@indigoai-us/hq-cli 5.322.0 → 5.324.0

package/dist/commands/core-derive-trigger-facts-native.d.ts

@@ -0,0 +1,21 @@
+export declare const DERIVE_TRIGGER_FACTS_ASSET = "core/scripts/derive-trigger-facts.sh";
+export type DeriveTriggerRunOptions = {
+    argv: readonly string[];
+    stdin: string;
+    cwd: string;
+    hqRoot: string;
+    env?: Record<string, string | undefined>;
+    /** Test seam for the shell's `git -C ... rev-parse` lookup. */
+    gitBranch?: string;
+    /** Test seam for `command -v jq`; production resolves jq from PATH. */
+    jqAvailable?: boolean;
+};
+export type DeriveTriggerRunResult = {
+    code: number;
+    stdout: Buffer;
+    stderr: Buffer;
+};
+/** Run the native handler contract, retaining exact bytes for differential tests. */
+export declare function runDeriveTriggerFacts(options: DeriveTriggerRunOptions): DeriveTriggerRunResult;
+export declare function runDeriveTriggerFactsFast(argv: readonly string[], stdin: string, cwd: string, hqRoot: string | undefined): number;
+//# sourceMappingURL=core-derive-trigger-facts-native.d.ts.map

package/dist/commands/core-derive-trigger-facts-native.js

@@ -0,0 +1,492 @@
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { runBundledScript } from "../utils/run-bundled-script.js";
+export const DERIVE_TRIGGER_FACTS_ASSET = "core/scripts/derive-trigger-facts.sh";
+const TEXT_FACT_AWK = "core/scripts/lib/trigger-fact-text.awk";
+const TRANSCRIPT_TAIL_MAX_BYTES = 1_048_576;
+function effectiveEnvironment(options) {
+    return {
+        ...process.env,
+        ...(options.env ?? {}),
+        HQ_ROOT: options.hqRoot,
+        CLAUDE_PROJECT_DIR: options.hqRoot,
+    };
+}
+class ShellFallbackRequired extends Error {
+}
+function asciiLower(value) {
+    return value.replace(/[A-Z]/g, (letter) => String.fromCharCode(letter.charCodeAt(0) + 32));
+}
+function localeLower(value, env) {
+    const locale = env.LC_ALL || env.LC_CTYPE || env.LANG || "C";
+    if (/^(?:C|POSIX)(?:$|\.(?!utf-?8$))/i.test(locale))
+        return asciiLower(value);
+    // glibc applies towlower independently to each character. Lowercase code
+    // points separately so JavaScript does not apply context-sensitive sigma.
+    // glibc maps U+0130 to simple `i`; JavaScript otherwise expands it.
+    return Array.from(value, (character) => character === "\u0130" ? "i" : character.toLowerCase()).join("");
+}
+function hasGlobPattern(value) {
+    // The bracket is a literal glob metacharacter in this predicate.
+    // eslint-disable-next-line no-useless-escape -- Keep the set as `*`, `?`, or `[`.
+    return /[*?\[]/.test(value);
+}
+function globSegmentMatches(pattern, value) {
+    let expression = "^";
+    for (let index = 0; index < pattern.length; index += 1) {
+        const character = pattern[index] ?? "";
+        if (character === "*")
+            expression += ".*";
+        else if (character === "?")
+            expression += ".";
+        else if (character === "[") {
+            const close = pattern.indexOf("]", index + 1);
+            if (close > index + 1) {
+                let characterClass = pattern.slice(index + 1, close);
+                if (characterClass.startsWith("!"))
+                    characterClass = `^${characterClass.slice(1)}`;
+                expression += `[${characterClass}]`;
+                index = close;
+            }
+            else
+                expression += "\\[";
+        }
+        else
+            expression += character.replace(/[\\^$+?.()|{}]/g, "\\$&");
+    }
+    try {
+        return new RegExp(`${expression}$`).test(value);
+    }
+    catch {
+        return false;
+    }
+}
+function expandBashGlob(token, cwd) {
+    if (!hasGlobPattern(token))
+        return [token];
+    const absolute = token.startsWith(path.sep);
+    const parts = token.split(path.sep).filter((part, index) => !(absolute && index === 0));
+    let candidates = [absolute ? path.sep : ""];
+    let matchedPattern = false;
+    for (const part of parts) {
+        if (!hasGlobPattern(part)) {
+            candidates = candidates.map((parent) => !parent ? part : parent === path.sep ? `${path.sep}${part}` : `${parent}${path.sep}${part}`);
+            continue;
+        }
+        matchedPattern = true;
+        const expanded = [];
+        for (const parent of candidates) {
+            const directory = absolute ? (parent || path.sep) : path.resolve(cwd, parent || ".");
+            let names;
+            try {
+                names = fs.readdirSync(directory).sort();
+            }
+            catch {
+                continue;
+            }
+            for (const name of names) {
+                if (name.startsWith(".") && !part.startsWith("."))
+                    continue;
+                if (!globSegmentMatches(part, name))
+                    continue;
+                expanded.push(!parent ? name : parent === path.sep ? `${path.sep}${name}` : `${parent}${path.sep}${name}`);
+            }
+        }
+        if (expanded.length === 0)
+            return [token];
+        candidates = expanded;
+    }
+    return matchedPattern ? candidates : [token];
+}
+function bashUnquotedWords(facts, cwd) {
+    return facts.join(" ").split(/[\t\n ]+/).filter(Boolean).flatMap((word) => expandBashGlob(word, cwd));
+}
+function commandOnPath(command, env) {
+    const pathValue = env.PATH ?? "";
+    for (const directory of pathValue.split(path.delimiter)) {
+        const candidate = path.join(directory || process.cwd(), command);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            // PATH probes intentionally ignore missing and inaccessible entries.
+        }
+    }
+    return false;
+}
+function jqField(value) {
+    // jq's `// ""` falls through for null and false only.
+    return value === null || value === undefined || value === false ? "" : value;
+}
+function jqText(value) {
+    const selected = jqField(value);
+    if (typeof selected === "string")
+        return selected;
+    if (typeof selected === "boolean")
+        return selected ? "true" : "";
+    if (typeof selected === "number" && Number.isFinite(selected)) {
+        throw new ShellFallbackRequired("numeric jq tostring requires shell serialization");
+    }
+    if (typeof selected === "object") {
+        if (selected === null)
+            return "";
+        throw new ShellFallbackRequired("compound jq tostring requires shell serialization");
+    }
+    return "";
+}
+function nestedField(record, first, second) {
+    const parent = jqField(record[first]);
+    if (parent === "")
+        return "";
+    if (typeof parent !== "object" || parent === null || Array.isArray(parent)) {
+        throw new ShellFallbackRequired(`unexpected ${first} payload shape`);
+    }
+    return jqField(parent[second]);
+}
+function parsePayload(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new ShellFallbackRequired("malformed hook JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new ShellFallbackRequired("unexpected hook payload shape");
+    }
+    const record = parsed;
+    const toolResponse = jqField(record.tool_response);
+    const fields = {
+        tool: jqText(record.tool_name),
+        command: jqText(nestedField(record, "tool_input", "command")),
+        runInBackground: jqText(nestedField(record, "tool_input", "run_in_background")),
+        toolResponse: typeof toolResponse === "string" ? toolResponse : jqText(toolResponse),
+        prompt: jqText(record.prompt),
+        cwd: jqText(record.cwd),
+        sessionId: jqText(record.session_id),
+        transcriptPath: jqText(record.transcript_path),
+    };
+    if (Object.values(fields).some((field) => field.includes("\0"))) {
+        throw new ShellFallbackRequired("NUL-delimited jq fields require shell semantics");
+    }
+    return fields;
+}
+function matchTextFacts(rawText, env) {
+    const text = localeLower(rawText, env);
+    const facts = [];
+    const words = /[a-z][a-z0-9_-]+/g;
+    for (const match of text.matchAll(words))
+        facts.push(match[0]);
+    if (/(^|[^a-z0-9_])aws_profile/.test(text) || /op:\/\/|\.env([^a-z0-9]|$)/.test(text)) {
+        facts.push("secret");
+    }
+    if (/(^|[^a-z0-9_])(main|master|staging|production)([^a-z0-9_]|$)/.test(text) || /release\//.test(text)) {
+        facts.push("shared_branch");
+    }
+    if (/(^|[^a-z0-9])sk-[a-z0-9]/.test(text) ||
+        /(^|[^a-z0-9])(gh[opsur]_|github_pat_)[a-z0-9_]/.test(text) ||
+        /(^|[^a-z0-9])akia[a-z0-9][a-z0-9]/.test(text) ||
+        /(^|[^a-z0-9])xox[bpsa]-[a-z0-9]/.test(text) ||
+        /(^|[^a-z0-9])glpat-[a-z0-9]/.test(text) ||
+        /-----begin[a-z -]*private key/.test(text) ||
+        /(^|[^a-z0-9])bearer [a-z0-9._-][a-z0-9._-][a-z0-9._-]/.test(text)) {
+        facts.push("apikey", "secret");
+    }
+    if (/successfully (merged|deployed|pushed|published|created)/.test(text) ||
+        /(deployment|deploy|build|release) (complete|completed|succeeded|ready)/.test(text) ||
+        /merged pull request/.test(text) ||
+        /pull request #?[0-9]+ [\s\S]* merged/.test(text)) {
+        facts.push("completed");
+    }
+    const filenames = /\.?[a-z0-9_][a-z0-9_./-]*\.[a-z][a-z0-9]+/g;
+    for (const match of text.matchAll(filenames)) {
+        const filename = match[0].slice(match[0].lastIndexOf("/") + 1);
+        const dot = filename.lastIndexOf(".");
+        facts.push(`.${filename.slice(dot + 1)}`, filename);
+    }
+    const slashCommands = / \/[a-z][a-z0-9-]*/g;
+    for (const match of `${" "}${text}`.matchAll(slashCommands)) {
+        facts.push(match[0].slice(1));
+    }
+    return facts;
+}
+function isSharedBranch(branch, env) {
+    const value = localeLower(branch, env);
+    return /(^|[^a-z0-9_])(main|master|staging|production)([^a-z0-9_]|$)/.test(value) || /release\//.test(value);
+}
+function normalizeFacts(facts, branch, cwd, env) {
+    const seen = new Set();
+    const output = [];
+    const expandedText = bashUnquotedWords(facts, cwd).join("\n");
+    const lower = localeLower(expandedText, env);
+    // AWK's [[:space:]] splitter recognizes these bytes after Bash has split and
+    // pathname-expanded the unquoted FACTS parameter expansion.
+    for (const token of lower.split(/[\t\n\v\f\r ]+/).filter(Boolean)) {
+        if (seen.has(token))
+            continue;
+        seen.add(token);
+        output.push(token);
+    }
+    if (isSharedBranch(branch, env) && !seen.has("shared_branch"))
+        output.push("shared_branch");
+    return output.join(" ");
+}
+function companyFromMeta(file) {
+    let contents;
+    try {
+        if (!fs.statSync(file).isFile())
+            return "";
+        contents = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return "";
+    }
+    for (const line of contents.split(/\n/)) {
+        const fields = line.trim().split(/[\t\v\f\r ]+/);
+        if (fields[0] !== "company_slug:")
+            continue;
+        let value = line.replace(/^[^:]+:[\t\n\v\f\r ]*/, "");
+        value = value.replace(/^"|"$/g, "");
+        return value;
+    }
+    return "";
+}
+function resolveCompanyFact(payloadCwd, sessionId, hqRoot, fallbackCwd, env) {
+    let scope = env.HQ_POLICY_COMPANY ?? "";
+    const cwd = payloadCwd || env.CLAUDE_PROJECT_DIR || fallbackCwd;
+    if (!scope) {
+        const marker = cwd.lastIndexOf("companies/");
+        if (marker >= 0)
+            scope = cwd.slice(marker + "companies/".length).split("/")[0] ?? "";
+    }
+    if (!scope && sessionId) {
+        const metaPath = path.join(hqRoot, "workspace", "sessions", sessionId, "meta.yaml");
+        scope = companyFromMeta(metaPath);
+    }
+    return Boolean(scope);
+}
+function readBranch(cwd, env) {
+    const result = spawnSync("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"], {
+        env: { ...process.env, ...env },
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    if (result.error || result.status !== 0)
+        return "";
+    return Buffer.from(result.stdout ?? "").toString("utf8").replace(/\n+$/, "");
+}
+function transcriptAssistantText(transcriptPath) {
+    let stat;
+    let raw;
+    try {
+        stat = fs.statSync(transcriptPath);
+        if (!stat.isFile())
+            return "";
+        if (stat.size > TRANSCRIPT_TAIL_MAX_BYTES + 1) {
+            throw new ShellFallbackRequired("bounded transcript tail requires shell semantics");
+        }
+        raw = fs.readFileSync(transcriptPath);
+    }
+    catch (error) {
+        if (error instanceof ShellFallbackRequired)
+            throw error;
+        throw new ShellFallbackRequired("transcript could not be read exactly");
+    }
+    if (raw.includes(0))
+        throw new ShellFallbackRequired("NUL transcript needs jq semantics");
+    const records = [];
+    for (const line of raw.toString("utf8").split(/\n/)) {
+        if (!line.trim())
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            throw new ShellFallbackRequired("malformed transcript JSON");
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new ShellFallbackRequired("transcript line requires jq object indexing");
+        }
+        const event = parsed;
+        const typeValue = jqField(event.type);
+        const eventType = typeof typeValue === "string" ? typeValue : typeValue === true ? "true" : "";
+        const message = event.message;
+        if (message !== null && message !== undefined && (typeof message !== "object" || Array.isArray(message))) {
+            throw new ShellFallbackRequired("transcript message requires jq object indexing");
+        }
+        let content = message?.content;
+        if (content === null || content === undefined || content === false)
+            content = event.content;
+        let text = "";
+        if (Array.isArray(content)) {
+            const selected = [];
+            for (const item of content) {
+                if (typeof item !== "object" || item === null || Array.isArray(item)) {
+                    throw new ShellFallbackRequired("transcript content item requires jq object indexing");
+                }
+                if (item.type !== "text")
+                    continue;
+                const itemText = item.text;
+                if (itemText === null || itemText === undefined)
+                    selected.push("");
+                else if (typeof itemText === "string")
+                    selected.push(itemText);
+                else
+                    throw new ShellFallbackRequired("transcript content requires jq join semantics");
+            }
+            text = selected.join(" ");
+        }
+        else if (typeof content === "string") {
+            text = content;
+        }
+        if (eventType === "user")
+            records.length = 0;
+        else if (eventType === "assistant") {
+            records.push(...(records.length ? [" "] : []), text);
+        }
+    }
+    return records.join("").replace(/\n+$/, "");
+}
+function computeOutput(options) {
+    const args = [...options.argv];
+    if (args.length === 0 || args.length > 2)
+        throw new ShellFallbackRequired("unsupported argv");
+    const event = args[0] ?? "";
+    const withAssistantIntent = args[1] === "--with-assistant-intent";
+    if (args.length === 2 && !withAssistantIntent)
+        throw new ShellFallbackRequired("unsupported argv");
+    if (!["PreToolUse", "PostToolUse", "UserPromptSubmit", "AssistantIntent"].includes(event)) {
+        throw new ShellFallbackRequired("unsupported event");
+    }
+    const paired = withAssistantIntent && (event === "PreToolUse" || event === "UserPromptSubmit");
+    const env = effectiveEnvironment(options);
+    const jqAvailable = options.jqAvailable ?? commandOnPath("jq", env);
+    let payload = {
+        tool: "", command: "", runInBackground: "", toolResponse: "", prompt: "",
+        cwd: "", sessionId: "", transcriptPath: "",
+    };
+    if (jqAvailable)
+        payload = parsePayload(options.stdin || "{}");
+    const payloadCwd = payload.cwd || env.CLAUDE_PROJECT_DIR || options.hqRoot;
+    const company = resolveCompanyFact(payload.cwd, payload.sessionId, options.hqRoot, options.hqRoot, env);
+    const derive = (kind) => {
+        const facts = ["always"];
+        let branch = "";
+        if (kind === "PreToolUse" || kind === "PostToolUse") {
+            if (payload.tool === "Bash") {
+                if (kind === "PreToolUse") {
+                    facts.push(...matchTextFacts(payload.command, env));
+                    if (payload.runInBackground === "true")
+                        facts.push("run_in_background");
+                }
+                else
+                    facts.push(...matchTextFacts(payload.toolResponse, env));
+            }
+            else if (payload.tool !== "") {
+                if (kind === "PreToolUse")
+                    facts.push(localeLower(payload.tool, env));
+                else
+                    facts.push(...matchTextFacts(payload.toolResponse, env));
+            }
+        }
+        else if (kind === "UserPromptSubmit") {
+            facts.push(...matchTextFacts(payload.prompt, env));
+        }
+        if (company)
+            facts.push("company");
+        if (kind === "AssistantIntent") {
+            if (payload.transcriptPath && jqAvailable) {
+                try {
+                    if (fs.statSync(payload.transcriptPath).isFile()) {
+                        const lookback = transcriptAssistantText(payload.transcriptPath);
+                        if (lookback)
+                            facts.push(...matchTextFacts(lookback, env));
+                    }
+                }
+                catch (error) {
+                    if (error instanceof ShellFallbackRequired)
+                        throw error;
+                    // The shell checks -f before invoking jq; missing files add no facts.
+                }
+            }
+        }
+        else {
+            if (payloadCwd.includes("repos/public/") || payloadCwd.includes("repos/private/"))
+                facts.push("repo");
+            branch = options.gitBranch ?? readBranch(payloadCwd, env);
+        }
+        return normalizeFacts(facts, branch, options.cwd, env);
+    };
+    const primary = derive(event);
+    return paired ? `${primary}\n${derive("AssistantIntent")}\n` : `${primary}\n`;
+}
+function shellFallback(options) {
+    const env = { ...process.env, ...(options.env ?? {}) };
+    delete env.HQ_ROOT;
+    delete env.CLAUDE_PROJECT_DIR;
+    const result = runBundledScript({
+        asset: DERIVE_TRIGGER_FACTS_ASSET,
+        args: [...options.argv],
+        cwd: options.hqRoot,
+        hqRoot: options.hqRoot,
+        stdin: options.stdin,
+        captureOutput: true,
+        env,
+    });
+    return {
+        code: result.code,
+        stdout: result.stdout ?? Buffer.alloc(0),
+        stderr: result.stderr ?? Buffer.alloc(0),
+    };
+}
+function missingSupportLibrary(hqRoot) {
+    const required = [
+        [
+            "core/scripts/lib/trigger-fact-text.awk",
+            "ERROR: derive-trigger-facts: missing core/scripts/lib/trigger-fact-text.awk",
+        ],
+        [
+            "core/scripts/lib/transcript-tail.sh",
+            "ERROR: derive-trigger-facts: missing core/scripts/lib/transcript-tail.sh",
+        ],
+    ];
+    for (const [relativePath, message] of required) {
+        try {
+            fs.accessSync(path.join(hqRoot, relativePath), fs.constants.R_OK);
+        }
+        catch {
+            return message;
+        }
+    }
+    return undefined;
+}
+/** Run the native handler contract, retaining exact bytes for differential tests. */
+export function runDeriveTriggerFacts(options) {
+    const missingLibrary = missingSupportLibrary(options.hqRoot);
+    if (missingLibrary) {
+        return {
+            code: 1,
+            stdout: Buffer.alloc(0),
+            stderr: Buffer.from(`${missingLibrary}\n`),
+        };
+    }
+    try {
+        return { code: 0, stdout: Buffer.from(computeOutput(options)), stderr: Buffer.alloc(0) };
+    }
+    catch (error) {
+        if (!(error instanceof ShellFallbackRequired))
+            throw error;
+        return shellFallback(options);
+    }
+}
+export function runDeriveTriggerFactsFast(argv, stdin, cwd, hqRoot) {
+    const result = runDeriveTriggerFacts({ argv, stdin, cwd, hqRoot: hqRoot ?? cwd });
+    if (result.stdout.length)
+        process.stdout.write(result.stdout);
+    if (result.stderr.length)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-derive-trigger-facts-native.js.map

package/dist/commands/core.js

@@ -46,6 +46,8 @@ import { registerCorePinNative } from "./core-pin-native.js";
 import { registerCoreRefreshVaultAccessNative } from "./core-refresh-vault-access-native.js";
 import { registerCoreWorkMeshBindTrustedNative } from "./core-work-mesh-bind-trusted-native.js";
 import { registerCoreHookHelperNativeCommands } from "./core-native-hook-helper-commands.js";
+import { registerCoreDeriveTriggerFactsCommand } from "./core-derive-trigger-facts-command.js";
+import { DERIVE_TRIGGER_FACTS_ASSET } from "./core-derive-trigger-facts-native.js";
 import { registerCoreHookStateHelpers } from "./core-hook-state-helpers-native.js";
 import { registerCoreHookBatchCommand } from "./core-hook-batch-command.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
@@ -253,6 +255,9 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
     { asset: "core/scripts/lib/work-mesh-live-hook.sh", root: "live", summary: "Work Mesh Live hook helpers sourced by rebind" },
     { asset: "core/scripts/lib/work-mesh-live-rebind.sh", root: "live", summary: "Work Mesh Live session rebind library sourced by hooks and the native rollback command" },
+    { asset: DERIVE_TRIGGER_FACTS_ASSET, root: "live", summary: "Rollback companion for native derive-trigger-facts" },
+    { asset: "core/scripts/lib/trigger-fact-text.awk", root: "live", summary: "Shared trigger fact tokenizer used by hooks" },
+    { asset: "core/scripts/lib/transcript-tail.sh", root: "live", summary: "Bounded transcript reader used by trigger helper rollback" },
     // Wave 2 handoff/worktree commands retain their old scripts for one release,
     // behind the shared default-off rollback flag.
     { asset: WORKTREE_GC_ASSET, root: "live", summary: "Rollback companion for native worktree-gc" },
@@ -397,6 +402,7 @@ export function registerCoreCommands(program) {
     registerCoreDmBindNative(core);
     registerCoreWorkMeshBindTrustedNative(core);
     registerCoreHookHelperNativeCommands(core);
+    registerCoreDeriveTriggerFactsCommand(core);
     registerCoreHookStateHelpers(core);
     registerCoreHookBatchCommand(core);
     const sessionHelperCommands = [

package/dist/commands/daemon.js

@@ -31,6 +31,7 @@ import { processCommandLine } from "../lib/daemon/lock.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
+import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 class DaemonCommandError extends Error {
 }
@@ -766,6 +767,37 @@ export function registerDaemonCommand(program, over = {}) {
             hqBinary: d.hqBinary,
         });
     }));
+    daemon
+        .command("call <op>")
+        .description("Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON")
+        .option("--json <args>", "Request args as a JSON object", "{}")
+        .option("--timeout <ms>", "Give up after this many milliseconds")
+        .action(wrap(async (d, op, opts) => {
+        requireAnywhereRuntime();
+        let args;
+        try {
+            args = JSON.parse(opts.json);
+        }
+        catch {
+            throw new Error("--json must be valid JSON");
+        }
+        if (!args || typeof args !== "object" || Array.isArray(args))
+            throw new Error("--json must be a JSON object");
+        const timeoutMs = Number(opts.timeout ?? (op === "policy.check" ? "40000" : "20000"));
+        if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+            throw new Error("--timeout must be a positive number of milliseconds");
+        const { hqdRequest, hqdSocketPath, HqdClientError } = await import("../lib/daemon/protocol.js");
+        try {
+            const result = await hqdRequest(op, args, { socketPath: hqdSocketPath(d.home, d.env), timeoutMs });
+            d.out(JSON.stringify(result, null, 2));
+        }
+        catch (err) {
+            if (!(err instanceof HqdClientError))
+                throw err;
+            d.out(JSON.stringify({ error: { code: err.code, message: err.message } }, null, 2));
+            process.exitCode = 1;
+        }
+    }));
     daemon
         .command("status")
         .description("Show the machine type and each service's state")
@@ -828,8 +860,13 @@ export function registerDaemonCommand(program, over = {}) {
         .action(wrap((d, unit, opts) => runLogs(d, unit, opts)));
     daemon
         .command("restart [unit]")
-        .description("Restart one service, or every running service")
-        .action(wrap(async (d, unit) => queueRequest(d, unit ? { action: "restart", unit } : { action: "restart" }, unit ? `restart ${unit}` : "restart all services")));
+        .description("Restart one service, every service, or the daemon process")
+        .option("--daemon", "Restart the supervisor process itself")
+        .action(wrap(async (d, unit, opts) => {
+        if (opts.daemon && unit)
+            throw new DaemonCommandError("--daemon cannot be combined with a service name");
+        return queueRequest(d, opts.daemon ? { action: "restart-daemon" } : unit ? { action: "restart", unit } : { action: "restart" }, opts.daemon ? "restart daemon" : unit ? `restart ${unit}` : "restart all services");
+    }));
     daemon
         .command("trigger <unit>")
         .description("Run a scheduled service now (for example search-index)")

package/dist/commands/db-provision.js

@@ -65,7 +65,12 @@ export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
                 throw error;
             const msg = error instanceof Error ? error.message : "Unknown error";
             const status = error.status;
-            if (status === 402 || /PLAN_REQUIRED|Team plan|Workforce|\$500/i.test(msg)) {
+            const code = error.code;
+            if (code === "REMOTE_DB_NOT_AVAILABLE" || status === 501) {
+                console.error(chalk.red("Error:"), "Remote databases are not available yet.");
+                console.error(chalk.dim("Local hq db status|sql|migrate still work offline."));
+            }
+            else if (status === 402 || /PLAN_REQUIRED|Team plan|Workforce|\$500/i.test(msg)) {
                 console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Workforce plan ($500/mo).");
                 console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no HQ Workforce plan required."));
             }

package/dist/commands/doctor.js

@@ -37,6 +37,7 @@ import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
 import { runSideEffectTests } from "../lib/doctor/deep/sandbox.js";
+import { anywhereRuntimeEnabled } from "./anywhere-runtime-flag.js";
 /**
  * Marker directories that identify an HQ tree root. A directory is an HQ root
  * only when it contains ALL of these. `.claude` + `core` are present in both
@@ -90,7 +91,8 @@ export async function runDoctor(options = {}) {
     const write = options.stdout ?? ((chunk) => void process.stdout.write(chunk));
     const writeErr = options.stderr ?? ((chunk) => void process.stderr.write(chunk));
     const hqRoot = options.root ?? resolveHqRoot(options.cwd);
-    if (!hqRoot) {
+    const standaloneAnywhere = !hqRoot && options.only?.length === 1 && options.only[0] === "anywhere" && anywhereRuntimeEnabled();
+    if (!hqRoot && !standaloneAnywhere) {
         const from = options.cwd ?? process.cwd();
         writeErr(`hq doctor: not inside an HQ tree.\n` +
             `  Searched upward from: ${from}\n` +
@@ -121,7 +123,9 @@ export async function runDoctor(options = {}) {
     // The detected platform and the session id are exposed to every check so the
     // host-specific runtime probe (US-006) can decide UNKNOWN vs FAIL vs UNTESTED.
     const context = {
-        hqRoot,
+        // Anywhere checks inspect ~/.hq and are intentionally runnable from a foreign
+        // repo. No other family is selected in this standalone path.
+        hqRoot: hqRoot ?? "",
         platform: { id: platform.id, evidence: platform.evidence },
         sessionId: options.sessionId,
         liveRuntimes: options.liveRuntimes === true,
@@ -166,7 +170,7 @@ export async function runDoctor(options = {}) {
             ? await resolveClientHealthReasonCodesCheckIds(families, options.resolveClientHealthReasonCodesForCompany)
             : undefined;
         write(renderJson(buildDoctorJson({
-            hqRoot,
+            hqRoot: hqRoot ?? "",
             families,
             platform,
             scope,
@@ -175,7 +179,7 @@ export async function runDoctor(options = {}) {
     }
     else {
         write(renderText({
-            hqRoot,
+            hqRoot: hqRoot ?? "",
             families,
             platform,
             verbose: options.verbose ?? false,

package/dist/commands/feedback.d.ts

@@ -2,6 +2,8 @@ import { Command } from "commander";
 import { type DiagnosticsBlob } from "../utils/feedback-diagnostics.js";
 import { collectFeedbackLogs, feedbackLogsEnabled } from "../utils/feedback-logs.js";
 import { type LogBundleRef } from "../utils/feedback-log-bundle.js";
+export declare const FEEDBACK_LATEST_VERSION_FLAG = "feedback.latest-version";
+export declare const FEEDBACK_LATEST_VERSION_FLAG_FALLBACK = false;
 export declare const BODY_MAX_BYTES: number;
 /** Validate fields that must be valid before feedback attachments are uploaded. */
 export declare function validateFeedbackContent(title: string, body: string): void;