@indigoai-us/hq-cli 5.325.0 → 5.327.0

package/dist/commands/install-global.js

@@ -10,13 +10,38 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { claudeConfigFormat, codexConfigFormat, isCodexInstalled, jsonFormat, unregisterCodexServer, readConfigDoc, realpathOrSelf, resolveEnv, unregisterClaudeServer, writeConfigAtomic, } from './mcp-registration.js';
+import { spawnSync } from 'node:child_process';
+import { buildCodexServerDef, claudeConfigFormat, codexConfigFormat, isCodexInstalled, jsonFormat, mergeCodexServer, registerCodexServer, unregisterCodexServer, mergeClaudeServer, readConfigDoc, realpathOrSelf, registerClaudeServer, resolveEnv, unregisterClaudeServer, writeConfigAtomic, } from './mcp-registration.js';
 import { seedRegistryFromHqRoot } from './link.js';
 import { resolveHqRoot } from './doctor.js';
 import { anywhereRuntimeEnabled, AnywhereRuntimeDisabledError } from './anywhere-runtime-flag.js';
 import { readRegistry, registryDir, registryFile, writeRegistry } from '../lib/registry/registry.js';
+import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from '../lib/daemon/install.js';
+import { readDaemonConfig } from '../lib/daemon/config.js';
+import { daemonPaths } from '../lib/daemon/paths.js';
 import { addAgentsMdBlock, addCodexHooks, classifyLegacySkills, codexAdapterPath, codexCharterSource, codexTargets, hasAllCodexHooks, HQ_OWNED_MARKER, LEGACY_BACKUP_NAME, LEGACY_SKILLS_NAME, removeAgentsMdBlock, removeCodexHooks, } from '../lib/install/codex-targets.js';
-import { addClaudeMdBlock, addHqHooks, charterPath, claudeTargets, hasAllHqHooks, HQ_ANYWHERE_PACK, HQ_MCP_SERVER_NAME, hqSkillsSource, lineDiff, masterHookPath, removeClaudeMdBlock, removeHqHooks, SKILL_LINK_PREFIX, } from '../lib/install/claude-targets.js';
+import { addClaudeMdBlock, addHqHooks, charterPath, claudeTargets, hasAllHqHooks, HQ_ANYWHERE_PACK, HQ_MCP_SERVER_NAME, hqSkillsSource, lineDiff, masterHookPath, shimPath, MCP_SUBPROCESS_PATH, removeClaudeMdBlock, removeHqHooks, SKILL_LINK_PREFIX, } from '../lib/install/claude-targets.js';
+/** True when an hq daemon unit (launchd plist or systemd unit) exists. */
+export function isDaemonInstalled(home, platform = process.platform, queryTask = (task) => spawnSync('schtasks.exe', ['/Query', '/TN', task], { encoding: 'utf8', windowsHide: true }).status === 0) {
+    if (platform === 'win32')
+        return queryTask(DAEMON_WINDOWS_TASK);
+    const candidates = platform === 'darwin'
+        ? [path.join(home, 'Library', 'LaunchAgents', `${DAEMON_LAUNCHD_LABEL}.plist`)]
+        : platform === 'linux'
+            ? [path.join(home, '.config', 'systemd', 'user', DAEMON_SYSTEMD_UNIT), path.join(SYSTEM_UNIT_DIR, DAEMON_SYSTEMD_UNIT)]
+            : [];
+    return candidates.some((p) => fs.existsSync(p));
+}
+/**
+ * US-010: with hqd installed (and the checkout shipping the shim), hooks go to
+ * the hqd shim; otherwise to master-hook.sh / the Codex adapter.
+ */
+export function hookTargetFor(hqRoot, home, daemonInstalled, env = process.env) {
+    const installed = daemonInstalled ?? isDaemonInstalled(home);
+    const configuredRoot = readDaemonConfig(daemonPaths(home, env).configPath).hqRoot;
+    const daemonMatchesRoot = configuredRoot !== undefined && realpathOrSelf(configuredRoot) === realpathOrSelf(hqRoot);
+    return installed && daemonMatchesRoot && fs.existsSync(shimPath(hqRoot)) ? 'shim' : 'master';
+}
 export { AnywhereRuntimeDisabledError as AnywhereDisabledError };
 export const isAnywhereEnabled = (_home, env = process.env) => anywhereRuntimeEnabled(env);
 function readOrNull(file) {
@@ -30,11 +55,10 @@ function readOrNull(file) {
     }
 }
 function writeFileAtomic(file, data) {
-    const target = realpathOrSelf(file);
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    const tmp = `${target}.hq-tmp-${process.pid}`;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.hq-tmp-${process.pid}`;
     fs.writeFileSync(tmp, data);
-    fs.renameSync(tmp, target);
+    fs.renameSync(tmp, file);
 }
 function canonical(v) {
     return JSON.stringify(v, (_k, val) => val && typeof val === 'object' && !Array.isArray(val)
@@ -42,12 +66,12 @@ function canonical(v) {
         : val);
 }
 /** JSON settings format whose verify step checks every HQ hook is registered. */
-function settingsInstallFormat(hqRoot) {
+function settingsInstallFormat(hqRoot, target) {
     return {
         ...jsonFormat,
         emptyDoc: () => ({}),
         assertEntry(doc) {
-            if (!hasAllHqHooks(doc, hqRoot))
+            if (!hasAllHqHooks(doc, hqRoot, target))
                 throw new Error('HQ hooks not present after write');
         },
     };
@@ -84,9 +108,18 @@ function restoringRemovalFormat(original, stillPresent) {
         },
     };
 }
-function planSkills(hqRoot, t, previouslyManaged = []) {
+function mcpManifest(opts) {
+    const command = opts.nodePath ?? process.execPath;
+    const entry = opts.cliEntry ?? fs.realpathSync(process.argv[1] ?? '');
+    for (const p of [command, entry]) {
+        if (!path.isAbsolute(p))
+            throw new Error(`HQ MCP server path must be absolute: ${p}`);
+    }
+    return { type: 'stdio', command, args: [entry, 'mcp', 'serve'], env: { PATH: MCP_SUBPROCESS_PATH } };
+}
+function planSkills(hqRoot, t) {
     const source = hqSkillsSource(hqRoot);
-    const plan = { link: [], replace: [], already: [], skipped: [] };
+    const plan = { link: [], already: [], skipped: [] };
     let names;
     try {
         names = fs
@@ -115,10 +148,6 @@ function planSkills(hqRoot, t, previouslyManaged = []) {
             plan.link.push(name);
         else if (st.isSymbolicLink() && path.resolve(t.skillsDir, fs.readlinkSync(link)) === target)
             plan.already.push(name);
-        else if (st.isSymbolicLink() && previouslyManaged.includes(name)) {
-            plan.link.push(name);
-            plan.replace.push(name);
-        }
         else
             plan.skipped.push(name);
     }
@@ -164,15 +193,23 @@ export function installGlobalClaude(opts) {
     const t = claudeTargets(home);
     const prior = readState(t);
     const regFile = opts.registryFile ?? registryFile(registryDir(home, env));
+    const manifest = mcpManifest(opts);
     const touched = [];
     const pointerOld = readOrNull(t.hqPointer);
     const pointerNew = `${hqRoot}\n`;
     const mdOld = readOrNull(t.claudeMd);
     const mdNew = addClaudeMdBlock(mdOld, hqRoot);
-    const skills = planSkills(hqRoot, t, prior?.skills.linked ?? []);
+    const skills = planSkills(hqRoot, t);
     const settingsOld = readOrNull(t.settingsJson);
     const settingsDoc = readConfigDoc(t.settingsJson, jsonFormat).doc;
-    const settingsNext = addHqHooks(settingsDoc, hqRoot);
+    const hookTarget = hookTargetFor(hqRoot, home, opts.daemonInstalled, env);
+    const settingsNext = addHqHooks(settingsDoc, hqRoot, hookTarget);
+    const claudeDoc = readConfigDoc(t.claudeJson, claudeConfigFormat).doc;
+    // Collision check runs here too, so a dry run surfaces a conflicting "hq" server.
+    const claudeNext = mergeClaudeServer(HQ_MCP_SERVER_NAME, {
+        ...manifest,
+        _hqPack: HQ_ANYWHERE_PACK,
+    })(claudeDoc);
     if (pointerOld !== pointerNew)
         touched.push(t.hqPointer);
     if (mdOld !== mdNew)
@@ -181,6 +218,8 @@ export function installGlobalClaude(opts) {
         touched.push(path.join(t.skillsDir, `${SKILL_LINK_PREFIX}${s}`));
     if (settingsNext !== settingsDoc)
         touched.push(t.settingsJson);
+    if (claudeNext !== claudeDoc)
+        touched.push(t.claudeJson);
     touched.push(regFile, t.stateFile);
     if (opts.dryRun) {
         log(`hq install --global --runtime claude --dry-run (HQ root ${hqRoot})`);
@@ -192,29 +231,33 @@ export function installGlobalClaude(opts) {
         }
         log(`\n--- ${t.settingsJson}`);
         log(lineDiff(jsonFormat.serialize(settingsDoc), jsonFormat.serialize(settingsNext)));
+        log(`\n--- ${t.claudeJson}`);
+        log(lineDiff(jsonFormat.serialize(claudeDoc), jsonFormat.serialize(claudeNext)));
         return touched;
     }
     writeFileAtomic(t.hqPointer, pointerNew);
     writeFileAtomic(t.claudeMd, mdNew);
     fs.mkdirSync(t.skillsDir, { recursive: true });
-    for (const name of skills.replace)
-        fs.unlinkSync(path.join(t.skillsDir, `${SKILL_LINK_PREFIX}${name}`));
     for (const name of skills.link) {
         fs.symlinkSync(path.join(hqSkillsSource(hqRoot), name), path.join(t.skillsDir, `${SKILL_LINK_PREFIX}${name}`));
     }
     writeConfigAtomic({
         target: t.settingsJson,
         pack: HQ_ANYWHERE_PACK,
-        format: settingsInstallFormat(hqRoot),
-        merge: (doc) => addHqHooks(doc, hqRoot),
+        format: settingsInstallFormat(hqRoot, hookTarget),
+        merge: (doc) => addHqHooks(doc, hqRoot, hookTarget),
         assertName: 'hooks',
         env: { home },
     });
+    registerClaudeServer({ name: HQ_MCP_SERVER_NAME, manifest, pack: HQ_ANYWHERE_PACK, env: { home } });
     // Seeding is best-effort: the runtime wiring above is already in place, so a
     // missing or unreadable manifest is reported rather than aborting the install.
     let seeded = [];
+    let ownedSeeded = [];
     try {
-        seeded = seedRegistryFromHqRoot(hqRoot, { file: regFile }).owned;
+        const result = seedRegistryFromHqRoot(hqRoot, { file: regFile });
+        seeded = result.added;
+        ownedSeeded = result.owned;
     }
     catch (e) {
         log(`Registry not seeded from companies/manifest.yaml: ${e.message}`);
@@ -231,13 +274,13 @@ export function installGlobalClaude(opts) {
             skipped: skills.skipped,
         },
         mcp: { name: HQ_MCP_SERVER_NAME, pack: HQ_ANYWHERE_PACK },
-        seeded: [...new Set([...(prior?.seeded ?? []), ...seeded])].sort(),
+        seeded: [...new Set([...(prior?.seeded ?? []), ...ownedSeeded])].sort(),
     };
     writeFileAtomic(t.stateFile, `${JSON.stringify(state, null, 2)}\n`);
     log(`HQ installed for Claude Code from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
-    log(`  hooks: master-hook.sh registered in ${t.settingsJson}`);
-    log('  MCP server registration is added by the stacked MCP shim change.');
+    log(`  hooks: ${hookTarget === 'shim' ? 'hqd-hook-shim.sh' : 'master-hook.sh'} registered in ${t.settingsJson}`);
+    log(`  MCP: "${HQ_MCP_SERVER_NAME}" registered in ${t.claudeJson}`);
     log(`  registry: ${seeded.length} manifest entr${seeded.length === 1 ? 'y' : 'ies'} seeded`);
     return touched;
 }
@@ -367,12 +410,12 @@ function assertCodexHqRoot(hqRoot) {
             throw new Error(`${hqRoot} is not an HQ checkout (missing ${p})`);
     }
 }
-function hooksInstallFormat(hqRoot) {
+function hooksInstallFormat(hqRoot, target) {
     return {
         ...jsonFormat,
         emptyDoc: () => ({}),
         assertEntry(doc) {
-            if (!hasAllCodexHooks(doc, hqRoot))
+            if (!hasAllCodexHooks(doc, hqRoot, target))
                 throw new Error('HQ Codex hooks not present after write');
         },
     };
@@ -399,6 +442,7 @@ export function installGlobalCodex(opts) {
     const hqPointer = claudeTargets(home).hqPointer;
     const prior = readCodexState(t);
     const regFile = opts.registryFile ?? registryFile(registryDir(home, env));
+    const manifest = mcpManifest(opts);
     const touched = [];
     const pointerOld = readOrNull(hqPointer);
     const pointerNew = `${hqRoot}\n`;
@@ -406,11 +450,20 @@ export function installGlobalCodex(opts) {
     const mdOld = readOrNull(t.agentsMd);
     const mdNew = addAgentsMdBlock(mdOld, charter);
     const legacy = classifyLegacySkills(t.skillsDir, hqRoot);
-    const skills = planSkills(hqRoot, t, prior?.skills.linked ?? []);
+    const legacyPath = path.join(t.skillsDir, LEGACY_SKILLS_NAME);
+    const legacyBackupPath = path.join(t.skillsDir, LEGACY_BACKUP_NAME);
+    if (legacy.kind === 'hq-dir' && fs.existsSync(legacyBackupPath)) {
+        throw new Error(`${legacyBackupPath} already exists; move it away before installing.`);
+    }
+    const skills = planSkills(hqRoot, t);
     const hooksOld = readOrNull(t.hooksJson);
-    const tomlOld = readOrNull(t.configToml);
     const hooksDoc = readConfigDoc(t.hooksJson, jsonFormat).doc;
-    const hooksNext = addCodexHooks(hooksDoc, hqRoot);
+    const hookTarget = hookTargetFor(hqRoot, home, opts.daemonInstalled, env);
+    const hooksNext = addCodexHooks(hooksDoc, hqRoot, hookTarget);
+    const tomlOld = readOrNull(t.configToml);
+    const tomlDoc = readConfigDoc(t.configToml, codexConfigFormat).doc;
+    // Collision check runs here too, so a dry run surfaces a conflicting "hq" server.
+    const tomlNext = mergeCodexServer(HQ_MCP_SERVER_NAME, buildCodexServerDef(manifest, HQ_ANYWHERE_PACK, () => null, new Set()))(tomlDoc);
     if (pointerOld !== pointerNew)
         touched.push(hqPointer);
     if (mdOld !== mdNew)
@@ -421,6 +474,8 @@ export function installGlobalCodex(opts) {
         touched.push(path.join(t.skillsDir, `${SKILL_LINK_PREFIX}${s}`));
     if (hooksNext !== hooksDoc)
         touched.push(t.hooksJson);
+    if (tomlNext !== tomlDoc)
+        touched.push(t.configToml);
     touched.push(regFile, t.stateFile);
     if (opts.dryRun) {
         log(`hq install --global --runtime codex --dry-run (HQ root ${hqRoot})`);
@@ -437,16 +492,14 @@ export function installGlobalCodex(opts) {
         }
         log(`\n--- ${t.hooksJson}`);
         log(lineDiff(jsonFormat.serialize(hooksDoc), jsonFormat.serialize(hooksNext)));
+        log(`\n--- ${t.configToml}`);
+        log(lineDiff(codexConfigFormat.serialize(tomlDoc), codexConfigFormat.serialize(tomlNext)));
         return touched;
     }
-    if (legacy.kind === 'hq-dir' && fs.existsSync(path.join(t.skillsDir, LEGACY_BACKUP_NAME))) {
-        throw new Error(`${path.join(t.skillsDir, LEGACY_BACKUP_NAME)} already exists; move it away before installing.`);
-    }
     writeFileAtomic(hqPointer, pointerNew);
     writeFileAtomic(t.agentsMd, mdNew);
     // Legacy mirror: replace only when HQ-owned; record enough to put it back.
     let legacyRecord = prior?.legacy ?? { kind: 'none' };
-    const legacyPath = path.join(t.skillsDir, LEGACY_SKILLS_NAME);
     if (legacy.kind === 'hq-symlink') {
         fs.unlinkSync(legacyPath);
         legacyRecord = { kind: 'symlink', target: legacy.target };
@@ -459,22 +512,24 @@ export function installGlobalCodex(opts) {
     else if (legacy.kind === 'foreign')
         log(legacyWarning(t.skillsDir));
     fs.mkdirSync(t.skillsDir, { recursive: true });
-    for (const name of skills.replace)
-        fs.unlinkSync(path.join(t.skillsDir, `${SKILL_LINK_PREFIX}${name}`));
     for (const name of skills.link) {
         fs.symlinkSync(path.join(hqSkillsSource(hqRoot), name), path.join(t.skillsDir, `${SKILL_LINK_PREFIX}${name}`));
     }
     writeConfigAtomic({
         target: t.hooksJson,
         pack: HQ_ANYWHERE_PACK,
-        format: hooksInstallFormat(hqRoot),
-        merge: (doc) => addCodexHooks(doc, hqRoot),
+        format: hooksInstallFormat(hqRoot, hookTarget),
+        merge: (doc) => addCodexHooks(doc, hqRoot, hookTarget),
         assertName: 'hooks',
         env: { home },
     });
+    registerCodexServer({ name: HQ_MCP_SERVER_NAME, manifest, pack: HQ_ANYWHERE_PACK, env: { home } });
     let seeded = [];
+    let ownedSeeded = [];
     try {
-        seeded = seedRegistryFromHqRoot(hqRoot, { file: regFile }).owned;
+        const result = seedRegistryFromHqRoot(hqRoot, { file: regFile });
+        seeded = result.added;
+        ownedSeeded = result.owned;
     }
     catch (e) {
         log(`Registry not seeded from companies/manifest.yaml: ${e.message}`);
@@ -492,13 +547,13 @@ export function installGlobalCodex(opts) {
         },
         legacy: legacyRecord,
         mcp: { name: HQ_MCP_SERVER_NAME, pack: HQ_ANYWHERE_PACK },
-        seeded: [...new Set([...(prior?.seeded ?? []), ...seeded])].sort(),
+        seeded: [...new Set([...(prior?.seeded ?? []), ...ownedSeeded])].sort(),
     };
     writeFileAtomic(t.stateFile, `${JSON.stringify(state, null, 2)}\n`);
     log(`HQ installed for Codex from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
-    log(`  hooks: ${codexAdapterPath(hqRoot)} registered in ${t.hooksJson}`);
-    log('  MCP server registration is added by the stacked MCP shim change.');
+    log(`  hooks: ${hookTarget === 'shim' ? shimPath(hqRoot) : codexAdapterPath(hqRoot)} registered in ${t.hooksJson}`);
+    log(`  MCP: "${HQ_MCP_SERVER_NAME}" registered in ${t.configToml}`);
     return touched;
 }
 /** Reverse every Codex install step; non-HQ entries are left untouched. */

package/dist/commands/logout.js

@@ -9,6 +9,8 @@ export function registerLogoutCommand(program) {
         .description('Log out and clear cached credentials')
         .action(async () => {
         try {
+            const { clearMcpOAuthCaches } = await import('../lib/daemon/mcp-oauth.js');
+            clearMcpOAuthCaches();
             const existing = loadCachedTokens();
             if (!existing) {
                 console.log(chalk.yellow('No cached HQ session'));

package/dist/commands/mcp-serve.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `hq mcp serve` (hq-anywhere US-011): a stdio MCP server that forwards every
+ * tool call to hqd over its socket.
+ *
+ * It keeps no state between requests, so an orphaned instance costs nothing
+ * (policy mcp-process-cleanup). src/index.ts routes `hq mcp serve` straight to
+ * {@link runMcpServe} without loading the command graph, which keeps start-up
+ * under 100ms. The MCP SDK is not loaded either: the stdio transport is
+ * newline-delimited JSON-RPC 2.0 and is handled here directly.
+ *
+ * When hqd is unreachable every tool call returns an isError result naming
+ * `hq daemon status`, and the server keeps running.
+ */
+export declare const MCP_PROTOCOL_VERSIONS: readonly ["2025-06-18", "2025-03-26", "2024-11-05"];
+export interface McpServeOptions {
+    input?: NodeJS.ReadableStream;
+    output?: NodeJS.WritableStream;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    cwd?: string;
+    /** Per-call hqd budget. Default 120s; policy checks and hq-mcp tools can be slow. */
+    timeoutMs?: number;
+}
+/** HQ root for prompts: HQ_ROOT, else the ~/.hq/root pointer written by `hq install --global`. */
+export declare function readHqRoot(env: NodeJS.ProcessEnv, home: string): string | null;
+/** Run the server until input ends. Resolves when stdin closes. */
+export declare function runMcpServe(opts?: McpServeOptions): Promise<void>;
+//# sourceMappingURL=mcp-serve.d.ts.map

package/dist/commands/mcp-serve.js

@@ -0,0 +1,165 @@
+/**
+ * `hq mcp serve` (hq-anywhere US-011): a stdio MCP server that forwards every
+ * tool call to hqd over its socket.
+ *
+ * It keeps no state between requests, so an orphaned instance costs nothing
+ * (policy mcp-process-cleanup). src/index.ts routes `hq mcp serve` straight to
+ * {@link runMcpServe} without loading the command graph, which keeps start-up
+ * under 100ms. The MCP SDK is not loaded either: the stdio transport is
+ * newline-delimited JSON-RPC 2.0 and is handled here directly.
+ *
+ * When hqd is unreachable every tool call returns an isError result naming
+ * `hq daemon status`, and the server keeps running.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { CLI_VERSION } from "../cli-version.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag.js";
+import { anywhereRuntimeEnabledFromSnapshot } from "../lib/anywhere-runtime-fast-flag.js";
+import { createLineSplitter, HqdClientError, hqdRequest, hqdSocketPath } from "../lib/daemon/protocol.js";
+export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+const UNREACHABLE_CODES = new Set(["ENOENT", "ECONNREFUSED", "ECONNRESET", "EPIPE", "ETIMEDOUT", "ESOCKET", "EACCES"]);
+/** HQ root for prompts: HQ_ROOT, else the ~/.hq/root pointer written by `hq install --global`. */
+export function readHqRoot(env, home) {
+    const fromEnv = env.HQ_ROOT?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
+    try {
+        return fs.readFileSync(path.join(dir, "root"), "utf8").trim() || null;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+function toolError(code, message) {
+    const error = { code, message };
+    return { content: [{ type: "text", text: JSON.stringify({ error }, null, 2) }], structuredContent: { error }, isError: true };
+}
+/** Run the server until input ends. Resolves when stdin closes. */
+export function runMcpServe(opts = {}) {
+    const input = opts.input ?? process.stdin;
+    const output = opts.output ?? process.stdout;
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? os.homedir();
+    const cwd = opts.cwd ?? process.cwd();
+    const socketPath = hqdSocketPath(home, env);
+    const timeoutMs = opts.timeoutMs ?? 120_000;
+    if (!anywhereRuntimeEnabledFromSnapshot(env)) {
+        process.stderr.write(`HQ Anywhere is not enabled. Enable the ${HQ_ANYWHERE_RUNTIME_FLAG} flag to use hq mcp serve.\n`);
+        process.exitCode = 1;
+        return Promise.resolve();
+    }
+    const send = (msg) => output.write(`${JSON.stringify({ jsonrpc: "2.0", ...msg })}\n`);
+    const reply = (id, result) => send({ id, result });
+    const replyError = (id, code, message) => send({ id, error: { code, message } });
+    const callTool = async (params) => {
+        const { MCP_TOOLS } = await import("../lib/mcp/tools.js");
+        const name = params.name;
+        if (typeof name !== "string" || !MCP_TOOLS.some((t) => t.name === name)) {
+            return toolError("unknown_tool", `unknown tool ${String(name)}`);
+        }
+        const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
+        try {
+            return await hqdRequest("mcp.call", { name, arguments: args, cwd, timeoutMs }, { socketPath, timeoutMs });
+        }
+        catch (err) {
+            if (!(err instanceof HqdClientError))
+                throw err;
+            if (UNREACHABLE_CODES.has(err.code)) {
+                return toolError("hqd_unreachable", `The HQ daemon (hqd) is not reachable at ${socketPath}. Run \`hq daemon status\` to check it, and \`hq daemon install\` if it is not installed. (${err.code})`);
+            }
+            return toolError(err.code, err.message);
+        }
+    };
+    const handle = async (msg) => {
+        const isRequest = msg.id !== undefined && msg.id !== null;
+        const id = msg.id ?? null;
+        const params = msg.params ?? {};
+        switch (msg.method) {
+            case "initialize": {
+                const requested = typeof params.protocolVersion === "string" ? params.protocolVersion : "";
+                const protocolVersion = MCP_PROTOCOL_VERSIONS.includes(requested) ? requested : MCP_PROTOCOL_VERSIONS[0];
+                reply(id, {
+                    protocolVersion,
+                    capabilities: { tools: { listChanged: false }, prompts: { listChanged: false } },
+                    serverInfo: { name: "hq", version: CLI_VERSION },
+                    instructions: "HQ tools, answered by the local HQ daemon. hq_resolve_company tells you which company the current repo belongs to; call it before company-scoped tools. If a tool returns hqd_unreachable, ask the user to run `hq daemon status`.",
+                });
+                return;
+            }
+            case "ping":
+                reply(id, {});
+                return;
+            case "tools/list":
+                reply(id, { tools: (await import("../lib/mcp/tools.js")).MCP_TOOLS });
+                return;
+            case "tools/call":
+                reply(id, await callTool(params));
+                return;
+            case "prompts/list":
+                reply(id, { prompts: (await import("../lib/mcp/prompts.js")).MCP_PROMPTS });
+                return;
+            case "prompts/get": {
+                const { getPrompt, PromptNotFoundError } = await import("../lib/mcp/prompts.js");
+                const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
+                try {
+                    reply(id, getPrompt(String(params.name), args, readHqRoot(env, home)));
+                }
+                catch (err) {
+                    if (!(err instanceof PromptNotFoundError))
+                        throw err;
+                    replyError(id, -32602, err.message);
+                }
+                return;
+            }
+            default:
+                // Notifications (initialized, cancelled, …) need no answer.
+                if (isRequest)
+                    replyError(id, -32601, `method not found: ${String(msg.method)}`);
+        }
+    };
+    return new Promise((resolve) => {
+        let inFlight = 0;
+        let ended = false;
+        const maybeDone = () => {
+            if (ended && inFlight === 0)
+                resolve();
+        };
+        const push = createLineSplitter((line) => {
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                replyError(null, -32700, "parse error");
+                return;
+            }
+            if (!msg || typeof msg !== "object" || Array.isArray(msg)) {
+                replyError(null, -32600, "invalid request");
+                return;
+            }
+            inFlight += 1;
+            handle(msg)
+                .catch((err) => {
+                if (msg.id !== undefined && msg.id !== null)
+                    replyError(msg.id, -32603, err instanceof Error ? err.message : String(err));
+                else
+                    process.stderr.write(`hq mcp serve: ${err instanceof Error ? err.message : String(err)}\n`);
+            })
+                .finally(() => {
+                inFlight -= 1;
+                maybeDone();
+            });
+        }, () => replyError(null, -32600, "request line too large"), 16 * 1024 * 1024);
+        input.on("data", push);
+        input.on("end", () => {
+            ended = true;
+            maybeDone();
+        });
+    });
+}
+//# sourceMappingURL=mcp-serve.js.map

package/dist/commands/mcp-status.js

@@ -389,6 +389,20 @@ export function registerMcpCommand(program) {
     const mcp = program
         .command('mcp')
         .description('MCP pack observability (read-only) across Claude + Codex');
+    mcp
+        .command('serve')
+        .description('Run the HQ stdio MCP server; every tool call is answered by hqd (`hq daemon status`)')
+        .action(async () => {
+        const { runMcpServe } = await import('./mcp-serve.js');
+        await runMcpServe();
+    });
+    mcp
+        .command('login')
+        .description('Sign in to the hosted HQ MCP connector with browser OAuth')
+        .action(async () => {
+        const { loginHostedMcp } = await import('../lib/daemon/mcp-oauth.js');
+        await loginHostedMcp();
+    });
     mcp
         .command('status')
         .alias('list')

package/dist/fast-core.js

@@ -39,11 +39,8 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     const useShell = entry.kind === "native" && Boolean(entry.familyFlagKey) && !familyEnabled;
     let worktreeScopeFixEnabled;
     if (entry.name === "repo-run-registry") {
-        const [{ CORE_RRR_WORKTREE_SCOPE_FIX_FLAG }, { fastFlagEnabled }] = await Promise.all([
-            import("./commands/core-rrr-worktree-scope-fix-flag.js"),
-            import("./native-fast-route.js"),
-        ]);
-        worktreeScopeFixEnabled = await fastFlagEnabled(CORE_RRR_WORKTREE_SCOPE_FIX_FLAG, process.env, { numericEnvironmentOverride: false });
+        const { coreRrrWorktreeScopeFixFastFlagEnabled } = await import("./commands/core-rrr-worktree-scope-fix-fast-flag.js");
+        worktreeScopeFixEnabled = await coreRrrWorktreeScopeFixFastFlagEnabled(process.env);
     }
     const shouldInjectRoot = useShell
         ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
@@ -57,7 +54,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     // its expected-user-error formatting remains authoritative.
     let hqRoot;
     if (shouldInjectRoot) {
-        const { resolveLiveRoot } = await import("./utils/hq-roots.js");
+        const { resolveLiveRoot } = await import("./utils/hq-roots-core.js");
         try {
             hqRoot = resolveLiveRoot(parsed.hqRootArg ? { hqRoot: parsed.hqRootArg } : {});
         }

package/dist/fast-scaffold.js

@@ -175,7 +175,11 @@ export const FAST_SCAFFOLD_SCRIPTS = [
     ...["share-suggestion-state", "repo-run-registry", "detect-stale-review-base"].map((name) => ({
         name,
         kind: "native",
-        modulePath: "./commands/core-hook-state-helpers-native.js",
+        modulePath: name === "share-suggestion-state"
+            ? "./commands/core-share-suggestion-state-fast.js"
+            : name === "repo-run-registry"
+                ? "./commands/core-repo-run-registry-fast.js"
+                : "./commands/core-detect-stale-review-base-fast.js",
         exportName: name === "share-suggestion-state"
             ? "runShareSuggestionStateFast"
             : name === "repo-run-registry"

package/dist/index.d.ts

@@ -14,6 +14,9 @@ export declare const __test__: {
     runCliEntry: typeof runCliEntry;
     isNpmPackageEntry: typeof isNpmPackageEntry;
     acquirePackageUseLease: (prefix: string, version: string, stateDirectory?: string) => Promise<import("./utils/package-use-lease.js").PackageUseLease>;
+    isMcpServeRequest: typeof isMcpServeRequest;
 };
+/** Exactly `hq mcp serve` with no further arguments; `--help` uses the command graph. */
+declare function isMcpServeRequest(argv: readonly string[]): boolean;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -77,6 +77,10 @@ function dispatchCliEntry() {
             });
         });
     }
+    else if (isMcpServeRequest(process.argv)) {
+        // Keep the minimal startup route; runMcpServe applies the hq-flags gate.
+        void import("./commands/mcp-serve.js").then(({ runMcpServe }) => runMcpServe());
+    }
     else if (parsedFastCore) {
         // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
         // dispatches straight to the bundled-script runner, so it never pays for the
@@ -163,5 +167,10 @@ export const __test__ = {
         const lease = await import("./utils/package-use-lease.js");
         return lease.acquirePackageUseLease(prefix, version, stateDirectory);
     },
+    isMcpServeRequest,
 };
+/** Exactly `hq mcp serve` with no further arguments; `--help` uses the command graph. */
+function isMcpServeRequest(argv) {
+    return argv.length === 4 && argv[2] === "mcp" && argv[3] === "serve";
+}
 //# sourceMappingURL=index.js.map

package/dist/lanes-drain-hook.js

@@ -1,8 +1,8 @@
 import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { fileURLToPath } from "node:url";
 import { MESSAGE_REPLAY_STATE_NAME, readMessageReplayState, updateMessageReplayTranscript, writeMessageReplayState, } from "./lib/lanes/message-replay.js";
+import { isMainModule } from "./utils/is-main-module.js";
 function parseHookInput(text) {
     if (text.trim() === "")
         return {};
@@ -193,7 +193,7 @@ async function main() {
     }
     finish(await runLaneDrainHook(process.env, input, inputError));
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isMainModule(import.meta.url)) {
     main().catch((err) => {
         process.stderr.write(`hq-lanes-drain: hook_runner_failed: ${err instanceof Error ? err.message : String(err)}\n`);
         // A hook runner failure must not stop the provider's requested tool call.

package/dist/lib/anywhere-runtime-fast-flag.d.ts

@@ -0,0 +1,3 @@
+/** Resolve the Anywhere gate from hq-flags without loading the CLI's large worker bundle. */
+export declare function anywhereRuntimeEnabledFromSnapshot(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=anywhere-runtime-fast-flag.d.ts.map

package/dist/lib/anywhere-runtime-fast-flag.js

@@ -0,0 +1,23 @@
+import { readLocalOverride, resolveFlag } from "@indigoai-us/hq-flags-client";
+import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { readFlagSnapshotFile } from "./flag-snapshot-file.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag-key.js";
+/** Resolve the Anywhere gate from hq-flags without loading the CLI's large worker bundle. */
+export function anywhereRuntimeEnabledFromSnapshot(env = process.env) {
+    const local = readLocalOverride(HQ_ANYWHERE_RUNTIME_FLAG, env);
+    if (local !== null)
+        return local;
+    const company = resolveProcessFlagCompanyContext(env);
+    const persisted = company.companyUid ? readFlagSnapshotFile(company.companyUid, { env }) : null;
+    const snapshot = persisted
+        ? { version: 0, flags: persisted.flags }
+        : null;
+    return resolveFlag({
+        flagKey: HQ_ANYWHERE_RUNTIME_FLAG,
+        env,
+        snapshot,
+        companyIdentifiers: [company.companyUid, company.companySlug].filter((value) => Boolean(value)),
+        lookup: { fallback: false },
+    }).value;
+}
+//# sourceMappingURL=anywhere-runtime-fast-flag.js.map