@indigoai-us/hq-cli 5.305.0 → 5.307.0

package/dist/commands/core-pin-native.js

@@ -0,0 +1,236 @@
+/** Native per-session pin implementation matching core/scripts/hq-pin.sh. */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { bundledShellUnboundValue, registerNativeUtility, utilityError } from "./core-native-utilities.js";
+export const PIN_ASSET = "core/scripts/hq-pin.sh";
+export const PIN_HELP = `# hq-pin.sh — anchor the current session to one goal (the "pin").
+#
+# A pin is the message, goal, or target the session keeps working toward
+# across loops, wakeups, compactions, and hand-offs. It is stored per session
+# and re-read at every checkpoint so the session cannot drift.
+#
+# Usage:
+#   core/scripts/hq-pin.sh set  "<goal>" [--done "<criterion>"]... [--owner <name>] [--channel <dm-channel>]
+#   core/scripts/hq-pin.sh show                # print the pin (goal, done criteria, owner, channel, set-at)
+#   core/scripts/hq-pin.sh check               # print a one-line reminder for loop ticks; exit 3 if no pin
+#   core/scripts/hq-pin.sh note "<progress>"   # append a dated progress line under the pin
+#   core/scripts/hq-pin.sh clear               # remove the pin (the goal is met or withdrawn)
+#
+# Storage: workspace/sessions/<sid>/pin.md plus \`pin: <goal>\` in the session's
+`;
+const SESSION_ENV_KEYS = ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID", "GROK_SESSION_ID"];
+const stamp = (date) => date.toISOString().replace(/\.\d{3}Z$/, "Z");
+function normalizeId(value) { return value.replace(/[\t\n\v\f\r ]/g, ""); }
+function validId(value) { return value !== "" && value !== "." && value !== ".." && /^[A-Za-z0-9._-]+$/.test(value); }
+export function resolvePinSessionId(root, env) {
+    for (const key of SESSION_ENV_KEYS) {
+        const value = normalizeId(env[key] ?? "");
+        if (validId(value))
+            return value;
+    }
+    try {
+        const value = normalizeId(fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8"));
+        return validId(value) ? value : "";
+    }
+    catch {
+        return "";
+    }
+}
+function pinPath(deps, sid) { return path.join(deps.root, "workspace/sessions", sid, "pin.md"); }
+function fail(message) { return utilityError(`hq-pin: ${message}`, 2); }
+function sessionMetaPath(deps, sid) { return path.join(deps.root, "workspace/sessions", sid, "meta.yaml"); }
+function writeSessionPin(deps, sid, goal) {
+    const meta = sessionMetaPath(deps, sid);
+    fs.mkdirSync(path.dirname(meta), { recursive: true });
+    let contents;
+    try {
+        contents = fs.readFileSync(meta, "utf8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        contents = `session_id: ${sid}\nstarted_at: "${stamp(deps.now())}"\nsenior: user\n`;
+    }
+    const lines = contents ? contents.replace(/\n$/, "").split("\n") : [];
+    let found = false;
+    const next = lines.map((line) => {
+        if (line.trimStart().split(/[\t ]/)[0] === "pin:") {
+            found = true;
+            return `pin: ${goal}`;
+        }
+        return line;
+    });
+    if (!found)
+        next.push(`pin: ${goal}`);
+    const text = `${next.join("\n")}\n`;
+    const temp = path.join(path.dirname(meta), `.meta.yaml.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
+    fs.writeFileSync(temp, text, { mode: 0o600 });
+    fs.renameSync(temp, meta);
+}
+function createPinDirectory(deps) {
+    const sid = resolvePinSessionId(deps.root, deps.env);
+    if (!sid)
+        return { error: fail("no current session (hq-session.sh current is empty)") };
+    const file = pinPath(deps, sid);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    return { sid, file };
+}
+function setPin(args, deps) {
+    const goal = args[0] ?? "";
+    if (!goal)
+        return fail("set needs the goal text");
+    let owner = "";
+    let channel = "";
+    const done = [];
+    for (let i = 1; i < args.length;) {
+        const arg = args[i];
+        if (arg === "--done") {
+            if (i + 1 >= args.length)
+                return bundledShellUnboundValue(PIN_ASSET, 36);
+            done.push(args[i + 1]);
+            i += 2;
+        }
+        else if (arg === "--owner") {
+            if (i + 1 >= args.length)
+                return bundledShellUnboundValue(PIN_ASSET, 37);
+            owner = args[i + 1];
+            i += 2;
+        }
+        else if (arg === "--channel") {
+            if (i + 1 >= args.length)
+                return bundledShellUnboundValue(PIN_ASSET, 38);
+            channel = args[i + 1];
+            i += 2;
+        }
+        else
+            return fail(`set: unknown arg ${arg}`);
+    }
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    const lines = ["# Pin", "", `Goal: ${goal}`, "", `Set: ${stamp(deps.now())}`];
+    if (owner)
+        lines.push(`Owner: ${owner}`);
+    if (channel)
+        lines.push(`Channel: ${channel}`);
+    if (done.length > 0)
+        lines.push("", "## Done when", ...done.map((criterion) => `- [ ] ${criterion}`));
+    lines.push("", "## Progress");
+    fs.writeFileSync(current.file, `${lines.join("\n")}\n`, { encoding: "utf8", mode: 0o666 });
+    writeSessionPin(deps, current.sid, goal);
+    return { code: 0, stdout: `pinned session ${current.sid}: ${goal}\n`, stderr: "" };
+}
+function showPin(deps) {
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return { code: 3, stdout: `no pin for session ${current.sid}\n`, stderr: "" };
+    return { code: 0, stdout: fs.readFileSync(current.file, "utf8"), stderr: "" };
+}
+function checkPin(deps) {
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return { code: 3, stdout: "no pin\n", stderr: "" };
+    const text = fs.readFileSync(current.file, "utf8");
+    const goal = text.split(/\r?\n/).find((line) => line.startsWith("Goal: "))?.slice(6) ?? "";
+    const open = (text.match(/^- \[ \]/gm) ?? []).length;
+    const closed = (text.match(/^- \[x\]/gm) ?? []).length;
+    return { code: 0, stdout: `PIN: ${goal} (done criteria: ${closed} met, ${open} open)\n`, stderr: "" };
+}
+function notePin(args, deps) {
+    const text = args[0] ?? "";
+    if (!text)
+        return fail("note needs text");
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return fail("no pin to note against");
+    const time = deps.now().toISOString().slice(11, 16);
+    fs.appendFileSync(current.file, `- ${time}Z ${text}\n`);
+    return { code: 0, stdout: "noted\n", stderr: "" };
+}
+function donePin(args, deps) {
+    const needle = args[0] ?? "";
+    if (!needle)
+        return fail("done needs a criterion substring");
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return fail("no pin");
+    const text = fs.readFileSync(current.file, "utf8");
+    const lines = text.split("\n");
+    // Bash read ignores a final line without a newline. The shell script then
+    // echoes every line it did read, adding a newline to each one.
+    lines.pop();
+    let hit = false;
+    const next = lines.map((line) => {
+        if (line.startsWith("- [ ] ") && line.includes(needle)) {
+            hit = true;
+            // Preserve the bundled shell's parameter-expansion result: it keeps the
+            // matched source line after adding the checked marker.
+            return `- [x] ${line}`;
+        }
+        return line;
+    });
+    const output = next.length > 0 ? `${next.join("\n")}\n` : "";
+    const tempDir = fs.mkdtempSync(path.join(deps.tmpDir ?? os.tmpdir(), "hq-pin-"));
+    const tempFile = path.join(tempDir, "pin");
+    try {
+        fs.writeFileSync(tempFile, output, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        try {
+            fs.renameSync(tempFile, current.file);
+        }
+        catch (error) {
+            if (error.code !== "EXDEV")
+                throw error;
+            fs.copyFileSync(tempFile, current.file);
+            fs.chmodSync(current.file, 0o600);
+            fs.unlinkSync(tempFile);
+        }
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+    return hit
+        ? { code: 0, stdout: `marked done: ${needle}\n`, stderr: "" }
+        : fail(`no open criterion matches: ${needle}`);
+}
+function clearPin(deps) {
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    fs.rmSync(current.file, { force: true });
+    writeSessionPin(deps, current.sid, "");
+    return { code: 0, stdout: "pin cleared\n", stderr: "" };
+}
+export function runPin(args, deps) {
+    const [command = "", ...rest] = args;
+    if (command === "set")
+        return setPin(rest, deps);
+    if (command === "show")
+        return showPin(deps);
+    if (command === "check")
+        return checkPin(deps);
+    if (command === "note")
+        return notePin(rest, deps);
+    if (command === "done")
+        return donePin(rest, deps);
+    if (command === "clear")
+        return clearPin(deps);
+    return { code: 2, stdout: PIN_HELP, stderr: "" };
+}
+export function registerCorePinNative(core) {
+    registerNativeUtility(core, {
+        name: "pin", asset: PIN_ASSET, root: "live", summary: "Pin the current session to one goal",
+        resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
+        run: (args, context) => runPin(args, context),
+    });
+}
+//# sourceMappingURL=core-pin-native.js.map

package/dist/commands/core-refresh-vault-access-native.d.ts

@@ -0,0 +1,20 @@
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
+export declare const REFRESH_VAULT_ACCESS_HELP: string;
+export type HqResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+    missing?: boolean;
+};
+export type RefreshVaultAccessDependencies = {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    hqAvailable: boolean;
+    runHq?: (args: string[], cwd: string) => HqResult;
+};
+export declare function runRefreshVaultAccess(args: string[], deps: RefreshVaultAccessDependencies): UtilityOutput;
+export declare function registerCoreRefreshVaultAccessNative(core: Command): void;
+//# sourceMappingURL=core-refresh-vault-access-native.d.ts.map

package/dist/commands/core-refresh-vault-access-native.js

@@ -0,0 +1,229 @@
+/** Native local manifest refresh for core/scripts/refresh-vault-access.sh. */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { registerNativeUtility } from "./core-native-utilities.js";
+export const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
+export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
+# refresh-vault-access.sh — build/refresh the local vault-access manifest that
+# enforce-vault-write-access.sh (PreToolUse hook) reads.
+#
+# Output: <hqRoot>/.hq/vault-access.json
+#
+#   {
+#     "version": 1,
+#     "generatedAt": "2026-01-01T00:00:00Z",
+#     "companies": {
+#       "<slug>": {
+#         "role": "owner|admin|member|guest|unknown",
+#         "grants": [ { "path": "reports/*", "permission": "read|write" } ]
+#       }
+#     }
+#   }
+#
+# Sources (best-effort, all via the hq CLI):
+#   - grants: \`hq files shared-with-me\` (explicit per-prefix grants)
+#   - role:   \`hq members --company <slug> list\` matched against the caller's
+#             email (from \`hq whoami\`, override with HQ_VAULT_ACCESS_EMAIL)
+#
+# Fail-open by design: anything this script cannot determine is recorded as
+# role "unknown" (the hook does not enforce unknown roles), and a company it
+# cannot query at all is left out of the manifest entirely (the hook allows
+# companies absent from the manifest). The server-side STS/ACL layer remains
+# the authoritative security boundary — this manifest only powers the local
+# early-warning block for read-only shares.
+#
+# Usage:
+#   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
+#
+`.replace(/^# ?/gm, "");
+function defaultHq(args, cwd, env) {
+    const result = spawnSync("hq", args, { cwd, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    if (result.error)
+        return { code: 127, stdout: "", stderr: result.error.message, missing: result.error.code === "ENOENT" };
+    return { code: result.status ?? 128, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "") };
+}
+function executableOnPath(name, value) {
+    if (!value)
+        return false;
+    for (const directory of value.split(path.delimiter)) {
+        if (!directory)
+            continue;
+        const candidate = path.join(directory, name);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return true;
+        }
+        catch { /* keep checking the PATH */ }
+    }
+    return false;
+}
+function isHqRoot(root) {
+    const candidate = root.endsWith(path.sep) ? root.slice(0, -1) : root;
+    if (!candidate)
+        return false;
+    try {
+        return fs.statSync(path.join(candidate, "core")).isDirectory() && fs.statSync(path.join(candidate, ".claude")).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function parseOptions(args) {
+    let root = "";
+    const slugs = [];
+    for (let i = 0; i < args.length;) {
+        const arg = args[i];
+        if (arg === "--root") {
+            if (i + 1 >= args.length)
+                return { root, slugs, help: false, error: "--root requires a value" };
+            root = args[i + 1];
+            i += 2;
+        }
+        else if (arg === "--company") {
+            if (i + 1 >= args.length)
+                return { root, slugs, help: false, error: "--company requires a value" };
+            slugs.push(args[i + 1]);
+            i += 2;
+        }
+        else if (arg === "-h" || arg === "--help")
+            return { root, slugs, help: true };
+        else
+            return { root, slugs, help: false, error: `unknown argument: ${arg}` };
+    }
+    return { root, slugs, help: false };
+}
+function resolveRoot(parsedRoot, deps) {
+    if (parsedRoot)
+        return parsedRoot;
+    if (isHqRoot(deps.env.CLAUDE_PROJECT_DIR ?? ""))
+        return deps.env.CLAUDE_PROJECT_DIR;
+    let current = path.resolve(deps.cwd);
+    while (current !== path.parse(current).root) {
+        if (isHqRoot(current))
+            return current;
+        current = path.dirname(current);
+    }
+    return "";
+}
+// eslint-disable-next-line no-control-regex -- strip ANSI SGR sequences printed by hq.
+function cleanAnsi(value) { return value.replace(/\u001b\[[0-9;]*m/g, ""); }
+function log(message) { return `refresh-vault-access: ${message}\n`; }
+function getEmail(output) {
+    const matches = cleanAnsi(output).match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g) ?? [];
+    return matches.find((email) => !email.includes("@outposts.")) ?? "";
+}
+function parseGrantTable(output) {
+    const grants = new Map();
+    for (let line of cleanAnsi(output).split(/\r?\n/)) {
+        line = line.replace(" (private folder)", "");
+        if (/^COMPANY\s/.test(line) || /^─/.test(line) || /^\s*$/.test(line) || /^Nothing is explicitly shared/.test(line))
+            continue;
+        const fields = line.trim().split(/\s+/);
+        if (fields.length < 3)
+            continue;
+        const permission = ["read", "write", "admin"].includes(fields[2]) ? fields[2]
+            : fields.length >= 4 && ["read", "write", "admin"].includes(fields[3]) ? fields[3] : "";
+        if (!permission)
+            continue;
+        const rows = grants.get(fields[0]) ?? [];
+        rows.push({ path: fields[1], permission });
+        grants.set(fields[0], rows);
+    }
+    return grants;
+}
+function roleFromTable(output, email) {
+    if (!email)
+        return "unknown";
+    for (const line of cleanAnsi(output).split(/\r?\n/)) {
+        const [candidate, role] = line.trim().split(/\s+/);
+        if (candidate === email && ["owner", "admin", "member", "guest"].includes(role ?? ""))
+            return role;
+        if (candidate === email)
+            return "unknown";
+    }
+    return "unknown";
+}
+function resolveEmail(deps, runHq) {
+    const override = deps.env.HQ_VAULT_ACCESS_EMAIL ?? "";
+    if (override)
+        return { email: override, stderr: "" };
+    const result = runHq(["whoami"], deps.cwd);
+    const email = getEmail(result.stdout);
+    return { email, stderr: email ? "" : log("could not determine caller email — roles will be 'unknown' (hook will not enforce)") };
+}
+export function runRefreshVaultAccess(args, deps) {
+    const parsed = parseOptions(args);
+    if (parsed.help)
+        return { code: 0, stdout: REFRESH_VAULT_ACCESS_HELP, stderr: "" };
+    if (parsed.error)
+        return { code: 1, stdout: "", stderr: log(parsed.error) };
+    const root = resolveRoot(parsed.root, deps);
+    if (!isHqRoot(root))
+        return { code: 1, stdout: "", stderr: log("could not resolve the HQ root (pass --root <hqRoot>)") };
+    if (!deps.hqAvailable)
+        return { code: 0, stdout: "", stderr: log("hq CLI not found — nothing refreshed (the write-access hook stays fail-open without a manifest)") };
+    const runHq = deps.runHq ?? ((hqArgs, cwd) => defaultHq(hqArgs, cwd, deps.env));
+    const identity = resolveEmail(deps, runHq);
+    let stderr = identity.stderr;
+    const explicit = parsed.slugs;
+    const allGrants = new Map();
+    if (explicit.length > 0) {
+        for (const slug of explicit) {
+            const result = runHq(["files", "shared-with-me", "--company", slug], deps.cwd);
+            if (result.code !== 0) {
+                stderr += log(`skipping ${slug} — shared-with-me query failed`);
+                continue;
+            }
+            const rows = parseGrantTable(result.stdout);
+            for (const [company, grants] of rows)
+                allGrants.set(company, [...(allGrants.get(company) ?? []), ...grants]);
+        }
+    }
+    else {
+        const result = runHq(["files", "shared-with-me"], deps.cwd);
+        if (result.code !== 0)
+            return { code: 0, stdout: "", stderr: `${stderr}${log("shared-with-me roll-up failed — nothing refreshed")}` };
+        for (const [company, grants] of parseGrantTable(result.stdout))
+            allGrants.set(company, grants);
+    }
+    const companies = new Set(allGrants.keys());
+    for (const slug of explicit)
+        companies.add(slug);
+    const sortedSlugs = [...companies].sort();
+    if (sortedSlugs.length === 0)
+        stderr += log("no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)");
+    const companyData = {};
+    for (const slug of sortedSlugs) {
+        let role = "unknown";
+        if (identity.email) {
+            const result = runHq(["members", "--company", slug, "list"], deps.cwd);
+            role = result.code === 0 ? roleFromTable(result.stdout, identity.email) : "unknown";
+        }
+        const grants = (allGrants.get(slug) ?? []).map((grant) => ({ path: grant.path, permission: grant.permission }));
+        companyData[slug] = { role, grants };
+    }
+    const manifest = { version: 1, generatedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"), companies: companyData };
+    const directory = path.join(root, ".hq");
+    fs.mkdirSync(directory, { recursive: true });
+    const target = path.join(directory, "vault-access.json");
+    const temp = `${target}.${process.pid}.${Math.random().toString(16).slice(2)}`;
+    fs.writeFileSync(temp, serializeJqJson(manifest, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    fs.chmodSync(temp, 0o600);
+    fs.renameSync(temp, target);
+    stderr += log(`wrote .hq/vault-access.json (${sortedSlugs.length} companies, identity: ${identity.email || "unknown"})`);
+    return { code: 0, stdout: "", stderr };
+}
+export function registerCoreRefreshVaultAccessNative(core) {
+    registerNativeUtility(core, {
+        name: "refresh-vault-access", asset: REFRESH_VAULT_ACCESS_ASSET, root: "cwd", summary: "Refresh the local vault access manifest",
+        resolveRoot: (cwd) => cwd,
+        run: (args, context) => runRefreshVaultAccess(args, {
+            cwd: context.cwd, env: context.env, now: context.now,
+            hqAvailable: executableOnPath("hq", context.env.PATH),
+            runHq: (args, cwd) => defaultHq(args, cwd, context.env),
+        }),
+    });
+}
+//# sourceMappingURL=core-refresh-vault-access-native.js.map

package/dist/commands/core.js

@@ -38,6 +38,10 @@ import { registerCoreKnowledgePrefsCommand } from "./core-knowledge-prefs.js";
 import { registerCorePolicyCommand } from "./core-policy.js";
 import { registerCoreJobsNativeCommand } from "./core-job-native.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
+import { registerCoreAuditLogNative } from "./core-audit-log-native.js";
+import { registerCoreGitPackExtensionCheckNative } from "./core-git-pack-extension-check-native.js";
+import { registerCorePinNative } from "./core-pin-native.js";
+import { registerCoreRefreshVaultAccessNative } from "./core-refresh-vault-access-native.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -271,6 +275,13 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },
     { asset: "core/scripts/handoff-open-steps.sh", root: "live", summary: "Rollback shell for native handoff open-steps" },
     { asset: "core/scripts/qmd-reindex-bg.sh", root: "live", summary: "Rollback handoff reindex forwarder" },
+    // Wave 5 native utility rollback companions, sourced verbatim from staging
+    // because these assets were not present in the hq-cli bundle at launch.
+    { asset: "core/scripts/audit-log.sh", root: "live", summary: "Rollback shell for native audit-log" },
+    { asset: "core/scripts/git-pack-extension-check.sh", root: "cwd", summary: "Rollback shell for native git-pack-extension-check" },
+    { asset: "core/scripts/hq-pin.sh", root: "live", summary: "Rollback shell for native pin" },
+    { asset: "core/scripts/refresh-vault-access.sh", root: "cwd", summary: "Rollback shell for native refresh-vault-access" },
+    { asset: "core/scripts/lib/portable.sh", root: "live", summary: "Shared portable helpers sourced by the audit-log rollback shell" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
         root,
@@ -354,6 +365,10 @@ export function registerCoreCommands(program) {
     registerCoreKnowledgePrefsCommand(core);
     registerCorePolicyCommand(core);
     registerCoreJobsNativeCommand(core);
+    registerCoreAuditLogNative(core);
+    registerCoreGitPackExtensionCheckNative(core);
+    registerCorePinNative(core);
+    registerCoreRefreshVaultAccessNative(core);
     // Wave 2 handoff/worktree commands retain their byte-identical shell assets
     // as a default-off rollback path for one release. Keep the gate helper small
     // so sibling Wave 2 work can reuse it without editing this command table.

package/dist/commands/daemon.js

@@ -627,25 +627,9 @@ async function runServiceSelfUpdate(d) {
     if (!result.ok)
         process.exitCode = 1;
 }
-/** Size, mtime and real path of a binary: changes whenever a new version is installed over it. */
-function binaryFingerprint(bin) {
-    try {
-        const real = fs.realpathSync(bin);
-        const st = fs.statSync(real);
-        return `${real}:${st.size}:${st.mtimeMs}`;
-    }
-    catch {
-        return null;
-    }
-}
 async function runTmuxService(d, opts) {
-    const { installFingerprint, runRemoteControlHost } = await import("../lib/daemon/remote-control.js");
+    const { runRemoteControlHost, toolFingerprint } = await import("../lib/daemon/remote-control.js");
     const { findOnPath } = await import("../lib/daemon/run.js");
-    const { resolveRunningInstall } = await import("../utils/version-gate.js");
-    // The daemon keeps this host running across a CLI update, so a new hq-cli
-    // install also counts as an update and restarts the session once it is quiet.
-    const cliRoot = resolveRunningInstall().packageRoot;
-    const watched = cliRoot ? [opts.watch, path.join(cliRoot, "package.json")] : [opts.watch];
     const hqRoot = d.env.HQ_ROOT?.trim();
     if (!hqRoot)
         throw new DaemonCommandError(`${opts.label} needs HQ_ROOT (the daemon sets it from the saved HQ folder)`);
@@ -663,7 +647,9 @@ async function runTmuxService(d, opts) {
             cwd: hqRoot,
             argv: opts.argv,
             label: opts.label,
-            binaryFingerprint: () => installFingerprint(watched, binaryFingerprint),
+            // Only a new version of the tool restarts the session: not a same-version
+            // reinstall, and not an hq-cli release (the host's own code rarely matters).
+            binaryFingerprint: () => toolFingerprint(opts.watch),
             now: () => Date.now(),
             run: d.run,
             pollMs: 5_000,
@@ -683,22 +669,37 @@ async function runTmuxService(d, opts) {
         process.off("SIGINT", stop);
     }
 }
+/** The claude or codex a remote-control host runs: --claude/--codex, else the one installed now. */
+async function hostTool(d, name, given) {
+    const [{ serviceTool }, { findUserBinary }] = await Promise.all([
+        import("../lib/daemon/remote-control.js"),
+        import("../lib/daemon/run.js"),
+    ]);
+    try {
+        return serviceTool(name, given, (tool) => findUserBinary(tool, d.env, d.home));
+    }
+    catch (err) {
+        throw new DaemonCommandError(err.message);
+    }
+}
 async function runServiceRemoteControl(d, opts) {
     const { TMUX_SESSION, remoteControlArgs } = await import("../lib/daemon/remote-control.js");
+    const claude = await hostTool(d, "claude", opts.claude);
     await runTmuxService(d, {
         session: TMUX_SESSION,
-        argv: [opts.claude, ...remoteControlArgs({ name: opts.name, permissionMode: opts.permissionMode })],
+        argv: [claude, ...remoteControlArgs({ name: opts.name, permissionMode: opts.permissionMode })],
         label: "claude remote-control",
-        watch: opts.claude,
+        watch: claude,
     });
 }
 async function runServiceCodexRemoteControl(d, opts) {
     const { CODEX_TMUX_SESSION } = await import("../lib/daemon/remote-control.js");
+    const codex = await hostTool(d, "codex", opts.codex);
     await runTmuxService(d, {
         session: CODEX_TMUX_SESSION,
         argv: ["bash", opts.script],
         label: "codex remote-control",
-        watch: opts.codex,
+        watch: codex,
     });
 }
 export function registerDaemonCommand(program, over = {}) {
@@ -839,7 +840,7 @@ export function registerDaemonCommand(program, over = {}) {
     service
         .command("remote-control")
         .description("Keep `claude remote-control` running in a tmux session in the HQ folder")
-        .requiredOption("--claude <path>", "claude binary")
+        .option("--claude <path>", "claude binary (default: the one installed for this user)")
         .requiredOption("--name <name>", "remote-control session name")
         .option("--permission-mode <mode>", "claude --permission-mode")
         .action(wrap((d, opts) => runServiceRemoteControl(d, opts)));
@@ -847,7 +848,7 @@ export function registerDaemonCommand(program, over = {}) {
         .command("codex-remote-control")
         .description("Keep the box's Codex remote-control runner going in a tmux session, restarting it after a Codex update")
         .requiredOption("--script <path>", "the box's Codex runner script")
-        .requiredOption("--codex <path>", "codex binary, watched for updates")
+        .option("--codex <path>", "codex binary, watched for updates (default: the one installed for this user)")
         .action(wrap((d, opts) => runServiceCodexRemoteControl(d, opts)));
     return daemon;
 }

package/dist/commands/dm.js

@@ -407,7 +407,12 @@ async function runConnectionAction(action, identifier) {
         const token = await ensureCognitoToken();
         // Resolve the pairKey from the caller's pending requests when possible so
         // accept/decline/block work against a friendly email or personUid.
-        const requests = await fetchRequests(token).catch(() => []);
+        const requests = await fetchRequests(token).catch((err) => {
+            console.error("hq dm: pending connection request lookup failed", {
+                errorName: err instanceof Error ? err.name : typeof err,
+            });
+            return [];
+        });
         const matched = matchRequest(requests, identifier);
         const body = buildConnectionActionBody(identifier, matched);
         const res = await vaultApiFetch({