@indigoai-us/hq-cli 5.269.0 → 5.270.0

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [5.270.0] — 2026-09-28
+
+### Fixed
+
+- Company billing links in CLI plan-limit notices no longer depend on the
+  rollout flag.
+
+### Removed
+
+- Removed stale gate language from hire-grant command help. Enforcement remains
+  unconditional; backfill remains dry-run only.
+
+### Fixed
+
+- `hq files unshare --with` now accepts the same person UID principals as direct grants.
+- The update gate no longer retries failed Windows installs through `sudo -n`.
+
 ## [5.269.0] — 2026-09-28
 
 ### Fixed
@@ -334,6 +351,10 @@
 - Removed the unused `cli.network.force-ipv4` hq-flags lookup and forced IPv4
   startup path. The existing Node family-attempt timeout remains unchanged.
 - `hq auth login` continues when it cannot read or save the remembered provider. It prints a dim warning with the state path and error code; a save failure does not turn a successful sign-in into a login failure.
+- `hq doctor`, client health metadata, and feedback attachments now use the
+  newest sync-log source from the desktop app or configured daemon directory.
+  Daemon `HQ_DAEMON_DIR` overrides and log rotations are supported, and
+  numeric runner error levels count in health metadata.
 
 ## [5.242.0] — 2026-09-27
 

package/dist/command-catalog.generated.d.ts

@@ -1701,7 +1701,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Email address, group id, or '@all' to remove the company-wide grant";
+            readonly description: "Person uid, email address, group id, or '@all' to remove the grant";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -7755,7 +7755,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Non-negative safe integer hire grant";
         }, {
             readonly flags: "--grant-context <base64url>";
-            readonly description: "Primary-authorized hire hierarchy and gate decision";
+            readonly description: "Primary-authorized hire hierarchy context";
         }, {
             readonly flags: "--json";
             readonly description: "JSON on stdout (always)";
@@ -7807,7 +7807,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "backfill-grants";
-        readonly description: "Preview or apply missing hire grants for alive manager lanes";
+        readonly description: "Preview missing hire grants for alive manager lanes; writes are disabled";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options]";
@@ -7817,7 +7817,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Print proposed values without writing (default)";
         }, {
             readonly flags: "--apply";
-            readonly description: "Write missing hire grants; only run before enforcement is enabled";
+            readonly description: "Retained for compatibility; writes are disabled";
         }, {
             readonly flags: "--json";
             readonly description: "JSON on stdout (always)";

package/dist/command-catalog.generated.js

@@ -2170,7 +2170,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Email address, group id, or '@all' to remove the company-wide grant"
+                        "description": "Person uid, email address, group id, or '@all' to remove the grant"
                     }
                 ],
                 "subcommands": []
@@ -10026,7 +10026,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--grant-context <base64url>",
-                        "description": "Primary-authorized hire hierarchy and gate decision"
+                        "description": "Primary-authorized hire hierarchy context"
                     },
                     {
                         "flags": "--json",
@@ -10095,7 +10095,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "backfill-grants",
-                "description": "Preview or apply missing hire grants for alive manager lanes",
+                "description": "Preview missing hire grants for alive manager lanes; writes are disabled",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options]",
@@ -10107,7 +10107,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--apply",
-                        "description": "Write missing hire grants; only run before enforcement is enabled"
+                        "description": "Retained for compatibility; writes are disabled"
                     },
                     {
                         "flags": "--json",

package/dist/commands/files.js

@@ -262,7 +262,7 @@ export function registerFilesCommand(program) {
     files
         .command("unshare <prefix>")
         .description("Remove a file access grant. A trailing slash targets the private-folder row exactly.")
-        .requiredOption("--with <principal>", "Email address, group id, or '@all' to remove the company-wide grant")
+        .requiredOption("--with <principal>", "Person uid, email address, group id, or '@all' to remove the grant")
         .action(async (prefix, opts) => {
         try {
             // Unshare MUTATES access with no preview, and it resolves the target
@@ -278,7 +278,8 @@ export function registerFilesCommand(program) {
             const isAll = principal === "@all";
             const isEmail = !isAll && EMAIL_PATTERN.test(principal);
             const isGroup = !isAll && GROUP_ID_PATTERN.test(principal);
-            if (!isAll && !isEmail && !isGroup) {
+            const isPerson = !isAll && !isEmail && !isGroup && PERSON_UID_PATTERN.test(principal);
+            if (!isAll && !isEmail && !isGroup && !isPerson) {
                 console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric>`));
                 process.exit(1);
             }
@@ -286,7 +287,9 @@ export function registerFilesCommand(program) {
                 ? "company-wide"
                 : isEmail
                     ? "email"
-                    : "group";
+                    : isGroup
+                        ? "group"
+                        : "person";
             const granteeId = isAll
                 ? ""
                 : isEmail

