@indigoai-us/hq-cli 5.309.1 → 5.311.0

package/dist/commands/lanes.js

@@ -33,7 +33,9 @@ import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
+import { isControllerAliasOutpostId } from "../lib/lanes/admission-host.js";
 import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
+import { syncOutpostLeadRegistries } from "../lib/lanes/autopilot-registry.js";
 import { OutpostSnapshotInvocationMemo } from "../lib/lanes/outpost-snapshot-memo.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, selectOutpostHireGrantHierarchy, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
@@ -253,6 +255,7 @@ function resolveDeps(deps = {}) {
         now: deps.now ?? (() => new Date()),
         hostname: deps.hostname ?? (() => os.hostname()),
         resolveCompany: deps.resolveCompany ?? defaultResolveCompany,
+        readLeadAutopilotFlag: deps.readLeadAutopilotFlag ?? readLanesRegistryFlag,
         resolveActiveCompany: deps.resolveActiveCompany ?? defaultResolveActiveCompany,
         listOutpostIds: deps.listOutpostIds ?? defaultListOutpostIds,
         listOutpostRoutes,
@@ -1112,8 +1115,7 @@ async function loadHostCapacitySnapshots(ctx, hqRoot, config = loadLanesConfig(h
         .map((id) => id.trim())
         // `primary` aliases the controller when running on the primary box. From
         // another Outpost it identifies a separate host and must be measured.
-        .filter((id) => id !== "primary" ||
-        (localHost.kind === "outpost" && localHost.id !== "primary"))
+        .filter((id) => !isControllerAliasOutpostId(id, localHost))
         .filter((id) => localHost.kind !== "outpost" || id !== localHost.id)
         .sort();
     const local = buildHostCapacitySnapshot({
@@ -1676,7 +1678,7 @@ async function loadClaudeBalanceHostSnapshots(ctx, hqRoot, config) {
         });
     }
     const remoteIds = outpostIds.map((id) => id.trim())
-        .filter((id) => id !== "primary" || (localHost.kind === "outpost" && localHost.id !== "primary"))
+        .filter((id) => !isControllerAliasOutpostId(id, localHost))
         .filter((id) => localHost.kind !== "outpost" || id !== localHost.id)
         .sort();
     const remoteResults = await mapWithConcurrency(remoteIds, OUTPOST_HIRE_SUMMARY_CONCURRENCY, async (id) => {
@@ -3282,6 +3284,8 @@ async function runCreate(ctx, opts) {
             hosts: balanceHostLoad.snapshots,
             targetHost,
             config,
+            quotaState: loadQuotaState(hqRoot),
+            ...(modelToValidate !== undefined ? { model: modelToValidate } : {}),
             recentUsageEnabled: await readClaudeAccountBalanceSignalsEnabled(ctx, company ?? undefined),
             now: ctx.now(),
             ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
@@ -3329,6 +3333,8 @@ async function runCreate(ctx, opts) {
                     hosts,
                     targetHost: balanceTargetHost,
                     config,
+                    quotaState: loadQuotaState(hqRoot),
+                    ...(modelToValidate !== undefined ? { model: modelToValidate } : {}),
                     recentUsageEnabled: await readClaudeAccountBalanceSignalsEnabled(ctx, company ?? undefined),
                     now: ctx.now(),
                     ...(allowedAccounts !== undefined ? { allowedAccounts } : {}),
@@ -6391,9 +6397,8 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
             probe: ctx.probeProvider,
             env: ctx.env,
         }).logged_in;
-    const accountNeedsRepair = lane.account !== undefined &&
+    const recordedAccountUnavailable = lane.account !== undefined &&
         (currentConfig?.enabled !== true || currentLogin === false);
-    const repairUnavailableAccount = options.repairUnavailableAccount === true && accountNeedsRepair;
     const profile = workerProfile?.profile ?? (lane.worker_profile !== undefined
         ? loadWorkerProfile(hqRoot, lane.worker_profile)
         : undefined);
@@ -6413,6 +6418,16 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         (lane.model_source === "cli" || lane.model_source === "preserved")
         ? lane.account
         : undefined;
+    const quotaModel = resolveLaneModel({
+        cliModel: pinnedModel ?? (lane.model_source === "account" ? lane.model : undefined),
+        profileModel: profileDefaultsApply ? profile?.meta.model : undefined,
+        accountModel: lane.account === undefined ? undefined : config.providers.claude.accounts[lane.account]?.model,
+        providerModel: config.providers.claude.model,
+    });
+    const recordedAccountQuotaHeld = lane.account !== undefined &&
+        quotaBlockFor(loadQuotaState(hqRoot), "claude", lane.account, quotaModel, ctx.now()).blocked;
+    const accountNeedsRepair = recordedAccountUnavailable || recordedAccountQuotaHeld;
+    const repairUnavailableAccount = options.repairUnavailableAccount === true && accountNeedsRepair;
     const preservedModel = repairUnavailableAccount && lane.model_source === "account"
         ? lane.model ?? currentConfig?.model
         : undefined;
@@ -6430,7 +6445,8 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
     const currentTargetAccount = lane.account === undefined
         ? undefined
         : targetHost?.capacity.providers.claude.accounts[lane.account];
-    if (profilePin !== undefined &&
+    if (!recordedAccountQuotaHeld &&
+        profilePin !== undefined &&
         lane.account !== undefined &&
         allowedAccounts?.includes(lane.account) &&
         currentConfig?.enabled === true &&
@@ -6443,6 +6459,7 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         hosts: balanceHosts.snapshots,
         targetHost: lane.host,
         config,
+        quotaState: loadQuotaState(hqRoot),
         recentUsageEnabled: await readClaudeAccountBalanceSignalsEnabled(ctx, lane.company ?? undefined),
         now: ctx.now(),
         ...(!repairUnavailableAccount && allowedAccounts !== undefined ? { allowedAccounts } : {}),
@@ -7810,6 +7827,29 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
         summary.ok = false;
     }
     const terminalizedRemoteIds = new Set(remoteLost.map(({ id }) => id));
+    let autopilotRegistrySync;
+    const reconcileHost = reconcileHostFromCtx(ctx);
+    const localHost = laneHostFromCtx(ctx);
+    if (!opts.dryRun && (reconcileHost.outpostId === null || isControllerAliasOutpostId(reconcileHost.outpostId, localHost))) {
+        try {
+            autopilotRegistrySync = await syncOutpostLeadRegistries({
+                hqRoot,
+                outpostIds: await ctx.listOutpostIds(),
+                generatedAt: ctx.now().toISOString(),
+                localHost,
+                resolveCompany: (slug) => ctx.resolveCompany(slug),
+                readFlag: (flag, options) => ctx.readLeadAutopilotFlag(flag, options),
+                dispatch: ctx.dispatchOutpostExec,
+            });
+        }
+        catch (error) {
+            const code = error instanceof LanesError ? error.error : "lead_autopilot_registry_sync_failed";
+            const message = error instanceof Error ? error.message : String(error);
+            summary.ok = false;
+            summary.errors.push({ code, message });
+            process.stderr.write(`hq lanes autopilot registry: ${message}\n`);
+        }
+    }
     let autopilot;
     try {
         const host = reconcileHostFromCtx(ctx);
@@ -7842,11 +7882,12 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         summary.ok = false;
-        summary.errors.push({ code: "lead_autopilot_failed", message });
+        summary.errors.push({ code: error instanceof LanesError ? error.error : "lead_autopilot_failed", message });
         process.stderr.write(`hq lanes autopilot: ${message}\n`);
     }
     printJson({
         ...summary,
+        ...(autopilotRegistrySync ? { autopilot_registry_sync: autopilotRegistrySync } : {}),
         ...(autopilot ? { autopilot } : {}),
         ...(remoteLost.length > 0 ? { remote_lost: remoteLost } : {}),
         ...(mirrorRefresh.unverifiedRemote.size > 0

package/dist/commands/personal-connector-settings-flag.d.ts

@@ -0,0 +1,4 @@
+export declare const CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG = "cli.personal-connector-settings";
+/** Keep company-shared connector storage unchanged until the flag is explicitly enabled. */
+export declare function personalConnectorSettingsEnabled(): boolean;
+//# sourceMappingURL=personal-connector-settings-flag.d.ts.map

package/dist/commands/personal-connector-settings-flag.js

@@ -0,0 +1,7 @@
+import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+export const CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG = "cli.personal-connector-settings";
+/** Keep company-shared connector storage unchanged until the flag is explicitly enabled. */
+export function personalConnectorSettingsEnabled() {
+    return resolveProcessFlagGate(CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=personal-connector-settings-flag.js.map

package/dist/commands/report.d.ts

@@ -1,44 +1,19 @@
 import { Command } from "commander";
-import { buildReportTarball, deployOrgContext, type ChannelReport, type DeployAccessPolicy, type ReportDeployment, type ReportPatch, ReportPublishError } from "../lib/report-publish.js";
-type ChannelRow = {
-    channelId?: string;
-    scope?: string;
-    companyUid?: string | null;
-};
+import { deployOrgContext, type ChannelReport, type ReportPatch } from "../lib/report-publish.js";
 type ReportPatchInput = ReportPatch | ((current: ChannelReport) => ReportPatch);
-/** Any company-owned channel (company or project scope) can carry reports; personal channels cannot. */
-export declare function isCompanyReportChannel(channel: ChannelRow): boolean;
-/**
- * Records created before hq-pro stamped companyUid carry null. The channel the
- * caller can see knows its company, and publish needs it to pick the deploy
- * org, so fill it from there rather than failing every publish.
- */
-export declare function withChannelCompany(report: ChannelReport, channels: ChannelRow[]): ChannelReport;
 /** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
 export declare function resolveReport(token: string, reportId: string, requestedChannelId?: string): Promise<ChannelReport>;
 export declare function patchReport(token: string, report: ChannelReport, patch: ReportPatchInput): Promise<ChannelReport>;
-/** hq-deploy refused the subdomain: another app, not visible to this caller, holds it. */
-export declare class SubdomainTakenError extends ReportPublishError {
-    constructor();
-}
 /**
  * Subdomains to try, in order. The first is the report's own slug; the rest
  * are used only when an app the caller cannot see already holds it (for
  * example, one left by an earlier publish under a different account).
  */
 export declare function candidateSlugs(slug: string, attempts?: number): string[];
-export declare function resolveCompanySlug(token: string, companyUid: string): Promise<string>;
 export declare function findOrCreateApp(token: string, slug: string, org: ReturnType<typeof deployOrgContext>): Promise<{
     id: string;
     subdomain: string;
 }>;
-export declare function deployReportStatic(token: string, input: {
-    slug: string;
-    files: Parameters<typeof buildReportTarball>[0];
-    access: DeployAccessPolicy;
-    org: ReturnType<typeof deployOrgContext>;
-}): Promise<ReportDeployment>;
 export declare function registerReportCommand(program: Command): void;
-export declare function runReportCommand(action: () => Promise<void>): Promise<void>;
 export {};
 //# sourceMappingURL=report.d.ts.map

package/dist/commands/report.js

@@ -99,7 +99,7 @@ async function listReportChannels(token) {
     return Array.isArray(listed.channels) ? listed.channels : [];
 }
 /** Any company-owned channel (company or project scope) can carry reports; personal channels cannot. */
-export function isCompanyReportChannel(channel) {
+function isCompanyReportChannel(channel) {
     if (channel.scope === "personal")
         return false;
     return channel.scope === "company" || channel.scope === "project" || Boolean(channel.companyUid);
@@ -125,7 +125,7 @@ async function readReportInChannel(token, channelId, reportId) {
  * caller can see knows its company, and publish needs it to pick the deploy
  * org, so fill it from there rather than failing every publish.
  */
-export function withChannelCompany(report, channels) {
+function withChannelCompany(report, channels) {
     if (report.companyUid)
         return report;
     const companyUid = channels.find((row) => row.channelId === report.channelId)?.companyUid;
@@ -232,7 +232,7 @@ async function deployJson(token, route, method, body, extraHeaders = {}) {
     return await res.json();
 }
 /** hq-deploy refused the subdomain: another app, not visible to this caller, holds it. */
-export class SubdomainTakenError extends ReportPublishError {
+class SubdomainTakenError extends ReportPublishError {
     constructor() {
         super("hq-deploy rejected the report deployment.");
     }
@@ -245,7 +245,7 @@ export class SubdomainTakenError extends ReportPublishError {
 export function candidateSlugs(slug, attempts = 3) {
     return [slug, ...Array.from({ length: attempts }, (_, i) => `${slug}-${i + 2}`)];
 }
-export async function resolveCompanySlug(token, companyUid) {
+async function resolveCompanySlug(token, companyUid) {
     const res = await vaultApiFetch({ token, path: `/entity/${encodeURIComponent(companyUid)}` });
     if (!res.ok)
         throw new ReportPublishError("Could not resolve the report's company for deploy.");
@@ -290,7 +290,7 @@ export async function findOrCreateApp(token, slug, org) {
         throw new ReportPublishError("hq-deploy returned an incomplete app record.");
     return { id, subdomain };
 }
-export async function deployReportStatic(token, input) {
+async function deployReportStatic(token, input) {
     const app = await findOrCreateApp(token, input.slug, input.org);
     await deployJson(token, `/api/apps/${encodeURIComponent(app.id)}/access-policy`, "PUT", input.access, input.org.headers);
     const tarball = buildReportTarball(input.files);
@@ -525,7 +525,7 @@ export function registerReportCommand(program) {
         print(templates, options.json === true);
     });
 }
-export async function runReportCommand(action) {
+async function runReportCommand(action) {
     try {
         await action();
     }

package/dist/fast-core.js

@@ -21,8 +21,11 @@ export async function runFastCore(argv) {
     const entry = parsed.entry;
     // The full graph's process gate accepts textual true/false overrides. It ignores
     // numeric env values, so preserve that behavior for family flags here too.
-    const familyEnabled = entry.kind !== "native" || !entry.familyFlagKey ||
-        await (await import("./native-fast-route.js")).fastFlagEnabled(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
+    let familyEnabled = true;
+    if (entry.kind === "native" && entry.familyFlagKey) {
+        const envOverride = localBooleanFlagOverride(entry.familyFlagKey, process.env);
+        familyEnabled = envOverride ?? await (await import("./native-fast-route.js")).fastFlagEnabled(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
+    }
     const useShell = entry.kind === "native" && Boolean(entry.familyFlagKey) && !familyEnabled;
     const shouldInjectRoot = useShell
         ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
@@ -87,4 +90,14 @@ export async function runFastCore(argv) {
     // Propagate verbatim: these scripts use their exit code as their interface.
     process.exit(code);
 }
+/** Match hq-flags-client's literal true/false env override without loading its module. */
+function localBooleanFlagOverride(flagKey, env) {
+    const envKey = `HQ_FLAG_${flagKey.replace(/[.-]/g, "_").toUpperCase()}`;
+    const value = env[envKey];
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    return null;
+}
 //# sourceMappingURL=fast-core.js.map

package/dist/fast-scaffold.js

@@ -11,8 +11,31 @@
  */
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export const FAST_SCAFFOLD_SCRIPTS = [
-    { name: "checkpoint-stop-gate", kind: "shell", asset: "core/scripts/checkpoint-stop-gate.sh", root: "live" },
-    { name: "hq-session", kind: "shell", asset: "core/scripts/hq-session.sh", root: "live" },
+    {
+        name: "checkpoint-stop-gate",
+        kind: "native",
+        modulePath: "./commands/core-checkpoint-stop-gate-native.js",
+        exportName: "runCheckpointStopGateFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-session",
+        asset: "core/scripts/checkpoint-stop-gate.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+        readsStdin: true,
+    },
+    {
+        name: "hq-session",
+        kind: "native",
+        modulePath: "./commands/core-hq-session-native.js",
+        exportName: "runHqSessionFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-session",
+        asset: "core/scripts/hq-session.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
     {
         name: "timeout-guard",
         kind: "native",

package/dist/index.js

@@ -35,6 +35,14 @@ if (isVersionRequest(process.argv)) {
         });
     }
 }
+else if (parseFastCore(process.argv)?.entry.kind === "native" &&
+    (process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "true" ||
+        process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "1")) {
+    // An explicit enabled override has already decided the global gate. Skip the
+    // snapshot reader import on hot native plumbing paths; runFastCore still
+    // checks the command-family flag before choosing native or shell rollback.
+    void import("./fast-core.js").then(({ runFastCore }) => runFastCore(process.argv));
+}
 else if (parseFastCore(process.argv)?.entry.kind === "native") {
     // Native routes are default-off. Resolve the company-scoped persisted flag
     // without loading the command graph; a miss or stale snapshot takes the

package/dist/lib/bot/continuity.d.ts

@@ -1,5 +1,5 @@
 import type { BotConfig } from "./config.js";
-export interface ContinuityFile {
+interface ContinuityFile {
     area: "worker" | "memory";
     path: string;
     bytes: number;
@@ -63,4 +63,5 @@ export declare function planFleetContinuity(bundle: BotContinuityBundle, target:
         sha256: string;
     };
 };
+export {};
 //# sourceMappingURL=continuity.d.ts.map

package/dist/lib/bot/job-completions.d.ts

@@ -45,7 +45,6 @@
  * everything it needs in its own prompt.
  */
 import type { JobRunStatus } from "./api.js";
-export declare const BOT_JOB_COMPLETIONS_NAME = "job-completions.json";
 /** First retry gap; each failure doubles it. */
 export declare const COMPLETION_RETRY_BASE_MS = 2000;
 /** Never wait longer than this between retries. */
@@ -75,7 +74,6 @@ export interface PendingJobCompletion {
     /** Epoch ms before which this must not be retried (exponential backoff). */
     nextAttemptAt: number;
 }
-export declare function botJobCompletionsPath(dir: string): string;
 export declare function readPendingJobCompletions(dir: string): PendingJobCompletion[];
 /** The gap before attempt N (1-based), doubling and capped. */
 export declare function completionRetryDelayMs(attempts: number): number;

package/dist/lib/bot/job-completions.js

@@ -46,7 +46,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-export const BOT_JOB_COMPLETIONS_NAME = "job-completions.json";
+const BOT_JOB_COMPLETIONS_NAME = "job-completions.json";
 /** First retry gap; each failure doubles it. */
 export const COMPLETION_RETRY_BASE_MS = 2_000;
 /** Never wait longer than this between retries. */
@@ -57,7 +57,7 @@ export const COMPLETION_RETRY_MAX_MS = 5 * 60_000;
  * in-progress slot on its own, so a later report changes nothing.
  */
 export const MAX_COMPLETION_AGE_MS = 60 * 60_000;
-export function botJobCompletionsPath(dir) {
+function botJobCompletionsPath(dir) {
     return path.join(dir, BOT_JOB_COMPLETIONS_NAME);
 }
 function isPending(raw) {

package/dist/lib/bot/local-config.d.ts

@@ -10,10 +10,6 @@
  * live only in ~/.hq/bots/<name>/machine-creds.json and never travel here.
  */
 import { type BotConfig, type BotKind, type BotMemoryMode, type BotRuntimeId } from "./config.js";
-/** Same limit the server enforces on the stored value. */
-export declare const BOT_LOCAL_CONFIG_MAX_BYTES: number;
-/** Key names the server rejects outright (case-insensitive, substring). */
-export declare const BOT_LOCAL_CONFIG_FORBIDDEN_KEY_RE: RegExp;
 /**
  * Everything needed to rebuild a bot here, minus anything secret. Written on
  * create, returned by `GET /v1/agents/mine?local=1` and by the credential
@@ -62,10 +58,4 @@ export declare const BOT_RESTORE_DEFAULTS: {
 };
 /** Human summary of the settings a restore is about to apply. */
 export declare function describeBotLocalConfig(local: BotLocalConfig | null): string;
-/** Exported so callers can present the accepted values without importing config.ts. */
-export declare const BOT_LOCAL_CONFIG_VALUES: {
-    readonly runtimes: readonly ["claude", "codex", "grok"];
-    readonly kinds: readonly ["personal", "company"];
-    readonly memoryModes: readonly ["synced", "local"];
-};
 //# sourceMappingURL=local-config.d.ts.map

package/dist/lib/bot/local-config.js

@@ -9,11 +9,11 @@
  * checks the result before it leaves this machine: a bot's machine credentials
  * live only in ~/.hq/bots/<name>/machine-creds.json and never travel here.
  */
-import { BOT_KINDS, BOT_MEMORY_MODES, BOT_RUNTIMES, botMemoryMode, effectiveBotCompanies, effectiveBotKind, isBotKind, isBotMemoryMode, isBotRuntimeId, } from "./config.js";
+import { botMemoryMode, effectiveBotCompanies, effectiveBotKind, isBotKind, isBotMemoryMode, isBotRuntimeId, } from "./config.js";
 /** Same limit the server enforces on the stored value. */
-export const BOT_LOCAL_CONFIG_MAX_BYTES = 8 * 1024;
+const BOT_LOCAL_CONFIG_MAX_BYTES = 8 * 1024;
 /** Key names the server rejects outright (case-insensitive, substring). */
-export const BOT_LOCAL_CONFIG_FORBIDDEN_KEY_RE = /secret|token|password|creds/i;
+const BOT_LOCAL_CONFIG_FORBIDDEN_KEY_RE = /secret|token|password|creds/i;
 /** Walks a value and throws when any key looks like it could carry a secret. */
 export function assertNoSecretKeys(value, path = "localConfig") {
     if (Array.isArray(value)) {
@@ -142,10 +142,4 @@ export function describeBotLocalConfig(local) {
         bits.push(local.model);
     return bits.join(", ");
 }
-/** Exported so callers can present the accepted values without importing config.ts. */
-export const BOT_LOCAL_CONFIG_VALUES = {
-    runtimes: BOT_RUNTIMES,
-    kinds: BOT_KINDS,
-    memoryModes: BOT_MEMORY_MODES,
-};
 //# sourceMappingURL=local-config.js.map

package/dist/lib/bot/owner-context.d.ts

@@ -13,7 +13,7 @@
  * slugs, uids, roles) reaches the model; the owner's token never does. A failed
  * lookup is reported as "could not check", never as "no companies".
  */
-export interface OwnerCompany {
+interface OwnerCompany {
     companyUid: string;
     /** Present when the server enriched it. */
     companySlug?: string;
@@ -55,15 +55,10 @@ export interface OwnerLookupIo {
     /** Test seam for the retry pause. */
     sleep?: (ms: number) => Promise<void>;
 }
-export declare const defaultOwnerLookupIo: OwnerLookupIo;
-/** A read right after sign-in or bot start can fail once; try again before reporting it. */
-export declare const OWNER_LOOKUP_RETRY_DELAYS_MS: number[];
 export declare function lookupOwnerContext(ownerUid: string, io?: OwnerLookupIo): Promise<OwnerContext>;
 /** Successful lookups are reused for 5 minutes, failures retried after 1 minute. */
 export declare const OWNER_CONTEXT_TTL_MS: number;
 export declare const OWNER_CONTEXT_RETRY_MS = 60000;
-/** A turn never waits longer than this for a refresh; the lookup keeps going in the background. */
-export declare const OWNER_CONTEXT_WAIT_MS = 8000;
 export declare class OwnerContextCache {
     private readonly lookup;
     private readonly nowMs;
@@ -80,4 +75,5 @@ export declare class OwnerContextCache {
  * model cannot confuse the owner's memberships with its own.
  */
 export declare function ownerContextBlock(ctx: OwnerContext, agentUid: string): string;
+export {};
 //# sourceMappingURL=owner-context.d.ts.map

package/dist/lib/bot/owner-context.js

@@ -18,7 +18,7 @@ import { resolveCallerPersonUid, vaultApiFetch } from "../../utils/vault-api.js"
 function message(err) {
     return err instanceof Error ? err.message : String(err);
 }
-export const defaultOwnerLookupIo = {
+const defaultOwnerLookupIo = {
     // tokenSource "person" never uses the bot's machine creds, even though
     // HQ_MACHINE_CREDS_FILE is set for this process.
     personToken: () => ensureCognitoToken({ tokenSource: "person", interactive: false }),
@@ -34,7 +34,7 @@ export const defaultOwnerLookupIo = {
     },
 };
 /** A read right after sign-in or bot start can fail once; try again before reporting it. */
-export const OWNER_LOOKUP_RETRY_DELAYS_MS = [1_000, 2_000];
+const OWNER_LOOKUP_RETRY_DELAYS_MS = [1_000, 2_000];
 async function withRetry(fn, io) {
     const sleep = io.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     let lastErr;
@@ -84,7 +84,7 @@ export async function lookupOwnerContext(ownerUid, io = defaultOwnerLookupIo) {
 export const OWNER_CONTEXT_TTL_MS = 5 * 60_000;
 export const OWNER_CONTEXT_RETRY_MS = 60_000;
 /** A turn never waits longer than this for a refresh; the lookup keeps going in the background. */
-export const OWNER_CONTEXT_WAIT_MS = 8_000;
+const OWNER_CONTEXT_WAIT_MS = 8_000;
 export class OwnerContextCache {
     lookup;
     nowMs;

package/dist/lib/bot/runtime/windows.d.ts

@@ -1,7 +1,5 @@
 import { type SpawnPlan } from "../../../utils/windows-spawn.js";
 type ExistsSync = (candidate: string) => boolean;
-/** Resolve an npm-installed provider command using Windows PATH and PATHEXT. */
-export declare function resolveWindowsExecutable(name: string, env: NodeJS.ProcessEnv, existsSync?: ExistsSync, cwd?: string): string | null;
 /** Preserve non-Windows lookup. Windows returns the first PATH/PATHEXT match. */
 export declare function resolveRuntimeBinary(name: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform, existsSync?: ExistsSync, cwd?: string): string;
 /** Directly spawn native files; pass only batch shims through cmd.exe. */

package/dist/lib/bot/runtime/windows.js

@@ -8,7 +8,7 @@ function envValue(env, name) {
     return key ? env[key] : undefined;
 }
 /** Resolve an npm-installed provider command using Windows PATH and PATHEXT. */
-export function resolveWindowsExecutable(name, env, existsSync = fs.existsSync, cwd = process.cwd()) {
+function resolveWindowsExecutable(name, env, existsSync = fs.existsSync, cwd = process.cwd()) {
     const pathValue = envValue(env, "PATH") ?? "";
     const rawExtensions = (envValue(env, "PATHEXT") || DEFAULT_PATHEXT)
         .split(";")

package/dist/lib/bot/setup-explain.d.ts

@@ -16,10 +16,6 @@
 export declare const EXPLAIN_HQ_SUGGESTION = "Explain HQ first";
 /** Where the explanation lives, relative to the setup worker folder. */
 export declare const EXPLAIN_HQ_FILE: string;
-/** The setup bot's progress note in its memory folder (setup worker.yaml). */
-export declare const SETUP_PROGRESS_FILE = "setup-progress.md";
-/** Runner-owned state, in the bot's own folder (never the model's memory). */
-export declare const SETUP_INTRO_STATE_FILE = "setup-intro.json";
 /**
  * Put in front of the next message from the person, so the model knows the
  * explanation went out without it. It never reaches the person.

package/dist/lib/bot/setup-explain.js

@@ -19,9 +19,9 @@ export const EXPLAIN_HQ_SUGGESTION = "Explain HQ first";
 /** Where the explanation lives, relative to the setup worker folder. */
 export const EXPLAIN_HQ_FILE = path.join("skills", "explain-hq.md");
 /** The setup bot's progress note in its memory folder (setup worker.yaml). */
-export const SETUP_PROGRESS_FILE = "setup-progress.md";
+const SETUP_PROGRESS_FILE = "setup-progress.md";
 /** Runner-owned state, in the bot's own folder (never the model's memory). */
-export const SETUP_INTRO_STATE_FILE = "setup-intro.json";
+const SETUP_INTRO_STATE_FILE = "setup-intro.json";
 const EXPLANATION_HEADING = /^##[ \t]+The explanation[ \t]*$/m;
 const CLOSING_HEADING = /^##[ \t]+After the explanation, when the app sends it[ \t]*$/m;
 /**

package/dist/lib/daemon/catalog.d.ts

@@ -23,7 +23,7 @@ export declare function enabledServices(machineType: MachineType, overrides: {
     enable: readonly string[];
     disable: readonly string[];
 }): ServiceName[];
-export type UnitCommand = {
+type UnitCommand = {
     type: "hq";
     args: string[];
 } | {
@@ -38,7 +38,7 @@ export type UnitCommand = {
     type: "internal";
     task: "rotate-logs";
 };
-export interface UnitBlock {
+interface UnitBlock {
     /** `waiting` clears on its own once the requirement appears; `unavailable` needs a newer CLI. */
     state: "waiting" | "unavailable";
     reason: string;
@@ -128,4 +128,5 @@ export declare const CODEX_RUNNER_SCRIPT = "/usr/local/bin/outpost-codex-runner.
 export declare const CLAUDE_RUNNER_SCRIPT = "/usr/local/bin/outpost-runner.sh";
 /** Turn enabled services into concrete units for this host. */
 export declare function planUnits(services: readonly ServiceName[], ctx: PlanContext): UnitPlan[];
+export {};
 //# sourceMappingURL=catalog.d.ts.map

package/dist/lib/daemon/hq-cloud.d.ts

@@ -52,7 +52,6 @@ export declare function hqCloudInstallCommand(prefix: string, version: string, p
     args: string[];
     shell: boolean;
 };
-export declare function readHqCloudCopy(root: string): HqCloudCopy | null;
 /** The copy bundled with this CLI. */
 export declare function bundledHqCloud(): HqCloudCopy | null;
 /** The hq-cloud the daemon should run right now. */
@@ -63,7 +62,7 @@ export interface HqCloudUpdateOutcome {
     to: string | null;
     detail?: string;
 }
-export interface NpmRunResult {
+interface NpmRunResult {
     status: number | null;
     stdout?: string | null;
     stderr?: string | null;
@@ -76,4 +75,5 @@ export interface UpdateHqCloudDeps {
 }
 /** Install or update the updater's copy, as this (the login) user. */
 export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv, deps?: UpdateHqCloudDeps): HqCloudUpdateOutcome;
+export {};
 //# sourceMappingURL=hq-cloud.d.ts.map

package/dist/lib/daemon/hq-cloud.js

@@ -108,7 +108,7 @@ export function hqCloudInstallCommand(prefix, version, platform = process.platfo
     const plan = buildSpawnPlan("npm", ["install", "--prefix", prefix, "--no-audit", "--no-fund", "--omit=dev", `${HQ_CLOUD_PACKAGE}@${version}`], platform);
     return { file: plan.cmd, args: plan.args, shell: plan.shell };
 }
-export function readHqCloudCopy(root) {
+function readHqCloudCopy(root) {
     try {
         const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
         return typeof pkg.version === "string" ? { root, version: pkg.version } : null;

package/dist/lib/daemon/machine-type.d.ts

@@ -12,12 +12,10 @@
  *   6. macOS or Windows → desktop
  *   7. any other host → self-hosted
  */
-export declare const MACHINE_TYPES: readonly ["desktop", "self-hosted", "outpost", "agent-box", "agent-kit"];
+declare const MACHINE_TYPES: readonly ["desktop", "self-hosted", "outpost", "agent-box", "agent-kit"];
 export type MachineType = (typeof MACHINE_TYPES)[number];
 export declare const MACHINE_TYPE_MARKER_PATH = "/etc/hq/machine-type";
-export type MachineTypeSource = "flag" | "config" | "marker" | "outpost-units" | "agent-kit-creds" | "container" | "platform";
-/** The Claude runner unit outpost provisioning installs; its `User=` is the box's login user. */
-export declare const OUTPOST_RUNNER_UNIT = "/etc/systemd/system/outpost-runner.service";
+type MachineTypeSource = "flag" | "config" | "marker" | "outpost-units" | "agent-kit-creds" | "container" | "platform";
 export interface MachineTypeResult {
     type: MachineType;
     source: MachineTypeSource;
@@ -48,4 +46,5 @@ export declare function parseMachineTypeMarker(text: string): {
 export declare function detectMachineType(flag: string | undefined, deps: DetectMachineTypeDeps): MachineTypeResult;
 /** The home directory of `user` in passwd-format text, or null when the account is not listed. */
 export declare function homeFromPasswd(passwd: string, user: string): string | null;
+export {};
 //# sourceMappingURL=machine-type.d.ts.map

package/dist/lib/daemon/machine-type.js

@@ -14,10 +14,10 @@
  */
 import * as path from "node:path";
 import { AGENT_DIR_ENV, MACHINE_CREDS_NAME, agentRootDir } from "../agent-kit/paths.js";
-export const MACHINE_TYPES = ["desktop", "self-hosted", "outpost", "agent-box", "agent-kit"];
+const MACHINE_TYPES = ["desktop", "self-hosted", "outpost", "agent-box", "agent-kit"];
 export const MACHINE_TYPE_MARKER_PATH = "/etc/hq/machine-type";
 /** The Claude runner unit outpost provisioning installs; its `User=` is the box's login user. */
-export const OUTPOST_RUNNER_UNIT = "/etc/systemd/system/outpost-runner.service";
+const OUTPOST_RUNNER_UNIT = "/etc/systemd/system/outpost-runner.service";
 export function isMachineType(value) {
     return typeof value === "string" && MACHINE_TYPES.includes(value);
 }

package/dist/lib/daemon/remote-control.d.ts

@@ -21,7 +21,6 @@
  * user's own tmux sessions.
  */
 import type { RunCommand } from "../service-manager/launchd.js";
-export declare const TMUX_SOCKET = "hq-daemon";
 export declare const TMUX_SESSION = "remote-control";
 export declare const CODEX_TMUX_SESSION = "codex-remote-control";
 export declare function remoteControlArgs(opts: {