@indigoai-us/hq-cli 5.306.0 → 5.308.0

package/dist/lib/agent-kit/kit-config.js

@@ -8,10 +8,10 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { KIT_COMPONENTS } from "./paths.js";
 import { writePrivateFile } from "./private-file.js";
-export const DEFAULT_SYNC_INTERVAL_MS = 5 * 60_000;
-export const DEFAULT_INBOX_POLL_MS = 15_000;
-export const DEFAULT_HEARTBEAT_INTERVAL_MS = 60_000;
-export const DEFAULT_MESH_REFRESH_MS = 5 * 60_000;
+const DEFAULT_SYNC_INTERVAL_MS = 5 * 60_000;
+const DEFAULT_INBOX_POLL_MS = 15_000;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 60_000;
+const DEFAULT_MESH_REFRESH_MS = 5 * 60_000;
 /**
  * Kit components whose health this install actually reports. `sync` drops out
  * when the vault is not mirrored to disk — there is no loop to be healthy or
@@ -20,7 +20,7 @@ export const DEFAULT_MESH_REFRESH_MS = 5 * 60_000;
 export function enabledKitComponents(config) {
     return KIT_COMPONENTS.filter((c) => c !== "sync" || config.syncFiles);
 }
-export function defaultHqRoot(paths) {
+function defaultHqRoot(paths) {
     return path.join(paths.agentDir, "hq");
 }
 export function defaultKitConfig(paths, cliVersion, now = () => new Date()) {

package/dist/lib/agent-kit/log.d.ts

@@ -4,7 +4,6 @@
  * on disk even through an error message.
  */
 import type { AgentKitPaths } from "./paths.js";
-export declare const KIT_LOG_MAX_BYTES: number;
 export type KitLogLevel = "info" | "warn" | "error";
 export type KitLogger = (level: KitLogLevel, message: string) => void;
 export declare function sanitizeLogLine(message: string): string;

package/dist/lib/agent-kit/log.js

@@ -6,7 +6,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { serviceLogPath } from "./paths.js";
-export const KIT_LOG_MAX_BYTES = 5 * 1024 * 1024;
+const KIT_LOG_MAX_BYTES = 5 * 1024 * 1024;
 export function sanitizeLogLine(message) {
     return message
         .replace(/Bearer\s+[A-Za-z0-9._-]+/gi, "Bearer [REDACTED]")

package/dist/lib/agent-kit/mcp/jsonrpc.d.ts

@@ -9,14 +9,6 @@
  * pump. Every request is answered; notifications are consumed silently;
  * malformed input yields a JSON-RPC error rather than a crash.
  */
-export declare const MCP_PROTOCOL_VERSIONS: readonly ["2025-06-18", "2025-03-26", "2024-11-05"];
-export declare const MCP_LATEST_PROTOCOL_VERSION: "2025-06-18";
-export interface JsonRpcRequest {
-    jsonrpc: "2.0";
-    id?: string | number | null;
-    method: string;
-    params?: unknown;
-}
 export interface JsonRpcResponse {
     jsonrpc: "2.0";
     id: string | number | null;
@@ -28,16 +20,14 @@ export interface JsonRpcResponse {
     };
 }
 export declare const JSONRPC_PARSE_ERROR = -32700;
-export declare const JSONRPC_INVALID_REQUEST = -32600;
 export declare const JSONRPC_METHOD_NOT_FOUND = -32601;
 export declare const JSONRPC_INVALID_PARAMS = -32602;
-export declare const JSONRPC_INTERNAL_ERROR = -32603;
 export interface McpToolDefinition {
     name: string;
     description: string;
     inputSchema: Record<string, unknown>;
 }
-export interface McpToolContent {
+interface McpToolContent {
     type: "text";
     text: string;
 }
@@ -45,7 +35,7 @@ export interface McpToolResult {
     content: McpToolContent[];
     isError?: boolean;
 }
-export type McpToolHandler = (args: Record<string, unknown>) => Promise<McpToolResult>;
+type McpToolHandler = (args: Record<string, unknown>) => Promise<McpToolResult>;
 export interface McpTool extends McpToolDefinition {
     handler: McpToolHandler;
 }
@@ -81,4 +71,5 @@ export declare class McpServer {
      */
     serve(input: NodeJS.ReadableStream, output: NodeJS.WritableStream): Promise<void>;
 }
+export {};
 //# sourceMappingURL=jsonrpc.d.ts.map

package/dist/lib/agent-kit/mcp/jsonrpc.js

@@ -9,13 +9,13 @@
  * pump. Every request is answered; notifications are consumed silently;
  * malformed input yields a JSON-RPC error rather than a crash.
  */
-export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
-export const MCP_LATEST_PROTOCOL_VERSION = MCP_PROTOCOL_VERSIONS[0];
+const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+const MCP_LATEST_PROTOCOL_VERSION = MCP_PROTOCOL_VERSIONS[0];
 export const JSONRPC_PARSE_ERROR = -32700;
-export const JSONRPC_INVALID_REQUEST = -32600;
+const JSONRPC_INVALID_REQUEST = -32600;
 export const JSONRPC_METHOD_NOT_FOUND = -32601;
 export const JSONRPC_INVALID_PARAMS = -32602;
-export const JSONRPC_INTERNAL_ERROR = -32603;
+const JSONRPC_INTERNAL_ERROR = -32603;
 export class McpToolInputError extends Error {
     constructor(message) {
         super(message);

package/dist/lib/agent-kit/mcp/tools.d.ts

@@ -57,8 +57,6 @@ export interface McpToolClients {
         body: unknown;
     }>;
 }
-export declare const MAX_TOOL_OUTPUT_CHARS = 40000;
-export declare const ATTACHMENTS_HINT: string;
 export declare function clampOutput(text: string, max?: number): string;
 /** Vault paths are company-anchored and must not escape. */
 export declare function assertVaultPath(p: string): string;

package/dist/lib/agent-kit/mcp/tools.js

@@ -21,8 +21,8 @@ import { isRecipientUid } from "../../../lib/notify-recipient.js";
 import { markInboxDone, mergeAgentInbox, readDoneIds, summarizeInboxEntry } from "../inbox-state.js";
 import { AttachmentCompanyUnresolvedError, fetchChatAttachment } from "./attachments.js";
 import { errorResult, McpToolInputError, textResult } from "./jsonrpc.js";
-export const MAX_TOOL_OUTPUT_CHARS = 40_000;
-export const ATTACHMENTS_HINT = "Some messages carry files. For each entry in a message's `attachments` whose vaultPath starts with chat/attachments/, " +
+const MAX_TOOL_OUTPUT_CHARS = 40_000;
+const ATTACHMENTS_HINT = "Some messages carry files. For each entry in a message's `attachments` whose vaultPath starts with chat/attachments/, " +
     "call hq_attachment_fetch with that vaultPath and companyUid to download it; hq_files_read cannot open message attachments. " +
     "Anything else (a folder or shared vault path) is not a chat attachment: use hq_files_list / hq_files_read for those.";
 function str(args, key, opts = {}) {

package/dist/lib/agent-kit/services.d.ts

@@ -7,7 +7,6 @@ import type { ServiceSpec } from "../service-manager/types.js";
 import type { AgentKitPaths } from "./paths.js";
 export type KitService = "sync" | "inbox" | "heartbeat";
 export declare const KIT_SERVICES: readonly KitService[];
-export declare const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
 export declare function isKitService(value: string): value is KitService;
 /**
  * Environment every service inherits. HQ_MACHINE_CREDS_FILE pins hq-cloud's

package/dist/lib/agent-kit/services.js

@@ -5,7 +5,7 @@
  */
 import { serviceLogPath } from "./paths.js";
 export const KIT_SERVICES = ["sync", "inbox", "heartbeat"];
-export const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
+const KIT_LABEL_PREFIX = "ai.getindigo.hq-agent";
 export function isKitService(value) {
     return KIT_SERVICES.includes(value);
 }

package/dist/lib/checkpoint-ontology/apply.d.ts

@@ -8,8 +8,6 @@
 import { type DuplicateReport, type MergeBackOutcome } from "./multi-writer.js";
 import { type CompanyBriefResult } from "./company-brief.js";
 import { type SyncClientVersions } from "./sync-client.js";
-import { type WritableEntityType } from "./identity.js";
-import { type EntityIndex } from "./tree.js";
 export declare const CAPS: {
     readonly creates: 25;
     readonly updates: 100;
@@ -18,15 +16,6 @@ export declare const CAPS: {
     readonly aliasesPerCandidate: 5;
     readonly nameLength: 200;
 };
-export declare const MIN_CREATE_CONFIDENCE = 0.7;
-export interface Candidate {
-    input: string;
-    type: WritableEntityType;
-    name: string;
-    aliases: string[];
-    confidence: number;
-    evidence: string;
-}
 export interface ApplyReport {
     schema: "hq-checkpoint-ontology-report.v1";
     company: string;
@@ -109,8 +98,6 @@ export interface ApplyOptions {
 export declare class ApplyError extends Error {
     constructor(message: string);
 }
-/** Validate one raw candidate. Returns the candidate or a rejection reason. */
-export declare function parseCandidate(raw: unknown): Candidate | string;
 /**
  * checkpoint.ontology.named-evidence: true when `evidence` holds one of
  * `names` as a word, matching case. A name inside a path, domain, handle, tag
@@ -119,41 +106,5 @@ export declare function parseCandidate(raw: unknown): Candidate | string;
  * `` `indigo` ``.
  */
 export declare function evidenceNames(evidence: string, names: string[]): boolean;
-type Resolution = {
-    tier: 1;
-    target: string;
-    duplicates: string[];
-} | {
-    tier: 2;
-    target: string;
-} | {
-    tier: "ambiguous_alias";
-    paths: string[];
-} | {
-    tier: "suspect_duplicate";
-    paths: string[];
-} | {
-    tier: "type_conflict";
-    types: string[];
-} | {
-    tier: "new";
-};
-/** Design section 5.3, tiers 1 to 4. */
-export declare function resolveCandidate(index: EntityIndex, type: string, canonical: string): Resolution;
-/**
- * Existing entities of `type` that a new candidate probably is: one of the
- * candidate's aliases is already their name or alias, or, for people, every
- * word of their name (two words or more) is in the candidate's name
- * (`Chaudhry Hassaan Saleem` and `Hassaan Saleem`).
- */
-export declare function overlappingEntities(index: EntityIndex, type: string, canonical: string, aliases: string[]): string[];
-/**
- * Existing people a one-word person candidate may be: the word is the first
- * word of their name or of one of their aliases, and that name has two words
- * or more (`John` and `John Smith`). The model never sees the entity tree, so
- * it cannot tell a first name that the company already holds in full.
- */
-export declare function firstNameOverlap(index: EntityIndex, canonical: string): string[];
 export declare function applyOntologyRun(options: ApplyOptions): ApplyReport;
-export {};
 //# sourceMappingURL=apply.d.ts.map

package/dist/lib/checkpoint-ontology/apply.js

@@ -25,7 +25,7 @@ export const CAPS = {
     aliasesPerCandidate: 5,
     nameLength: MAX_NAME_LENGTH,
 };
-export const MIN_CREATE_CONFIDENCE = 0.7;
+const MIN_CREATE_CONFIDENCE = 0.7;
 /** Inbound links the dominant sibling must have for each one the named entity has. */
 const DOMINANT_SIBLING_RATIO = 3;
 /** Inbound links the dominant sibling must have before a redirect. */
@@ -44,7 +44,7 @@ function sha256(content) {
     return createHash("sha256").update(content).digest("hex");
 }
 /** Validate one raw candidate. Returns the candidate or a rejection reason. */
-export function parseCandidate(raw) {
+function parseCandidate(raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return "not_an_object";
     const c = raw;
@@ -101,7 +101,7 @@ export function evidenceNames(evidence, names) {
     return false;
 }
 /** Design section 5.3, tiers 1 to 4. */
-export function resolveCandidate(index, type, canonical) {
+function resolveCandidate(index, type, canonical) {
     const normalized = normalizeEntityName(canonical, type);
     const byCanonical = [...(index.canonical.get(entityKey(type, normalized)) ?? [])].sort();
     if (byCanonical.length > 0)
@@ -125,7 +125,7 @@ export function resolveCandidate(index, type, canonical) {
  * word of their name (two words or more) is in the candidate's name
  * (`Chaudhry Hassaan Saleem` and `Hassaan Saleem`).
  */
-export function overlappingEntities(index, type, canonical, aliases) {
+function overlappingEntities(index, type, canonical, aliases) {
     const paths = new Set();
     for (const alias of aliases) {
         const normalized = normalizeEntityName(alias, type);
@@ -157,7 +157,7 @@ export function overlappingEntities(index, type, canonical, aliases) {
  * or more (`John` and `John Smith`). The model never sees the entity tree, so
  * it cannot tell a first name that the company already holds in full.
  */
-export function firstNameOverlap(index, canonical) {
+function firstNameOverlap(index, canonical) {
     const words = normalizeEntityName(canonical, "person").split(" ");
     if (words.length !== 1 || !words[0])
         return [];

package/dist/lib/checkpoint-ontology/identity.d.ts

@@ -7,7 +7,7 @@
  * synced entity file with these rules, so they must match byte for byte.
  */
 /** The entity types this writer creates or updates. */
-export declare const WRITABLE_ENTITY_TYPES: readonly ["person", "project", "company", "concept"];
+declare const WRITABLE_ENTITY_TYPES: readonly ["person", "project", "company", "concept"];
 export type WritableEntityType = (typeof WRITABLE_ENTITY_TYPES)[number];
 export declare function isWritableEntityType(value: unknown): value is WritableEntityType;
 /**
@@ -34,4 +34,5 @@ export declare function squash(normalized: string): string;
  * and are matched by tiers 1 and 2 before this filter runs.
  */
 export declare function isRejectedName(normalized: string): boolean;
+export {};
 //# sourceMappingURL=identity.d.ts.map

package/dist/lib/checkpoint-ontology/identity.js

@@ -8,7 +8,7 @@
  */
 import { createHash } from "node:crypto";
 /** The entity types this writer creates or updates. */
-export const WRITABLE_ENTITY_TYPES = ["person", "project", "company", "concept"];
+const WRITABLE_ENTITY_TYPES = ["person", "project", "company", "concept"];
 export function isWritableEntityType(value) {
     return typeof value === "string" && WRITABLE_ENTITY_TYPES.includes(value);
 }

package/dist/lib/checkpoint-ontology/multi-writer.d.ts

@@ -16,15 +16,9 @@
 import { type OntologyCompany } from "./company.js";
 import { type SignalBackRef } from "./entity-file.js";
 import { type EntityIndex } from "./tree.js";
-export declare const OUTBOX_SCHEMA = "hq-ontology-outbox.v1";
-export declare const OUTBOX_DIR = ".hq/ontology-outbox";
-export declare const OUTBOX_RETENTION_MS: number;
-/** Where sync parks a losing local body (hq-cloud `CONFLICT_BACKUPS_DIR`). */
-export declare const CONFLICT_BACKUPS_DIR = ".hq/conflict-backups";
+declare const OUTBOX_SCHEMA = "hq-ontology-outbox.v1";
 export declare const MERGED_BACKUPS_DIR = ".hq/conflict-backups/ontology-merged";
-export declare const STALE_BACKUP_MS: number;
-export declare const DUPLICATE_REPORT_LIMIT = 20;
-export interface OutboxEntry {
+interface OutboxEntry {
     sha256: string;
     written_at: string;
 }
@@ -49,7 +43,7 @@ export declare function readOutbox(hqRoot: string, company: OntologyCompany): Ou
 export declare function recordOutbox(hqRoot: string, company: OntologyCompany, writes: OutboxWrite[], now: Date): {
     reset: boolean;
 };
-export type MergeBackResult = "merged" | "kept_both" | "stale" | "deleted" | "identity_conflict" | "invalid" | "write_error";
+type MergeBackResult = "merged" | "kept_both" | "stale" | "deleted" | "identity_conflict" | "invalid" | "write_error";
 export interface MergeBackOutcome {
     /** HQ-relative path of the set-aside version. */
     backup: string;
@@ -103,4 +97,5 @@ export interface MultiWriterStart {
 export declare function startMultiWriterRun(hqRoot: string, company: OntologyCompany, now: Date): MultiWriterStart;
 /** Count merge-back outcomes by result, for one-line summaries. */
 export declare function summarizeMergeBack(outcomes: MergeBackOutcome[]): string;
+export {};
 //# sourceMappingURL=multi-writer.d.ts.map

package/dist/lib/checkpoint-ontology/multi-writer.js

@@ -22,14 +22,14 @@ import { entitiesRoot, safeWriteFile } from "./company.js";
 import { appendBackRefs, OWNED_KEYS, parseEntityFile, patchEntityFile, validateEntityFrontmatter, } from "./entity-file.js";
 import { isWritableEntityType, squash } from "./identity.js";
 import { buildEntityIndex, indexAlias } from "./tree.js";
-export const OUTBOX_SCHEMA = "hq-ontology-outbox.v1";
-export const OUTBOX_DIR = ".hq/ontology-outbox";
-export const OUTBOX_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+const OUTBOX_SCHEMA = "hq-ontology-outbox.v1";
+const OUTBOX_DIR = ".hq/ontology-outbox";
+const OUTBOX_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
 /** Where sync parks a losing local body (hq-cloud `CONFLICT_BACKUPS_DIR`). */
-export const CONFLICT_BACKUPS_DIR = ".hq/conflict-backups";
+const CONFLICT_BACKUPS_DIR = ".hq/conflict-backups";
 export const MERGED_BACKUPS_DIR = ".hq/conflict-backups/ontology-merged";
-export const STALE_BACKUP_MS = 7 * 24 * 60 * 60 * 1000;
-export const DUPLICATE_REPORT_LIMIT = 20;
+const STALE_BACKUP_MS = 7 * 24 * 60 * 60 * 1000;
+const DUPLICATE_REPORT_LIMIT = 20;
 /**
  * Keys that differ between two versions of a new entity for reasons that say
  * nothing about its content. The vault's value stands and the difference is

package/dist/lib/checkpoint-ontology/plan.d.ts

@@ -40,14 +40,14 @@ export declare const CANDIDATES_FILE = "ontology-candidates.json";
 export declare const REPORT_FILE = "ontology-report.json";
 export declare const PLAN_SCHEMA = "hq-checkpoint-ontology-plan.v1";
 export declare const CANDIDATES_SCHEMA = "hq-checkpoint-ontology-candidates.v1";
-export declare const LEDGER_SCHEMA = "hq-checkpoint-ontology-ledger.v1";
+declare const LEDGER_SCHEMA = "hq-checkpoint-ontology-ledger.v1";
 export declare const BUDGET: {
     readonly maxInputs: 20;
     readonly maxTokens: 60000;
     readonly chunkTokens: 12000;
 };
-export type PendingReason = "session-touched";
-export interface LedgerEntry {
+type PendingReason = "session-touched";
+interface LedgerEntry {
     sha256: string;
     size: number;
     mtime_ms: number;
@@ -164,25 +164,11 @@ export type PlanOutcome = {
 };
 export declare const READ_PATH_INSTRUCTION = "When an input has read_path, read that file (relative to the run directory) instead of path, with the same line range. It is the same text with an older annotator's entity lists and entity links removed.";
 export declare const FIRST_NAME_PEOPLE_INSTRUCTION = "Name a person by the full name the input or the company's entities give. When neither gives more than a first name, name the person by that first name; do not leave them out.";
-export declare function ledgerPath(hqRoot: string, company: OntologyCompany): string;
 export declare function readLedger(hqRoot: string, company: OntologyCompany): Ledger | null;
 export declare function writeLedger(hqRoot: string, company: OntologyCompany, ledger: Ledger): void;
 export declare function backendPreferencePath(hqRoot: string, company: OntologyCompany): string;
 /** The grok-backend flag value the last plan recorded; false when no plan has recorded one. */
 export declare function readBackendPreference(hqRoot: string, company: OntologyCompany): boolean;
-/** Company-relative paths of the payload's touched files that are inside this company. */
-export declare function sessionTouched(hqRoot: string, company: OntologyCompany, files: unknown): Set<string>;
-/** 1-based line ranges, each at most `chunkTokens` tokens (bytes / 4). */
-export declare function chunkLines(content: string, chunkTokens: number): Array<[number, number]>;
-/**
- * Update the ledger with the current tree and return it. New or changed files
- * the session touched become pending; others are recorded as seen. The first
- * run records the entity boundary (design 14.3).
- */
-export declare function refreshLedger(company: OntologyCompany, existing: Ledger | null, touched: Set<string>): {
-    ledger: Ledger;
-    firstRun: boolean;
-};
 /**
  * The company this run's ontology step works on: the payload's own company,
  * or else the `ontology_company` the checkpoint parent picked for queued
@@ -203,4 +189,5 @@ export declare function planOntologyRun(options: PlanOptions): Promise<PlanOutco
  * segment. Returns null when the text has neither.
  */
 export declare function stripAnnotations(text: string): string | null;
+export {};
 //# sourceMappingURL=plan.d.ts.map

package/dist/lib/checkpoint-ontology/plan.js

@@ -45,7 +45,7 @@ export const CANDIDATES_FILE = "ontology-candidates.json";
 export const REPORT_FILE = "ontology-report.json";
 export const PLAN_SCHEMA = "hq-checkpoint-ontology-plan.v1";
 export const CANDIDATES_SCHEMA = "hq-checkpoint-ontology-candidates.v1";
-export const LEDGER_SCHEMA = "hq-checkpoint-ontology-ledger.v1";
+const LEDGER_SCHEMA = "hq-checkpoint-ontology-ledger.v1";
 export const BUDGET = {
     maxInputs: 20,
     maxTokens: 60_000,
@@ -64,7 +64,7 @@ const CANDIDATE_INSTRUCTIONS = [
 function sha256File(file) {
     return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 }
-export function ledgerPath(hqRoot, company) {
+function ledgerPath(hqRoot, company) {
     return path.join(stateRoot(hqRoot, company), "ledger.json");
 }
 export function readLedger(hqRoot, company) {
@@ -108,7 +108,7 @@ function recordBackendPreference(hqRoot, company, preferGrok) {
     safeWriteFile(hqRoot, [stateRoot(hqRoot, company)], target, `${JSON.stringify({ prefer_grok: preferGrok })}\n`);
 }
 /** Company-relative paths of the payload's touched files that are inside this company. */
-export function sessionTouched(hqRoot, company, files) {
+function sessionTouched(hqRoot, company, files) {
     const out = new Set();
     if (!Array.isArray(files))
         return out;
@@ -124,7 +124,7 @@ export function sessionTouched(hqRoot, company, files) {
     return out;
 }
 /** 1-based line ranges, each at most `chunkTokens` tokens (bytes / 4). */
-export function chunkLines(content, chunkTokens) {
+function chunkLines(content, chunkTokens) {
     const lines = content.split("\n");
     const maxBytes = chunkTokens * 4;
     const chunks = [];
@@ -171,7 +171,7 @@ function missingRefs(companyDir, rel) {
  * the session touched become pending; others are recorded as seen. The first
  * run records the entity boundary (design 14.3).
  */
-export function refreshLedger(company, existing, touched) {
+function refreshLedger(company, existing, touched) {
     const firstRun = existing === null;
     const index = firstRun ? buildEntityIndex(company.dir) : null;
     const boundary = existing ? existing.boundary : entityBoundary(index);

package/dist/lib/checkpoint-ontology/queued-touches.d.ts

@@ -1,7 +1,4 @@
 import { type OntologyCompany } from "./company.js";
-export declare const QUEUED_TOUCHES_FILE = "queued-touches.jsonl";
-export declare const QUEUED_TOUCHES_CLAIM_FILE = "queued-touches-claimed.jsonl";
-export declare const QUEUED_TOUCHES_BORROWED_FILE = "queued-touches-borrowed-at";
 export declare const MAX_QUEUED_TOUCHES = 200;
 export declare function queuedTouchesPath(hqRoot: string, slug: string): string;
 /**

package/dist/lib/checkpoint-ontology/queued-touches.js

@@ -16,9 +16,9 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { assertSafeTarget, resolveOntologyCompany, safeWriteFile, WriteBoundsError, } from "./company.js";
-export const QUEUED_TOUCHES_FILE = "queued-touches.jsonl";
-export const QUEUED_TOUCHES_CLAIM_FILE = "queued-touches-claimed.jsonl";
-export const QUEUED_TOUCHES_BORROWED_FILE = "queued-touches-borrowed-at";
+const QUEUED_TOUCHES_FILE = "queued-touches.jsonl";
+const QUEUED_TOUCHES_CLAIM_FILE = "queued-touches-claimed.jsonl";
+const QUEUED_TOUCHES_BORROWED_FILE = "queued-touches-borrowed-at";
 export const MAX_QUEUED_TOUCHES = 200;
 function ontologyStateBase(hqRoot) {
     return path.join(hqRoot, "workspace", "checkpoints", "ontology");

package/dist/lib/db/control-plane.js

@@ -1,4 +1,8 @@
 import { planGateErrorFromPayload } from "../../utils/plan-gate-error.js";
+// Provision may allocate remote resources, so allow two minutes and never retry.
+const DB_PROVISION_TIMEOUT_MS = 120_000;
+// Status is a read-only probe; 15 seconds is longer than its normal response time.
+const DB_STATUS_TIMEOUT_MS = 15_000;
 function assertNoPostgresUrl(label, text) {
     if (/postgres:\/\//i.test(text) || /postgresql:\/\//i.test(text)) {
         throw new Error(`${label}: control plane returned a connection string (refusing to surface)`);
@@ -22,6 +26,7 @@ export class ControlPlaneDbClient {
                 "Content-Type": "application/json",
             },
             body: JSON.stringify(input),
+            signal: AbortSignal.timeout(DB_PROVISION_TIMEOUT_MS),
         });
         const text = await res.text();
         assertNoPostgresUrl("provision", text);
@@ -53,6 +58,7 @@ export class ControlPlaneDbClient {
         const res = await this.fetchImpl(url, {
             method: "GET",
             headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(DB_STATUS_TIMEOUT_MS),
         });
         const text = await res.text();
         assertNoPostgresUrl("status", text);

package/dist/lib/deploy-apps.js

@@ -7,6 +7,7 @@ export const MAX_DEPLOY_APPS_PAGES = 100;
  */
 export async function listDeployApps(fetchPage) {
     const apps = [];
+    const seenCursors = new Set();
     let cursor;
     for (let page = 0; page < MAX_DEPLOY_APPS_PAGES; page += 1) {
         const result = await fetchPage(cursor);
@@ -17,6 +18,10 @@ export async function listDeployApps(fetchPage) {
         if (typeof result.nextCursor !== "string" || result.nextCursor.length === 0) {
             throw new Error("hq-deploy returned an invalid apps-list cursor.");
         }
+        if (seenCursors.has(result.nextCursor)) {
+            throw new Error("hq-deploy returned a repeated apps list cursor.");
+        }
+        seenCursors.add(result.nextCursor);
         cursor = result.nextCursor;
     }
     throw new Error(`hq-deploy apps list exceeded the ${MAX_DEPLOY_APPS_PAGES}-page safety cap.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.306.0",
+  "version": "5.308.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {