@indigoai-us/hq-cli 5.325.0 → 5.327.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.327.0] — 2026-10-02
+- Reduce hook-time startup imports for repo-run-registry and isolate hook-helper handlers from sibling modules.
+- Keep package-root Sentry diagnostics off the fast-route import path unless root diagnostics are needed.
+- `hq mcp login` adds browser-based OAuth sign-in for hosted MCP.
+
+## [5.326.0] — 2026-10-02
+- Company-scoped daemon tools now reject an explicit company that conflicts with the active session or repository binding.
+- Added a flag-gated `hq mcp serve` command and global install hook for the Anywhere runtime.
+- `hq mcp serve` can forward supported calls to hosted hq-mcp, including search and fetch, without a local hq-mcp process.
+- Make standalone HQ auth refresh entry points run through npm bin symlinks.
+
 ## [5.325.0] — 2026-10-02
 - Match Bash pathname expansion in native derive-trigger-facts when a glob has missing suffixes, a trailing slash, or symlink path components.
 

package/dist/bin/hq-auth-refresh.js

@@ -15,8 +15,7 @@
 import "../node-preflight.js";
 import { acquireCurrentPackageUseLease } from "../utils/package-use-lease.js";
 import "../node-network-compat.js";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
+import { isMainModule } from "../utils/is-main-module.js";
 const MIN_VALIDITY_FLAG = "--min-validity-seconds";
 function parseMinimumValiditySeconds(argv, env) {
     let raw;
@@ -109,7 +108,7 @@ export async function startAuthRefresh(acquireLease = acquireCurrentPackageUseLe
     initSentry();
     return runAuthRefresh();
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isMainModule(import.meta.url)) {
     void startAuthRefresh().then((exitCode) => process.exit(exitCode));
 }
 //# sourceMappingURL=hq-auth-refresh.js.map

package/dist/command-catalog.generated.d.ts

@@ -3720,6 +3720,24 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly arguments: readonly [];
     readonly options: readonly [];
     readonly subcommands: readonly [{
+        readonly name: "serve";
+        readonly description: "Run the HQ stdio MCP server; every tool call is answered by hqd (`hq daemon status`)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "login";
+        readonly description: "Sign in to the hosted HQ MCP connector with browser OAuth";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
         readonly name: "status";
         readonly description: "Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)";
         readonly aliases: readonly ["list"];
@@ -9927,7 +9945,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "call";
-        readonly description: "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON";
+        readonly description: "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, mcp.call, …) and print the result as JSON";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <op>";

package/dist/command-catalog.generated.js

@@ -4801,6 +4801,26 @@ export const COMMAND_CATALOG = [
         "arguments": [],
         "options": [],
         "subcommands": [
+            {
+                "name": "serve",
+                "description": "Run the HQ stdio MCP server; every tool call is answered by hqd (`hq daemon status`)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "login",
+                "description": "Sign in to the hosted HQ MCP connector with browser OAuth",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "status",
                 "description": "Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)",
@@ -12789,7 +12809,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "call",
-                "description": "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON",
+                "description": "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, mcp.call, …) and print the result as JSON",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <op>",

package/dist/commands/anywhere-runtime-flag.d.ts

@@ -1,5 +1,5 @@
-/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
-export declare const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
+export { HQ_ANYWHERE_RUNTIME_FLAG };
 export declare class AnywhereRuntimeDisabledError extends Error {
     readonly expected: true;
     constructor();

package/dist/commands/anywhere-runtime-flag.js

@@ -1,6 +1,6 @@
 import { resolveFlagGate, resolveProcessFlagGate } from "../lib/flag-registry.js";
-/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
-export const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
+export { HQ_ANYWHERE_RUNTIME_FLAG };
 export class AnywhereRuntimeDisabledError extends Error {
     expected = true;
     constructor() {

package/dist/commands/auth.js

@@ -264,7 +264,9 @@ export function registerAuthCommands(program) {
     authCmd
         .command("logout")
         .description("Clear the cached HQ Cognito session")
-        .action(() => {
+        .action(async () => {
+        const { clearMcpOAuthCaches } = await import("../lib/daemon/mcp-oauth.js");
+        clearMcpOAuthCaches();
         const existing = loadCachedTokens();
         if (!existing) {
             console.log(chalk.yellow("No cached HQ session"));

package/dist/commands/core-detect-stale-review-base-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDetectStaleReviewBaseFast(args: readonly string[], _stdin: string, _cwd: string, hqRoot: string | undefined): Promise<number>;
+//# sourceMappingURL=core-detect-stale-review-base-fast.d.ts.map

package/dist/commands/core-detect-stale-review-base-fast.js

@@ -0,0 +1,23 @@
+/** Fast-route adapter isolated from the other hook-helper command modules. */
+import { resolveBundledAsset } from "../utils/hq-roots-core.js";
+import { runDetectStaleReviewBase, DETECT_STALE_REVIEW_BASE_ASSET } from "./core-detect-stale-review-base-native.js";
+function writeResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+export async function runDetectStaleReviewBaseFast(args, _stdin, _cwd, hqRoot) {
+    let root = hqRoot;
+    if (!root) {
+        const { resolveLiveRoot } = await import("../utils/hq-roots-core.js");
+        root = resolveLiveRoot();
+    }
+    return writeResult(runDetectStaleReviewBase(args, {
+        cwd: root,
+        env: { ...process.env, HQ_ROOT: root },
+        scriptPath: resolveBundledAsset(DETECT_STALE_REVIEW_BASE_ASSET),
+    }));
+}
+//# sourceMappingURL=core-detect-stale-review-base-fast.js.map

package/dist/commands/core-job-remote-launcher.js

@@ -1,7 +1,6 @@
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
+import { isMainModule } from "../utils/is-main-module.js";
 function signalNumber(signal) {
     if (!signal)
         return 0;
@@ -40,7 +39,7 @@ export async function runRemoteLauncher(argv, injected = {}) {
     await deps.sleep(15_000);
     return exitCode;
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isMainModule(import.meta.url)) {
     void runRemoteLauncher(process.argv.slice(2))
         .then((exitCode) => { process.exitCode = exitCode; })
         .catch((error) => {

package/dist/commands/core-register-project-native.js

@@ -4,7 +4,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { spawnSync } from "node:child_process";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
-import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { resolveBundledAsset } from "../utils/hq-roots-core.js";
 export const REGISTER_PROJECT_ASSET = "core/scripts/register-project.sh";
 const USAGE = "usage: register-project.sh <company> <project> | --audit <company> | --backfill <company> --only-active [--yes] | --retry-pending <company>";
 const MIN_HQ_CLI = "5.139.0";

package/dist/commands/core-repo-run-registry-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runRepoRunRegistryFast(args: readonly string[], _stdin: string, _cwd: string, hqRoot: string | undefined, _commandName: string, _hqRootArg?: string, worktreeScopeFixEnabled?: boolean): Promise<number>;
+//# sourceMappingURL=core-repo-run-registry-fast.d.ts.map

package/dist/commands/core-repo-run-registry-fast.js

@@ -0,0 +1,35 @@
+/** Fast-route adapter isolated from the other hook-helper command modules. */
+import { runBundledScript } from "../utils/run-bundled-script.js";
+import { runRepoRunRegistry, REPO_RUN_REGISTRY_ASSET } from "./core-repo-run-registry-native.js";
+function writeResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+async function liveRoot(hqRoot) {
+    if (hqRoot)
+        return hqRoot;
+    const { resolveLiveRoot } = await import("../utils/hq-roots-core.js");
+    return resolveLiveRoot();
+}
+export async function runRepoRunRegistryFast(args, _stdin, _cwd, hqRoot, _commandName, _hqRootArg, worktreeScopeFixEnabled = false) {
+    const root = await liveRoot(hqRoot);
+    return writeResult(runRepoRunRegistry(args, {
+        root,
+        cwd: root,
+        env: process.env,
+        worktreeScopeFixEnabled,
+        runShellFallback: (fallbackArgs) => {
+            const { code } = runBundledScript({
+                asset: REPO_RUN_REGISTRY_ASSET,
+                args: [...fallbackArgs],
+                cwd: root,
+                hqRoot: root,
+            });
+            return { code, stdout: "", stderr: "" };
+        },
+    }));
+}
+//# sourceMappingURL=core-repo-run-registry-fast.js.map

package/dist/commands/core-rrr-worktree-scope-fix-fast-flag.d.ts

@@ -0,0 +1,7 @@
+/** Light company-scoped reader for the repo-run-registry worktree-scope flag. */
+/**
+ * Resolve the same default-off, company-scoped flag without loading the full
+ * flag registry and work-context graph on the ordinary UID-scoped path.
+ */
+export declare function coreRrrWorktreeScopeFixFastFlagEnabled(env?: NodeJS.ProcessEnv): Promise<boolean>;
+//# sourceMappingURL=core-rrr-worktree-scope-fix-fast-flag.d.ts.map

package/dist/commands/core-rrr-worktree-scope-fix-fast-flag.js

@@ -0,0 +1,25 @@
+/** Light company-scoped reader for the repo-run-registry worktree-scope flag. */
+import { readLocalOverride } from "@indigoai-us/hq-flags-client";
+import { readFlagSnapshotFile } from "../lib/flag-snapshot-file.js";
+import { resolveFastProcessFlagCompanyContext } from "../lib/process-flag-company-context-fast.js";
+/**
+ * Resolve the same default-off, company-scoped flag without loading the full
+ * flag registry and work-context graph on the ordinary UID-scoped path.
+ */
+export async function coreRrrWorktreeScopeFixFastFlagEnabled(env = process.env) {
+    const flagKey = "core-rrr-worktree-scope-fix";
+    const override = readLocalOverride(flagKey, env);
+    if (override !== null)
+        return override;
+    try {
+        const context = await resolveFastProcessFlagCompanyContext(env);
+        if (!context.companyUid)
+            return false;
+        return readFlagSnapshotFile(context.companyUid, { env })?.flags[flagKey] === true;
+    }
+    catch {
+        // Keep the fast gate's established fail-closed default for unavailable scope or cache data.
+        return false;
+    }
+}
+//# sourceMappingURL=core-rrr-worktree-scope-fix-fast-flag.js.map

package/dist/commands/core-session-journal-native.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { resolveSessionHelperRuntime } from "./core-session-helper-runtime.js";
-import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { resolveBundledAsset } from "../utils/hq-roots-core.js";
 const USAGE = `session-journal.sh: usage:
   session-journal.sh write "<title>" [--files f1,f2,...] [--body-file PATH] [--session KEY]
   session-journal.sh list [--date YYYY-MM-DD]

package/dist/commands/core-share-suggestion-state-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runShareSuggestionStateFast(args: readonly string[], stdin: string, _cwd: string, hqRoot: string | undefined): Promise<number>;
+//# sourceMappingURL=core-share-suggestion-state-fast.d.ts.map

package/dist/commands/core-share-suggestion-state-fast.js

@@ -0,0 +1,25 @@
+/** Fast-route adapter isolated from the other hook-helper command modules. */
+import { runShareSuggestionState } from "./core-share-suggestion-state-native.js";
+function writeResult(result) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+async function liveRoot(hqRoot) {
+    if (hqRoot)
+        return hqRoot;
+    const { resolveLiveRoot } = await import("../utils/hq-roots-core.js");
+    return resolveLiveRoot();
+}
+export async function runShareSuggestionStateFast(args, stdin, _cwd, hqRoot) {
+    const root = await liveRoot(hqRoot);
+    return writeResult(runShareSuggestionState(args, stdin, {
+        root,
+        cwd: root,
+        env: process.env,
+        stdinIsTty: process.stdin.isTTY,
+    }));
+}
+//# sourceMappingURL=core-share-suggestion-state-fast.js.map

package/dist/commands/daemon.js

@@ -769,7 +769,7 @@ export function registerDaemonCommand(program, over = {}) {
     }));
     daemon
         .command("call <op>")
-        .description("Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON")
+        .description("Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, mcp.call, …) and print the result as JSON")
         .option("--json <args>", "Request args as a JSON object", "{}")
         .option("--timeout <ms>", "Give up after this many milliseconds")
         .action(wrap(async (d, op, opts) => {

package/dist/commands/install-global.d.ts

@@ -1,5 +1,6 @@
 import { Command } from 'commander';
 import { AnywhereRuntimeDisabledError } from './anywhere-runtime-flag.js';
+import { type HookTarget } from '../lib/install/claude-targets.js';
 export interface GlobalInstallOptions {
     /** HQ checkout to install from (absolute). */
     hqRoot: string;
@@ -14,7 +15,16 @@ export interface GlobalInstallOptions {
     /** Registry file override (default ~/.hq/registry.json under `home`). */
     registryFile?: string;
     log?: (line: string) => void;
+    /** Is the hq daemon installed? Default: look for its launchd/systemd unit under `home`. */
+    daemonInstalled?: boolean;
 }
+/** True when an hq daemon unit (launchd plist or systemd unit) exists. */
+export declare function isDaemonInstalled(home: string, platform?: NodeJS.Platform, queryTask?: (task: string) => boolean): boolean;
+/**
+ * US-010: with hqd installed (and the checkout shipping the shim), hooks go to
+ * the hqd shim; otherwise to master-hook.sh / the Codex adapter.
+ */
+export declare function hookTargetFor(hqRoot: string, home: string, daemonInstalled?: boolean, env?: NodeJS.ProcessEnv): HookTarget;
 export { AnywhereRuntimeDisabledError as AnywhereDisabledError };
 export declare const isAnywhereEnabled: (_home: string, env?: NodeJS.ProcessEnv) => boolean;
 /** Install HQ into Claude Code user scope. Returns the files touched (or that would be). */