@indigoai-us/hq-cli 5.341.1 → 5.341.2

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.341.2] — 2026-10-03
+
+- Preserve the original integrations response read error instead of returning a consumed response.
+
+- The CLI no longer starts while a confirmed Desktop update is in progress after a lease I/O error.
+- hqd refreshes `hq-anywhere-runtime` every 30 seconds, fails closed when the last successful read is older than 60 seconds, and clears its in-memory stdin login when the flag turns off.
+- Hardened hqd company resolution so unreadable registries and registry links to companies missing from the configured HQ manifest fall back to personal context. Added adversarial coverage for symlinks, nested repositories, clones, path normalization, worktrees, and session bindings.
+
 ## [5.341.1] — 2026-10-03
 - Match native policy frontmatter and report bytes to the bundled shell on Windows, including paths, diagnostics, and JSON newlines.
 - Keep session-journal printable paths byte-compatible with the shell on Windows.

package/dist/bin/hq-auth-refresh.d.ts

@@ -18,6 +18,6 @@ type RefreshSession = (options?: {
     minValiditySeconds?: number;
 }) => ReturnType<typeof refreshCachedSession>;
 export declare function runAuthRefresh(refreshSession?: RefreshSession): Promise<number>;
-export declare function startAuthRefresh(acquireLease?: typeof acquireCurrentPackageUseLease): Promise<number>;
+export declare function startAuthRefresh(acquireLease?: typeof acquireCurrentPackageUseLease, updateRequestPending?: () => boolean): Promise<number>;
 export {};
 //# sourceMappingURL=hq-auth-refresh.d.ts.map

package/dist/bin/hq-auth-refresh.js

@@ -13,7 +13,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 import "../node-preflight.js";
-import { acquireCurrentPackageUseLease } from "../utils/package-use-lease.js";
+import { acquireCurrentPackageUseLease, currentPackageUseUpdatePending, } from "../utils/package-use-lease.js";
 import "../node-network-compat.js";
 import { isMainModule } from "../utils/is-main-module.js";
 const MIN_VALIDITY_FLAG = "--min-validity-seconds";
@@ -93,7 +93,7 @@ function packageUseErrorClass(error) {
     }
     return typeof value.name === "string" ? value.name : "unknown";
 }
-export async function startAuthRefresh(acquireLease = acquireCurrentPackageUseLease) {
+export async function startAuthRefresh(acquireLease = acquireCurrentPackageUseLease, updateRequestPending = currentPackageUseUpdatePending) {
     try {
         acquireLease();
     }
@@ -102,6 +102,15 @@ export async function startAuthRefresh(acquireLease = acquireCurrentPackageUseLe
             process.stderr.write(`hq-auth-refresh: ${error instanceof Error ? error.message : "The HQ CLI package is being updated"}\n`);
             return 1;
         }
+        try {
+            if (updateRequestPending()) {
+                process.stderr.write("hq-auth-refresh: The HQ CLI package is being updated; retry after the update finishes\n");
+                return 1;
+            }
+        }
+        catch {
+            // A failed pending-request probe preserves the existing fail-open behavior.
+        }
         process.stderr.write(`hq-auth-refresh: package-use lease unavailable (${packageUseErrorClass(error)}); continuing without lease\n`);
     }
     const { initSentry } = await import("../sentry.js");

package/dist/index.d.ts

@@ -4,8 +4,9 @@ import "./node-network-compat-fast.js";
 import { isVersionRequest } from "./version-request.js";
 import { isFastCoreRequest } from "./fast-scaffold.js";
 type PackageUseLeaseLoader = () => Promise<void>;
+type PackageUseUpdateProbe = () => Promise<boolean>;
 declare function isNpmPackageEntry(entryUrl: string): boolean;
-declare function dispatchWithPackageUseLease(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader): void | Promise<void>;
+declare function dispatchWithPackageUseLease(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader, updateRequestPending?: PackageUseUpdateProbe): void | Promise<void>;
 declare function runCliEntry(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader): void | Promise<void>;
 export declare const __test__: {
     isVersionRequest: typeof isVersionRequest;

package/dist/index.js

@@ -140,14 +140,30 @@ function packageUseErrorClass(error) {
 function dispatchWithPackageUseLease(entryUrl, dispatch, loadLease = async () => {
     const { acquireCurrentPackageUseLease } = await import("./utils/package-use-lease.js");
     acquireCurrentPackageUseLease();
+}, updateRequestPending = async () => {
+    const { currentPackageUseUpdatePending } = await import("./utils/package-use-lease.js");
+    return currentPackageUseUpdatePending();
 }) {
     if (!isNpmPackageEntry(entryUrl)) {
         dispatch();
         return;
     }
-    return loadLease().then(dispatch, (error) => {
+    return loadLease().then(dispatch, async (error) => {
         if (isPackageUseUpdatePendingError(error))
             throw error;
+        try {
+            if (await updateRequestPending()) {
+                const pending = new Error("The HQ CLI package is being updated; retry after the update finishes");
+                pending.name = "PackageUseUpdatePendingError";
+                throw pending;
+            }
+        }
+        catch (probeError) {
+            if (isPackageUseUpdatePendingError(probeError))
+                throw probeError;
+            // A lease probe failure must not make the CLI unavailable. Keep the
+            // existing fail-open path when no live update request could be confirmed.
+        }
         process.stderr.write(`hq-cli package-use lease unavailable (${packageUseErrorClass(error)}); continuing without lease\n`);
         dispatch();
     });

package/dist/lib/daemon/flag-monitor.d.ts

@@ -0,0 +1,18 @@
+export declare const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30000;
+export declare const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60000;
+export interface BoundedDaemonFlagMonitorOptions {
+    read: () => Promise<boolean>;
+    now?: () => number;
+    onChange?: (enabled: boolean) => void;
+    onReadError?: (error: unknown) => void;
+}
+export interface BoundedDaemonFlagMonitor {
+    enabled(): Promise<boolean>;
+    close(): void;
+}
+/**
+ * Refreshes a long-running daemon's flag independently of incoming requests.
+ * A failed read keeps the last successful decision only until its 60s age limit.
+ */
+export declare function createBoundedDaemonFlagMonitor(options: BoundedDaemonFlagMonitorOptions): BoundedDaemonFlagMonitor;
+//# sourceMappingURL=flag-monitor.d.ts.map

package/dist/lib/daemon/flag-monitor.js

@@ -0,0 +1,86 @@
+export const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30_000;
+export const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
+/**
+ * Refreshes a long-running daemon's flag independently of incoming requests.
+ * A failed read keeps the last successful decision only until its 60s age limit.
+ */
+export function createBoundedDaemonFlagMonitor(options) {
+    const now = options.now ?? Date.now;
+    let value;
+    let lastSuccessAt;
+    let lastAttemptAt;
+    let successVersion = 0;
+    let refreshInFlight;
+    let expiryTimer;
+    let closed = false;
+    const publish = (next) => {
+        const changed = value !== next;
+        value = next;
+        if (changed)
+            options.onChange?.(next);
+    };
+    const expireIfStale = () => {
+        if (!closed && lastSuccessAt !== undefined && now() - lastSuccessAt >= HQ_ANYWHERE_FLAG_MAX_STALENESS_MS) {
+            publish(false);
+        }
+    };
+    const refresh = () => {
+        if (closed)
+            return Promise.resolve(false);
+        if (refreshInFlight)
+            return refreshInFlight;
+        lastAttemptAt = now();
+        refreshInFlight = Promise.resolve().then(options.read).then((next) => {
+            if (closed)
+                return false;
+            lastSuccessAt = now();
+            const thisSuccessVersion = ++successVersion;
+            publish(next);
+            if (expiryTimer)
+                clearTimeout(expiryTimer);
+            // Expire from the elapsed timer itself, not a wall-clock comparison.
+            expiryTimer = setTimeout(() => {
+                if (!closed && successVersion === thisSuccessVersion)
+                    publish(false);
+            }, HQ_ANYWHERE_FLAG_MAX_STALENESS_MS);
+            expiryTimer.unref?.();
+            return next;
+        }).catch((error) => {
+            options.onReadError?.(error);
+            expireIfStale();
+            return value ?? false;
+        }).finally(() => {
+            refreshInFlight = undefined;
+        });
+        return refreshInFlight;
+    };
+    const refreshTimer = setInterval(() => {
+        expireIfStale();
+        void refresh();
+    }, HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS);
+    refreshTimer.unref?.();
+    void refresh();
+    return {
+        async enabled() {
+            expireIfStale();
+            if (lastSuccessAt !== undefined && now() - lastSuccessAt >= HQ_ANYWHERE_FLAG_MAX_STALENESS_MS) {
+                void refresh();
+                return false;
+            }
+            if (value === undefined)
+                return refresh();
+            if (lastAttemptAt === undefined || now() - lastAttemptAt >= HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS) {
+                void refresh();
+            }
+            return value;
+        },
+        close() {
+            closed = true;
+            if (refreshTimer)
+                clearInterval(refreshTimer);
+            if (expiryTimer)
+                clearTimeout(expiryTimer);
+        },
+    };
+}
+//# sourceMappingURL=flag-monitor.js.map

package/dist/lib/daemon/flag.d.ts

@@ -20,6 +20,8 @@ export interface ReadDaemonFlagOptions {
     createClient?: (options: FlagClientOptions) => DaemonFlagClient;
     getToken?: () => Promise<string>;
     onError?: (error: unknown) => void;
+    /** Reject a failed registry read so the daemon monitor can distinguish it from an explicit OFF. */
+    throwOnError?: boolean;
 }
 export declare function readDaemonFlag(flagKey: string, options?: ReadDaemonFlagOptions): Promise<boolean>;
 //# sourceMappingURL=flag.d.ts.map

package/dist/lib/daemon/flag.js

@@ -18,8 +18,10 @@ export async function readDaemonFlag(flagKey, options = {}) {
     if (override !== null)
         return override;
     let failed = false;
+    let reportedError;
     const onError = (error) => {
         failed = true;
+        reportedError ??= error;
         options.onError?.(error);
     };
     let client;
@@ -41,10 +43,17 @@ export async function readDaemonFlag(flagKey, options = {}) {
         });
         await client.ready();
         const resolution = client.explain(flagKey, { fallback: false });
+        if (failed && options.throwOnError) {
+            throw new Error("hq-flags registry read failed", { cause: reportedError });
+        }
         return !failed && resolution.source === "snapshot" && resolution.value === true;
     }
     catch (error) {
-        onError(error);
+        if (!failed)
+            onError(error);
+        if (options.throwOnError && failed) {
+            throw new Error("hq-flags registry read failed", { cause: reportedError ?? error });
+        }
         return false;
     }
     finally {

package/dist/lib/daemon/server.d.ts

@@ -6,7 +6,8 @@
  * machine. Sessions in any repo ask it which company they belong to and
  * register themselves here.
  */
-import { type ResolveResult } from "../registry/registry.js";
+import { readRegistry, type ResolveResult } from "../registry/registry.js";
+import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
 import { type StdinMachineCredentials } from "./machine-login.js";
@@ -26,6 +27,8 @@ export interface HqdServerOptions {
     workMeshRoot?: string;
     /** Test seam for the hq-anywhere-runtime default-off gate. */
     mcpEnabled?: () => boolean | Promise<boolean>;
+    /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
+    runtimeFlagReader?: () => Promise<boolean>;
     /** Test seam for the hosted Streamable HTTP MCP transport. */
     mcpBridge?: HqMcpBridge;
     /** Test seam for machine login while keeping production credentials off disk. */
@@ -43,6 +46,11 @@ export interface HqdServer {
     close(): Promise<void>;
 }
 /** Resolve cwd → company through the registry, cached until registry.json changes. */
-export declare function createResolver(registryPath: string): (cwd: string) => ResolveResult;
+export declare function createResolver(registryPath: string, options?: {
+    hqRoot?: string;
+    log?: HqdServerOptions["log"];
+    readRegistry?: typeof readRegistry;
+    readCompaniesManifest?: typeof readCompaniesManifestMap;
+}): (cwd: string) => ResolveResult;
 export declare function startHqdServer(opts: HqdServerOptions): Promise<HqdServer>;
 //# sourceMappingURL=server.d.ts.map

package/dist/lib/daemon/server.js

@@ -10,7 +10,8 @@ import * as fs from "node:fs";
 import * as net from "node:net";
 import * as path from "node:path";
 import { CLI_VERSION } from "../../cli-version.js";
-import { canonicalDir, readRegistry, registryFile, resolveCompanyForDir } from "../registry/registry.js";
+import { canonicalDir, emptyRegistry, readRegistry, registryFile, resolveCompanyForDir } from "../registry/registry.js";
+import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { createLineSplitter, encodeMessage, HQD_DEFAULT_REQUEST_TIMEOUT_MS, HQD_MAX_LINE_BYTES, parseRequestLine } from "./protocol.js";
 import { SessionRegistry } from "./session-registry.js";
 import { journalAppend, JournalOpError } from "./ops/journal.js";
@@ -20,7 +21,9 @@ import { PolicyIndex, PolicyOpError, policyCheck } from "./ops/policy.js";
 import { defaultMcpToken, HqMcpBridge, jsonResult, McpOpError, runWorker } from "./ops/mcp.js";
 import { authenticateMachineCredentials, machineTokenExpiresAt, MachineLoginError, parseStdinMachineCredentials } from "./machine-login.js";
 import { HQ_MCP_TOOL_NAMES, HQD_NATIVE_TOOL_NAMES } from "../mcp/tools.js";
-import { anywhereRuntimeEnabled, HQ_ANYWHERE_RUNTIME_FLAG } from "../../commands/anywhere-runtime-flag.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "../../commands/anywhere-runtime-flag.js";
+import { createBoundedDaemonFlagMonitor } from "./flag-monitor.js";
+import { readDaemonFlag } from "./flag.js";
 // The allowlist is deliberately read-only. A newly added hosted MCP tool must
 // pass hq.policy_check until it is explicitly reviewed as read-only here.
 const MCP_READ_ONLY_TOOL_NAMES = new Set([
@@ -62,29 +65,89 @@ function stringArg(args, name, required = true) {
     throw new OpError("bad_args", `${name} must be a non-empty string`);
 }
 /** Resolve cwd → company through the registry, cached until registry.json changes. */
-export function createResolver(registryPath) {
+export function createResolver(registryPath, options = {}) {
+    const loadRegistry = options.readRegistry ?? readRegistry;
+    const loadCompaniesManifest = options.readCompaniesManifest ?? readCompaniesManifestMap;
     const cache = new Map();
-    let stamp = "";
+    let registryStamp = "";
+    let registry = emptyRegistry();
+    let registryLoadFailed = false;
+    let manifestStamp = "";
+    let companies = null;
+    let manifestLoadFailed = false;
     return (cwd) => {
-        let current = "missing";
+        let currentRegistryStamp = "missing";
         try {
             const st = fs.statSync(registryPath);
-            current = `${st.mtimeMs}:${st.size}:${st.ino}`;
+            currentRegistryStamp = `${st.mtimeMs}:${st.ctimeMs}:${st.size}:${st.ino}:${st.mode}`;
         }
         catch (err) {
-            if (err.code !== "ENOENT")
-                throw err;
+            const code = err.code;
+            if (code !== "ENOENT") {
+                cache.clear();
+                const detail = err instanceof Error ? err.message : String(err);
+                options.log?.("warn", `hqd registry unavailable; using personal context: ${detail}`);
+                return { company: null, reason: "HQ registry is unavailable; using personal context." };
+            }
         }
-        if (current !== stamp) {
+        if (currentRegistryStamp !== registryStamp) {
             cache.clear();
-            stamp = current;
+            registryStamp = currentRegistryStamp;
+            registryLoadFailed = false;
+            if (currentRegistryStamp === "missing") {
+                registry = emptyRegistry();
+            }
+            else {
+                try {
+                    registry = loadRegistry(registryPath);
+                }
+                catch (err) {
+                    registryLoadFailed = true;
+                    const detail = err instanceof Error ? err.message : String(err);
+                    options.log?.("warn", `hqd registry unavailable; using personal context: ${detail}`);
+                }
+            }
+        }
+        if (registryLoadFailed) {
+            return { company: null, reason: "HQ registry is unavailable; using personal context." };
         }
         const key = canonicalDir(cwd);
-        const hit = cache.get(key);
-        if (hit)
-            return hit;
-        const result = resolveCompanyForDir(readRegistry(registryPath), key);
+        const result = cache.get(key) ?? resolveCompanyForDir(registry, key);
         cache.set(key, result);
+        if (result.company && options.hqRoot) {
+            const manifestPath = path.join(options.hqRoot, "companies", "manifest.yaml");
+            let currentManifestStamp;
+            try {
+                const st = fs.statSync(manifestPath);
+                currentManifestStamp = `${st.mtimeMs}:${st.ctimeMs}:${st.size}:${st.ino}:${st.mode}`;
+            }
+            catch (err) {
+                const code = err.code;
+                currentManifestStamp = code === "ENOENT" ? "missing" : `unavailable:${code ?? "unknown"}`;
+            }
+            if (currentManifestStamp !== manifestStamp) {
+                manifestStamp = currentManifestStamp;
+                companies = null;
+                manifestLoadFailed = false;
+                if (currentManifestStamp === "missing" || currentManifestStamp.startsWith("unavailable:")) {
+                    manifestLoadFailed = true;
+                }
+                else {
+                    companies = loadCompaniesManifest(options.hqRoot);
+                    manifestLoadFailed = companies === null;
+                }
+                if (manifestLoadFailed) {
+                    options.log?.("warn", "hqd companies/manifest.yaml unavailable or malformed; using personal context");
+                }
+            }
+            if (manifestLoadFailed || !companies) {
+                return { company: null, reason: "HQ company manifest is unavailable; using personal context." };
+            }
+            if (!Object.hasOwn(companies, result.company)) {
+                options.log?.("warn", `hqd registry company ${result.company} is not present in companies/manifest.yaml; using personal context`);
+                return { company: null, reason: `Registry company ${result.company} is not present in companies/manifest.yaml; using personal context.` };
+            }
+        }
         return result;
     };
 }
@@ -106,12 +169,13 @@ export async function startHqdServer(opts) {
     const isPipe = process.platform === "win32";
     const startedAtMs = (opts.now ?? (() => new Date()))().getTime();
     const sessions = new SessionRegistry(opts.now);
-    const resolve = createResolver(opts.registryPath ?? registryFile());
     const log = opts.log ?? (() => { });
+    const resolve = createResolver(opts.registryPath ?? registryFile(), { hqRoot: opts.hqRoot, log });
     const clock = opts.now ?? (() => new Date());
     const env = opts.env ?? process.env;
     const policyIndex = opts.hqRoot ? new PolicyIndex(opts.hqRoot, log) : null;
     let ephemeralMachineToken;
+    let flagRevocationGeneration = 0;
     const requireRoot = () => {
         if (!opts.hqRoot)
             throw new OpError("no_hq_root", "hqd has no HQ root configured (set hqRoot in daemon config or HQ_ROOT)");
@@ -138,7 +202,6 @@ export async function startHqdServer(opts) {
         return explicit ?? boundCompany;
     };
     let hqMcp = opts.mcpBridge;
-    const mcpEnabled = opts.mcpEnabled ?? (() => anywhereRuntimeEnabled(env));
     if (!isPipe) {
         fs.mkdirSync(path.dirname(socketPath), { recursive: true, mode: 0o700 });
         if (fs.existsSync(socketPath)) {
@@ -147,6 +210,22 @@ export async function startHqdServer(opts) {
             fs.unlinkSync(socketPath);
         }
     }
+    const runtimeFlagMonitor = opts.mcpEnabled ? undefined : createBoundedDaemonFlagMonitor({
+        read: opts.runtimeFlagReader ?? (() => readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, {
+            env,
+            throwOnError: true,
+        })),
+        onChange: (enabled) => {
+            if (!enabled) {
+                flagRevocationGeneration += 1;
+                ephemeralMachineToken = undefined;
+            }
+        },
+        onReadError: (error) => {
+            log("warn", `hqd runtime flag refresh failed (${error instanceof Error ? error.name : "UnknownError"}); retaining the last decision only until its 60-second limit`);
+        },
+    });
+    const mcpEnabled = opts.mcpEnabled ?? (() => runtimeFlagMonitor.enabled());
     /** Synchronous ops answer in request order; policy.check and mcp.call may return a promise. */
     const handle = (req) => {
         const args = req.args ?? {};
@@ -162,7 +241,7 @@ export async function startHqdServer(opts) {
             case "auth.status":
                 return Promise.resolve(mcpEnabled()).then((enabled) => {
                     if (!enabled)
-                        throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                        ephemeralMachineToken = undefined;
                     if (ephemeralMachineToken && ephemeralMachineToken.expiresAt <= clock().getTime())
                         ephemeralMachineToken = undefined;
                     return { signedIn: Boolean(ephemeralMachineToken), tokenSource: ephemeralMachineToken ? "stdin-memory" : null };
@@ -171,10 +250,12 @@ export async function startHqdServer(opts) {
                 return Promise.resolve(mcpEnabled()).then(async (enabled) => {
                     if (!enabled)
                         throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                    const loginGeneration = flagRevocationGeneration;
                     const credentials = parseStdinMachineCredentials(JSON.stringify(args.credentials) ?? "");
                     const controller = new AbortController();
                     const timeoutMs = opts.machineAuthTimeoutMs ?? 25_000;
                     let timer;
+                    let authenticatedToken;
                     try {
                         const authentication = (opts.machineAuthenticator ?? ((input, signal) => authenticateMachineCredentials(input, { env, signal })))(credentials, controller.signal);
                         const deadline = new Promise((_, reject) => {
@@ -183,11 +264,10 @@ export async function startHqdServer(opts) {
                                 reject(new MachineLoginError("auth_timeout", "hqd sign-in timed out; try again"));
                             }, timeoutMs);
                         });
-                        const token = await Promise.race([authentication, deadline]);
-                        const expiresAt = machineTokenExpiresAt(token);
+                        authenticatedToken = await Promise.race([authentication, deadline]);
+                        const expiresAt = machineTokenExpiresAt(authenticatedToken);
                         if (expiresAt <= clock().getTime())
                             throw new MachineLoginError("auth_failed", "hqd sign-in failed; the identity provider returned an expired token");
-                        ephemeralMachineToken = { value: token, expiresAt };
                     }
                     catch {
                         throw new MachineLoginError("auth_failed", "hqd sign-in failed; check the machine credentials and try again");
@@ -196,6 +276,10 @@ export async function startHqdServer(opts) {
                         if (timer)
                             clearTimeout(timer);
                     }
+                    if (loginGeneration !== flagRevocationGeneration || !(await mcpEnabled())) {
+                        throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                    }
+                    ephemeralMachineToken = { value: authenticatedToken, expiresAt: machineTokenExpiresAt(authenticatedToken) };
                     return { signedIn: true, tokenSource: "stdin-memory" };
                 });
             case "resolve": {
@@ -344,7 +428,7 @@ export async function startHqdServer(opts) {
                         const deadline = requestStartedAt + timeoutMs;
                         const forward = () => Promise.resolve(mcpEnabled()).then((enabled) => {
                             if (!enabled) {
-                                throw new McpOpError("hq_mcp_unavailable", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
                             }
                             const remainingMs = Math.floor(deadline - Date.now());
                             if (remainingMs <= 0) {
@@ -365,9 +449,14 @@ export async function startHqdServer(opts) {
                             });
                             return hqMcp.callTool(name, raw, remainingMs);
                         });
-                        return !MCP_READ_ONLY_TOOL_NAMES.has(name)
-                            ? policyGuardedCall(forward)
-                            : forward();
+                        return Promise.resolve(mcpEnabled()).then((enabled) => {
+                            if (!enabled) {
+                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                            }
+                            return !MCP_READ_ONLY_TOOL_NAMES.has(name)
+                                ? policyGuardedCall(forward)
+                                : forward();
+                        });
                     }
                 }
             }
@@ -463,6 +552,7 @@ export async function startHqdServer(opts) {
         sessions,
         close: () => (closing ??= new Promise((done) => {
             policyIndex?.close();
+            runtimeFlagMonitor?.close();
             hqMcp?.close();
             server.close(() => done());
             // Answered-but-idle clients would otherwise hold close() open.

package/dist/utils/package-use-lease.d.ts

@@ -16,6 +16,10 @@ export declare function packageUseUpdateRequestPath(prefix: string, stateDirecto
 declare function waitForUpdateRequest(requestPath: string, timeoutMs: number): void;
 export declare function acquirePackageUseLease(prefix: string, hqVersion: string, stateDirectory?: string): PackageUseLease;
 export declare function acquireCurrentPackageUseLease(): PackageUseLease | null;
+/** True only when a valid update request belongs to a live updater process. */
+export declare function packageUseUpdatePending(prefix: string, stateDirectory?: string): boolean;
+/** True while the desktop updater owns the per-prefix update request. */
+export declare function currentPackageUseUpdatePending(): boolean;
 /** True while the desktop updater owns the per-prefix update request. */
 export declare function currentPackageUseUpdateRequested(): boolean;
 export declare const __test__: {

package/dist/utils/package-use-lease.js

@@ -197,6 +197,34 @@ export function acquireCurrentPackageUseLease() {
     }
     return acquirePackageUseLease(prefix, pkg.version);
 }
+/** True only when a valid update request belongs to a live updater process. */
+export function packageUseUpdatePending(prefix, stateDirectory) {
+    try {
+        waitForUpdateRequest(packageUseUpdateRequestPath(prefix, stateDirectory), 0);
+        return false;
+    }
+    catch (error) {
+        if (error instanceof PackageUseUpdatePendingError)
+            return true;
+        throw error;
+    }
+}
+/** True while the desktop updater owns the per-prefix update request. */
+export function currentPackageUseUpdatePending() {
+    const pkg = findCliPackage(path.dirname(fileURLToPath(import.meta.url)));
+    if (!pkg || isPnpmGlobal(pkg.root) || isBunGlobal(pkg.root))
+        return false;
+    const prefix = npmPrefix(pkg.root);
+    if (!prefix)
+        return false;
+    if (process.platform !== "win32") {
+        const parts = pkg.root.replace(/\\/g, "/").replace(/\/+$/, "").split("/").filter(Boolean);
+        const nodeModules = parts.lastIndexOf("node_modules");
+        if (nodeModules > 0 && parts[nodeModules - 1] !== "lib")
+            return false;
+    }
+    return packageUseUpdatePending(prefix);
+}
 /** True while the desktop updater owns the per-prefix update request. */
 export function currentPackageUseUpdateRequested() {
     const pkg = findCliPackage(path.dirname(fileURLToPath(import.meta.url)));

package/dist/utils/vault-api.js

@@ -95,20 +95,19 @@ function identityLookupTimeoutMs() {
 /**
  * Best-effort peek of a 2xx JSON body for plan-limit status (US-016).
  *
- * For ok JSON responses: read the body ONCE, record planLimits (best-effort),
- * and return a NEW Response built from the buffered body so callers can still
- * call .json()/.text()/.arrayBuffer(). Non-JSON and non-ok responses are
- * returned untouched (streamed binary downloads must never be buffered).
+ * For ok JSON responses: inspect a clone, record planLimits (best-effort),
+ * cancel the unused original tee branch, and return a NEW Response built from
+ * the buffered body so callers can still call .json()/.text()/.arrayBuffer().
+ * Non-JSON and non-ok responses are returned untouched (streamed binary
+ * downloads must never be buffered).
  *
  * On inspection errors, return the original response by default to preserve
  * existing behavior. Secret-load callers opt into rethrowing body read errors
  * so the load path can classify a broken stream for offline-cache fallback.
  *
- * Why not response.clone()? Cloning tees the undici body stream; when a
- * caller never consumes the original Response body (many commands only check
- * response.ok/status), the unused tee branch keeps the connection/handle
- * referenced and the process (or vitest worker / spawned CLI child) never
- * exits on Linux CI. Reading once + re-wrapping fully drains the stream.
+ * Cloning tees the undici body stream. Cancel the original branch after the
+ * clone has been read so callers can use the buffered replacement without an
+ * unread tee branch keeping the connection/handle referenced.
  */
 async function peekPlanLimitStatus(response, options = {}) {
     let bufferedBody;
@@ -123,8 +122,9 @@ async function peekPlanLimitStatus(response, options = {}) {
         if (!ct.includes('application/json') && !ct.includes('+json')) {
             return response;
         }
-        const buf = await response.arrayBuffer();
+        const buf = await response.clone().arrayBuffer();
         bufferedBody = buf;
+        await response.body?.cancel();
         try {
             const text = new TextDecoder().decode(buf);
             try {
@@ -147,8 +147,8 @@ async function peekPlanLimitStatus(response, options = {}) {
     }
     catch (err) {
         // Only secret-load callers need the body-read error for offline fallback.
-        // Other endpoints retain the best-effort peek behavior only while the
-        // original body is still readable.
+        // Other endpoints retain the best-effort peek behavior. Reading the clone
+        // leaves the original body available when inspection fails.
         if (bufferedBody !== undefined) {
             // Retry with safe metadata: statusText can itself make Response
             // construction throw after the original stream has already been drained.

package/docs/anywhere-runtime.md

@@ -34,6 +34,23 @@ When the flag is enabled, the global hook uses hqd for events outside the HQ
 root. Inside the root, the project hook routes through hqd when it is running
 and uses the direct master hook when it is stopped.
 
+## Flag revocation
+
+While hqd is running, it refreshes `hq-anywhere-runtime` every 30 seconds.
+Successful reads are never trusted for more than 60 seconds. This gives a
+healthy flag service a 30-second revocation window while limiting reads to two
+per minute per daemon; the five-second flag request timeout bounds the work
+when the service is slow. Staleness uses elapsed monotonic time, so wall-clock
+corrections cannot extend an ON decision.
+
+When a read fails, hqd keeps the last successful value only until it is 60
+seconds old. After that, it fails closed. An OFF decision refuses new daemon
+login and hosted MCP calls with `anywhere_disabled` and clears any stdin machine
+token held in memory. `auth.status` remains available and reports signed out.
+An authentication still in progress when revocation arrives fails cleanly;
+hosted MCP calls already forwarded are allowed to finish or return their normal
+request error. The daemon process itself does not terminate.
+
 ## Link a repository
 
 Run `hq link <company>` from a repository to associate it with a company. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.341.1",
+  "version": "5.341.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {