@indigoai-us/hq-cli 5.167.0 → 5.169.0

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+## [5.169.0] — 2026-09-24
+
+### Fixed
+
+- `hq lanes create` and `hq lanes story <add|start|block|done>` keep story work
+  local when an existing Work Mesh Board rejects a missing story. The
+  `story_warning` identifies the project and story and suggests:
+  `hq mesh project ensure <projectId> --company <slug> --stories-file prd.json`.
+
+## [5.168.0] — 2026-09-24
+
+### Fixed
+
+- `hq mesh project set --stories-file` keeps live Board story status and
+
+- `hq mesh` ignores nonpositive, malformed, and expired `Retry-After` hints.
+
+### Added
+
+- `hq daemon` keeps the hq CLI, Claude, Codex and Grok up to date on every machine type, desktops included, every six hours. It updates the login user's own copy of each tool through that tool's npm package or its own `update` command, and leaves a copy the user cannot write (for example one root installed in /usr) alone. On outposts the daemon also runs Codex remote control (the box's Codex runner) next to Claude remote control, keeps the session name the box's runner used, and restarts either one onto a newly installed Claude or Codex once the session has been quiet for 10 minutes, or after 2 hours at the latest. `hq daemon install` never sets the daemon up to run as root: a box runs it as the login user from `/etc/hq/machine-type`, the outpost runner unit, `--user` or `sudo`, and an outpost without the marker file is recognised from its runner unit. `hq daemon migrate --apply` also takes over the outpost runner watchdogs and the Codex update timer.
+- Added outpost worktree cleanup commands for dry runs and pruning clean, aged
+  worktrees. Lane, session, and process references keep their worktrees. Pressure
+  and daily timers use the `outpost.worktree-pruner` hq-flags key, which starts off.
+  Live-lane `worker.out` files and matching Claude session transcripts are read in
+  bounded chunks. Transcript lookup reads only the file matching the lane's
+  provider session ID under `.claude*/projects/*`. An unresolved lane keeps
+  worktrees whose root, linked Git index, or linked Git `HEAD` changed at or after
+  its `created_at`; a missing or invalid start time keeps every candidate. A
+  never-spawned queued lane without a provider session does not hold a worktree.
+
 ## [5.167.0] — 2026-09-24
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -5731,6 +5731,9 @@ export declare const COMMAND_CATALOG: readonly [{
             }, {
                 readonly flags: "--create";
                 readonly description: "Create the Board view when the GET is a 404";
+            }, {
+                readonly flags: "--reset-status";
+                readonly description: "Overwrite live story status from the PRD (prints a one-line summary of changes)";
             }, {
                 readonly flags: "--json";
                 readonly description: "Print machine-readable JSON";
@@ -6775,6 +6778,72 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly arguments: readonly [];
     readonly options: readonly [];
     readonly subcommands: readonly [{
+        readonly name: "outpost-pruner";
+        readonly description: "Inspect, install, and run safe outpost worktree pruning";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "run";
+            readonly description: "Run the guarded outpost worktree and user-cache cleanup";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--trigger <kind>";
+                readonly description: "pressure | daily | manual";
+            }, {
+                readonly flags: "--min-age-days <days>";
+                readonly description: "Minimum age before cleanup (1–365 days)";
+            }, {
+                readonly flags: "--dry-run";
+                readonly description: "List eligible worktrees without deleting files";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "install";
+            readonly description: "Write the pressure and daily systemd user timers";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--systemd-root <path>";
+                readonly description: "Systemd user unit directory";
+            }, {
+                readonly flags: "--enable";
+                readonly description: "Enable both timers after writing the units";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "uninstall";
+            readonly description: "Disable and remove the pressure and daily systemd user timers";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--systemd-root <path>";
+                readonly description: "Systemd user unit directory";
+            }, {
+                readonly flags: "--disable";
+                readonly description: "Disable both timers before removing their units";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }];
+    }, {
         readonly name: "create";
         readonly description: "Register a lane, run admission, and return immediately";
         readonly aliases: readonly [];
@@ -7660,6 +7729,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--hq-root <path>";
             readonly description: "HQ folder the services work against";
+        }, {
+            readonly flags: "--user <login>";
+            readonly description: "on a box: the login user the daemon runs as (never root)";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -7800,7 +7872,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [];
         readonly subcommands: readonly [{
             readonly name: "self-update";
-            readonly description: "Update the hq CLI (and Codex), then restart the daemon onto the new version";
+            readonly description: "Update the hq CLI, Claude, Codex and Grok, then restart the daemon onto a new CLI";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options]";
@@ -7825,6 +7897,21 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "claude --permission-mode";
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "codex-remote-control";
+            readonly description: "Keep the box's Codex remote-control runner going in a tmux session, restarting it after a Codex update";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--script <path>";
+                readonly description: "the box's Codex runner script";
+            }, {
+                readonly flags: "--codex <path>";
+                readonly description: "codex binary, watched for updates";
+            }];
+            readonly subcommands: readonly [];
         }];
     }];
 }, {

package/dist/command-catalog.generated.js

@@ -7396,6 +7396,10 @@ export const COMMAND_CATALOG = [
                                 "flags": "--create",
                                 "description": "Create the Board view when the GET is a 404"
                             },
+                            {
+                                "flags": "--reset-status",
+                                "description": "Overwrite live story status from the PRD (prints a one-line summary of changes)"
+                            },
                             {
                                 "flags": "--json",
                                 "description": "Print machine-readable JSON"
@@ -8754,6 +8758,90 @@ export const COMMAND_CATALOG = [
         "arguments": [],
         "options": [],
         "subcommands": [
+            {
+                "name": "outpost-pruner",
+                "description": "Inspect, install, and run safe outpost worktree pruning",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "run",
+                        "description": "Run the guarded outpost worktree and user-cache cleanup",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--trigger <kind>",
+                                "description": "pressure | daily | manual"
+                            },
+                            {
+                                "flags": "--min-age-days <days>",
+                                "description": "Minimum age before cleanup (1–365 days)"
+                            },
+                            {
+                                "flags": "--dry-run",
+                                "description": "List eligible worktrees without deleting files"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "install",
+                        "description": "Write the pressure and daily systemd user timers",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--systemd-root <path>",
+                                "description": "Systemd user unit directory"
+                            },
+                            {
+                                "flags": "--enable",
+                                "description": "Enable both timers after writing the units"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "uninstall",
+                        "description": "Disable and remove the pressure and daily systemd user timers",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--systemd-root <path>",
+                                "description": "Systemd user unit directory"
+                            },
+                            {
+                                "flags": "--disable",
+                                "description": "Disable both timers before removing their units"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "create",
                 "description": "Register a lane, run admission, and return immediately",
@@ -9904,6 +9992,10 @@ export const COMMAND_CATALOG = [
                     {
                         "flags": "--hq-root <path>",
                         "description": "HQ folder the services work against"
+                    },
+                    {
+                        "flags": "--user <login>",
+                        "description": "on a box: the login user the daemon runs as (never root)"
                     }
                 ],
                 "subcommands": []
@@ -10080,7 +10172,7 @@ export const COMMAND_CATALOG = [
                 "subcommands": [
                     {
                         "name": "self-update",
-                        "description": "Update the hq CLI (and Codex), then restart the daemon onto the new version",
+                        "description": "Update the hq CLI, Claude, Codex and Grok, then restart the daemon onto a new CLI",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options]",
