPDATE_ENV = {
+    codex: { CODEX_NON_INTERACTIVE: "1" },
+};
+/** The login user's own install folders, searched before PATH. */
+export function userToolDirs(home) {
+    return [
+        path.posix.join(home, ".local", "bin"),
+        path.posix.join(home, ".npm-global", "bin"),
+        path.posix.join(home, ".grok", "bin"),
+    ];
+}
+export function findUserTool(name, deps) {
+    const windows = (deps.platform ?? process.platform) === "win32";
+    if (!windows) {
+        for (const dir of userToolDirs(deps.home)) {
+            const candidate = path.posix.join(dir, name);
+            if (deps.exists(candidate))
+                return candidate;
+        }
+    }
+    const p = windows ? path.win32 : path.posix;
+    // Windows installs are claude.exe, codex.cmd and so on.
+    const exts = windows ? (deps.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+    for (const dir of (deps.env.PATH ?? "").split(p.delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const candidate = p.join(dir, `${name}${ext.toLowerCase()}`);
+            if (deps.exists(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+export function parseToolVersion(output) {
+    const m = /\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)\b/.exec(output);
+    return m ? m[1] : null;
+}
+export function locateTool(name, deps) {
+    const found = findUserTool(name, deps);
+    if (!found)
+        return null;
+    const realPath = deps.realpath(found);
+    const r = deps.version(found);
+    return {
+        path: found,
+        realPath,
+        version: r.status === 0 ? parseToolVersion(r.stdout) : null,
+        writable: deps.writable(path.dirname(realPath)),
+    };
+}
+/**
+ * The npm global prefix an install lives in: `<prefix>/lib/node_modules/<pkg>`
+ * on Unix, `<prefix>\\node_modules\\<pkg>` on Windows. Null when the real path
+ * is not inside that package.
+ */
+function npmPrefixOf(realPath, pkg, platform) {
+    const windows = platform === "win32";
+    const p = windows ? path.win32 : path.posix;
+    const marker = windows ? `${p.sep}node_modules${p.sep}${pkg.split("/").join(p.sep)}${p.sep}` : `/lib/node_modules/${pkg}/`;
+    const at = realPath.indexOf(marker);
+    return at > 0 ? realPath.slice(0, at) : null;
+}
+/**
+ * An npm install is updated through npm, into the prefix it was found in (the
+ * npm on PATH may be configured for another one); anything else through the
+ * CLI's own `update`.
+ */
+export function toolUpdateCommand(name, install, platform = process.platform) {
+    const pkg = NPM_PACKAGES[name];
+    const prefix = pkg ? npmPrefixOf(install.realPath, pkg, platform) : null;
+    if (pkg && prefix) {
+        return { file: "npm", args: ["install", "-g", "--prefix", prefix, `${pkg}@latest`], env: {} };
+    }
+    return { file: install.path, args: ["update"], env: { ...(UPDATE_ENV[name] ?? {}) } };
+}
+//# sourceMappingURL=tools.js.map

package/dist/lib/daemon/updater.d.ts

@@ -3,37 +3,45 @@
  * replaces the boxes' `hq-cli-update.timer` and `*-codex-update.timer`:
  *
  * 1. Update the hq CLI through the shared self-update path (same install
- *    routing, lock and convergence check as every other CLI update).
- * 2. Update Codex when it is installed as a global npm package and behind.
+ *    routing, lock and convergence check as every other CLI update), when it
+ *    is a global install this process may replace.
+ * 2. Update the Claude, Codex and Grok CLIs the login user installed, each
+ *    through its own update route. A copy this user cannot write (root's
+ *    under /usr) is reported and left alone.
  * 3. After a CLI update, ask the daemon to restart itself so the supervisor and
- *    every service run the new version.
+ *    every service run the new version. The remote-control hosts notice an
+ *    updated Claude or Codex on disk themselves and restart once idle.
