@indigoai-us/hq-cli 5.324.0 → 5.326.0

package/dist/commands/mcp-serve.js

@@ -0,0 +1,165 @@
+/**
+ * `hq mcp serve` (hq-anywhere US-011): a stdio MCP server that forwards every
+ * tool call to hqd over its socket.
+ *
+ * It keeps no state between requests, so an orphaned instance costs nothing
+ * (policy mcp-process-cleanup). src/index.ts routes `hq mcp serve` straight to
+ * {@link runMcpServe} without loading the command graph, which keeps start-up
+ * under 100ms. The MCP SDK is not loaded either: the stdio transport is
+ * newline-delimited JSON-RPC 2.0 and is handled here directly.
+ *
+ * When hqd is unreachable every tool call returns an isError result naming
+ * `hq daemon status`, and the server keeps running.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { CLI_VERSION } from "../cli-version.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag.js";
+import { anywhereRuntimeEnabledFromSnapshot } from "../lib/anywhere-runtime-fast-flag.js";
+import { createLineSplitter, HqdClientError, hqdRequest, hqdSocketPath } from "../lib/daemon/protocol.js";
+export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+const UNREACHABLE_CODES = new Set(["ENOENT", "ECONNREFUSED", "ECONNRESET", "EPIPE", "ETIMEDOUT", "ESOCKET", "EACCES"]);
+/** HQ root for prompts: HQ_ROOT, else the ~/.hq/root pointer written by `hq install --global`. */
+export function readHqRoot(env, home) {
+    const fromEnv = env.HQ_ROOT?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
+    try {
+        return fs.readFileSync(path.join(dir, "root"), "utf8").trim() || null;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+function toolError(code, message) {
+    const error = { code, message };
+    return { content: [{ type: "text", text: JSON.stringify({ error }, null, 2) }], structuredContent: { error }, isError: true };
+}
+/** Run the server until input ends. Resolves when stdin closes. */
+export function runMcpServe(opts = {}) {
+    const input = opts.input ?? process.stdin;
+    const output = opts.output ?? process.stdout;
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? os.homedir();
+    const cwd = opts.cwd ?? process.cwd();
+    const socketPath = hqdSocketPath(home, env);
+    const timeoutMs = opts.timeoutMs ?? 120_000;
+    if (!anywhereRuntimeEnabledFromSnapshot(env)) {
+        process.stderr.write(`HQ Anywhere is not enabled. Enable the ${HQ_ANYWHERE_RUNTIME_FLAG} flag to use hq mcp serve.\n`);
+        process.exitCode = 1;
+        return Promise.resolve();
+    }
+    const send = (msg) => output.write(`${JSON.stringify({ jsonrpc: "2.0", ...msg })}\n`);
+    const reply = (id, result) => send({ id, result });
+    const replyError = (id, code, message) => send({ id, error: { code, message } });
+    const callTool = async (params) => {
+        const { MCP_TOOLS } = await import("../lib/mcp/tools.js");
+        const name = params.name;
+        if (typeof name !== "string" || !MCP_TOOLS.some((t) => t.name === name)) {
+            return toolError("unknown_tool", `unknown tool ${String(name)}`);
+        }
+        const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
+        try {
+            return await hqdRequest("mcp.call", { name, arguments: args, cwd, timeoutMs }, { socketPath, timeoutMs });
+        }
+        catch (err) {
+            if (!(err instanceof HqdClientError))
+                throw err;
+            if (UNREACHABLE_CODES.has(err.code)) {
+                return toolError("hqd_unreachable", `The HQ daemon (hqd) is not reachable at ${socketPath}. Run \`hq daemon status\` to check it, and \`hq daemon install\` if it is not installed. (${err.code})`);
+            }
+            return toolError(err.code, err.message);
+        }
+    };
+    const handle = async (msg) => {
+        const isRequest = msg.id !== undefined && msg.id !== null;
+        const id = msg.id ?? null;
+        const params = msg.params ?? {};
+        switch (msg.method) {
+            case "initialize": {
+                const requested = typeof params.protocolVersion === "string" ? params.protocolVersion : "";
+                const protocolVersion = MCP_PROTOCOL_VERSIONS.includes(requested) ? requested : MCP_PROTOCOL_VERSIONS[0];
+                reply(id, {
+                    protocolVersion,
+                    capabilities: { tools: { listChanged: false }, prompts: { listChanged: false } },
+                    serverInfo: { name: "hq", version: CLI_VERSION },
+                    instructions: "HQ tools, answered by the local HQ daemon. hq_resolve_company tells you which company the current repo belongs to; call it before company-scoped tools. If a tool returns hqd_unreachable, ask the user to run `hq daemon status`.",
+                });
+                return;
+            }
+            case "ping":
+                reply(id, {});
+                return;
+            case "tools/list":
+                reply(id, { tools: (await import("../lib/mcp/tools.js")).MCP_TOOLS });
+                return;
+            case "tools/call":
+                reply(id, await callTool(params));
+                return;
+            case "prompts/list":
+                reply(id, { prompts: (await import("../lib/mcp/prompts.js")).MCP_PROMPTS });
+                return;
+            case "prompts/get": {
+                const { getPrompt, PromptNotFoundError } = await import("../lib/mcp/prompts.js");
+                const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
+                try {
+                    reply(id, getPrompt(String(params.name), args, readHqRoot(env, home)));
+                }
+                catch (err) {
+                    if (!(err instanceof PromptNotFoundError))
+                        throw err;
+                    replyError(id, -32602, err.message);
+                }
+                return;
+            }
+            default:
+                // Notifications (initialized, cancelled, …) need no answer.
+                if (isRequest)
+                    replyError(id, -32601, `method not found: ${String(msg.method)}`);
+        }
+    };
+    return new Promise((resolve) => {
+        let inFlight = 0;
+        let ended = false;
+        const maybeDone = () => {
+            if (ended && inFlight === 0)
+                resolve();
+        };
+        const push = createLineSplitter((line) => {
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                replyError(null, -32700, "parse error");
+                return;
+            }
+            if (!msg || typeof msg !== "object" || Array.isArray(msg)) {
+                replyError(null, -32600, "invalid request");
+                return;
+            }
+            inFlight += 1;
+            handle(msg)
+                .catch((err) => {
+                if (msg.id !== undefined && msg.id !== null)
+                    replyError(msg.id, -32603, err instanceof Error ? err.message : String(err));
+                else
+                    process.stderr.write(`hq mcp serve: ${err instanceof Error ? err.message : String(err)}\n`);
+            })
+                .finally(() => {
+                inFlight -= 1;
+                maybeDone();
+            });
+        }, () => replyError(null, -32600, "request line too large"), 16 * 1024 * 1024);
+        input.on("data", push);
+        input.on("end", () => {
+            ended = true;
+            maybeDone();
+        });
+    });
+}
+//# sourceMappingURL=mcp-serve.js.map

package/dist/commands/mcp-status.js

@@ -389,6 +389,13 @@ export function registerMcpCommand(program) {
     const mcp = program
         .command('mcp')
         .description('MCP pack observability (read-only) across Claude + Codex');
+    mcp
+        .command('serve')
+        .description('Run the HQ stdio MCP server; every tool call is answered by hqd (`hq daemon status`)')
+        .action(async () => {
+        const { runMcpServe } = await import('./mcp-serve.js');
+        await runMcpServe();
+    });
     mcp
         .command('status')
         .alias('list')

package/dist/index.d.ts

@@ -14,6 +14,9 @@ export declare const __test__: {
     runCliEntry: typeof runCliEntry;
     isNpmPackageEntry: typeof isNpmPackageEntry;
     acquirePackageUseLease: (prefix: string, version: string, stateDirectory?: string) => Promise<import("./utils/package-use-lease.js").PackageUseLease>;
+    isMcpServeRequest: typeof isMcpServeRequest;
 };
+/** Exactly `hq mcp serve` with no further arguments; `--help` uses the command graph. */
+declare function isMcpServeRequest(argv: readonly string[]): boolean;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -77,6 +77,10 @@ function dispatchCliEntry() {
             });
         });
     }
+    else if (isMcpServeRequest(process.argv)) {
+        // Keep the minimal startup route; runMcpServe applies the hq-flags gate.
+        void import("./commands/mcp-serve.js").then(({ runMcpServe }) => runMcpServe());
+    }
     else if (parsedFastCore) {
         // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
         // dispatches straight to the bundled-script runner, so it never pays for the
@@ -163,5 +167,10 @@ export const __test__ = {
         const lease = await import("./utils/package-use-lease.js");
         return lease.acquirePackageUseLease(prefix, version, stateDirectory);
     },
+    isMcpServeRequest,
 };
+/** Exactly `hq mcp serve` with no further arguments; `--help` uses the command graph. */
+function isMcpServeRequest(argv) {
+    return argv.length === 4 && argv[2] === "mcp" && argv[3] === "serve";
+}
 //# sourceMappingURL=index.js.map

package/dist/lanes-drain-hook.js

@@ -1,8 +1,8 @@
 import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { fileURLToPath } from "node:url";
 import { MESSAGE_REPLAY_STATE_NAME, readMessageReplayState, updateMessageReplayTranscript, writeMessageReplayState, } from "./lib/lanes/message-replay.js";
+import { isMainModule } from "./utils/is-main-module.js";
 function parseHookInput(text) {
     if (text.trim() === "")
         return {};
@@ -193,7 +193,7 @@ async function main() {
     }
     finish(await runLaneDrainHook(process.env, input, inputError));
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isMainModule(import.meta.url)) {
     main().catch((err) => {
         process.stderr.write(`hq-lanes-drain: hook_runner_failed: ${err instanceof Error ? err.message : String(err)}\n`);
         // A hook runner failure must not stop the provider's requested tool call.

package/dist/lib/anywhere-runtime-fast-flag.d.ts

@@ -0,0 +1,3 @@
+/** Resolve the Anywhere gate from hq-flags without loading the CLI's large worker bundle. */
+export declare function anywhereRuntimeEnabledFromSnapshot(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=anywhere-runtime-fast-flag.d.ts.map

package/dist/lib/anywhere-runtime-fast-flag.js

@@ -0,0 +1,23 @@
+import { readLocalOverride, resolveFlag } from "@indigoai-us/hq-flags-client";
+import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { readFlagSnapshotFile } from "./flag-snapshot-file.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag-key.js";
+/** Resolve the Anywhere gate from hq-flags without loading the CLI's large worker bundle. */
+export function anywhereRuntimeEnabledFromSnapshot(env = process.env) {
+    const local = readLocalOverride(HQ_ANYWHERE_RUNTIME_FLAG, env);
+    if (local !== null)
+        return local;
+    const company = resolveProcessFlagCompanyContext(env);
+    const persisted = company.companyUid ? readFlagSnapshotFile(company.companyUid, { env }) : null;
+    const snapshot = persisted
+        ? { version: 0, flags: persisted.flags }
+        : null;
+    return resolveFlag({
+        flagKey: HQ_ANYWHERE_RUNTIME_FLAG,
+        env,
+        snapshot,
+        companyIdentifiers: [company.companyUid, company.companySlug].filter((value) => Boolean(value)),
+        lookup: { fallback: false },
+    }).value;
+}
+//# sourceMappingURL=anywhere-runtime-fast-flag.js.map

package/dist/lib/anywhere-runtime-flag-key.d.ts

@@ -0,0 +1,3 @@
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+export declare const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+//# sourceMappingURL=anywhere-runtime-flag-key.d.ts.map

package/dist/lib/anywhere-runtime-flag-key.js

@@ -0,0 +1,3 @@
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+export const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+//# sourceMappingURL=anywhere-runtime-flag-key.js.map

package/dist/lib/daemon/ops/mcp.d.ts

@@ -0,0 +1,54 @@
+/** Hosted hq-mcp forwarding used by the hqd mcp.call operation. */
+export declare class McpOpError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface McpToolResult {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    structuredContent?: Record<string, unknown>;
+    isError?: boolean;
+}
+export declare function jsonResult(value: unknown): McpToolResult;
+export declare const HQ_MCP_HTTP_TIMEOUT_MS = 30000;
+/** Derive the hosted MCP sibling from the same hq-pro URL used by hq-cli. */
+export declare function resolveHqMcpEndpoint(env?: NodeJS.ProcessEnv): URL;
+export interface HqMcpBridgeOptions {
+    endpoint?: URL;
+    env?: NodeJS.ProcessEnv;
+    getToken?: () => Promise<string>;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+/** A short-lived Streamable HTTP MCP client; no local hq-mcp process is started. */
+export declare class HqMcpBridge {
+    private readonly endpoint;
+    private readonly getToken;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    private readonly activeClients;
+    constructor(options?: HqMcpBridgeOptions);
+    listTools(): Promise<Array<{
+        name: string;
+        description?: string;
+        inputSchema: Record<string, unknown>;
+    }>>;
+    callTool(name: string, args: Record<string, unknown>, timeoutMs?: number): Promise<unknown>;
+    close(): void;
+    private withClient;
+    private toSafeError;
+}
+export interface RunWorkerRequest {
+    worker: string;
+    skill?: string;
+    args?: string;
+    company?: string;
+}
+/**
+ * Dispatch `/run <worker> <skill> <args>` in a detached headless Claude Code
+ * session rooted at HQ_ROOT. HQ_RUN_WORKER_CMD overrides the binary (tests).
+ */
+export declare function runWorker(req: RunWorkerRequest, hqRoot: string, env: NodeJS.ProcessEnv, now: Date): Promise<Record<string, unknown>>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/lib/daemon/ops/mcp.js

@@ -0,0 +1,217 @@
+/** Hosted hq-mcp forwarding used by the hqd mcp.call operation. */
+import { spawn } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { ensureCognitoToken, isMachineIdentity } from "../../../utils/cognito-session.js";
+import { DEFAULT_VAULT_API_URL } from "../../../utils/cognito-session.js";
+import { ensurePrivateDir, openPrivateAppend } from "../paths.js";
+export class McpOpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "McpOpError";
+    }
+}
+export function jsonResult(value) {
+    const structured = value && typeof value === "object" && !Array.isArray(value) ? value : { value };
+    return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }], structuredContent: structured };
+}
+export const HQ_MCP_HTTP_TIMEOUT_MS = 30_000;
+/** Derive the hosted MCP sibling from the same hq-pro URL used by hq-cli. */
+export function resolveHqMcpEndpoint(env = process.env) {
+    const apiUrl = env.HQ_VAULT_API_URL?.trim() || DEFAULT_VAULT_API_URL;
+    let api;
+    try {
+        api = new URL(apiUrl);
+    }
+    catch {
+        throw new McpOpError("hq_mcp_config_error", "HQ's configured API URL is invalid; check HQ_VAULT_API_URL.");
+    }
+    if (api.protocol !== "https:" || !api.hostname.startsWith("hqapi.")) {
+        throw new McpOpError("hq_mcp_config_error", "Hosted hq-mcp requires an HTTPS hqapi host in HQ_VAULT_API_URL.");
+    }
+    api.hostname = `hq-mcp.${api.hostname.slice("hqapi.".length)}`;
+    api.pathname = "/mcp";
+    api.search = "";
+    api.hash = "";
+    return api;
+}
+async function defaultMcpToken() {
+    if (!isMachineIdentity()) {
+        throw new McpOpError("hq_mcp_auth_required", "This HQ login is not an hq-mcp audience token. Sign in to the hosted connector with its DCR plus PKCE flow; hq login tokens cannot call hq-mcp yet.");
+    }
+    try {
+        // Send this box's existing machine token. The hosted hq-mcp audience check
+        // accepts it only when it was issued for hqMcpMachineClient; otherwise the
+        // server rejects it. This helper does not inspect the credential's client ID.
+        return await ensureCognitoToken({ tokenSource: "machine", interactive: false });
+    }
+    catch {
+        throw new McpOpError("hq_mcp_auth_required", "An hq-mcp machine token is unavailable. Configure this box with hq-pro's hqMcpMachineClient ID, then retry the daemon call.");
+    }
+}
+/** A short-lived Streamable HTTP MCP client; no local hq-mcp process is started. */
+export class HqMcpBridge {
+    endpoint;
+    getToken;
+    fetchImpl;
+    timeoutMs;
+    activeClients = new Set();
+    constructor(options = {}) {
+        this.endpoint = options.endpoint ?? resolveHqMcpEndpoint(options.env ?? process.env);
+        this.getToken = options.getToken ?? defaultMcpToken;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? HQ_MCP_HTTP_TIMEOUT_MS;
+    }
+    async listTools() {
+        return this.withClient(async (client) => {
+            const result = await client.listTools();
+            return result.tools.map((tool) => ({
+                name: tool.name,
+                ...(tool.description ? { description: tool.description } : {}),
+                inputSchema: tool.inputSchema,
+            }));
+        });
+    }
+    async callTool(name, args, timeoutMs = this.timeoutMs) {
+        return this.withClient(async (client, token) => {
+            const { tools } = await client.listTools();
+            if (!tools.some((tool) => tool.name === name)) {
+                throw new McpOpError("hq_mcp_tool_unavailable", `Hosted hq-mcp does not expose ${name}.`);
+            }
+            try {
+                return await client.callTool({ name, arguments: args });
+            }
+            catch (error) {
+                throw this.toSafeError(error, token);
+            }
+        }, timeoutMs);
+    }
+    close() {
+        for (const client of this.activeClients) {
+            void client.close().catch(() => {
+                // The in-flight call is already being cancelled; shutdown owns its result.
+            });
+        }
+    }
+    async withClient(work, timeoutMs = this.timeoutMs) {
+        let token = "";
+        let transport;
+        let client;
+        let timeout;
+        let timedOut = false;
+        const abortController = new AbortController();
+        try {
+            token = await this.getToken();
+            if (!token.trim())
+                throw new McpOpError("hq_mcp_auth_required", "An hq-mcp audience token is required.");
+            transport = new StreamableHTTPClientTransport(this.endpoint, {
+                requestInit: {
+                    headers: { Authorization: `Bearer ${token}` },
+                },
+                fetch: (input, init) => this.fetchImpl(input, {
+                    ...init,
+                    signal: init?.signal ? AbortSignal.any([abortController.signal, init.signal]) : abortController.signal,
+                }),
+            });
+            client = new Client({ name: "hqd", version: "1" }, { capabilities: {} });
+            this.activeClients.add(client);
+            timeout = setTimeout(() => {
+                timedOut = true;
+                abortController.abort();
+                void client?.close().catch(() => {
+                    // The deadline already ended the request.
+                });
+            }, timeoutMs);
+            await client.connect(transport);
+            return await work(client, token);
+        }
+        catch (error) {
+            if (timedOut) {
+                throw new McpOpError("hq_mcp_timeout", `Hosted hq-mcp request did not finish within ${timeoutMs}ms.`);
+            }
+            throw this.toSafeError(error, token);
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+            if (client) {
+                this.activeClients.delete(client);
+                try {
+                    await client.close();
+                }
+                catch {
+                    // Closing a finished HTTP session cannot change the request result.
+                }
+            }
+            else if (transport) {
+                try {
+                    await transport.close();
+                }
+                catch {
+                    // Same as above; the transport owns no child process or token cache.
+                }
+            }
+        }
+    }
+    toSafeError(error, token) {
+        if (error instanceof McpOpError)
+            return error;
+        const status = error instanceof StreamableHTTPError ? error.code : undefined;
+        if (status === 401 || status === 403) {
+            return new McpOpError("hq_mcp_auth_required", "Hosted hq-mcp rejected this token. Use the DCR plus PKCE person flow or configure the hq-mcp machine client ID on this box.");
+        }
+        const message = error instanceof Error ? error.message : "request failed";
+        const safe = token ? message.split(token).join("[redacted]") : message;
+        return new McpOpError("hq_mcp_error", `Hosted hq-mcp request failed: ${safe}`);
+    }
+}
+const SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/**
+ * Dispatch `/run <worker> <skill> <args>` in a detached headless Claude Code
+ * session rooted at HQ_ROOT. HQ_RUN_WORKER_CMD overrides the binary (tests).
+ */
+export async function runWorker(req, hqRoot, env, now) {
+    if (!SLUG_RE.test(req.worker))
+        throw new McpOpError("bad_args", "worker must be a worker id (letters, digits, '.', '_', '-')");
+    if (req.skill !== undefined && !SLUG_RE.test(req.skill))
+        throw new McpOpError("bad_args", "skill must be a skill name");
+    const prompt = ["/run", req.worker, req.skill, req.args?.trim()].filter(Boolean).join(" ");
+    const logDir = path.join(hqRoot, "workspace", "orchestrator", "hqd-run-worker");
+    ensurePrivateDir(logDir);
+    const logPath = path.join(logDir, `${now.toISOString().replace(/[:.]/g, "-")}-${req.worker}.log`);
+    const fd = openPrivateAppend(logPath);
+    fs.chmodSync(logPath, 0o600);
+    const bin = env.HQ_RUN_WORKER_CMD?.trim() || "claude";
+    try {
+        const workerEnv = { ...env };
+        for (const key of Object.keys(workerEnv)) {
+            if (key.toUpperCase() === "HQ_SPAWN_COMPANY")
+                delete workerEnv[key];
+        }
+        if (req.company)
+            workerEnv.HQ_SPAWN_COMPANY = req.company;
+        const child = spawn(bin, ["-p", prompt], {
+            cwd: hqRoot,
+            env: workerEnv,
+            detached: true,
+            stdio: ["ignore", fd, fd],
+        });
+        await new Promise((resolve, reject) => {
+            child.once("spawn", resolve);
+            child.once("error", (err) => {
+                fs.appendFileSync(logPath, `\nhqd could not start ${bin}: ${err.message}\n`, { mode: 0o600 });
+                reject(new McpOpError("worker_spawn_failed", `could not start ${bin}: ${err.message}`));
+            });
+        });
+        child.unref();
+        return { dispatched: true, prompt, pid: child.pid ?? null, logPath, company: req.company ?? null };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+//# sourceMappingURL=mcp.js.map

package/dist/lib/daemon/protocol.d.ts

@@ -7,10 +7,11 @@
  * out of order, so clients match them by `id`.
  */
 export declare const HQD_SOCKET_NAME = "hqd.sock";
-export declare const HQD_OPS: readonly ["ping", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "shutdown"];
+export declare const HQD_OPS: readonly ["ping", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "shutdown"];
 export type HqdOp = (typeof HQD_OPS)[number];
 /** A request line larger than this is rejected and the connection closed. */
 export declare const HQD_MAX_LINE_BYTES: number;
+export declare const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2000;
 export interface HqdRequest {
     id: string | number;
     op: string;

package/dist/lib/daemon/protocol.js

@@ -22,10 +22,12 @@ export const HQD_OPS = [
     "memory.get",
     "memory.put",
     "mesh.presence",
+    "mcp.call",
     "shutdown",
 ];
 /** A request line larger than this is rejected and the connection closed. */
 export const HQD_MAX_LINE_BYTES = 1024 * 1024;
+export const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2_000;
 /**
  * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
  * On Windows the socket is a per-user named pipe.
@@ -115,7 +117,7 @@ let nextClientId = 0;
  */
 export function hqdRequest(op, args = {}, opts = {}) {
     const socketPath = opts.socketPath ?? hqdSocketPath();
-    const timeoutMs = opts.timeoutMs ?? 2_000;
+    const timeoutMs = opts.timeoutMs ?? HQD_DEFAULT_REQUEST_TIMEOUT_MS;
     const id = `c${process.pid}-${(nextClientId += 1)}`;
     return new Promise((resolve, reject) => {
         const socket = net.createConnection(socketPath);

package/dist/lib/daemon/server.d.ts

@@ -8,6 +8,7 @@
  */
 import { type ResolveResult } from "../registry/registry.js";
 import { SessionRegistry } from "./session-registry.js";
+import { HqMcpBridge } from "./ops/mcp.js";
 export interface HqdServerOptions {
     socketPath: string;
     /** registry.json to resolve against (US-004). */
@@ -22,6 +23,10 @@ export interface HqdServerOptions {
     env?: NodeJS.ProcessEnv;
     /** Work-mesh root override for mesh.presence (tests). */
     workMeshRoot?: string;
+    /** Test seam for the hq-anywhere-runtime default-off gate. */
+    mcpEnabled?: () => boolean | Promise<boolean>;
+    /** Test seam for the hosted Streamable HTTP MCP transport. */
+    mcpBridge?: HqMcpBridge;
     /** Crash reporter for internal op failures (US-012); run.ts wires Sentry here. */
     reportError?: (op: string, err: unknown) => void;
 }