@@ -10110,6 +10202,25 @@ export const COMMAND_CATALOG = [
                             }
                         ],
                         "subcommands": []
+                    },
+                    {
+                        "name": "codex-remote-control",
+                        "description": "Keep the box's Codex remote-control runner going in a tmux session, restarting it after a Codex update",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--script <path>",
+                                "description": "the box's Codex runner script"
+                            },
+                            {
+                                "flags": "--codex <path>",
+                                "description": "codex binary, watched for updates"
+                            }
+                        ],
+                        "subcommands": []
                     }
                 ]
             }

package/dist/commands/daemon.d.ts

@@ -29,6 +29,8 @@ export interface DaemonCommandDeps {
     isRoot: boolean;
     fileExists: (p: string) => boolean;
     readFile: (p: string) => string;
+    /** Writes a root-owned file such as /etc/hq/machine-type, creating its folder. */
+    writeFile: (p: string, text: string) => void;
     legacyUnits: () => LegacyUnit[];
     resolveHqRoot: (flag: string | undefined) => string | undefined;
     /** Home folder of the login user a box's system unit runs as. */

package/dist/commands/daemon.js

@@ -20,10 +20,10 @@ import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices } from "../lib/
 import { applyServiceToggle, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
 import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
 import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/daemon/migrate.js";
-import { SYSTEM_UNIT_DIR, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
+import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, daemonRootRefusal, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
 import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
 import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
-import { detectMachineType, homeFromPasswd } from "../lib/daemon/machine-type.js";
+import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "../lib/daemon/machine-type.js";
 import { daemonPaths } from "../lib/daemon/paths.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
@@ -67,6 +67,11 @@ async function loadDefaults(over) {
         isRoot: over.isRoot ?? (typeof process.getuid === "function" && process.getuid() === 0),
         fileExists: over.fileExists ?? fs.existsSync,
         readFile: over.readFile ?? ((p) => fs.readFileSync(p, "utf8")),
+        writeFile: over.writeFile ??
+            ((p, text) => {
+                fs.mkdirSync(path.dirname(p), { recursive: true });
+                fs.writeFileSync(p, text, { mode: 0o644 });
+            }),
         legacyUnits: over.legacyUnits ??
             (() => findLegacyUnits({
                 platform,
@@ -142,17 +147,22 @@ function loginHome(user, run) {
  * Where the daemon's files are for this machine. On boxes the system unit runs
  * as the login user, so its files live in that user's home, not root's.
  */
-function hostPaths(d, flag) {
+function hostPaths(d, flag, userFlag) {
     const own = daemonPaths(d.home, d.env);
     const detected = detect(d, flag, readDaemonConfig(own.configPath));
     if (installScopeFor(detected.type) !== "system")
         return { paths: own, detected };
-    const runAsUser = detected.runAsUser;
+    // An explicit --user, then the marker or the outpost runner's User=, then
+    // the account that ran sudo.
+    const sudoUser = d.env.SUDO_USER?.trim();
+    const runAsUser = userFlag ?? detected.runAsUser ?? (sudoUser && sudoUser !== "root" ? sudoUser : undefined);
+    if (runAsUser === "root")
+        throw new DaemonCommandError(`${ROOT_REFUSAL} Pass the box's login user with --user <name>.`);
     if (!runAsUser) {
-        throw new DaemonCommandError("A box install needs the login user the daemon runs as. Provisioning writes it to /etc/hq/machine-type (user=<name>).");
+        throw new DaemonCommandError("A box install needs the login user the daemon runs as: pass --user <name>, or provisioning writes it to /etc/hq/machine-type (user=<name>).");
     }
     const paths = daemonPaths(d.userHome(runAsUser), d.env);
-    if (flag !== undefined)
+    if (flag !== undefined || userFlag !== undefined)
         return { paths, detected, runAsUser };
     // Root normally has no saved config; the login user's saved type is the real one.
     const saved = readDaemonConfig(paths.configPath);
@@ -177,8 +187,12 @@ function handOver(d, host) {
         d.run("chown", ["-R", `${host.runAsUser}:`, host.paths.root]);
 }
 async function runInstall(d, opts) {
-    const { paths, detected, runAsUser } = hostPaths(d, opts.machineType);
+    const { paths, detected, runAsUser } = hostPaths(d, opts.machineType, opts.user);
     const scope = installScopeFor(detected.type);
+    // A per-user unit installed by root would run every service as root.
+    const refusal = scope === "user" ? daemonRootRefusal(d.isRoot, detected.type) : null;
+    if (refusal)
+        throw new DaemonCommandError(refusal);
     const config = {
         ...readDaemonConfig(paths.configPath),
         machineType: detected.type,
@@ -198,6 +212,13 @@ async function runInstall(d, opts) {
     for (const u of migratable) {
         d.out(`Note: ${describeLegacyUnit(u)} still runs ${u.unitId}. The daemon leaves it alone until \`hq daemon migrate\` takes it over.`);
     }
+    // A box worked out from its runner unit, --user or sudo gets the marker file
+    // provisioning would have written: `migrate --apply` moves the runner unit
+    // aside, and later root commands (uninstall) must still find the box's type
+    // and login user.
+    if (scope === "system" && runAsUser && d.isRoot && !d.fileExists(MACHINE_TYPE_MARKER_PATH)) {
+        d.writeFile(MACHINE_TYPE_MARKER_PATH, `type=${detected.type}\nuser=${runAsUser}\n`);
+    }
     const runAsHome = runAsUser ? d.userHome(runAsUser) : undefined;
     const result = installDaemonUnit(hostFor(d, paths, scope === "user"), { scope, runAsUser, runAsHome }, { run: d.run });
     handOver(d, { paths, detected, runAsUser });
@@ -397,32 +418,41 @@ async function runMigrate(d, opts) {
     d.out("Nothing was changed. `hq daemon migrate --apply` takes them over.");
 }
 async function runServiceSelfUpdate(d) {
-    const [{ daemonSelfUpdate }, { npmCodexUpdater, runDaemonUpdater, updaterEnv }, { cliSelfUpdatable }] = await Promise.all([
+    const [{ daemonSelfUpdate }, { hostToolUpdater, runDaemonUpdater, updaterEnv }, { TOOL_NAMES }, { cliSelfUpdatable }] = await Promise.all([
         import("../utils/self-update.js"),
         import("../lib/daemon/updater.js"),
+        import("../lib/daemon/tools.js"),
         import("../lib/daemon/run.js"),
     ]);
-    // Same guard as the plan: never replace a dev checkout or a project's copy with a global install.
-    if (!cliSelfUpdatable()) {
-        d.out("This hq CLI is not a global install; nothing to update here.");
-        return;
-    }
     const { paths } = currentHost(d);
+    const env = updaterEnv(d.env);
     const result = await runDaemonUpdater({
-        updateCli: () => daemonSelfUpdate({ env: updaterEnv(d.env) }),
-        codex: npmCodexUpdater(),
+        // Same guard as every self-update: never replace a dev checkout or a project's copy with a global install.
+        updateCli: cliSelfUpdatable() ? () => daemonSelfUpdate({ env }) : null,
+        tools: TOOL_NAMES.map((name) => hostToolUpdater(name, env, d.home)),
         requestDaemonRestart: () => writeControlRequest(paths.requestsDir, { action: "restart-daemon" }),
         log: d.out,
     });
     if (!result.ok)
         process.exitCode = 1;
 }
-async function runServiceRemoteControl(d, opts) {
+/** Size, mtime and real path of a binary: changes whenever a new version is installed over it. */
+function binaryFingerprint(bin) {
+    try {
+        const real = fs.realpathSync(bin);
+        const st = fs.statSync(real);
+        return `${real}:${st.size}:${st.mtimeMs}`;
+    }
+    catch {
+        return null;
+    }
+}
+async function runTmuxService(d, opts) {
     const { runRemoteControlHost } = await import("../lib/daemon/remote-control.js");
     const { findOnPath } = await import("../lib/daemon/run.js");
     const hqRoot = d.env.HQ_ROOT?.trim();
     if (!hqRoot)
-        throw new DaemonCommandError("remote-control needs HQ_ROOT (the daemon sets it from the saved HQ folder)");
+        throw new DaemonCommandError(`${opts.label} needs HQ_ROOT (the daemon sets it from the saved HQ folder)`);
     const tmux = findOnPath("tmux", d.env);
     if (!tmux)
         throw new DaemonCommandError("tmux is not installed");
@@ -433,10 +463,12 @@ async function runServiceRemoteControl(d, opts) {
     try {
         process.exitCode = await runRemoteControlHost({
             tmux,
-            claude: opts.claude,
-            hqRoot,
-            name: opts.name,
-            permissionMode: opts.permissionMode,
+            session: opts.session,
+            cwd: hqRoot,
+            argv: opts.argv,
+            label: opts.label,
+            binaryFingerprint: () => binaryFingerprint(opts.watch),
+            now: () => Date.now(),
             run: d.run,
             pollMs: 5_000,
             signal: controller.signal,
@@ -455,6 +487,24 @@ async function runServiceRemoteControl(d, opts) {
         process.off("SIGINT", stop);
     }
 }
+async function runServiceRemoteControl(d, opts) {
+    const { TMUX_SESSION, remoteControlArgs } = await import("../lib/daemon/remote-control.js");
+    await runTmuxService(d, {
+        session: TMUX_SESSION,
+        argv: [opts.claude, ...remoteControlArgs({ name: opts.name, permissionMode: opts.permissionMode })],
+        label: "claude remote-control",
+        watch: opts.claude,
+    });
+}
+async function runServiceCodexRemoteControl(d, opts) {
+    const { CODEX_TMUX_SESSION } = await import("../lib/daemon/remote-control.js");
+    await runTmuxService(d, {
+        session: CODEX_TMUX_SESSION,
+        argv: ["bash", opts.script],
+        label: "codex remote-control",
+        watch: opts.codex,
+    });
+}
 export function registerDaemonCommand(program, over = {}) {
     let resolved = null;
     const deps = () => (resolved ??= loadDefaults(over));
@@ -477,6 +527,7 @@ export function registerDaemonCommand(program, over = {}) {
         .description("Detect this machine's type, install the daemon, and start its default services")
         .option("--machine-type <type>", "desktop | self-hosted | outpost | agent-box | agent-kit (skips detection)")
         .option("--hq-root <path>", "HQ folder the services work against")
+        .option("--user <login>", "on a box: the login user the daemon runs as (never root)")
         .action(wrap((d, opts) => runInstall(d, opts)));
     daemon
         .command("uninstall")
@@ -540,7 +591,7 @@ export function registerDaemonCommand(program, over = {}) {
         .description("Entry points the daemon runs for services that have no command of their own");
     service
         .command("self-update")
-        .description("Update the hq CLI (and Codex), then restart the daemon onto the new version")
+        .description("Update the hq CLI, Claude, Codex and Grok, then restart the daemon onto a new CLI")
         .action(wrap((d) => runServiceSelfUpdate(d)));
     service
         .command("remote-control")
@@ -549,6 +600,12 @@ export function registerDaemonCommand(program, over = {}) {
         .requiredOption("--name <name>", "remote-control session name")
         .option("--permission-mode <mode>", "claude --permission-mode")
         .action(wrap((d, opts) => runServiceRemoteControl(d, opts)));
+    service
+        .command("codex-remote-control")
+        .description("Keep the box's Codex remote-control runner going in a tmux session, restarting it after a Codex update")
+        .requiredOption("--script <path>", "the box's Codex runner script")
+        .requiredOption("--codex <path>", "codex binary, watched for updates")
+        .action(wrap((d, opts) => runServiceCodexRemoteControl(d, opts)));
     return daemon;
 }
 //# sourceMappingURL=daemon.js.map