  */
 import type { SelfUpdateOutcome } from "../../utils/self-update.js";
-export declare const CODEX_PACKAGE = "@openai/codex";
-export interface CodexUpdater {
-    /** Version of the global npm install, or null when Codex is not installed that way. */
-    installedVersion: () => string | null;
-    latestVersion: () => string | null;
-    install: () => {
+import { type ToolInstall, type ToolName } from "./tools.js";
+export type { ToolInstall } from "./tools.js";
+export interface ToolUpdater {
+    name: ToolName;
+    locate: () => ToolInstall | null;
+    update: (install: ToolInstall) => {
         ok: boolean;
         detail?: string;
     };
 }
 export interface UpdaterDeps {
-    updateCli: () => Promise<Pick<SelfUpdateOutcome, "action" | "latest">>;
-    codex: CodexUpdater;
+    /** Null when this CLI is not a global install the updater may replace. */
+    updateCli: (() => Promise<Pick<SelfUpdateOutcome, "action" | "latest">>) | null;
+    tools: readonly ToolUpdater[];
     requestDaemonRestart: () => void;
     log: (line: string) => void;
 }
-export declare function runDaemonUpdater(deps: UpdaterDeps): Promise<{
+export interface UpdaterResult {
     ok: boolean;
-}>;
+    /** Tools whose version changed in this run. */
+    updated: ToolName[];
+}
+export declare function runDaemonUpdater(deps: UpdaterDeps): Promise<UpdaterResult>;
 /**
  * The variables for the updater's own CLI update. Every supervised service
  * gets HQ_NO_UPDATE_CHECK=1 so it never updates itself; the updater is the one
  * process that must, so it drops that opt-out.
  */
 export declare function updaterEnv(vars: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-/** Codex through the global npm install, the way the boxes install it. */
-export declare function npmCodexUpdater(): CodexUpdater;
+/** The real updater for one tool, run as this (the login) user. */
+export declare function hostToolUpdater(name: ToolName, env: NodeJS.ProcessEnv, home: string): ToolUpdater;
 //# sourceMappingURL=updater.d.ts.map

package/dist/lib/daemon/updater.js

@@ -3,56 +3,77 @@
  * replaces the boxes' `hq-cli-update.timer` and `*-codex-update.timer`:
  *
  * 1. Update the hq CLI through the shared self-update path (same install
- *    routing, lock and convergence check as every other CLI update).
- * 2. Update Codex when it is installed as a global npm package and behind.
+ *    routing, lock and convergence check as every other CLI update), when it
+ *    is a global install this process may replace.
+ * 2. Update the Claude, Codex and Grok CLIs the login user installed, each
+ *    through its own update route. A copy this user cannot write (root's
+ *    under /usr) is reported and left alone.
  * 3. After a CLI update, ask the daemon to restart itself so the supervisor and
- *    every service run the new version.
+ *    every service run the new version. The remote-control hosts notice an
+ *    updated Claude or Codex on disk themselves and restart once idle.
  */
 import { spawnSync } from "node:child_process";
-import semver from "semver";
-export const CODEX_PACKAGE = "@openai/codex";
+import * as fs from "node:fs";
+import { locateTool, toolUpdateCommand } from "./tools.js";
 export async function runDaemonUpdater(deps) {
     let ok = true;
-    const cli = await deps.updateCli();
     // The restart stops this process too, so it is requested only once all the
-    // updater's work (including a global npm install of Codex) is done.
+    // updater's work (every tool install) is done.
     let restart = false;
-    switch (cli.action) {
-        case "updated":
-            deps.log(`hq CLI updated to ${cli.latest ?? "the latest version"}; the daemon restarts onto it once Codex is checked`);
-            restart = true;
-            break;
-        case "update-failed":
-        case "update-ineffective":
-            deps.log(`hq CLI update to ${cli.latest ?? "latest"} did not take effect (${cli.action})`);
+    if (deps.updateCli === null) {
+        deps.log("hq CLI: not a global install, so it is updated with the project or app that owns it");
+    }
+    else {
+        const cli = await deps.updateCli();
+        switch (cli.action) {
+            case "updated":
+                deps.log(`hq CLI updated to ${cli.latest ?? "the latest version"}; the daemon restarts onto it once the tools are checked`);
+                restart = true;
+                break;
+            case "update-failed":
+            case "update-ineffective":
+                deps.log(`hq CLI update to ${cli.latest ?? "latest"} did not take effect (${cli.action})`);
+                ok = false;
+                break;
+            default:
+                deps.log(`hq CLI: ${cli.action === "current" ? "up to date" : cli.action}`);
+        }
+    }
+    const updated = [];
+    for (const tool of deps.tools) {
+        const outcome = updateTool(tool, deps.log);
+        if (outcome === "failed")
             ok = false;
-            break;
-        default:
-            deps.log(`hq CLI: ${cli.action === "current" ? "up to date" : cli.action}`);
+        if (outcome === "updated")
+            updated.push(tool.name);
     }
-    if (!updateCodex(deps))
-        ok = false;
     if (restart)
         deps.requestDaemonRestart();
-    return { ok };
+    return { ok, updated };
 }
-/** Update Codex when it is a global npm install and behind; false when that update failed. */
-function updateCodex(deps) {
-    const installed = deps.codex.installedVersion();
-    if (installed === null)
-        return true;
-    const latest = deps.codex.latestVersion();
-    if (latest === null || !semver.valid(installed) || !semver.valid(latest) || !semver.gt(latest, installed)) {
-        deps.log(`Codex ${installed}: nothing to update`);
-        return true;
+function updateTool(tool, log) {
+    const before = tool.locate();
+    if (!before) {
+        log(`${tool.name}: not installed`);
+        return "skipped";
+    }
+    if (!before.writable) {
+        log(`${tool.name} at ${before.path} belongs to another account, so it is not updated as this user`);
+        return "skipped";
+    }
+    const result = tool.update(before);
+    if (!result.ok) {
+        log(`${tool.name} update failed: ${result.detail ?? "unknown error"}`);
+        return "failed";
     }
-    const result = deps.codex.install();
-    if (result.ok) {
-        deps.log(`Codex updated ${installed} -> ${latest}`);
-        return true;
+    const after = tool.locate();
+    const from = before.version ?? "unknown version";
+    if (after?.version && after.version !== before.version) {
+        log(`${tool.name} updated ${from} -> ${after.version}`);
+        return "updated";
     }
-    deps.log(`Codex update ${installed} -> ${latest} failed: ${result.detail ?? "unknown error"}`);
-    return false;
+    log(`${tool.name} ${from}: up to date`);
+    return "current";
 }
 /**
  * The variables for the updater's own CLI update. Every supervised service
@@ -64,39 +85,55 @@ export function updaterEnv(vars) {
     delete copy.HQ_NO_UPDATE_CHECK;
     return copy;
 }
-function npm(args) {
-    const r = spawnSync(process.platform === "win32" ? "npm.cmd" : "npm", args, {
-        encoding: "utf8",
-        timeout: 10 * 60_000,
-        windowsHide: true,
-        shell: process.platform === "win32",
-    });
-    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
-}
-/** Codex through the global npm install, the way the boxes install it. */
-export function npmCodexUpdater() {
+function hostProbe(env, home) {
     return {
-        installedVersion: () => {
-            const r = npm(["ls", "-g", CODEX_PACKAGE, "--depth=0", "--json"]);
+        home,
+        env,
+        exists: (p) => {
             try {
-                const parsed = JSON.parse(r.stdout);
-                return parsed.dependencies?.[CODEX_PACKAGE]?.version ?? null;
+                fs.accessSync(p, fs.constants.X_OK);
+                return true;
             }
             catch {
-                return null;
+                return false;
             }
         },
-        latestVersion: () => {
-            const r = npm(["view", CODEX_PACKAGE, "version"]);
-            const v = r.status === 0 ? r.stdout.trim() : "";
-            return v || null;
+        realpath: (p) => fs.realpathSync(p),
+        writable: (dir) => {
+            try {
+                fs.accessSync(dir, fs.constants.W_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        version: (bin) => {
+            const r = spawnSync(bin, ["--version"], { encoding: "utf8", env, timeout: 30_000, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+            return { status: r.status, stdout: r.stdout ?? "" };
         },
-        install: () => {
-            const r = npm(["install", "-g", `${CODEX_PACKAGE}@latest`]);
+    };
+}
+/** The real updater for one tool, run as this (the login) user. */
+export function hostToolUpdater(name, env, home) {
+    const probe = hostProbe(env, home);
+    return {
+        name,
+        locate: () => locateTool(name, probe),
+        update: (install) => {
+            const cmd = toolUpdateCommand(name, install);
+            const r = spawnSync(cmd.file, cmd.args, {
+                encoding: "utf8",
+                env: { ...env, ...cmd.env },
+                timeout: 10 * 60_000,
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+                shell: process.platform === "win32" && cmd.file === "npm",
+            });
             if (r.status === 0)
                 return { ok: true };
-            const tail = r.stderr.trim().split("\n").slice(-3).join(" ").slice(0, 400);
-            return { ok: false, detail: tail || `npm exited ${r.status ?? "by signal"}` };
+            const tail = `${r.stderr ?? ""}\n${r.stdout ?? ""}`.trim().split("\n").slice(-3).join(" ").slice(0, 400);
+            return { ok: false, detail: tail || (r.error ? r.error.message : `${cmd.file} exited ${r.status ?? "by signal"}`) };
         },
     };
 }

package/dist/lib/lanes/outpost-pruner-install.d.ts

@@ -0,0 +1,37 @@
+export declare const OUTPOST_PRUNER_PRESSURE_SERVICE = "hq-outpost-worktree-pruner-pressure.service";
+export declare const OUTPOST_PRUNER_PRESSURE_TIMER = "hq-outpost-worktree-pruner-pressure.timer";
+export declare const OUTPOST_PRUNER_DAILY_SERVICE = "hq-outpost-worktree-pruner-daily.service";
+export declare const OUTPOST_PRUNER_DAILY_TIMER = "hq-outpost-worktree-pruner-daily.timer";
+export declare const OUTPOST_PRUNER_MIN_AGE_DAYS = 14;
+export interface OutpostPrunerInstallOptions {
+    systemdRoot: string;
+    hqRoot: string;
+    nodeBinary?: string;
+    hqBinary?: string;
+    home?: string;
+    flagApiUrl?: string;
+    companyUid?: string;
+    enable?: boolean;
+    runCommand?: (command: string, args: string[]) => {
+        status: number;
+        stdout?: string;
+        stderr?: string;
+    };
+}
+export interface OutpostPrunerInstallResult {
+    ok: true;
+    action: "outpost-pruner.install" | "outpost-pruner.uninstall";
+    systemd_root: string;
+    units: string[];
+    written?: boolean;
+    enabled?: boolean;
+    removed?: boolean;
+}
+export declare function renderOutpostPrunerPressureTimer(): string;
+export declare function renderOutpostPrunerDailyTimer(): string;
+export declare function defaultOutpostPrunerSystemdDir(home?: string): string;
+export declare function installOutpostPrunerTimers(options: OutpostPrunerInstallOptions): OutpostPrunerInstallResult;
+export declare function uninstallOutpostPrunerTimers(options: Pick<OutpostPrunerInstallOptions, "systemdRoot" | "runCommand"> & {
+    disable?: boolean;
+}): OutpostPrunerInstallResult;
+//# sourceMappingURL=outpost-pruner-install.d.ts.map