@indigoai-us/hq-cli 5.341.1 → 5.341.3

package/dist/commands/core-migrate-policy-triggers-native.js

@@ -57,16 +57,24 @@ function isDirectory(fileSystem, value) {
         return false;
     }
 }
-function executableInPath(name, env, fileSystem) {
+export function executableInPath(name, env, fileSystem, platform = process.platform) {
+    const extensions = platform === "win32"
+        // spawnSync("flock", ...) without shell support can launch native images,
+        // but not batch files. Treating .cmd/.bat as available skips the fallback
+        // lock while the later spawn fails on Windows.
+        ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((extension) => /^\.(?:COM|EXE)$/i.test(extension))
+        : [""];
     for (const directory of (env.PATH ?? "").split(path.delimiter)) {
         if (!directory)
             continue;
-        try {
-            const stat = fileSystem.statSync(path.join(directory, name));
-            if (stat.isFile() && (stat.mode & 0o111) !== 0)
-                return true;
+        for (const extension of extensions) {
+            try {
+                const stat = fileSystem.statSync(path.join(directory, `${name}${extension}`));
+                if (stat.isFile() && (platform === "win32" || (stat.mode & 0o111) !== 0))
+                    return true;
+            }
+            catch { /* continue through PATH */ }
         }
-        catch { /* continue through PATH */ }
     }
     return false;
 }
@@ -79,7 +87,9 @@ function runNonblockingFlock(lockFd, cwd, pathValue) {
 }
 function frontmatterValue(content, key) {
     let depth = 0;
-    for (const line of content.split("\n")) {
+    for (const rawLine of content.split("\n")) {
+        // Git for Windows' awk reads CRLF as a line ending; POSIX awk keeps the CR.
+        const line = process.platform === "win32" ? rawLine.replace(/\r$/, "") : rawLine;
         if (line === "---") {
             depth += 1;
             continue;
@@ -154,10 +164,11 @@ function deriveWhen(trigger, rawTags, enforcementRaw) {
 function writeAtomic(fileSystem, target, bytes) {
     const temporary = path.join(path.dirname(target), `.migrate-policy-triggers.${process.pid}.${Math.random().toString(16).slice(2)}`);
     // The shell writes through mktemp, whose private mode survives the rename on both platforms.
-    const mode = 0o600;
+    const mode = process.platform === "win32" ? undefined : 0o600;
     try {
-        fileSystem.writeFileSync(temporary, bytes, { encoding: "utf8", mode, flag: "wx" });
-        fileSystem.chmodSync(temporary, mode);
+        fileSystem.writeFileSync(temporary, bytes, { encoding: "utf8", ...(mode === undefined ? {} : { mode }), flag: "wx" });
+        if (mode !== undefined)
+            fileSystem.chmodSync(temporary, mode);
         fileSystem.renameSync(temporary, target);
         return true;
     }
@@ -447,7 +458,7 @@ export function runMigratePolicyTriggers(args, deps) {
                     continue;
                 }
                 const anchor = original.split("\n").some((line) => line.startsWith("trigger:")) ? /^trigger:/ : /^id:/;
-                const lines = original.split("\n");
+                const lines = original.split("\n").map((line) => process.platform === "win32" ? line.replace(/\r$/, "") : line);
                 let inserted = false;
                 const rewritten = lines.flatMap((line) => {
                     if (!inserted && anchor.test(line)) {
@@ -471,7 +482,10 @@ export function runMigratePolicyTriggers(args, deps) {
         if (!dryRun && stateReady && !errorCode) {
             const stampTmp = path.join(path.dirname(stamp), `.last-success.${process.pid}.${Math.random().toString(16).slice(2)}`);
             try {
-                fileSystem.writeFileSync(stampTmp, `${nowSeconds()}\n`, { mode: 0o600, flag: "wx" });
+                fileSystem.writeFileSync(stampTmp, `${nowSeconds()}\n`, {
+                    ...(process.platform === "win32" ? {} : { mode: 0o600 }),
+                    flag: "wx",
+                });
                 fileSystem.renameSync(stampTmp, stamp);
             }
             catch {

package/dist/commands/doctor.js

@@ -37,7 +37,6 @@ import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
 import { runSideEffectTests } from "../lib/doctor/deep/sandbox.js";
-import { anywhereRuntimeEnabled } from "./anywhere-runtime-flag.js";
 /**
  * Marker directories that identify an HQ tree root. A directory is an HQ root
  * only when it contains ALL of these. `.claude` + `core` are present in both
@@ -91,7 +90,7 @@ export async function runDoctor(options = {}) {
     const write = options.stdout ?? ((chunk) => void process.stdout.write(chunk));
     const writeErr = options.stderr ?? ((chunk) => void process.stderr.write(chunk));
     const hqRoot = options.root ?? resolveHqRoot(options.cwd);
-    const standaloneAnywhere = !hqRoot && options.only?.length === 1 && options.only[0] === "anywhere" && anywhereRuntimeEnabled();
+    const standaloneAnywhere = !hqRoot && options.only?.length === 1 && options.only[0] === "anywhere";
     if (!hqRoot && !standaloneAnywhere) {
         const from = options.cwd ?? process.cwd();
         writeErr(`hq doctor: not inside an HQ tree.\n` +
@@ -126,6 +125,7 @@ export async function runDoctor(options = {}) {
         // Anywhere checks inspect ~/.hq and are intentionally runnable from a foreign
         // repo. No other family is selected in this standalone path.
         hqRoot: hqRoot ?? "",
+        cwd: options.cwd ?? process.cwd(),
         platform: { id: platform.id, evidence: platform.evidence },
         sessionId: options.sessionId,
         liveRuntimes: options.liveRuntimes === true,

package/dist/index.d.ts

@@ -4,8 +4,9 @@ import "./node-network-compat-fast.js";
 import { isVersionRequest } from "./version-request.js";
 import { isFastCoreRequest } from "./fast-scaffold.js";
 type PackageUseLeaseLoader = () => Promise<void>;
+type PackageUseUpdateProbe = () => Promise<boolean>;
 declare function isNpmPackageEntry(entryUrl: string): boolean;
-declare function dispatchWithPackageUseLease(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader): void | Promise<void>;
+declare function dispatchWithPackageUseLease(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader, updateRequestPending?: PackageUseUpdateProbe): void | Promise<void>;
 declare function runCliEntry(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader): void | Promise<void>;
 export declare const __test__: {
     isVersionRequest: typeof isVersionRequest;

package/dist/index.js

@@ -140,14 +140,30 @@ function packageUseErrorClass(error) {
 function dispatchWithPackageUseLease(entryUrl, dispatch, loadLease = async () => {
     const { acquireCurrentPackageUseLease } = await import("./utils/package-use-lease.js");
     acquireCurrentPackageUseLease();
+}, updateRequestPending = async () => {
+    const { currentPackageUseUpdatePending } = await import("./utils/package-use-lease.js");
+    return currentPackageUseUpdatePending();
 }) {
     if (!isNpmPackageEntry(entryUrl)) {
         dispatch();
         return;
     }
-    return loadLease().then(dispatch, (error) => {
+    return loadLease().then(dispatch, async (error) => {
         if (isPackageUseUpdatePendingError(error))
             throw error;
+        try {
+            if (await updateRequestPending()) {
+                const pending = new Error("The HQ CLI package is being updated; retry after the update finishes");
+                pending.name = "PackageUseUpdatePendingError";
+                throw pending;
+            }
+        }
+        catch (probeError) {
+            if (isPackageUseUpdatePendingError(probeError))
+                throw probeError;
+            // A lease probe failure must not make the CLI unavailable. Keep the
+            // existing fail-open path when no live update request could be confirmed.
+        }
         process.stderr.write(`hq-cli package-use lease unavailable (${packageUseErrorClass(error)}); continuing without lease\n`);
         dispatch();
     });

package/dist/lib/aws-sdk-node-warning-output.js

@@ -1,4 +1,5 @@
 import { companyErrorsSdkWarningEnabled } from "./company-errors-sdk-warning-flag.js";
+import { diagnosticsEnabled } from "./diagnostics.js";
 export const AWS_SDK_NODE_VERSION_WARNING_ENV = "AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED";
 /**
  * Configure the AWS SDK's documented, warning-specific switch before loading
@@ -10,9 +11,7 @@ export function configureAwsSdkNodeVersionWarningOutput(options = {}) {
     const enabled = options.enabled ?? companyErrorsSdkWarningEnabled();
     if (!enabled)
         return;
-    const verbose = argv.includes("--verbose");
-    const debug = /^(1|true|yes)$/i.test(env.HQ_DEBUG?.trim() ?? "");
-    if (verbose || debug) {
+    if (diagnosticsEnabled(env, argv)) {
         delete env[AWS_SDK_NODE_VERSION_WARNING_ENV];
     }
     else {

package/dist/lib/billing/plan-lock.js

@@ -21,6 +21,7 @@
  * missing data (hq-absent-field-never-means-constraining-value).
  */
 import chalk from "chalk";
+import { diagnosticsEnabled } from "../diagnostics.js";
 import { vaultApiFetch } from "../../utils/vault-api.js";
 import { parseFreeMonth } from "./free-month.js";
 import { selectPlanLimitUpgradeUrl } from "./plan-limit-upgrade-url.js";
@@ -212,6 +213,16 @@ function statusFromUsage(companySlug, companyUid, body, upgradeCompanySlug) {
         checkedAt: new Date().toISOString(),
     };
 }
+function isSilentPlanLimitBodyError(error) {
+    return (error instanceof Error &&
+        (error.name === "AbortError" || error.name === "TimeoutError"));
+}
+function notePlanLimitBodyUnreadable(error) {
+    if (isSilentPlanLimitBodyError(error) || !diagnosticsEnabled())
+        return;
+    const errorName = error instanceof Error ? error.name : "Error";
+    console.error(`plan-limit body unreadable errorName=${errorName}`);
+}
 /**
  * Read the live nag for one company from usage-limits. `/membership/me` is
  * used only to resolve slug → companyUid. Returns null when the server did
@@ -226,7 +237,10 @@ export async function fetchPlanLimitStatus(token, companyRef, opts = {}) {
     });
     if (!res.ok)
         return null;
-    const selected = selectCompanyMembership(await res.json().catch(() => null), companyRef);
+    const selected = selectCompanyMembership(await res.json().catch((error) => {
+        notePlanLimitBodyUnreadable(error);
+        return null;
+    }), companyRef);
     if (!selected?.companyUid)
         return null;
     try {
@@ -238,7 +252,10 @@ export async function fetchPlanLimitStatus(token, companyRef, opts = {}) {
         });
         if (!usage.ok)
             return null;
-        const body = await usage.json().catch(() => null);
+        const body = await usage.json().catch((error) => {
+            notePlanLimitBodyUnreadable(error);
+            return null;
+        });
         if (!body)
             return null;
         const selectedSlug = selected.companySlug ??

package/dist/lib/bot/owner-context.d.ts

@@ -67,6 +67,8 @@ export declare class OwnerContextCache {
     private value;
     private at;
     private pending;
+    /** True only after the wait ended before this lookup, so a later rejection is the hidden one. */
+    private waitEnded;
     constructor(lookup: () => Promise<OwnerContext>, nowMs?: () => number, waitMs?: number, ownerUid?: string);
     get(): Promise<OwnerContext>;
 }

package/dist/lib/bot/owner-context.js

@@ -13,6 +13,7 @@
  * slugs, uids, roles) reaches the model; the owner's token never does. A failed
  * lookup is reported as "could not check", never as "no companies".
  */
+import { diagnosticsEnabled } from "../diagnostics.js";
 import { ensureCognitoToken } from "../../utils/cognito-session.js";
 import { resolveCallerPersonUid, vaultApiFetch } from "../../utils/vault-api.js";
 function message(err) {
@@ -85,6 +86,12 @@ export const OWNER_CONTEXT_TTL_MS = 5 * 60_000;
 export const OWNER_CONTEXT_RETRY_MS = 60_000;
 /** A turn never waits longer than this for a refresh; the lookup keeps going in the background. */
 const OWNER_CONTEXT_WAIT_MS = 8_000;
+function noteOwnerContextLookupRejected(error) {
+    if (!diagnosticsEnabled())
+        return;
+    const errorName = error instanceof Error ? error.name : "Error";
+    console.error(`owner-context lookup failed errorName=${errorName}`);
+}
 export class OwnerContextCache {
     lookup;
     nowMs;
@@ -93,6 +100,8 @@ export class OwnerContextCache {
     value = null;
     at = 0;
     pending = null;
+    /** True only after the wait ended before this lookup, so a later rejection is the hidden one. */
+    waitEnded = false;
     constructor(lookup, nowMs = Date.now, waitMs = OWNER_CONTEXT_WAIT_MS, ownerUid = "") {
         this.lookup = lookup;
         this.nowMs = nowMs;
@@ -104,6 +113,7 @@ export class OwnerContextCache {
         if (this.value && age < (this.value.status === "ok" ? OWNER_CONTEXT_TTL_MS : OWNER_CONTEXT_RETRY_MS))
             return this.value;
         if (!this.pending) {
+            this.waitEnded = false;
             this.pending = this.lookup()
                 .then((v) => {
                 this.value = v;
@@ -113,7 +123,14 @@ export class OwnerContextCache {
                 .finally(() => {
                 this.pending = null;
             });
-            this.pending.catch(() => undefined);
+            // An in-time rejection is rethrown by the race below and leaves
+            // waitEnded false, so it is not logged. A rejection that lands after
+            // the wait already returned is otherwise invisible.
+            void this.pending.catch((error) => {
+                if (!this.waitEnded)
+                    return;
+                noteOwnerContextLookupRejected(error);
+            });
         }
         let timer;
         const slow = new Promise((resolve) => {
@@ -123,6 +140,7 @@ export class OwnerContextCache {
             const got = await Promise.race([this.pending, slow]);
             if (got)
                 return got;
+            this.waitEnded = true;
         }
         finally {
             if (timer)

package/dist/lib/daemon/flag-monitor.d.ts

@@ -0,0 +1,23 @@
+export declare const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30000;
+export declare const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60000;
+export interface BoundedDaemonFlagMonitorOptions {
+    read: () => Promise<boolean>;
+    now?: () => number;
+    onChange?: (enabled: boolean) => void;
+    onReadError?: (error: unknown) => void;
+}
+export interface BoundedDaemonFlagMonitor {
+    enabled(): Promise<boolean>;
+    status(): {
+        enabled: boolean;
+        lastSuccessfulReadAgeMs: number | null;
+        heldThroughReadError: boolean;
+    };
+    close(): void;
+}
+/**
+ * Refreshes a long-running daemon's flag independently of incoming requests.
+ * A failed read keeps the last successful decision only until its 60s age limit.
+ */
+export declare function createBoundedDaemonFlagMonitor(options: BoundedDaemonFlagMonitorOptions): BoundedDaemonFlagMonitor;
+//# sourceMappingURL=flag-monitor.d.ts.map

package/dist/lib/daemon/flag-monitor.js

@@ -0,0 +1,99 @@
+import { performance } from "node:perf_hooks";
+export const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30_000;
+export const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
+/**
+ * Refreshes a long-running daemon's flag independently of incoming requests.
+ * A failed read keeps the last successful decision only until its 60s age limit.
+ */
+export function createBoundedDaemonFlagMonitor(options) {
+    const now = options.now ?? (() => performance.now());
+    let value;
+    let lastSuccessAt;
+    let lastAttemptAt;
+    let lastReadFailed = false;
+    let successVersion = 0;
+    let refreshInFlight;
+    let expiryTimer;
+    let closed = false;
+    const publish = (next) => {
+        const changed = value !== next;
+        value = next;
+        if (changed)
+            options.onChange?.(next);
+    };
+    const expireIfStale = () => {
+        if (!closed && lastSuccessAt !== undefined && now() - lastSuccessAt >= HQ_ANYWHERE_FLAG_MAX_STALENESS_MS) {
+            publish(false);
+        }
+    };
+    const refresh = () => {
+        if (closed)
+            return Promise.resolve(false);
+        if (refreshInFlight)
+            return refreshInFlight;
+        lastAttemptAt = now();
+        refreshInFlight = Promise.resolve().then(options.read).then((next) => {
+            if (closed)
+                return false;
+            lastSuccessAt = now();
+            lastReadFailed = false;
+            const thisSuccessVersion = ++successVersion;
+            publish(next);
+            if (expiryTimer)
+                clearTimeout(expiryTimer);
+            // Expire from the elapsed timer itself, not a wall-clock comparison.
+            expiryTimer = setTimeout(() => {
+                if (!closed && successVersion === thisSuccessVersion)
+                    publish(false);
+            }, HQ_ANYWHERE_FLAG_MAX_STALENESS_MS);
+            expiryTimer.unref?.();
+            return next;
+        }).catch((error) => {
+            lastReadFailed = true;
+            options.onReadError?.(error);
+            expireIfStale();
+            return value ?? false;
+        }).finally(() => {
+            refreshInFlight = undefined;
+        });
+        return refreshInFlight;
+    };
+    const refreshTimer = setInterval(() => {
+        expireIfStale();
+        void refresh();
+    }, HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS);
+    refreshTimer.unref?.();
+    void refresh();
+    return {
+        async enabled() {
+            expireIfStale();
+            if (lastSuccessAt !== undefined && now() - lastSuccessAt >= HQ_ANYWHERE_FLAG_MAX_STALENESS_MS) {
+                void refresh();
+                return false;
+            }
+            if (value === undefined)
+                return refresh();
+            if (lastAttemptAt === undefined || now() - lastAttemptAt >= HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS) {
+                void refresh();
+            }
+            return value;
+        },
+        status() {
+            const age = lastSuccessAt === undefined ? null : Math.max(0, now() - lastSuccessAt);
+            const fresh = age !== null && age < HQ_ANYWHERE_FLAG_MAX_STALENESS_MS;
+            return {
+                enabled: value === true && fresh,
+                lastSuccessfulReadAgeMs: age,
+                heldThroughReadError: lastReadFailed && fresh,
+            };
+        },
+        close() {
+            closed = true;
+            if (refreshTimer)
+                clearInterval(refreshTimer);
+            if (expiryTimer)
+                clearTimeout(expiryTimer);
+        },
+    };
+}
+//# sourceMappingURL=flag-monitor.js.map

package/dist/lib/daemon/flag.d.ts

@@ -20,6 +20,8 @@ export interface ReadDaemonFlagOptions {
     createClient?: (options: FlagClientOptions) => DaemonFlagClient;
     getToken?: () => Promise<string>;
     onError?: (error: unknown) => void;
+    /** Reject a failed registry read so the daemon monitor can distinguish it from an explicit OFF. */
+    throwOnError?: boolean;
 }
 export declare function readDaemonFlag(flagKey: string, options?: ReadDaemonFlagOptions): Promise<boolean>;
 //# sourceMappingURL=flag.d.ts.map

package/dist/lib/daemon/flag.js

@@ -18,8 +18,10 @@ export async function readDaemonFlag(flagKey, options = {}) {
     if (override !== null)
         return override;
     let failed = false;
+    let reportedError;
     const onError = (error) => {
         failed = true;
+        reportedError ??= error;
         options.onError?.(error);
     };
     let client;
@@ -41,10 +43,17 @@ export async function readDaemonFlag(flagKey, options = {}) {
         });
         await client.ready();
         const resolution = client.explain(flagKey, { fallback: false });
+        if (failed && options.throwOnError) {
+            throw new Error("hq-flags registry read failed", { cause: reportedError });
+        }
         return !failed && resolution.source === "snapshot" && resolution.value === true;
     }
     catch (error) {
-        onError(error);
+        if (!failed)
+            onError(error);
+        if (options.throwOnError && failed) {
+            throw new Error("hq-flags registry read failed", { cause: reportedError ?? error });
+        }
         return false;
     }
     finally {

package/dist/lib/daemon/protocol.d.ts

@@ -7,8 +7,31 @@
  * out of order, so clients match them by `id`.
  */
 export declare const HQD_SOCKET_NAME = "hqd.sock";
-export declare const HQD_OPS: readonly ["ping", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "auth.login", "auth.status", "shutdown"];
+export declare const HQD_OPS: readonly ["ping", "health", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "auth.login", "auth.status", "shutdown"];
 export type HqdOp = (typeof HQD_OPS)[number];
+export type HqdHealthFallbackReason = "registry_unavailable" | "manifest_missing_or_malformed" | "company_not_in_manifest" | "no_match";
+export interface HqdHealthResult {
+    reachable: boolean;
+    version: string | null;
+    uptimeMs: number | null;
+    flag: {
+        enabled: boolean | null;
+        lastSuccessfulReadAgeMs: number | null;
+        heldThroughReadError: boolean;
+    };
+    resolution: {
+        scope: "company" | "personal" | "unknown";
+        company: string | null;
+        fallbackReason: HqdHealthFallbackReason | null;
+    };
+    socket: {
+        path: string;
+        transport: "unix_socket" | "windows_named_pipe";
+        mode: string | null;
+        ownerMatchesUser: boolean | null;
+        userOnly: boolean | null;
+    };
+}
 /** A request line larger than this is rejected and the connection closed. */
 export declare const HQD_MAX_LINE_BYTES: number;
 export declare const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2000;
@@ -31,10 +54,10 @@ export type HqdResponse = {
     error: HqdError;
 };
 /**
- * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
+ * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/daemon/hqd.sock.
  * On Windows the socket is a per-user named pipe.
  */
-export declare function hqdSocketPath(home?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+export declare function hqdSocketPath(home?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, currentUserSid?: () => string | null): string;
 export declare function encodeMessage(message: HqdRequest | HqdResponse): string;
 export type ParsedLine = {
     ok: true;

package/dist/lib/daemon/protocol.js

@@ -9,9 +9,11 @@
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readCurrentUserSid } from "../work-context/windows-acl.js";
 export const HQD_SOCKET_NAME = "hqd.sock";
 export const HQD_OPS = [
     "ping",
+    "health",
     "resolve",
     "session.open",
     "session.get",
@@ -31,19 +33,21 @@ export const HQD_OPS = [
 export const HQD_MAX_LINE_BYTES = 1024 * 1024;
 export const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2_000;
 /**
- * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
+ * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/daemon/hqd.sock.
  * On Windows the socket is a per-user named pipe.
  */
-export function hqdSocketPath(home = os.homedir(), env = process.env, platform = process.platform) {
+export function hqdSocketPath(home = os.homedir(), env = process.env, platform = process.platform, currentUserSid = readCurrentUserSid) {
     const override = env.HQ_HQD_SOCKET?.trim();
     if (override)
         return override;
     if (platform === "win32") {
-        const user = (env.USERNAME ?? os.userInfo().username).replace(/[^A-Za-z0-9_.-]/g, "-");
-        return `\\\\.\\pipe\\hqd-${user}`;
+        const userSid = currentUserSid();
+        if (!userSid)
+            throw new Error("Cannot determine the current Windows user SID for the hqd pipe name");
+        return `\\\\.\\pipe\\hqd-${userSid.toLowerCase()}`;
     }
     const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
-    return path.join(dir, HQD_SOCKET_NAME);
+    return path.join(dir, "daemon", HQD_SOCKET_NAME);
 }
 export function encodeMessage(message) {
     return `${JSON.stringify(message)}\n`;

package/dist/lib/daemon/run.js

@@ -693,24 +693,22 @@ export async function runDaemon(opts) {
     let hqdShutdown = null;
     if (anywhereRuntimeEnabled()) {
         const refusal = hqdStartupRefusal(platform, true);
-        if (refusal) {
-            log("error", refusal);
+        try {
+            const startConfig = readDaemonConfig(paths.configPath);
+            hqd = await startHqdServer({
+                socketPath: hqdSocketPath(home, env),
+                registryPath: registryFile(registryDir(home, env)),
+                hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
+                log,
+                onShutdown: () => hqdShutdown?.(),
+                reportError: reportHqdCrash,
+            });
         }
-        else {
-            try {
-                const startConfig = readDaemonConfig(paths.configPath);
-                hqd = await startHqdServer({
-                    socketPath: hqdSocketPath(home, env),
-                    registryPath: registryFile(registryDir(home, env)),
-                    hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
-                    log,
-                    onShutdown: () => hqdShutdown?.(),
-                    reportError: reportHqdCrash,
-                });
-            }
-            catch (err) {
+        catch (err) {
+            if (refusal && err.message === refusal)
+                log("error", refusal);
+            else
                 log("error", `hqd socket did not start; services run without it: ${err.message}`);
-            }
         }
     }
     // US-012: 60s presence heartbeat with version and session count.

package/dist/lib/daemon/server.d.ts

@@ -6,12 +6,26 @@
  * machine. Sessions in any repo ask it which company they belong to and
  * register themselves here.
  */
-import { type ResolveResult } from "../registry/registry.js";
+import * as fs from "node:fs";
+import { readRegistry, type ResolveResult } from "../registry/registry.js";
+import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
 import { type StdinMachineCredentials } from "./machine-login.js";
+import { type WindowsPipeAclReport, type WindowsPipeHost } from "./windows-pipe-host.js";
 export interface HqdServerOptions {
     socketPath: string;
+    /** Test seam for selecting the Windows transport without changing host behavior. */
+    platform?: NodeJS.Platform;
+    /** Test seam for verifying socket ownership without changing the host uid. */
+    socketLstat?: (path: string) => fs.Stats;
+    /** Test seam for helper startup and its OS-read ACL report. */
+    windowsPipeHostFactory?: (socketPath: string) => Promise<{
+        host: WindowsPipeHost;
+        acl: WindowsPipeAclReport;
+    }>;
+    /** Test seam for rejecting an invalid helper ACL report. */
+    windowsPipeAclCheck?: (report: WindowsPipeAclReport) => WindowsPipeAclReport;
     /** registry.json to resolve against (US-004). */
     registryPath?: string;
     hqRoot?: string;
@@ -26,6 +40,8 @@ export interface HqdServerOptions {
     workMeshRoot?: string;
     /** Test seam for the hq-anywhere-runtime default-off gate. */
     mcpEnabled?: () => boolean | Promise<boolean>;
+    /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
+    runtimeFlagReader?: () => Promise<boolean>;
     /** Test seam for the hosted Streamable HTTP MCP transport. */
     mcpBridge?: HqMcpBridge;
     /** Test seam for machine login while keeping production credentials off disk. */
@@ -43,6 +59,11 @@ export interface HqdServer {
     close(): Promise<void>;
 }
 /** Resolve cwd → company through the registry, cached until registry.json changes. */
-export declare function createResolver(registryPath: string): (cwd: string) => ResolveResult;
+export declare function createResolver(registryPath: string, options?: {
+    hqRoot?: string;
+    log?: HqdServerOptions["log"];
+    readRegistry?: typeof readRegistry;
+    readCompaniesManifest?: typeof readCompaniesManifestMap;
+}): (cwd: string) => ResolveResult;
 export declare function startHqdServer(opts: HqdServerOptions): Promise<HqdServer>;
 //# sourceMappingURL=server.d.ts.map