package/dist/commands/lanes.js

@@ -7002,7 +7002,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .command("grant-target", { hidden: true })
         .argument("<lane-id>", "Lane id")
         .option("--hire <n>", "Non-negative safe integer hire grant")
-        .option("--grant-context <base64url>", "Primary-authorized hire hierarchy and gate decision")
+        .option("--grant-context <base64url>", "Primary-authorized hire hierarchy context")
         .action(wrap(async (laneId, opts) => {
         await runGrantOwnerTarget(ctx, laneId, opts);
     }));
@@ -7027,9 +7027,9 @@ export function registerLanesCommand(parent, deps = {}) {
     }));
     lanes
         .command("backfill-grants")
-        .description("Preview or apply missing hire grants for alive manager lanes")
+        .description("Preview missing hire grants for alive manager lanes; writes are disabled")
         .option("--dry-run", "Print proposed values without writing (default)")
-        .option("--apply", "Write missing hire grants; only run before enforcement is enabled")
+        .option("--apply", "Retained for compatibility; writes are disabled")
         .action(wrap(async (opts) => {
         await runBackfillGrants(ctx, opts);
     }));

package/dist/lib/billing/plan-limit-upgrade-url.d.ts

@@ -1,14 +1,11 @@
-export declare const PLAN_LIMIT_UPGRADE_FALLBACK_FLAG = "cli.plan-limit-upgrade-fallback";
-export declare const PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT = false;
 export interface PlanLimitUpgradeUrlChoices {
     topLevelUrl?: string | null;
     nestedUrl?: string | null;
     legacyUrl: string;
 }
-export declare function isPlanLimitUpgradeFallbackEnabled(): boolean;
 /** Resolve and attribute the final selected company billing destination. */
 export declare function selectPlanLimitUpgradeUrl(companySlug: string | undefined, choices: PlanLimitUpgradeUrlChoices): string;
 export declare function withCliLimitEntrySurface(value: string): string;
-/** Keep the existing destination and flag behavior while labeling company limit links. */
+/** Select the standard upgrade destination and label company limit links. */
 export declare function planLimitUpgradeFallbackUrl(companySlug: string | undefined, previousFallbackUrl: string): string;
 //# sourceMappingURL=plan-limit-upgrade-url.d.ts.map

package/dist/lib/billing/plan-limit-upgrade-url.js

@@ -1,11 +1,5 @@
-import { resolveProcessFlagGate } from "../flag-registry.js";
 import { DEFAULT_VAULT_API_URL } from "../../utils/cognito-session.js";
 import { consoleOrigin } from "../../utils/console-origin.js";
-export const PLAN_LIMIT_UPGRADE_FALLBACK_FLAG = "cli.plan-limit-upgrade-fallback";
-export const PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT = false;
-export function isPlanLimitUpgradeFallbackEnabled() {
-    return resolveProcessFlagGate(PLAN_LIMIT_UPGRADE_FALLBACK_FLAG, { fallback: PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT }, () => PLAN_LIMIT_UPGRADE_FALLBACK_DEFAULT);
-}
 function companyBillingUrl(companySlug) {
     const controlPlaneUrl = process.env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
     const origin = consoleOrigin(controlPlaneUrl);
@@ -19,20 +13,15 @@ function companyBillingUrl(companySlug) {
 }
 /** Resolve and attribute the final selected company billing destination. */
 export function selectPlanLimitUpgradeUrl(companySlug, choices) {
+    const topLevelUrl = choices.topLevelUrl?.trim() || undefined;
+    const nestedUrl = choices.nestedUrl?.trim() || undefined;
+    const generatedUrl = companyBillingUrl(companySlug);
     let selected;
-    if (!isPlanLimitUpgradeFallbackEnabled()) {
-        selected = choices.legacyUrl;
+    if (companySlug?.trim()) {
+        selected = generatedUrl ?? topLevelUrl ?? nestedUrl ?? choices.legacyUrl;
     }
     else {
-        const topLevelUrl = choices.topLevelUrl?.trim() || undefined;
-        const nestedUrl = choices.nestedUrl?.trim() || undefined;
-        const generatedUrl = companyBillingUrl(companySlug);
-        if (companySlug?.trim()) {
-            selected = generatedUrl ?? topLevelUrl ?? nestedUrl ?? choices.legacyUrl;
-        }
-        else {
-            selected = topLevelUrl ?? nestedUrl ?? generatedUrl ?? choices.legacyUrl;
-        }
+        selected = topLevelUrl ?? nestedUrl ?? generatedUrl ?? choices.legacyUrl;
     }
     return withCliLimitEntrySurface(selected);
 }
@@ -68,7 +57,7 @@ export function withCliLimitEntrySurface(value) {
     }
     return value;
 }
-/** Keep the existing destination and flag behavior while labeling company limit links. */
+/** Select the standard upgrade destination and label company limit links. */
 export function planLimitUpgradeFallbackUrl(companySlug, previousFallbackUrl) {
     return selectPlanLimitUpgradeUrl(companySlug, {
         legacyUrl: previousFallbackUrl,

package/dist/lib/doctor/checks/sync-runtime.d.ts

@@ -7,5 +7,5 @@ export interface SyncRuntimeOptions {
 /** Classify the last hour of sync log lines into privacy-safe results. */
 export declare function analyzeSyncRuntimeLog(lines: readonly string[], options: SyncRuntimeOptions): CheckResult[];
 /** Read the machine's sync logs and client health file. */
-export declare function defaultSyncRuntimeResults(now: Date, hqHome?: string): CheckResult[];
+export declare function defaultSyncRuntimeResults(now: Date, hqHome?: string, env?: NodeJS.ProcessEnv): CheckResult[];
 //# sourceMappingURL=sync-runtime.d.ts.map

package/dist/lib/doctor/checks/sync-runtime.js

@@ -9,6 +9,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { currentSyncLogFamily, SYNC_LOG_GENERATIONS, syncLogBasePaths, syncLogGenerationPath, } from "../../../utils/sync-log-sources.js";
 export const SYNC_RUNTIME_WINDOW_MS = 60 * 60_000;
 const LAG_SECONDS = 15 * 60;
 const LAG_MIN_RECEIPTS = 3;
@@ -32,6 +33,32 @@ function parseRecord(rest) {
         return null;
     }
 }
+function timestampFromRecord(record) {
+    if (!record)
+        return null;
+    for (const key of ["time", "timestamp", "ts"]) {
+        const value = record[key];
+        if (typeof value === "number" && Number.isFinite(value)) {
+            const millis = value < 100_000_000_000 ? value * 1000 : value;
+            if (Number.isFinite(millis))
+                return millis;
+        }
+        if (typeof value === "string") {
+            const parsed = Date.parse(value);
+            if (Number.isFinite(parsed))
+                return parsed;
+        }
+    }
+    return null;
+}
+function lineTimestamp(line) {
+    const stamp = TIMESTAMP.exec(line);
+    if (stamp) {
+        const parsed = Date.parse(stamp[1]);
+        return Number.isFinite(parsed) ? parsed : null;
+    }
+    return timestampFromRecord(parseRecord(line));
+}
 /** Classify the last hour of sync log lines into privacy-safe results. */
 export function analyzeSyncRuntimeLog(lines, options) {
     const since = options.now - SYNC_RUNTIME_WINDOW_MS;
@@ -40,13 +67,13 @@ export function analyzeSyncRuntimeLog(lines, options) {
     let starts = 0;
     let deviceLimited = 0;
     for (const line of lines) {
-        const stamp = TIMESTAMP.exec(line);
-        if (!stamp)
+        const time = lineTimestamp(line);
+        if (time === null)
             continue;
-        const time = Date.parse(stamp[1]);
         if (!Number.isFinite(time) || time < since || time > options.now)
             continue;
-        const rest = line.slice(stamp[0].length);
+        const stamp = TIMESTAMP.exec(line);
+        const rest = stamp ? line.slice(stamp[0].length) : line;
         if (DEVICE_LIMIT.test(rest))
             deviceLimited += 1;
         const record = parseRecord(rest);
@@ -61,7 +88,8 @@ export function analyzeSyncRuntimeLog(lines, options) {
         else if (event === "receiver.start") {
             starts += 1;
         }
-        if ((record.type === "receiver" || record.type === "error") &&
+        if ((record.type === "receiver" || record.type === "error" ||
+            (typeof event === "string" && event.startsWith("receiver."))) &&
             PERMISSION.test(JSON.stringify(record.err ?? record.message ?? ""))) {
             denied += 1;
         }
@@ -80,7 +108,7 @@ export function analyzeSyncRuntimeLog(lines, options) {
             checkId: `sync.runtime.${check.id}`,
             reasonCode: check.reasonCode,
             message: `${check.count} ${check.label} in the last hour.`,
-            remediation: "Run `hq sync status` and check ~/.hq/logs/hq-sync.log.",
+            remediation: "Run `hq sync status` and inspect the selected sync log under ~/.hq/logs/, ~/.hq/daemon/logs/, or the configured HQ_DAEMON_DIR/logs/.",
         }
         : {
             status: "PASS",
@@ -88,7 +116,6 @@ export function analyzeSyncRuntimeLog(lines, options) {
             message: `${check.count} ${check.label} in the last hour.`,
         });
 }
-const LOG_GENERATIONS = 4;
 function readLogTail(file) {
     const fd = fs.openSync(file, "r");
     try {
@@ -104,9 +131,9 @@ function readLogTail(file) {
 }
 function firstTimestamp(lines) {
     for (const line of lines) {
-        const stamp = TIMESTAMP.exec(line);
-        if (stamp)
-            return Date.parse(stamp[1]);
+        const timestamp = lineTimestamp(line);
+        if (timestamp !== null)
+            return timestamp;
     }
     return null;
 }
@@ -114,15 +141,21 @@ function firstTimestamp(lines) {
  * Lines from the active log and as many rotated generations as needed to
  * cover the window. Throws when a present log cannot be read.
  */
-function readWindowLines(logFile, since) {
+function readWindowLines(logFile, since, daemonLog) {
     const generations = [];
-    for (let n = 0; n < LOG_GENERATIONS; n += 1) {
-        const file = n === 0 ? logFile : `${logFile}.${n}`;
+    for (let n = 0; n < SYNC_LOG_GENERATIONS; n += 1) {
+        const file = syncLogGenerationPath(logFile, n);
         if (!fs.existsSync(file))
-            break;
+            continue;
         const lines = readLogTail(file);
-        generations.unshift(lines);
-        const first = firstTimestamp(lines);
+        const fallbackTime = daemonLog ? fs.statSync(file).mtimeMs : null;
+        const timestampedLines = fallbackTime === null
+            ? lines
+            : lines.map((line) => lineTimestamp(line) === null
+                ? `${new Date(fallbackTime).toISOString()} ${line}`
+                : line);
+        generations.unshift(timestampedLines);
+        const first = firstTimestamp(timestampedLines);
         if (first !== null && first <= since)
             break;
     }
@@ -139,15 +172,32 @@ function readConflictCount(file) {
     }
 }
 /** Read the machine's sync logs and client health file. */
-export function defaultSyncRuntimeResults(now, hqHome = path.join(os.homedir(), ".hq")) {
+export function defaultSyncRuntimeResults(now, hqHome = path.join(os.homedir(), ".hq"), env = process.env) {
     const options = {
         now: now.getTime(),
         conflictCount: readConflictCount(path.join(hqHome, "client-health.json")),
     };
-    const logFile = path.join(hqHome, "logs", "hq-sync.log");
+    const paths = syncLogBasePaths(hqHome, env);
+    const familyModifiedMs = (family) => {
+        let newest = null;
+        for (let generation = 0; generation < SYNC_LOG_GENERATIONS; generation += 1) {
+            try {
+                const stat = fs.lstatSync(syncLogGenerationPath(paths[family], generation));
+                if (!stat.isFile() && !stat.isDirectory())
+                    continue;
+                newest = newest === null ? stat.mtimeMs : Math.max(newest, stat.mtimeMs);
+            }
+            catch {
+                // Missing or inaccessible generations do not make a source family newer.
+            }
+        }
+        return newest;
+    };
+    const family = currentSyncLogFamily(familyModifiedMs("desktop"), familyModifiedMs("daemon"));
+    const logFile = family === null ? paths.desktop : paths[family];
     let lines;
     try {
-        lines = readWindowLines(logFile, options.now - SYNC_RUNTIME_WINDOW_MS);
+        lines = readWindowLines(logFile, options.now - SYNC_RUNTIME_WINDOW_MS, family === "daemon");
     }
     catch {
         return [

package/dist/lib/plan-limit-nag.js

@@ -37,7 +37,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { resolveProcessFlagCompanyContext } from "./flag-registry.js";
-import { isPlanLimitUpgradeFallbackEnabled, planLimitUpgradeFallbackUrl, selectPlanLimitUpgradeUrl, } from "./billing/plan-limit-upgrade-url.js";
+import { planLimitUpgradeFallbackUrl, selectPlanLimitUpgradeUrl, } from "./billing/plan-limit-upgrade-url.js";
 export const PLAN_LIMIT_UPGRADE_URL = "https://hq.computer/billing/upgrade";
 /**
  * Cadence of the over-limit per-turn line (US-036). Was once a day; the nag
@@ -230,9 +230,7 @@ export function recordPlanLimitStatus(body, opts = {}) {
                 : null;
             const topLevelUpgradeUrl = parseUpgradeUrl(bodyRecord?.upgradeUrl);
             const nestedUpgradeUrl = parseNestedUpgradeUrl(body);
-            const companySlug = isPlanLimitUpgradeFallbackEnabled()
-                ? resolveProcessFlagCompanyContext().companySlug
-                : undefined;
+            const companySlug = resolveProcessFlagCompanyContext().companySlug;
             resolvedUpgradeUrl = selectPlanLimitUpgradeUrl(companySlug, {
                 topLevelUrl: topLevelUpgradeUrl,
                 nestedUrl: nestedUpgradeUrl,

package/dist/utils/feedback-logs.d.ts

@@ -13,8 +13,9 @@
  *     (`hq-sync.log.1`, `.2`, `.3`) are eligible too — just after a rotation
  *     the active file is nearly empty and the history lives in `.1`.
  *     `logs/mcp-registry.log` is the CLI's own append-only MCP audit trail.
- *     Any future `*.log`/`*.jsonl` dropped into `~/.hq/logs/` is picked up
- *     automatically.
+ *     The daemon runner's `daemon/logs/sync.log` and its three rotations are
+ *     eligible too. When both sync families exist, only the newer family is
+ *     attached.
  *
  *   - STATE SNAPSHOTS (`state`) — small JSON files that describe where sync
  *     and client health currently stand: the in-flight sync phase and conflict
@@ -36,8 +37,9 @@
  *
  *   1. ALLOWLIST, NOT A SCAN. `~/.hq` also holds `cognito-tokens.json`,
  *      `deploy-passwords.json`, and `secrets-cache/`. Only `*.log` files
- *      directly inside `~/.hq/logs/` plus the two known root-level boot logs
- *      are ever eligible. A recursive walk over `~/.hq` is a credential leak
+ *      directly inside `~/.hq/logs/`, the exact daemon sync-log generations
+ *      under the configured daemon root, and the two known root-level boot
+ *      logs are eligible. A recursive walk over `~/.hq` is a credential leak
  *      and must never be introduced here.
  *
  *   2. NO SYMLINKS. Eligibility is decided with `lstat`, and a candidate must
@@ -235,12 +237,13 @@ export declare function feedbackLogsEnabled(env?: NodeJS.ProcessEnv): boolean;
  * Enumerate eligible log files under `hqDir`.
  *
  * Eligibility is the allowlist described in the module header: `*.log` files
- * directly inside `hqDir/logs/`, plus {@link FEEDBACK_ROOT_LOG_FILENAMES} at
- * the root. Every candidate must be a REGULAR file by `lstat` — directories
- * and, critically, symlinks are rejected. Returned newest-modified first so
- * the most relevant log is offered the budget before older ones.
+ * directly inside `hqDir/logs/`, the exact daemon sync-log generations, plus
+ * {@link FEEDBACK_ROOT_LOG_FILENAMES} at the root. Every candidate must be a
+ * REGULAR file by `lstat` — directories and, critically, symlinks are rejected.
+ * Returned newest-modified first so the most relevant log is offered budget
+ * before older ones.
  */
-export declare function discoverLogFiles(hqDir: string): LogCandidate[];
+export declare function discoverLogFiles(hqDir: string, env?: NodeJS.ProcessEnv): LogCandidate[];
 /**
  * Read the last `maxBytes` of a file.
  *
@@ -314,6 +317,8 @@ export interface CollectFeedbackLogsOptions {
     hqDir?: string;
     /** Override the home directory used to derive `~/.hq` (tests). */
     homeDir?: string;
+    /** Override process environment for configured log paths (tests). */
+    env?: NodeJS.ProcessEnv;
 }
 /**
  * Collect redacted `~/.hq` evidence within `budgetBytes`.

package/dist/utils/feedback-logs.js

@@ -13,8 +13,9 @@
  *     (`hq-sync.log.1`, `.2`, `.3`) are eligible too — just after a rotation
  *     the active file is nearly empty and the history lives in `.1`.
  *     `logs/mcp-registry.log` is the CLI's own append-only MCP audit trail.
- *     Any future `*.log`/`*.jsonl` dropped into `~/.hq/logs/` is picked up
- *     automatically.
+ *     The daemon runner's `daemon/logs/sync.log` and its three rotations are
+ *     eligible too. When both sync families exist, only the newer family is
+ *     attached.
  *
  *   - STATE SNAPSHOTS (`state`) — small JSON files that describe where sync
  *     and client health currently stand: the in-flight sync phase and conflict
@@ -36,8 +37,9 @@
  *
  *   1. ALLOWLIST, NOT A SCAN. `~/.hq` also holds `cognito-tokens.json`,
  *      `deploy-passwords.json`, and `secrets-cache/`. Only `*.log` files
- *      directly inside `~/.hq/logs/` plus the two known root-level boot logs
- *      are ever eligible. A recursive walk over `~/.hq` is a credential leak
+ *      directly inside `~/.hq/logs/`, the exact daemon sync-log generations
+ *      under the configured daemon root, and the two known root-level boot
+ *      logs are eligible. A recursive walk over `~/.hq` is a credential leak
  *      and must never be introduced here.
  *
  *   2. NO SYMLINKS. Eligibility is decided with `lstat`, and a candidate must
@@ -58,6 +60,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { currentSyncLogFamily, SYNC_LOG_RELATIVE_PATHS, SYNC_LOG_GENERATIONS, syncLogBasePaths, syncLogFamilyForRelativePath, syncLogGenerationPath, } from "./sync-log-sources.js";
 /**
  * Ceiling on the total redacted log text attached to one submission.
  *
@@ -279,15 +282,15 @@ function lstatOrNull(absPath) {
  * Enumerate eligible log files under `hqDir`.
  *
  * Eligibility is the allowlist described in the module header: `*.log` files
- * directly inside `hqDir/logs/`, plus {@link FEEDBACK_ROOT_LOG_FILENAMES} at
- * the root. Every candidate must be a REGULAR file by `lstat` — directories
- * and, critically, symlinks are rejected. Returned newest-modified first so
- * the most relevant log is offered the budget before older ones.
+ * directly inside `hqDir/logs/`, the exact daemon sync-log generations, plus
+ * {@link FEEDBACK_ROOT_LOG_FILENAMES} at the root. Every candidate must be a
+ * REGULAR file by `lstat` — directories and, critically, symlinks are rejected.
+ * Returned newest-modified first so the most relevant log is offered budget
+ * before older ones.
  */
-export function discoverLogFiles(hqDir) {
+export function discoverLogFiles(hqDir, env = process.env) {
     const candidates = [];
-    const consider = (relName) => {
-        const absPath = path.join(hqDir, relName);
+    const consider = (relName, absPath = path.join(hqDir, relName)) => {
         const st = lstatOrNull(absPath);
         // isFile() is false for both directories and symlinks under lstat. A
         // symlink here would be the credential-exfiltration path (see header).
@@ -313,11 +316,37 @@ export function discoverLogFiles(hqDir) {
             continue;
         consider(`${FEEDBACK_LOGS_DIRNAME}/${entry}`);
     }
+    const daemonLogPath = syncLogBasePaths(hqDir, env).daemon;
+    for (let generation = 0; generation < SYNC_LOG_GENERATIONS; generation += 1) {
+        const relName = syncLogGenerationPath(SYNC_LOG_RELATIVE_PATHS.daemon, generation);
+        const absPath = syncLogGenerationPath(daemonLogPath, generation);
+        consider(relName, absPath);
+    }
     for (const filename of FEEDBACK_ROOT_LOG_FILENAMES) {
         consider(filename);
     }
-    candidates.sort((a, b) => b.modifiedMs - a.modifiedMs);
-    return candidates;
+    let desktopModifiedMs = null;
+    let daemonModifiedMs = null;
+    for (const candidate of candidates) {
+        const family = syncLogFamilyForRelativePath(candidate.name);
+        if (family === "desktop") {
+            desktopModifiedMs = desktopModifiedMs === null
+                ? candidate.modifiedMs
+                : Math.max(desktopModifiedMs, candidate.modifiedMs);
+        }
+        else if (family === "daemon") {
+            daemonModifiedMs = daemonModifiedMs === null
+                ? candidate.modifiedMs
+                : Math.max(daemonModifiedMs, candidate.modifiedMs);
+        }
+    }
+    const selectedFamily = currentSyncLogFamily(desktopModifiedMs, daemonModifiedMs);
+    const selected = candidates.filter((candidate) => {
+        const family = syncLogFamilyForRelativePath(candidate.name);
+        return family === null || family === selectedFamily;
+    });
+    selected.sort((a, b) => b.modifiedMs - a.modifiedMs);
+    return selected;
 }
 /**
  * Read the last `maxBytes` of a file.
@@ -546,7 +575,7 @@ export function collectFeedbackLogs(opts = {}) {
     let logCandidates;
     let stateCandidates;
     try {
-        logCandidates = discoverLogFiles(hqDir);
+        logCandidates = discoverLogFiles(hqDir, opts.env);
         // Order matters: root status documents first, then the lock/claim files
         // (highest signal for a hang), then scheduled-job status. Under a tight
         // budget the earlier ones win, and that is the intended priority.

package/dist/utils/local-files-overview.d.ts

@@ -11,10 +11,11 @@
  * cross the wire; there is no string field on it for anything sensitive to
  * hide inside.
  *
- * Sources (metadata only, via `fs.stat` — full content is read only for the
+ * Sources (metadata only, via `fs.lstat` — full content is read only for the
  * bounded error-line count below, and even then only a capped tail window,
  * and even then only an integer count is ever returned):
- *   - the hq-sync desktop app's log file, `~/.hq/logs/hq-sync.log`
+ *   - the newest available desktop or daemon sync-log family and its rotations
+ *     under `~/.hq/logs/` or `~/.hq/daemon/logs/`
  *   - the CLI's own per-company sync journals, enumerated via `listJournals()`
  *     (never a hand-reconstructed path — see client-health.ts's note on the
  *     single-path-reconstruction regression this mirrors).
@@ -42,6 +43,7 @@ export declare function countRecentErrorLines(filePath: string, maxBytes?: numbe
 export interface CollectLocalFilesOverviewDeps {
     now?: () => Date;
     homeDir?: () => string;
+    env?: NodeJS.ProcessEnv;
     journals?: () => readonly {
         path: string;
     }[];

package/dist/utils/local-files-overview.js

@@ -11,10 +11,11 @@
  * cross the wire; there is no string field on it for anything sensitive to
  * hide inside.
  *
- * Sources (metadata only, via `fs.stat` — full content is read only for the
+ * Sources (metadata only, via `fs.lstat` — full content is read only for the
  * bounded error-line count below, and even then only a capped tail window,
  * and even then only an integer count is ever returned):
- *   - the hq-sync desktop app's log file, `~/.hq/logs/hq-sync.log`
+ *   - the newest available desktop or daemon sync-log family and its rotations
+ *     under `~/.hq/logs/` or `~/.hq/daemon/logs/`
  *   - the CLI's own per-company sync journals, enumerated via `listJournals()`
  *     (never a hand-reconstructed path — see client-health.ts's note on the
  *     single-path-reconstruction regression this mirrors).
@@ -28,6 +29,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { listJournals } from "@indigoai-us/hq-cloud";
+import { currentSyncLogFamily, SYNC_LOG_GENERATIONS, syncLogBasePaths, syncLogGenerationPath, } from "./sync-log-sources.js";
 import { CLIENT_HEALTH_MAX_ERROR_LINE_COUNT, CLIENT_HEALTH_MAX_FILE_AGE_SECONDS, CLIENT_HEALTH_MAX_FILE_SIZE_BYTES, } from "./client-health-contract.js";
 /**
  * Only the last N bytes of the sync log are read for error-line counting —
@@ -37,7 +39,8 @@ import { CLIENT_HEALTH_MAX_ERROR_LINE_COUNT, CLIENT_HEALTH_MAX_FILE_AGE_SECONDS,
 export const LOCAL_FILES_OVERVIEW_TAIL_READ_BYTES = 2 * 1024 * 1024; // 2 MiB
 /** Case-insensitive marker matched against each line (or JSON-lines `level`). */
 const ERROR_MARKER = /error/i;
-const JSON_LEVEL_ERROR = /"level"\s*:\s*"error"/i;
+const JSON_LEVEL_ERROR = /"level"\s*:\s*"error"\s*(?=[,}])/i;
+const JSON_NUMERIC_LEVEL = /"level"\s*:\s*(-?\d+(?:\.\d+)?)\s*(?=[,}])/;
 const ABSENT = { exists: false, sizeBytes: 0, ageSeconds: 0 };
 function clampInt(value, max) {
     if (!Number.isFinite(value) || value < 0)
@@ -102,6 +105,12 @@ export function countRecentErrorLines(filePath, maxBytes = LOCAL_FILES_OVERVIEW_
         for (const line of text.split("\n")) {
             if (count >= cap)
                 break;
+            const numericLevel = JSON_NUMERIC_LEVEL.exec(line)?.[1];
+            if (numericLevel !== undefined) {
+                if (Number(numericLevel) >= 50)
+                    count += 1;
+                continue;
+            }
             if (ERROR_MARKER.test(line) || JSON_LEVEL_ERROR.test(line))
                 count += 1;
         }
@@ -133,9 +142,41 @@ export function collectLocalFilesOverview(deps = {}) {
     const nowMs = now.getTime();
     const homeDir = (deps.homeDir ?? os.homedir)();
     const countErrorLines = deps.countErrorLines ?? countRecentErrorLines;
-    const syncLogPath = path.join(homeDir, ".hq", "logs", "hq-sync.log");
-    const syncLogFacts = statFacts(syncLogPath, nowMs);
-    const recentErrorLineCount = syncLogFacts.exists ? countErrorLines(syncLogPath) : 0;
+    const hqDir = path.join(homeDir, ".hq");
+    const syncLogPaths = syncLogBasePaths(hqDir, deps.env);
+    const generations = {
+        desktop: [],
+        daemon: [],
+    };
+    const familyModifiedMs = (family) => {
+        let newest = null;
+        for (let generation = 0; generation < SYNC_LOG_GENERATIONS; generation += 1) {
+            const file = syncLogGenerationPath(syncLogPaths[family], generation);
+            try {
+                const stat = fs.lstatSync(file);
+                if (!stat.isFile())
+                    continue;
+                generations[family].push({ file, modifiedMs: stat.mtimeMs });
+                newest = newest === null ? stat.mtimeMs : Math.max(newest, stat.mtimeMs);
+            }
+            catch {
+                // Missing, denied, or raced generations are absent from this overview.
+            }
+        }
+        return newest;
+    };
+    const family = currentSyncLogFamily(familyModifiedMs("desktop"), familyModifiedMs("daemon"));
+    const selectedFamily = family ?? "desktop";
+    const selectedFiles = generations[selectedFamily];
+    const activePath = syncLogPaths[selectedFamily];
+    const activeFacts = statFacts(activePath, nowMs);
+    const freshestGeneration = [...selectedFiles].sort((a, b) => b.modifiedMs - a.modifiedMs)[0];
+    const syncLogPath = activeFacts.exists ? activePath : freshestGeneration?.file;
+    const syncLogFacts = syncLogPath ? statFacts(syncLogPath, nowMs) : ABSENT;
+    let recentErrorLineCount = 0;
+    for (const generation of selectedFiles) {
+        recentErrorLineCount = Math.min(CLIENT_HEALTH_MAX_ERROR_LINE_COUNT, recentErrorLineCount + countErrorLines(generation.file));
+    }
     let journalEntries;
     try {
         journalEntries = (deps.journals ?? listJournals)();

package/dist/utils/sync-log-sources.d.ts

@@ -0,0 +1,15 @@
+/** Stable relative names used for feedback attachments. */
+export declare const SYNC_LOG_RELATIVE_PATHS: {
+    readonly desktop: "logs/hq-sync.log";
+    readonly daemon: "daemon/logs/sync.log";
+};
+export type SyncLogFamily = keyof typeof SYNC_LOG_RELATIVE_PATHS;
+/** Read the active file plus the three retained rotations. */
+export declare const SYNC_LOG_GENERATIONS = 4;
+/** Resolve both sync-log families, honoring the daemon's configured root. */
+export declare function syncLogBasePaths(hqDir: string, env?: NodeJS.ProcessEnv): Record<SyncLogFamily, string>;
+export declare function syncLogGenerationPath(basePath: string, generation: number): string;
+export declare function syncLogFamilyForRelativePath(name: string): SyncLogFamily | null;
+/** Choose the most recently written family; desktop wins a timestamp tie. */
+export declare function currentSyncLogFamily(desktopModifiedMs: number | null, daemonModifiedMs: number | null): SyncLogFamily | null;
+//# sourceMappingURL=sync-log-sources.d.ts.map

package/dist/utils/sync-log-sources.js

@@ -0,0 +1,36 @@
+import * as path from "node:path";
+import { daemonPaths } from "../lib/daemon/paths.js";
+/** Stable relative names used for feedback attachments. */
+export const SYNC_LOG_RELATIVE_PATHS = {
+    desktop: "logs/hq-sync.log",
+    daemon: "daemon/logs/sync.log",
+};
+/** Read the active file plus the three retained rotations. */
+export const SYNC_LOG_GENERATIONS = 4;
+/** Resolve both sync-log families, honoring the daemon's configured root. */
+export function syncLogBasePaths(hqDir, env = process.env) {
+    const daemonLogDir = daemonPaths(path.dirname(hqDir), env).logsDir;
+    return {
+        desktop: path.join(hqDir, SYNC_LOG_RELATIVE_PATHS.desktop),
+        daemon: path.join(daemonLogDir, "sync.log"),
+    };
+}
+export function syncLogGenerationPath(basePath, generation) {
+    return generation === 0 ? basePath : `${basePath}.${generation}`;
+}
+export function syncLogFamilyForRelativePath(name) {
+    if (/^logs\/hq-sync\.log(?:\.\d+)?$/.test(name))
+        return "desktop";
+    if (/^daemon\/logs\/sync\.log(?:\.\d+)?$/.test(name))
+        return "daemon";
+    return null;
+}
+/** Choose the most recently written family; desktop wins a timestamp tie. */
+export function currentSyncLogFamily(desktopModifiedMs, daemonModifiedMs) {
+    if (desktopModifiedMs === null)
+        return daemonModifiedMs === null ? null : "daemon";
+    if (daemonModifiedMs === null)
+        return "desktop";
+    return daemonModifiedMs > desktopModifiedMs ? "daemon" : "desktop";
+}
+//# sourceMappingURL=sync-log-sources.js.map

package/dist/utils/version-gate.d.ts

@@ -390,6 +390,7 @@ interface EnforceUpdateDeps {
     performUpdateString?: (command: string) => UpdateResult;
     resolveInstall?: () => RunningInstall;
     runner?: UpdateRunner;
+    platform?: NodeJS.Platform;
     cleanStale?: (prefix: string) => string[];
     acquireLock?: () => UpdateLockHandle | null;
     /**

package/dist/utils/version-gate.js

@@ -1224,7 +1224,12 @@ function attemptRequiredUpdate(decision, deps, install) {
     // Never for pnpm or Bun: elevation changes the package manager's global home,
     // leaving the user's shim untouched while reporting success. A failed
     // non-npm update must surface instead.
-    if (!result.ok && result.code !== "ETIMEDOUT" && primaryCmd && !isManagedOutsideNpm) {
+    const platform = deps.platform ?? process.platform;
+    if (platform !== "win32" &&
+        !result.ok &&
+        result.code !== "ETIMEDOUT" &&
+        primaryCmd &&
+        !isManagedOutsideNpm) {
         console.error(chalk.dim(`  Update failed unprivileged; retrying with: sudo -n ${primaryCmd} ${primaryArgs.join(" ")}`));
         const sudoResult = performUpdateCommand("sudo", ["-n", primaryCmd, ...primaryArgs], runner);
         if (sudoResult.ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.269.0",
+  "version": "5.270.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {