@indigoai-us/hq-cli 5.323.0 → 5.324.0

package/CHANGELOG.md

@@ -2,8 +2,15 @@
 
 ## [Unreleased]
 
-## [5.323.0] — 2026-10-02
+## [5.324.0] — 2026-10-02
+- Keep the bundled shell runner out of native fast-route startup and defer timeout-guard flag snapshot imports until a timeout would block.
+- Reuse the parsed fast-route entry when dispatching the selected command.
 - Add native `hq core derive-trigger-facts` on the fast route behind the default-off `core-native-hook-helpers` flag.
+- Feedback reports can include the current cached hq-cli release when the default-off `feedback.latest-version` flag is enabled.
+- Added flag-gated global Anywhere installation, company linking, and hqd daemon commands.
+- Added flag-gated Anywhere daemon operations, doctor checks, and update convergence.
+- `hq-auth-refresh` accepts `--min-validity-seconds` or `HQ_AUTH_MIN_VALIDITY_SECONDS`; values above 1800 seconds use the resolver's 1800-second cache margin.
+- `hq db provision` now says remote databases are not available yet, instead of printing the server adapter error.
 
 ## [5.322.0] — 2026-10-02
 - Add an opt-in, default-off CLI prompt for solo companies to invite a teammate after a work-bearing sync.

package/dist/bin/hq-auth-refresh.d.ts

@@ -14,6 +14,10 @@ import "../node-preflight.js";
 import { acquireCurrentPackageUseLease } from "../utils/package-use-lease.js";
 import "../node-network-compat.js";
 import type { refreshCachedSession } from "../utils/cognito-session.js";
-export declare function runAuthRefresh(refreshSession?: typeof refreshCachedSession): Promise<number>;
+type RefreshSession = (options?: {
+    minValiditySeconds?: number;
+}) => ReturnType<typeof refreshCachedSession>;
+export declare function runAuthRefresh(refreshSession?: RefreshSession): Promise<number>;
 export declare function startAuthRefresh(acquireLease?: typeof acquireCurrentPackageUseLease): Promise<number>;
+export {};
 //# sourceMappingURL=hq-auth-refresh.d.ts.map

package/dist/bin/hq-auth-refresh.js

@@ -17,12 +17,44 @@ import { acquireCurrentPackageUseLease } from "../utils/package-use-lease.js";
 import "../node-network-compat.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
+const MIN_VALIDITY_FLAG = "--min-validity-seconds";
+function parseMinimumValiditySeconds(argv, env) {
+    let raw;
+    let fromFlag = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg === MIN_VALIDITY_FLAG) {
+            raw = argv[index + 1];
+            fromFlag = true;
+            if (!raw || raw.startsWith("--")) {
+                throw new Error(`${MIN_VALIDITY_FLAG} requires a non-negative integer`);
+            }
+            break;
+        }
+        if (arg.startsWith(`${MIN_VALIDITY_FLAG}=`)) {
+            raw = arg.slice(MIN_VALIDITY_FLAG.length + 1);
+            fromFlag = true;
+            break;
+        }
+    }
+    if (!fromFlag)
+        raw = env.HQ_AUTH_MIN_VALIDITY_SECONDS || undefined;
+    if (raw === undefined)
+        return undefined;
+    const value = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isSafeInteger(value)) {
+        throw new Error("minimum token validity must be a non-negative integer");
+    }
+    // Values above the provider's cache margin are clamped by cognito-session.
+    return value;
+}
 export async function runAuthRefresh(refreshSession) {
     const { finishSentrySession, Sentry } = await import("../sentry.js");
     const { refreshCachedSession: refresh } = await import("../utils/cognito-session.js");
     let exitCode = 1;
     try {
-        const result = await (refreshSession ?? refresh)();
+        const minValiditySeconds = parseMinimumValiditySeconds(process.argv.slice(2), process.env);
+        const result = await (refreshSession ?? refresh)(minValiditySeconds === undefined ? {} : { minValiditySeconds });
         if (result.refreshed) {
             exitCode = 0;
         }

package/dist/command-catalog.generated.d.ts

@@ -96,10 +96,10 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly description: "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.";
         readonly aliases: readonly [];
         readonly hidden: false;
-        readonly usage: "[options] <source>";
+        readonly usage: "[options] [source]";
         readonly arguments: readonly [{
             readonly name: "source";
-            readonly required: true;
+            readonly required: false;
             readonly variadic: false;
         }];
         readonly options: readonly [{
@@ -114,6 +114,18 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--branch";
             readonly description: "Follow a ref instead of SHA-pinning (git content-pack flow)";
+        }, {
+            readonly flags: "--global";
+            readonly description: "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)";
+        }, {
+            readonly flags: "--runtime <runtime>";
+            readonly description: "Runtime for --global (claude | codex)";
+        }, {
+            readonly flags: "--dry-run";
+            readonly description: "With --global: print every file and config diff without writing";
+        }, {
+            readonly flags: "--hq-root <dir>";
+            readonly description: "With --global: HQ checkout to install from (default: walk up from cwd)";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -368,10 +380,10 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly description: "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.";
     readonly aliases: readonly [];
     readonly hidden: false;
-    readonly usage: "[options] <source>";
+    readonly usage: "[options] [source]";
     readonly arguments: readonly [{
         readonly name: "source";
-        readonly required: true;
+        readonly required: false;
         readonly variadic: false;
     }];
     readonly options: readonly [{
@@ -386,6 +398,18 @@ export declare const COMMAND_CATALOG: readonly [{
     }, {
         readonly flags: "--branch";
         readonly description: "Follow a ref instead of SHA-pinning (git content-pack flow)";
+    }, {
+        readonly flags: "--global";
+        readonly description: "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)";
+    }, {
+        readonly flags: "--runtime <runtime>";
+        readonly description: "Runtime for --global (claude | codex)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "With --global: print every file and config diff without writing";
+    }, {
+        readonly flags: "--hq-root <dir>";
+        readonly description: "With --global: HQ checkout to install from (default: walk up from cwd)";
     }];
     readonly subcommands: readonly [];
 }, {
@@ -839,6 +863,79 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly description: "Also report this company's workspace plan state (Starter nag)";
     }];
     readonly subcommands: readonly [];
+}, {
+    readonly name: "link";
+    readonly description: "Link this folder (or its git remote) to an HQ company";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options] [company]";
+    readonly arguments: readonly [{
+        readonly name: "company";
+        readonly required: false;
+        readonly variadic: false;
+    }];
+    readonly options: readonly [{
+        readonly flags: "--path <dir>";
+        readonly description: "Folder to link (default: current directory)";
+    }, {
+        readonly flags: "--list";
+        readonly description: "Print every linked folder";
+    }, {
+        readonly flags: "--json";
+        readonly description: "Print JSON output";
+    }, {
+        readonly flags: "--seed-manifest <hqRoot>";
+        readonly description: "Seed entries from an HQ companies/manifest.yaml";
+    }];
+    readonly subcommands: readonly [];
+}, {
+    readonly name: "unlink";
+    readonly description: "Remove the HQ company link for this folder";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options]";
+    readonly arguments: readonly [];
+    readonly options: readonly [{
+        readonly flags: "--path <dir>";
+        readonly description: "Folder to unlink (default: current directory)";
+    }];
+    readonly subcommands: readonly [];
+}, {
+    readonly name: "uninstall";
+    readonly description: "Remove the HQ global install from an agent runtime (use with --global)";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options]";
+    readonly arguments: readonly [];
+    readonly options: readonly [{
+        readonly flags: "--global";
+        readonly description: "Reverse `hq install --global`";
+    }, {
+        readonly flags: "--runtime <runtime>";
+        readonly description: "Runtime to uninstall from (claude | codex)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "Print what would change without writing";
+    }, {
+        readonly flags: "--hq-root <dir>";
+        readonly description: "HQ checkout (only needed when install state is missing)";
+    }];
+    readonly subcommands: readonly [];
+}, {
+    readonly name: "resolve-company";
+    readonly description: "Print the HQ company linked to this folder (never guesses)";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options]";
+    readonly arguments: readonly [];
+    readonly options: readonly [{
+        readonly flags: "--path <dir>";
+        readonly description: "Folder to resolve (default: current directory)";
+    }, {
+        readonly flags: "--json";
+        readonly description: "Print JSON output";
+    }];
+    readonly subcommands: readonly [];
 }, {
     readonly name: "version";
     readonly description: "Show HQ, CLI, and latest hq-core versions";
@@ -9828,6 +9925,25 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Run as a child of this app (only \"desktop\"), which has handed sync over to the daemon";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "call";
+        readonly description: "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <op>";
+        readonly arguments: readonly [{
+            readonly name: "op";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json <args>";
+            readonly description: "Request args as a JSON object";
+        }, {
+            readonly flags: "--timeout <ms>";
+            readonly description: "Give up after this many milliseconds";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "status";
         readonly description: "Show the machine type and each service's state";
@@ -10000,7 +10116,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "restart";
-        readonly description: "Restart one service, or every running service";
+        readonly description: "Restart one service, every service, or the daemon process";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] [unit]";
@@ -10009,7 +10125,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly required: false;
             readonly variadic: false;
         }];
-        readonly options: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--daemon";
+            readonly description: "Restart the supervisor process itself";
+        }];
         readonly subcommands: readonly [];
     }, {
         readonly name: "trigger";

package/dist/command-catalog.generated.js

@@ -101,11 +101,11 @@ export const COMMAND_CATALOG = [
                 "description": "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.",
                 "aliases": [],
                 "hidden": false,
-                "usage": "[options] <source>",
+                "usage": "[options] [source]",
                 "arguments": [
                     {
                         "name": "source",
-                        "required": true,
+                        "required": false,
                         "variadic": false
                     }
                 ],
@@ -125,6 +125,22 @@ export const COMMAND_CATALOG = [
                     {
                         "flags": "--branch",
                         "description": "Follow a ref instead of SHA-pinning (git content-pack flow)"
+                    },
+                    {
+                        "flags": "--global",
+                        "description": "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)"
+                    },
+                    {
+                        "flags": "--runtime <runtime>",
+                        "description": "Runtime for --global (claude | codex)"
+                    },
+                    {
+                        "flags": "--dry-run",
+                        "description": "With --global: print every file and config diff without writing"
+                    },
+                    {
+                        "flags": "--hq-root <dir>",
+                        "description": "With --global: HQ checkout to install from (default: walk up from cwd)"
                     }
                 ],
                 "subcommands": []
@@ -465,11 +481,11 @@ export const COMMAND_CATALOG = [
         "description": "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.",
         "aliases": [],
         "hidden": false,
-        "usage": "[options] <source>",
+        "usage": "[options] [source]",
         "arguments": [
             {
                 "name": "source",
-                "required": true,
+                "required": false,
                 "variadic": false
             }
         ],
@@ -489,6 +505,22 @@ export const COMMAND_CATALOG = [
             {
                 "flags": "--branch",
                 "description": "Follow a ref instead of SHA-pinning (git content-pack flow)"
+            },
+            {
+                "flags": "--global",
+                "description": "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)"
+            },
+            {
+                "flags": "--runtime <runtime>",
+                "description": "Runtime for --global (claude | codex)"
+            },
+            {
+                "flags": "--dry-run",
+                "description": "With --global: print every file and config diff without writing"
+            },
+            {
+                "flags": "--hq-root <dir>",
+                "description": "With --global: HQ checkout to install from (default: walk up from cwd)"
             }
         ],
         "subcommands": []
@@ -1073,6 +1105,100 @@ export const COMMAND_CATALOG = [
         ],
         "subcommands": []
     },
+    {
+        "name": "link",
+        "description": "Link this folder (or its git remote) to an HQ company",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options] [company]",
+        "arguments": [
+            {
+                "name": "company",
+                "required": false,
+                "variadic": false
+            }
+        ],
+        "options": [
+            {
+                "flags": "--path <dir>",
+                "description": "Folder to link (default: current directory)"
+            },
+            {
+                "flags": "--list",
+                "description": "Print every linked folder"
+            },
+            {
+                "flags": "--json",
+                "description": "Print JSON output"
+            },
+            {
+                "flags": "--seed-manifest <hqRoot>",
+                "description": "Seed entries from an HQ companies/manifest.yaml"
+            }
+        ],
+        "subcommands": []
+    },
+    {
+        "name": "unlink",
+        "description": "Remove the HQ company link for this folder",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options]",
+        "arguments": [],
+        "options": [
+            {
+                "flags": "--path <dir>",
+                "description": "Folder to unlink (default: current directory)"
+            }
+        ],
+        "subcommands": []
+    },
+    {
+        "name": "uninstall",
+        "description": "Remove the HQ global install from an agent runtime (use with --global)",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options]",
+        "arguments": [],
+        "options": [
+            {
+                "flags": "--global",
+                "description": "Reverse `hq install --global`"
+            },
+            {
+                "flags": "--runtime <runtime>",
+                "description": "Runtime to uninstall from (claude | codex)"
+            },
+            {
+                "flags": "--dry-run",
+                "description": "Print what would change without writing"
+            },
+            {
+                "flags": "--hq-root <dir>",
+                "description": "HQ checkout (only needed when install state is missing)"
+            }
+        ],
+        "subcommands": []
+    },
+    {
+        "name": "resolve-company",
+        "description": "Print the HQ company linked to this folder (never guesses)",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options]",
+        "arguments": [],
+        "options": [
+            {
+                "flags": "--path <dir>",
+                "description": "Folder to resolve (default: current directory)"
+            },
+            {
+                "flags": "--json",
+                "description": "Print JSON output"
+            }
+        ],
+        "subcommands": []
+    },
     {
         "name": "version",
         "description": "Show HQ, CLI, and latest hq-core versions",
@@ -12661,6 +12787,31 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "call",
+                "description": "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <op>",
+                "arguments": [
+                    {
+                        "name": "op",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json <args>",
+                        "description": "Request args as a JSON object"
+                    },
+                    {
+                        "flags": "--timeout <ms>",
+                        "description": "Give up after this many milliseconds"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "status",
                 "description": "Show the machine type and each service's state",
@@ -12879,7 +13030,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "restart",
-                "description": "Restart one service, or every running service",
+                "description": "Restart one service, every service, or the daemon process",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] [unit]",
@@ -12890,7 +13041,12 @@ export const COMMAND_CATALOG = [
                         "variadic": false
                     }
                 ],
-                "options": [],
+                "options": [
+                    {
+                        "flags": "--daemon",
+                        "description": "Restart the supervisor process itself"
+                    }
+                ],
                 "subcommands": []
             },
             {

package/dist/command-registration-plan.d.ts

@@ -177,6 +177,30 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/whoami.js";
     readonly exportName: "registerWhoamiCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "link";
+    readonly parent: "program";
+    readonly module: "./commands/link.js";
+    readonly exportName: "registerLinkCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "unlink";
+    readonly parent: "program";
+    readonly module: "./commands/link.js";
+    readonly exportName: "registerUnlinkCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "uninstall";
+    readonly parent: "program";
+    readonly module: "./commands/install-global.js";
+    readonly exportName: "registerUninstallCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "resolve-company";
+    readonly parent: "program";
+    readonly module: "./commands/link.js";
+    readonly exportName: "registerResolveCompanyCommand";
 }, {
     readonly type: "registrar";
     readonly root: "version";

package/dist/command-registration-plan.js

@@ -32,6 +32,10 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "login", parent: "program", module: "./commands/login.js", exportName: "registerLoginCommand" },
     { type: "registrar", root: "logout", parent: "program", module: "./commands/logout.js", exportName: "registerLogoutCommand" },
     { type: "registrar", root: "whoami", parent: "program", module: "./commands/whoami.js", exportName: "registerWhoamiCommand" },
+    { type: "registrar", root: "link", parent: "program", module: "./commands/link.js", exportName: "registerLinkCommand" },
+    { type: "registrar", root: "unlink", parent: "program", module: "./commands/link.js", exportName: "registerUnlinkCommand" },
+    { type: "registrar", root: "uninstall", parent: "program", module: "./commands/install-global.js", exportName: "registerUninstallCommand" },
+    { type: "registrar", root: "resolve-company", parent: "program", module: "./commands/link.js", exportName: "registerResolveCompanyCommand" },
     { type: "registrar", root: "version", parent: "program", module: "./commands/version.js", exportName: "registerVersionCommand" },
     { type: "registrar", root: "auth", parent: "program", module: "./commands/auth.js", exportName: "registerAuthCommands" },
     { type: "registrar", root: "secrets", parent: "program", module: "./commands/secrets.js", exportName: "registerSecretsCommand" },

package/dist/commands/anywhere-runtime-flag.d.ts

@@ -0,0 +1,9 @@
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+export declare const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+export declare class AnywhereRuntimeDisabledError extends Error {
+    readonly expected: true;
+    constructor();
+}
+export declare function anywhereRuntimeEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function requireAnywhereRuntime(): void;
+//# sourceMappingURL=anywhere-runtime-flag.d.ts.map

package/dist/commands/anywhere-runtime-flag.js

@@ -0,0 +1,22 @@
+import { resolveFlagGate, resolveProcessFlagGate } from "../lib/flag-registry.js";
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+export const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+export class AnywhereRuntimeDisabledError extends Error {
+    expected = true;
+    constructor() {
+        super("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use this command.");
+        this.name = "AnywhereRuntimeDisabledError";
+    }
+}
+export function anywhereRuntimeEnabled(env = process.env) {
+    const fallback = () => false;
+    const lookup = { fallback: false };
+    return env === process.env
+        ? resolveProcessFlagGate(HQ_ANYWHERE_RUNTIME_FLAG, lookup, fallback)
+        : resolveFlagGate(undefined, HQ_ANYWHERE_RUNTIME_FLAG, lookup, fallback, env);
+}
+export function requireAnywhereRuntime() {
+    if (!anywhereRuntimeEnabled())
+        throw new AnywhereRuntimeDisabledError();
+}
+//# sourceMappingURL=anywhere-runtime-flag.js.map

package/dist/commands/daemon.js

@@ -31,6 +31,7 @@ import { processCommandLine } from "../lib/daemon/lock.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
+import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 class DaemonCommandError extends Error {
 }
@@ -766,6 +767,37 @@ export function registerDaemonCommand(program, over = {}) {
             hqBinary: d.hqBinary,
         });
     }));
+    daemon
+        .command("call <op>")
+        .description("Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON")
+        .option("--json <args>", "Request args as a JSON object", "{}")
+        .option("--timeout <ms>", "Give up after this many milliseconds")
+        .action(wrap(async (d, op, opts) => {
+        requireAnywhereRuntime();
+        let args;
+        try {
+            args = JSON.parse(opts.json);
+        }
+        catch {
+            throw new Error("--json must be valid JSON");
+        }
+        if (!args || typeof args !== "object" || Array.isArray(args))
+            throw new Error("--json must be a JSON object");
+        const timeoutMs = Number(opts.timeout ?? (op === "policy.check" ? "40000" : "20000"));
+        if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+            throw new Error("--timeout must be a positive number of milliseconds");
+        const { hqdRequest, hqdSocketPath, HqdClientError } = await import("../lib/daemon/protocol.js");
+        try {
+            const result = await hqdRequest(op, args, { socketPath: hqdSocketPath(d.home, d.env), timeoutMs });
+            d.out(JSON.stringify(result, null, 2));
+        }
+        catch (err) {
+            if (!(err instanceof HqdClientError))
+                throw err;
+            d.out(JSON.stringify({ error: { code: err.code, message: err.message } }, null, 2));
+            process.exitCode = 1;
+        }
+    }));
     daemon
         .command("status")
         .description("Show the machine type and each service's state")
@@ -828,8 +860,13 @@ export function registerDaemonCommand(program, over = {}) {
         .action(wrap((d, unit, opts) => runLogs(d, unit, opts)));
     daemon
         .command("restart [unit]")
-        .description("Restart one service, or every running service")
-        .action(wrap(async (d, unit) => queueRequest(d, unit ? { action: "restart", unit } : { action: "restart" }, unit ? `restart ${unit}` : "restart all services")));
+        .description("Restart one service, every service, or the daemon process")
+        .option("--daemon", "Restart the supervisor process itself")
+        .action(wrap(async (d, unit, opts) => {
+        if (opts.daemon && unit)
+            throw new DaemonCommandError("--daemon cannot be combined with a service name");
+        return queueRequest(d, opts.daemon ? { action: "restart-daemon" } : unit ? { action: "restart", unit } : { action: "restart" }, opts.daemon ? "restart daemon" : unit ? `restart ${unit}` : "restart all services");
+    }));
     daemon
         .command("trigger <unit>")
         .description("Run a scheduled service now (for example search-index)")

package/dist/commands/db-provision.js

@@ -65,7 +65,12 @@ export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
                 throw error;
             const msg = error instanceof Error ? error.message : "Unknown error";
             const status = error.status;
-            if (status === 402 || /PLAN_REQUIRED|Team plan|Workforce|\$500/i.test(msg)) {
+            const code = error.code;
+            if (code === "REMOTE_DB_NOT_AVAILABLE" || status === 501) {
+                console.error(chalk.red("Error:"), "Remote databases are not available yet.");
+                console.error(chalk.dim("Local hq db status|sql|migrate still work offline."));
+            }
+            else if (status === 402 || /PLAN_REQUIRED|Team plan|Workforce|\$500/i.test(msg)) {
                 console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Workforce plan ($500/mo).");
                 console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no HQ Workforce plan required."));
             }