@indigoai-us/hq-cli 5.340.1-beta.0 → 5.341.0

package/CHANGELOG.md

@@ -2,8 +2,9 @@
 
 ## [Unreleased]
 
-## [5.340.1-beta.0] — 2026-10-03
-- Let `hq sync now` skip unchanged server-owned cloud placeholders while keeping their warnings visible, so the sync can complete.
+## [5.341.0] — 2026-10-03
+- Keep-alive reconciliation polls every 15 seconds and admits due lane resumes within the same sweep.
+- Add flag-gated `hq daemon login --stdin` for machine sign-in on disposable hosts. Credentials are piped over the local daemon socket, and the resulting token stays in hqd memory until restart or token expiry. Login is deadline-bounded, and the generic argv-based `hq daemon call` command cannot submit credentials.
 
 ## [5.340.0] — 2026-10-03
 - Preserve resolver output when child processes exit before Windows pipe data has drained.

package/assets/lanes-reconcile/hq-lanes-reconcile.timer

@@ -3,7 +3,7 @@ Description=Periodic HQ lanes reconcile pass
 
 [Timer]
 OnBootSec=30s
-OnUnitActiveSec=1min
+OnUnitActiveSec=15s
 AccuracySec=10s
 Persistent=true
 Unit=hq-lanes-reconcile.service

package/dist/command-catalog.generated.d.ts

@@ -13278,6 +13278,31 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "login";
+        readonly description: "Sign the running daemon in from machine credentials piped on stdin; credentials and tokens stay off disk";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] [extra...]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "extra";
+            readonly required: false;
+            readonly variadic: true;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--stdin";
+            readonly description: "Read a machine credentials JSON object from stdin";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--status";
+            readonly description: "Show whether hqd has an in-memory machine sign-in";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "call";
         readonly description: "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, mcp.call, …) and print the result as JSON";

package/dist/command-catalog.generated.js

@@ -16149,6 +16149,37 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "login",
+                "description": "Sign the running daemon in from machine credentials piped on stdin; credentials and tokens stay off disk",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] [extra...]",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "extra",
+                        "required": false,
+                        "variadic": true,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--stdin",
+                        "description": "Read a machine credentials JSON object from stdin",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--status",
+                        "description": "Show whether hqd has an in-memory machine sign-in",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "call",
                 "description": "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, mcp.call, …) and print the result as JSON",

package/dist/commands/cloud.js

@@ -1751,7 +1751,6 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             hqRoot,
             progressRecorder: trackingProgressRecorder(planLimitTracker, pushProgressCompany),
             skipUnchanged: true,
-            serverOwnedPathPolicy: "skip",
             propagateDeletes: true,
             propagateDeletePolicy: resolveDeletePolicy(),
             ...(onConflict ? { onConflict } : {}),

package/dist/commands/daemon.d.ts

@@ -42,6 +42,8 @@ export interface DaemonCommandDeps {
     daemonAlive: (pid: number) => boolean;
     /** Test seam for the company sync-mode commands. */
     syncModeClient?: () => Promise<SyncModeVaultClient>;
+    /** Reads stdin for the one-shot daemon machine login; never reads env or argv credentials. */
+    readStdin?: () => Promise<string>;
     windowsUser?: string;
     windowsHeadlessLauncher?: string;
     systemUnitDir?: string;

package/dist/commands/daemon.js

@@ -32,6 +32,8 @@ import { writeControlRequest } from "../lib/daemon/requests.js";
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
 import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
+import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
+import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 class DaemonCommandError extends Error {
 }
@@ -81,6 +83,7 @@ async function loadDefaults(over) {
         isRoot: over.isRoot ?? (typeof process.getuid === "function" && process.getuid() === 0),
         fileExists: over.fileExists ?? fs.existsSync,
         readFile: over.readFile ?? ((p) => fs.readFileSync(p, "utf8")),
+        readStdin: over.readStdin,
         writeFile: over.writeFile ??
             ((p, text) => {
                 fs.mkdirSync(path.dirname(p), { recursive: true });
@@ -105,6 +108,27 @@ async function loadDefaults(over) {
         systemRecordPath: over.systemRecordPath ?? path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
     };
 }
+async function readLoginStdin() {
+    if (process.stdin.isTTY)
+        throw new DaemonCommandError("Pipe machine credentials to `hq daemon login --stdin`.");
+    const chunks = [];
+    let bytes = 0;
+    try {
+        for await (const chunk of process.stdin) {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            bytes += buffer.byteLength;
+            if (bytes > 64 * 1024)
+                throw new DaemonCommandError("stdin credentials are too large");
+            chunks.push(buffer);
+        }
+    }
+    catch (err) {
+        if (err instanceof DaemonCommandError)
+            throw err;
+        throw new DaemonCommandError("Could not read machine credentials from stdin.");
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
 function detect(d, flag, config) {
     return detectMachineType(flag, {
         platform: d.platform,
@@ -767,6 +791,45 @@ export function registerDaemonCommand(program, over = {}) {
             hqBinary: d.hqBinary,
         });
     }));
+    daemon
+        .command("login [extra...]")
+        .description("Sign the running daemon in from machine credentials piped on stdin; credentials and tokens stay off disk")
+        .option("--stdin", "Read a machine credentials JSON object from stdin")
+        .option("--status", "Show whether hqd has an in-memory machine sign-in")
+        .allowUnknownOption(true)
+        .action(wrap(async (d, extra, opts) => {
+        requireAnywhereRuntime();
+        if (extra?.length)
+            throw new DaemonCommandError("Machine credentials are accepted from stdin only; do not pass credentials as arguments.");
+        const socketPath = hqdSocketPath(d.home, d.env, d.platform);
+        if (opts.status) {
+            let result;
+            try {
+                result = await hqdRequest("auth.status", {}, { socketPath });
+            }
+            catch {
+                throw new DaemonCommandError("Could not read the daemon sign-in status.");
+            }
+            d.out(`hqd signed in: ${result.signedIn === true ? "yes" : "no"} (memory only)`);
+            return;
+        }
+        if (!opts.stdin)
+            throw new DaemonCommandError("Use `hq daemon login --stdin` to provide machine credentials.");
+        const raw = await (d.readStdin ?? readLoginStdin)();
+        const credentials = parseStdinMachineCredentials(raw);
+        try {
+            await hqdRequest("auth.login", { credentials }, { socketPath, timeoutMs: 30_000 });
+        }
+        catch (error) {
+            if (error instanceof HqdClientError) {
+                throw new DaemonCommandError(error.code === "anywhere_disabled"
+                    ? "HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use daemon login."
+                    : "Could not sign hqd in. Check the machine credentials and daemon status.");
+            }
+            throw new DaemonCommandError("Could not sign hqd in. Check the machine credentials and daemon status.");
+        }
+        d.out("Signed in hqd. The token is held in daemon memory and will be lost when hqd restarts.");
+    }));
     daemon
         .command("call <op>")
         .description("Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, mcp.call, …) and print the result as JSON")
@@ -774,6 +837,9 @@ export function registerDaemonCommand(program, over = {}) {
         .option("--timeout <ms>", "Give up after this many milliseconds")
         .action(wrap(async (d, op, opts) => {
         requireAnywhereRuntime();
+        if (op === "auth.login") {
+            throw new Error("Use `hq daemon login --stdin`; credentials are accepted from stdin only.");
+        }
         let args;
         try {
             args = JSON.parse(opts.json);

package/dist/lib/daemon/catalog.js

@@ -230,7 +230,7 @@ function planService(service, ctx) {
             return [
                 base(service, {
                     kind: "scheduled",
-                    intervalSec: 60,
+                    intervalSec: 15,
                     initialDelaySec: 30,
                     command: { type: "hq", args: ["lanes", "reconcile"] },
                     env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},

package/dist/lib/daemon/machine-login.d.ts

@@ -0,0 +1,20 @@
+/** Ephemeral Cognito machine login for a resident hqd process. */
+import type { MachineCreds } from "@indigoai-us/hq-cloud";
+export declare class MachineLoginError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export type StdinMachineCredentials = Pick<MachineCreds, "username" | "secret"> & Partial<Pick<MachineCreds, "clientId" | "region" | "entityType" | "entityUid">>;
+/** Parse only the established machine-creds fields. Parse errors never include input text. */
+export declare function parseStdinMachineCredentials(raw: string): StdinMachineCredentials;
+export interface MachineAuthenticatorOptions {
+    endpoint?: string;
+    fetchImpl?: typeof fetch;
+    env?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+}
+/** Read the Cognito ID token expiry without exposing or persisting the token. */
+export declare function machineTokenExpiresAt(token: string): number;
+/** Authenticate without using hq-cloud's persistent machine token cache. */
+export declare function authenticateMachineCredentials(credentials: StdinMachineCredentials, options?: MachineAuthenticatorOptions): Promise<string>;
+//# sourceMappingURL=machine-login.d.ts.map

package/dist/lib/daemon/machine-login.js

@@ -0,0 +1,102 @@
+/** Ephemeral Cognito machine login for a resident hqd process. */
+import { DEFAULT_COGNITO } from "../../utils/cognito-session.js";
+const MAX_STDIN_BYTES = 64 * 1024;
+export class MachineLoginError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MachineLoginError";
+    }
+}
+/** Parse only the established machine-creds fields. Parse errors never include input text. */
+export function parseStdinMachineCredentials(raw) {
+    if (Buffer.byteLength(raw, "utf8") > MAX_STDIN_BYTES) {
+        throw new MachineLoginError("bad_credentials", "stdin credentials are too large");
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new MachineLoginError("bad_credentials", "stdin must contain a machine credentials JSON object");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new MachineLoginError("bad_credentials", "stdin must contain a machine credentials JSON object");
+    }
+    const input = value;
+    const allowed = new Set(["username", "secret", "clientId", "region", "entityType", "entityUid"]);
+    if (Object.keys(input).some((key) => !allowed.has(key))) {
+        throw new MachineLoginError("bad_credentials", "stdin credentials contain an unsupported field");
+    }
+    if (typeof input.username !== "string" || !input.username.trim() || typeof input.secret !== "string" || !input.secret) {
+        throw new MachineLoginError("bad_credentials", "stdin credentials require non-empty username and secret fields");
+    }
+    for (const name of ["clientId", "region", "entityUid"]) {
+        if (input[name] !== undefined && (typeof input[name] !== "string" || !input[name].trim())) {
+            throw new MachineLoginError("bad_credentials", `stdin credentials have an invalid ${name} field`);
+        }
+    }
+    if (input.entityType !== undefined && input.entityType !== "agent" && input.entityType !== "outpost") {
+        throw new MachineLoginError("bad_credentials", "stdin credentials have an invalid entityType field");
+    }
+    return input;
+}
+/** Read the Cognito ID token expiry without exposing or persisting the token. */
+export function machineTokenExpiresAt(token) {
+    try {
+        const encodedPayload = token.split(".")[1];
+        if (!encodedPayload)
+            throw new Error("missing JWT payload");
+        const payload = JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8"));
+        if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp))
+            throw new Error("missing JWT expiry");
+        return payload.exp * 1000;
+    }
+    catch {
+        throw new MachineLoginError("auth_failed", "hqd sign-in failed; the identity provider returned an invalid token");
+    }
+}
+/** Authenticate without using hq-cloud's persistent machine token cache. */
+export async function authenticateMachineCredentials(credentials, options = {}) {
+    const env = options.env ?? process.env;
+    const region = credentials.region ?? env.AWS_REGION ?? DEFAULT_COGNITO.region;
+    const clientId = credentials.clientId ?? env.HQ_COGNITO_CLIENT_ID ?? DEFAULT_COGNITO.clientId;
+    const endpoint = options.endpoint ?? `https://cognito-idp.${region}.amazonaws.com/`;
+    let response;
+    try {
+        response = await (options.fetchImpl ?? fetch)(endpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-amz-json-1.1",
+                "X-Amz-Target": "AWSCognitoIdentityProviderService.InitiateAuth",
+            },
+            signal: options.signal,
+            body: JSON.stringify({
+                AuthFlow: "USER_PASSWORD_AUTH",
+                ClientId: clientId,
+                AuthParameters: { USERNAME: credentials.username, PASSWORD: credentials.secret },
+            }),
+        });
+    }
+    catch {
+        throw new MachineLoginError("auth_failed", "hqd sign-in failed; check the machine credentials and try again");
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new MachineLoginError("auth_failed", "hqd sign-in failed; check the machine credentials and try again");
+    }
+    if (!response.ok || !body || typeof body !== "object" || Array.isArray(body)) {
+        throw new MachineLoginError("auth_failed", "hqd sign-in failed; check the machine credentials and try again");
+    }
+    const result = body.AuthenticationResult;
+    const idToken = result && typeof result === "object" ? result.IdToken : undefined;
+    if (typeof idToken !== "string" || !idToken) {
+        throw new MachineLoginError("auth_failed", "hqd sign-in failed; check the machine credentials and try again");
+    }
+    return idToken;
+}
+//# sourceMappingURL=machine-login.js.map

package/dist/lib/daemon/ops/mcp.d.ts

@@ -14,6 +14,7 @@ export interface McpToolResult {
 export declare function jsonResult(value: unknown): McpToolResult;
 export declare const HQ_MCP_HTTP_TIMEOUT_MS = 30000;
 export declare function resolveHqMcpEndpoint(env?: NodeJS.ProcessEnv): URL;
+export declare function defaultMcpToken(): Promise<string>;
 export interface HqMcpBridgeOptions {
     endpoint?: URL;
     env?: NodeJS.ProcessEnv;

package/dist/lib/daemon/ops/mcp.js

@@ -27,7 +27,7 @@ export function resolveHqMcpEndpoint(env = process.env) {
         throw error;
     }
 }
-async function defaultMcpToken() {
+export async function defaultMcpToken() {
     const { ensureCognitoToken, resolveCognitoTokenSource } = await import("../../../utils/cognito-session.js");
     if (resolveCognitoTokenSource() !== "machine") {
         const { getMcpAudienceToken, McpOAuthError } = await import("../mcp-oauth.js");

package/dist/lib/daemon/protocol.d.ts

@@ -7,7 +7,7 @@
  * out of order, so clients match them by `id`.
  */
 export declare const HQD_SOCKET_NAME = "hqd.sock";
-export declare const HQD_OPS: readonly ["ping", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "shutdown"];
+export declare const HQD_OPS: readonly ["ping", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "auth.login", "auth.status", "shutdown"];
 export type HqdOp = (typeof HQD_OPS)[number];
 /** A request line larger than this is rejected and the connection closed. */
 export declare const HQD_MAX_LINE_BYTES: number;

package/dist/lib/daemon/protocol.js

@@ -23,6 +23,8 @@ export const HQD_OPS = [
     "memory.put",
     "mesh.presence",
     "mcp.call",
+    "auth.login",
+    "auth.status",
     "shutdown",
 ];
 /** A request line larger than this is rejected and the connection closed. */

package/dist/lib/daemon/server.d.ts

@@ -9,6 +9,7 @@
 import { type ResolveResult } from "../registry/registry.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
+import { type StdinMachineCredentials } from "./machine-login.js";
 export interface HqdServerOptions {
     socketPath: string;
     /** registry.json to resolve against (US-004). */
@@ -27,6 +28,10 @@ export interface HqdServerOptions {
     mcpEnabled?: () => boolean | Promise<boolean>;
     /** Test seam for the hosted Streamable HTTP MCP transport. */
     mcpBridge?: HqMcpBridge;
+    /** Test seam for machine login while keeping production credentials off disk. */
+    machineAuthenticator?: (credentials: StdinMachineCredentials, signal?: AbortSignal) => Promise<string>;
+    /** Test seam for the bounded Cognito login request. */
+    machineAuthTimeoutMs?: number;
     /** Test seam for reduced host parity runs without spawning an agent process. */
     workerDispatch?: (request: RunWorkerRequest, hqRoot: string, env: NodeJS.ProcessEnv, now: Date) => Promise<Record<string, unknown>>;
     /** Crash reporter for internal op failures (US-012); run.ts wires Sentry here. */

package/dist/lib/daemon/server.js

@@ -17,7 +17,8 @@ import { journalAppend, JournalOpError } from "./ops/journal.js";
 import { memoryGet, memoryPut, MemoryOpError } from "./ops/memory.js";
 import { meshPresence, MeshOpError } from "./ops/mesh.js";
 import { PolicyIndex, PolicyOpError, policyCheck } from "./ops/policy.js";
-import { HqMcpBridge, jsonResult, McpOpError, runWorker } from "./ops/mcp.js";
+import { defaultMcpToken, HqMcpBridge, jsonResult, McpOpError, runWorker } from "./ops/mcp.js";
+import { authenticateMachineCredentials, machineTokenExpiresAt, MachineLoginError, parseStdinMachineCredentials } from "./machine-login.js";
 import { HQ_MCP_TOOL_NAMES, HQD_NATIVE_TOOL_NAMES } from "../mcp/tools.js";
 import { anywhereRuntimeEnabled, HQ_ANYWHERE_RUNTIME_FLAG } from "../../commands/anywhere-runtime-flag.js";
 // The allowlist is deliberately read-only. A newly added hosted MCP tool must
@@ -110,6 +111,7 @@ export async function startHqdServer(opts) {
     const clock = opts.now ?? (() => new Date());
     const env = opts.env ?? process.env;
     const policyIndex = opts.hqRoot ? new PolicyIndex(opts.hqRoot, log) : null;
+    let ephemeralMachineToken;
     const requireRoot = () => {
         if (!opts.hqRoot)
             throw new OpError("no_hq_root", "hqd has no HQ root configured (set hqRoot in daemon config or HQ_ROOT)");
@@ -157,6 +159,45 @@ export async function startHqdServer(opts) {
                     pid: process.pid,
                     sessions: sessions.size,
                 };
+            case "auth.status":
+                return Promise.resolve(mcpEnabled()).then((enabled) => {
+                    if (!enabled)
+                        throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                    if (ephemeralMachineToken && ephemeralMachineToken.expiresAt <= clock().getTime())
+                        ephemeralMachineToken = undefined;
+                    return { signedIn: Boolean(ephemeralMachineToken), tokenSource: ephemeralMachineToken ? "stdin-memory" : null };
+                });
+            case "auth.login":
+                return Promise.resolve(mcpEnabled()).then(async (enabled) => {
+                    if (!enabled)
+                        throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                    const credentials = parseStdinMachineCredentials(JSON.stringify(args.credentials) ?? "");
+                    const controller = new AbortController();
+                    const timeoutMs = opts.machineAuthTimeoutMs ?? 25_000;
+                    let timer;
+                    try {
+                        const authentication = (opts.machineAuthenticator ?? ((input, signal) => authenticateMachineCredentials(input, { env, signal })))(credentials, controller.signal);
+                        const deadline = new Promise((_, reject) => {
+                            timer = setTimeout(() => {
+                                controller.abort();
+                                reject(new MachineLoginError("auth_timeout", "hqd sign-in timed out; try again"));
+                            }, timeoutMs);
+                        });
+                        const token = await Promise.race([authentication, deadline]);
+                        const expiresAt = machineTokenExpiresAt(token);
+                        if (expiresAt <= clock().getTime())
+                            throw new MachineLoginError("auth_failed", "hqd sign-in failed; the identity provider returned an expired token");
+                        ephemeralMachineToken = { value: token, expiresAt };
+                    }
+                    catch {
+                        throw new MachineLoginError("auth_failed", "hqd sign-in failed; check the machine credentials and try again");
+                    }
+                    finally {
+                        if (timer)
+                            clearTimeout(timer);
+                    }
+                    return { signedIn: true, tokenSource: "stdin-memory" };
+                });
             case "resolve": {
                 const cwd = stringArg(args, "cwd");
                 return resolve(cwd);
@@ -309,7 +350,19 @@ export async function startHqdServer(opts) {
                             if (remainingMs <= 0) {
                                 throw new McpOpError("hq_mcp_timeout", `Hosted hq-mcp request exceeded its ${timeoutMs}ms end-to-end deadline before forwarding.`);
                             }
-                            hqMcp ??= new HqMcpBridge({ env });
+                            hqMcp ??= new HqMcpBridge({
+                                env,
+                                getToken: async () => {
+                                    if (ephemeralMachineToken) {
+                                        if (ephemeralMachineToken.expiresAt <= clock().getTime()) {
+                                            ephemeralMachineToken = undefined;
+                                            throw new Error("The stdin machine sign-in expired; sign hqd in again.");
+                                        }
+                                        return ephemeralMachineToken.value;
+                                    }
+                                    return defaultMcpToken();
+                                },
+                            });
                             return hqMcp.callTool(name, raw, remainingMs);
                         });
                         return !MCP_READ_ONLY_TOOL_NAMES.has(name)
@@ -353,7 +406,8 @@ export async function startHqdServer(opts) {
                     err instanceof JournalOpError ||
                     err instanceof MemoryOpError ||
                     err instanceof MeshOpError ||
-                    err instanceof McpOpError
+                    err instanceof McpOpError ||
+                    err instanceof MachineLoginError
                     ? { code: err.code, message: err.message }
                     : { code: "internal", message: err instanceof Error ? err.message : String(err) };
                 if (error.code === "internal") {

package/dist/lib/lanes/reconcile-install.d.ts

@@ -6,7 +6,7 @@
  * unit files under a systemd user dir and is idempotent and reversible.
  * Enabling the timer is optional — the CLI pass works without it.
  */
-export declare const RECONCILE_TIMER_INTERVAL = "1min";
+export declare const RECONCILE_TIMER_INTERVAL = "15s";
 export interface ProviderPathEnv {
     /**
      * For each resolved provider: the directory where the command name was

package/dist/lib/lanes/reconcile-install.js

@@ -13,7 +13,7 @@ import { LanesError } from "./errors.js";
 import { RECONCILE_TIMER_NAME, RECONCILE_UNIT_NAME } from "./reconcile.js";
 import { resolveHqBinary, resolveNodeBinary, } from "../mesh/live/daemon/install.js";
 import { SYSTEMD_PATH_ENV } from "../service-manager/systemd.js";
-export const RECONCILE_TIMER_INTERVAL = "1min";
+export const RECONCILE_TIMER_INTERVAL = "15s";
 /**
  * Resolve provider commands with the installing shell's PATH. The resulting
  * directories are carried into the systemd unit, whose default PATH is too

package/dist/lib/lanes/reconcile.js

@@ -1209,13 +1209,17 @@ export async function runPassBody(hqRoot, deps) {
         cpuObservation,
         skipAdmissionWithoutCpuSample: !hasAdmissionCandidates,
     };
+    let dueKeepAliveLaneIds = new Set();
     await withAllLaneAdmissionLocks(hqRoot, async () => {
         const freshLanes = loadLaneRecords(hqRoot, summary);
         const freshQuestions = loadQuestionRecords(hqRoot, summary);
         await closeInterruptedDoneStoryWorkers(hqRoot, freshLanes, freshQuestions, summary, admissionDeps, now, storyCloseEnabledByCompany);
-        await resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, admissionDeps, now, keepAliveFlagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, deps.terminalKeepAliveCandidate);
+        const dueKeepAlivesAdmitted = await resumeKeepAlive(hqRoot, freshLanes, freshQuestions, summary, admissionDeps, now, keepAliveFlagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, deps.terminalKeepAliveCandidate, async (laneIds) => {
+            dueKeepAliveLaneIds = new Set(laneIds);
+            await admitQueued(hqRoot, loadLaneRecords(hqRoot, summary), summary, admissionDeps, now, laneIds);
+        });
         const drainLanes = loadLaneRecords(hqRoot, summary);
-        await admitQueued(hqRoot, drainLanes, summary, admissionDeps, now);
+        await admitQueued(hqRoot, drainLanes, summary, admissionDeps, now, undefined, dueKeepAlivesAdmitted ? dueKeepAliveLaneIds : undefined);
         await resumeAwaiting(hqRoot, drainLanes, freshQuestions, summary, admissionDeps);
     });
     if (!deps.dryRun && cpuObservation.snapshot !== undefined) {
@@ -1715,7 +1719,7 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
         }
     }
 }
-async function admitQueued(hqRoot, lanes, summary, deps, now, onlyLaneIds) {
+async function admitQueued(hqRoot, lanes, summary, deps, now, onlyLaneIds, excludeLaneIds) {
     if (onlyLaneIds === undefined)
         expireAbandonedPickupValidation(hqRoot, lanes, summary, deps, now);
     // A lane whose pickup probe is still out is not admitted: its record is
@@ -1724,6 +1728,7 @@ async function admitQueued(hqRoot, lanes, summary, deps, now, onlyLaneIds) {
     const localQueued = lanes
         .filter((lane) => lane.state === "queued" &&
         (onlyLaneIds === undefined || onlyLaneIds.has(lane.lane_id)) &&
+        (excludeLaneIds === undefined || !excludeLaneIds.has(lane.lane_id)) &&
         lane.pickup_validation_pending !== true &&
         laneRunsHere(lane, deps.host))
         .filter((lane) => !hasFreshAdmissionReservation(lane, now.getTime()))
@@ -2324,7 +2329,7 @@ function appendBlockedKeepAliveHistory(hqRoot, lane, terminalAt, at, reason, dep
         }),
     }), false);
 }
-async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, flagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, terminalKeepAliveCandidate) {
+async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, flagByCompany, supersessionLineageAwareByCompany, blockedResumeFlagByCompany, immediateFirstResumeFlagByCompany, terminalKeepAliveCandidate, admitDueCandidates) {
     const nowMs = now.getTime();
     const nowIso = now.toISOString();
     const config = loadLanesConfig(hqRoot);
@@ -2347,7 +2352,39 @@ async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, fla
             markError(summary, err);
         }
     }
-    for (const originalLane of lanes) {
+    const dueCandidateIds = new Set();
+    if (admitDueCandidates !== undefined && terminalKeepAliveCandidate === undefined) {
+        for (const lane of lanes) {
+            if (lane.state !== "done" || lane.keep_alive !== true || !laneRunsHere(lane, deps.host))
+                continue;
+            const envelope = readLatestEnvelopeRecord(hqRoot, lane.lane_id)?.envelope;
+            if (!envelope || envelope.decision !== "done" || hasPendingKeepAliveWork(hqRoot, lane, questions))
+                continue;
+            const anchorMs = Date.parse(lane.last_envelope?.at ?? lane.updated_at);
+            const nextCheckMs = Date.parse(envelope.next_check_at ?? "");
+            if (!Number.isFinite(anchorMs) || !Number.isFinite(nextCheckMs))
+                continue;
+            const cappedNextCheckMs = Math.min(nextCheckMs, anchorMs + LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_MAX_DELAY_MS);
+            if (cappedNextCheckMs <= nowMs &&
+                doneKeepAliveVerdict(lane, envelope, false, { nowMs, nextCheckAnchorMs: anchorMs }) === "eligible")
+                dueCandidateIds.add(lane.lane_id);
+        }
+    }
+    const candidates = dueCandidateIds.size === 0
+        ? lanes
+        : [...lanes].sort((a, b) => Number(dueCandidateIds.has(b.lane_id)) - Number(dueCandidateIds.has(a.lane_id)));
+    const queuedDueCandidateIds = new Set();
+    let dueAdmissionRan = false;
+    const admitQueuedDueCandidates = async () => {
+        if (dueAdmissionRan || queuedDueCandidateIds.size === 0 || admitDueCandidates === undefined)
+            return;
+        dueAdmissionRan = true;
+        await admitDueCandidates(new Set(queuedDueCandidateIds));
+    };
+    for (const originalLane of candidates) {
+        if (admitDueCandidates !== undefined && dueCandidateIds.size > 0 && !dueCandidateIds.has(originalLane.lane_id)) {
+            await admitQueuedDueCandidates();
+        }
         if (terminalKeepAliveCandidate && (originalLane.lane_id !== terminalKeepAliveCandidate.laneId ||
             originalLane.version !== terminalKeepAliveCandidate.version ||
             originalLane.state !== "done"))
@@ -3012,6 +3049,8 @@ async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, fla
         }
         if (!queued.changed)
             continue;
+        if (resumeReason === "next_check_at_due")
+            queuedDueCandidateIds.add(current.lane_id);
         summary.resumed.push({
             id: current.lane_id,
             from: resumedFrom,
@@ -3032,6 +3071,8 @@ async function resumeKeepAlive(hqRoot, lanes, questions, summary, deps, now, fla
             });
         }
     }
+    await admitQueuedDueCandidates();
+    return dueAdmissionRan;
 }
 async function resumeAwaiting(hqRoot, lanes, questions, summary, deps, onlyLaneIds) {
     const config = loadLanesConfig(hqRoot);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.340.1-beta.0",
+  "version": "5.341.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {