@indigoai-us/hq-cli 5.173.0 → 5.174.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.174.0] — 2026-09-24
+
+### Fixed
+
+- Outpost worktree pruning now tolerates cwd `EACCES` only for the verified
+  same-user systemd `(sd-pam)` helper. Other same-user cwd failures and all fd
+  scan failures remain fail-closed. This entry was listed under 5.173.0 by
+  mistake: 5.173.0 was tagged before the change merged, so it first ships here.
+
 ## [5.173.0] — 2026-09-24
 
 ### Fixed
@@ -46,6 +55,7 @@
 
 - Switching the HQ session company (including `hq-session.sh set company_slug`) clears the Work Mesh project and task, posts `session_end` to the previous company, and holds a personal target as `needs_company`.
 
+
 ## [5.169.0] — 2026-09-24
 
 ### Fixed

package/dist/lib/lanes/outpost-worktree-pruner.d.ts

@@ -22,6 +22,8 @@ export interface ProcessPathReader {
     readdirSync(path: string): string[];
     readlinkSync(path: string): string;
     uid(path: string): number;
+    /** Test seam for read-only process identity checks used by the cwd exception. */
+    readFileSync?(path: string): string;
 }
 export interface PackageStorePruneResult {
     attempted: boolean;

package/dist/lib/lanes/outpost-worktree-pruner.js

@@ -521,7 +521,71 @@ const defaultProcessPathReader = {
     readdirSync: (entryPath) => fs.readdirSync(entryPath),
     readlinkSync: (entryPath) => fs.readlinkSync(entryPath),
     uid: (entryPath) => fs.statSync(entryPath).uid,
+    readFileSync: (entryPath) => fs.readFileSync(entryPath, "utf8"),
 };
+function readProcFile(reader, procRoot, pid, name) {
+    if (!reader.readFileSync)
+        return null;
+    try {
+        return reader.readFileSync(path.join(procRoot, pid, name));
+    }
+    catch {
+        // Missing or unreadable identity metadata disables the exception.
+        return null;
+    }
+}
+function procStatusIdentity(contents) {
+    if (contents === null)
+        return null;
+    const value = (name) => {
+        const prefix = `${name}:`;
+        const line = contents.split(/\r?\n/).find((entry) => entry.startsWith(prefix));
+        return line?.slice(prefix.length).trim() || null;
+    };
+    const numeric = (name) => {
+        const raw = value(name);
+        if (!raw)
+            return null;
+        const parsed = Number(raw.split(/\s+/)[0]);
+        return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null;
+    };
+    const name = value("Name");
+    const pid = numeric("Pid");
+    const parentPid = numeric("PPid");
+    const uid = numeric("Uid");
+    if (name === null || pid === null || parentPid === null || uid === null)
+        return null;
+    return { name, pid, parentPid, uid };
+}
+/**
+ * `sd-pam` is systemd's non-dumpable PAM-session helper. Its cwd link can return
+ * EACCES to its own UID, so require the exact proc identity and user-manager
+ * ancestry before treating that one cwd as harmless.
+ */
+function isSystemdUserSdPamProcess(procRoot, pid, currentUid, ownerUid, reader) {
+    if (currentUid === null || ownerUid !== currentUid)
+        return false;
+    const helper = procStatusIdentity(readProcFile(reader, procRoot, pid, "status"));
+    if (!helper || helper.name !== "(sd-pam)" || helper.pid !== Number(pid) || helper.uid !== currentUid ||
+        readProcFile(reader, procRoot, pid, "comm")?.trim() !== "(sd-pam)")
+        return false;
+    const managerPid = String(helper.parentPid);
+    const manager = procStatusIdentity(readProcFile(reader, procRoot, managerPid, "status"));
+    if (!manager || manager.name !== "systemd" || manager.pid !== helper.parentPid || manager.parentPid !== 1 ||
+        manager.uid !== currentUid || readProcFile(reader, procRoot, managerPid, "comm")?.trim() !== "systemd")
+        return false;
+    const init = procStatusIdentity(readProcFile(reader, procRoot, "1", "status"));
+    if (!init || init.name !== "systemd" || init.pid !== 1 || init.parentPid !== 0 || init.uid !== 0 ||
+        readProcFile(reader, procRoot, "1", "comm")?.trim() !== "systemd")
+        return false;
+    try {
+        return reader.uid(path.join(procRoot, managerPid)) === currentUid && reader.uid(path.join(procRoot, "1")) === 0;
+    }
+    catch {
+        // A vanished or inaccessible parent does not prove the helper identity.
+        return false;
+    }
+}
 function scanProcessPaths(procRoot, childName, currentUid = currentProcessUserId(), reader = defaultProcessPathReader) {
     const paths = [];
     let entries;
@@ -547,7 +611,7 @@ function scanProcessPaths(procRoot, childName, currentUid = currentProcessUserId
             continue;
         }
         const base = path.join(processDirectory, childName);
-        // An inaccessible foreign UID cannot own this user's worktree; same-user failures stay fail-closed.
+        // Foreign UID access stays ignorable; same-UID EACCES is excepted only for a verified sd-pam cwd below.
         let descriptors;
         if (childName === "fd") {
             try {
@@ -573,8 +637,10 @@ function scanProcessPaths(procRoot, childName, currentUid = currentProcessUserId
             }
             catch (err) {
                 const code = err.code;
-                if (code !== "ENOENT" && code !== "ESRCH" &&
-                    !(code === "EACCES" && currentUid !== null && ownerUid !== currentUid))
+                const inaccessibleForeign = code === "EACCES" && currentUid !== null && ownerUid !== currentUid;
+                const knownSystemdCwd = code === "EACCES" && childName === "cwd" &&
+                    isSystemdUserSdPamProcess(procRoot, pid, currentUid, ownerUid, reader);
+                if (code !== "ENOENT" && code !== "ESRCH" && !inaccessibleForeign && !knownSystemdCwd)
                     complete = false;
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.173.0",
+  "version": "5.174.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {