@indigoai-us/hq-cli 5.341.1 → 5.341.3

package/dist/lib/daemon/server.js

@@ -9,8 +9,10 @@
 import * as fs from "node:fs";
 import * as net from "node:net";
 import * as path from "node:path";
+import { performance } from "node:perf_hooks";
 import { CLI_VERSION } from "../../cli-version.js";
-import { canonicalDir, readRegistry, registryFile, resolveCompanyForDir } from "../registry/registry.js";
+import { canonicalDir, emptyRegistry, readRegistry, registryFile, resolveCompanyForDir } from "../registry/registry.js";
+import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { createLineSplitter, encodeMessage, HQD_DEFAULT_REQUEST_TIMEOUT_MS, HQD_MAX_LINE_BYTES, parseRequestLine } from "./protocol.js";
 import { SessionRegistry } from "./session-registry.js";
 import { journalAppend, JournalOpError } from "./ops/journal.js";
@@ -20,7 +22,10 @@ import { PolicyIndex, PolicyOpError, policyCheck } from "./ops/policy.js";
 import { defaultMcpToken, HqMcpBridge, jsonResult, McpOpError, runWorker } from "./ops/mcp.js";
 import { authenticateMachineCredentials, machineTokenExpiresAt, MachineLoginError, parseStdinMachineCredentials } from "./machine-login.js";
 import { HQ_MCP_TOOL_NAMES, HQD_NATIVE_TOOL_NAMES } from "../mcp/tools.js";
-import { anywhereRuntimeEnabled, HQ_ANYWHERE_RUNTIME_FLAG } from "../../commands/anywhere-runtime-flag.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "../../commands/anywhere-runtime-flag.js";
+import { createBoundedDaemonFlagMonitor } from "./flag-monitor.js";
+import { readDaemonFlag } from "./flag.js";
+import { startWindowsPipeHost, validateWindowsPipeAcl, WINDOWS_PIPE_STARTUP_REFUSAL } from "./windows-pipe-host.js";
 // The allowlist is deliberately read-only. A newly added hosted MCP tool must
 // pass hq.policy_check until it is explicitly reviewed as read-only here.
 const MCP_READ_ONLY_TOOL_NAMES = new Set([
@@ -46,6 +51,47 @@ const MCP_READ_ONLY_TOOL_NAMES = new Set([
     "hq_version",
     "hq_whoami",
 ]);
+function healthResolution(result) {
+    if (result.company) {
+        // A manifest key is expected to be a single company slug. Do not echo
+        // arbitrary registry text through the diagnostics surface.
+        if (/^[a-z0-9][a-z0-9-]{0,62}$/.test(result.company)) {
+            return { scope: "company", company: result.company, fallbackReason: null };
+        }
+        return { scope: "personal", company: null, fallbackReason: "company_not_in_manifest" };
+    }
+    let fallbackReason = "no_match";
+    const reason = "reason" in result ? result.reason : "";
+    if (reason.startsWith("HQ registry is unavailable"))
+        fallbackReason = "registry_unavailable";
+    else if (reason.startsWith("HQ company manifest is unavailable"))
+        fallbackReason = "manifest_missing_or_malformed";
+    else if (reason.startsWith("Registry company "))
+        fallbackReason = "company_not_in_manifest";
+    return { scope: "personal", company: null, fallbackReason };
+}
+function healthSocket(socketPath, isPipe) {
+    if (isPipe) {
+        return { path: socketPath, transport: "windows_named_pipe", mode: null, ownerMatchesUser: null, userOnly: null };
+    }
+    try {
+        const stat = fs.lstatSync(socketPath);
+        const mode = stat.mode & 0o777;
+        const uid = typeof process.getuid === "function" ? process.getuid() : null;
+        const ownerMatchesUser = uid !== null && stat.uid === uid;
+        const userOnly = stat.isSocket() && ownerMatchesUser && (mode & 0o077) === 0;
+        return {
+            path: socketPath,
+            transport: "unix_socket",
+            mode: `0${mode.toString(8).padStart(3, "0")}`,
+            ownerMatchesUser,
+            userOnly,
+        };
+    }
+    catch {
+        return { path: socketPath, transport: "unix_socket", mode: null, ownerMatchesUser: null, userOnly: false };
+    }
+}
 class OpError extends Error {
     code;
     constructor(code, message) {
@@ -62,29 +108,89 @@ function stringArg(args, name, required = true) {
     throw new OpError("bad_args", `${name} must be a non-empty string`);
 }
 /** Resolve cwd → company through the registry, cached until registry.json changes. */
-export function createResolver(registryPath) {
+export function createResolver(registryPath, options = {}) {
+    const loadRegistry = options.readRegistry ?? readRegistry;
+    const loadCompaniesManifest = options.readCompaniesManifest ?? readCompaniesManifestMap;
     const cache = new Map();
-    let stamp = "";
+    let registryStamp = "";
+    let registry = emptyRegistry();
+    let registryLoadFailed = false;
+    let manifestStamp = "";
+    let companies = null;
+    let manifestLoadFailed = false;
     return (cwd) => {
-        let current = "missing";
+        let currentRegistryStamp = "missing";
         try {
             const st = fs.statSync(registryPath);
-            current = `${st.mtimeMs}:${st.size}:${st.ino}`;
+            currentRegistryStamp = `${st.mtimeMs}:${st.ctimeMs}:${st.size}:${st.ino}:${st.mode}`;
         }
         catch (err) {
-            if (err.code !== "ENOENT")
-                throw err;
+            const code = err.code;
+            if (code !== "ENOENT") {
+                cache.clear();
+                const detail = err instanceof Error ? err.message : String(err);
+                options.log?.("warn", `hqd registry unavailable; using personal context: ${detail}`);
+                return { company: null, reason: "HQ registry is unavailable; using personal context." };
+            }
         }
-        if (current !== stamp) {
+        if (currentRegistryStamp !== registryStamp) {
             cache.clear();
-            stamp = current;
+            registryStamp = currentRegistryStamp;
+            registryLoadFailed = false;
+            if (currentRegistryStamp === "missing") {
+                registry = emptyRegistry();
+            }
+            else {
+                try {
+                    registry = loadRegistry(registryPath);
+                }
+                catch (err) {
+                    registryLoadFailed = true;
+                    const detail = err instanceof Error ? err.message : String(err);
+                    options.log?.("warn", `hqd registry unavailable; using personal context: ${detail}`);
+                }
+            }
+        }
+        if (registryLoadFailed) {
+            return { company: null, reason: "HQ registry is unavailable; using personal context." };
         }
         const key = canonicalDir(cwd);
-        const hit = cache.get(key);
-        if (hit)
-            return hit;
-        const result = resolveCompanyForDir(readRegistry(registryPath), key);
+        const result = cache.get(key) ?? resolveCompanyForDir(registry, key);
         cache.set(key, result);
+        if (result.company && options.hqRoot) {
+            const manifestPath = path.join(options.hqRoot, "companies", "manifest.yaml");
+            let currentManifestStamp;
+            try {
+                const st = fs.statSync(manifestPath);
+                currentManifestStamp = `${st.mtimeMs}:${st.ctimeMs}:${st.size}:${st.ino}:${st.mode}`;
+            }
+            catch (err) {
+                const code = err.code;
+                currentManifestStamp = code === "ENOENT" ? "missing" : `unavailable:${code ?? "unknown"}`;
+            }
+            if (currentManifestStamp !== manifestStamp) {
+                manifestStamp = currentManifestStamp;
+                companies = null;
+                manifestLoadFailed = false;
+                if (currentManifestStamp === "missing" || currentManifestStamp.startsWith("unavailable:")) {
+                    manifestLoadFailed = true;
+                }
+                else {
+                    companies = loadCompaniesManifest(options.hqRoot);
+                    manifestLoadFailed = companies === null;
+                }
+                if (manifestLoadFailed) {
+                    options.log?.("warn", "hqd companies/manifest.yaml unavailable or malformed; using personal context");
+                }
+            }
+            if (manifestLoadFailed || !companies) {
+                return { company: null, reason: "HQ company manifest is unavailable; using personal context." };
+            }
+            if (!Object.hasOwn(companies, result.company)) {
+                options.log?.("warn", `hqd registry company ${result.company} is not present in companies/manifest.yaml; using personal context`);
+                return { company: null, reason: `Registry company ${result.company} is not present in companies/manifest.yaml; using personal context.` };
+            }
+        }
         return result;
     };
 }
@@ -101,17 +207,143 @@ function socketIsLive(socketPath) {
         setTimeout(() => done(false), 500).unref();
     });
 }
+function socketLstatOrMissing(socketPath, lstat) {
+    try {
+        return lstat(socketPath);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(`${socketPath}: cannot inspect filesystem entry: ${detail}`);
+    }
+}
+function assertTrustedSocketPathComponents(directory, lstat, uid) {
+    const resolved = path.resolve(directory);
+    const { root } = path.parse(resolved);
+    let current = root;
+    for (const component of resolved.slice(root.length).split(path.sep).filter(Boolean)) {
+        current = path.join(current, component);
+        const stat = socketLstatOrMissing(current, lstat);
+        if (!stat)
+            return;
+        if (stat.isSymbolicLink())
+            throw new Error(`${current}: path component is a symlink`);
+        if (stat.uid !== uid && stat.uid !== 0 && (stat.mode & 0o022) !== 0) {
+            throw new Error(`${current}: path component is owned by another uid and writable by others`);
+        }
+    }
+}
+function assertPrivateSocketDirectory(directory, stat, uid) {
+    if (stat.isSymbolicLink())
+        throw new Error(`${directory}: socket directory must not be a symlink`);
+    if (!stat.isDirectory())
+        throw new Error(`${directory}: socket directory is not a directory`);
+    if (stat.uid !== uid)
+        throw new Error(`${directory}: socket directory is not owned by the current uid`);
+    if ((stat.mode & 0o077) !== 0)
+        throw new Error(`${directory}: socket directory has group or other permission bits`);
+}
+function assertOwnedUnixSocket(socketPath, stat, uid) {
+    if (stat.isSymbolicLink())
+        throw new Error(`${socketPath}: existing path is a symlink`);
+    if (stat.isDirectory())
+        throw new Error(`${socketPath}: existing path is a directory`);
+    if (!stat.isSocket())
+        throw new Error(`${socketPath}: existing path is not a Unix socket`);
+    if (stat.uid !== uid)
+        throw new Error(`${socketPath}: existing Unix socket is not owned by the current uid`);
+}
+function unlinkOwnedSocketIfPresent(socketPath, lstat, uid, log) {
+    try {
+        assertTrustedSocketPathComponents(path.dirname(socketPath), lstat, uid);
+        const stat = socketLstatOrMissing(socketPath, lstat);
+        if (!stat)
+            return;
+        assertOwnedUnixSocket(socketPath, stat, uid);
+        fs.unlinkSync(socketPath);
+    }
+    catch (err) {
+        log("warn", err instanceof Error ? err.message : `${socketPath}: could not safely remove socket path`);
+    }
+}
+function prepareSocketDirectory(directory, lstat, uid) {
+    assertTrustedSocketPathComponents(directory, lstat, uid);
+    let stat = socketLstatOrMissing(directory, lstat);
+    let created = false;
+    if (!stat) {
+        try {
+            created = fs.mkdirSync(directory, { recursive: true, mode: 0o700 }) !== undefined;
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new Error(`${directory}: cannot create socket directory: ${detail}`);
+        }
+        assertTrustedSocketPathComponents(directory, lstat, uid);
+        stat = socketLstatOrMissing(directory, lstat);
+        if (!stat)
+            throw new Error(`${directory}: socket directory was not created`);
+    }
+    assertPrivateSocketDirectory(directory, stat, uid);
+    if (!created)
+        return;
+    try {
+        fs.chmodSync(directory, 0o700);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(`${directory}: cannot set newly created socket directory mode to 0700: ${detail}`);
+    }
+    assertTrustedSocketPathComponents(directory, lstat, uid);
+    const verified = socketLstatOrMissing(directory, lstat);
+    if (!verified)
+        throw new Error(`${directory}: socket directory disappeared during permission verification`);
+    assertPrivateSocketDirectory(directory, verified, uid);
+    if ((verified.mode & 0o7777) !== 0o700) {
+        throw new Error(`${directory}: newly created socket directory mode is not 0700 after chmod`);
+    }
+}
+function verifyUserOnlySocket(socketPath, lstat, uid) {
+    assertTrustedSocketPathComponents(path.dirname(socketPath), lstat, uid);
+    const before = socketLstatOrMissing(socketPath, lstat);
+    if (!before)
+        throw new Error(`${socketPath}: Unix socket is missing after listen`);
+    assertOwnedUnixSocket(socketPath, before, uid);
+    if ((before.mode & 0o7777) !== 0o600) {
+        try {
+            fs.chmodSync(socketPath, 0o600);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new Error(`${socketPath}: cannot set Unix socket mode to 0600: ${detail}`);
+        }
+    }
+    assertTrustedSocketPathComponents(path.dirname(socketPath), lstat, uid);
+    const after = socketLstatOrMissing(socketPath, lstat);
+    if (!after)
+        throw new Error(`${socketPath}: Unix socket disappeared during permission verification`);
+    assertOwnedUnixSocket(socketPath, after, uid);
+    if ((after.mode & 0o7777) !== 0o600) {
+        throw new Error(`${socketPath}: Unix socket mode is not 0600 after chmod`);
+    }
+}
 export async function startHqdServer(opts) {
-    const { socketPath } = opts;
-    const isPipe = process.platform === "win32";
+    const isPipe = (opts.platform ?? process.platform) === "win32";
+    // Normalize before checking or binding so `..` cannot make the kernel traverse
+    // a symlink that the lexical component check has already removed.
+    const socketPath = isPipe ? opts.socketPath : path.resolve(opts.socketPath);
+    const lstatSocketPath = opts.socketLstat ?? ((candidate) => fs.lstatSync(candidate));
+    const currentUid = !isPipe ? process.getuid?.() : undefined;
+    const startedMonotonicMs = performance.now();
     const startedAtMs = (opts.now ?? (() => new Date()))().getTime();
     const sessions = new SessionRegistry(opts.now);
-    const resolve = createResolver(opts.registryPath ?? registryFile());
     const log = opts.log ?? (() => { });
+    const resolve = createResolver(opts.registryPath ?? registryFile(), { hqRoot: opts.hqRoot, log });
     const clock = opts.now ?? (() => new Date());
     const env = opts.env ?? process.env;
     const policyIndex = opts.hqRoot ? new PolicyIndex(opts.hqRoot, log) : null;
     let ephemeralMachineToken;
+    let flagRevocationGeneration = 0;
     const requireRoot = () => {
         if (!opts.hqRoot)
             throw new OpError("no_hq_root", "hqd has no HQ root configured (set hqRoot in daemon config or HQ_ROOT)");
@@ -138,15 +370,62 @@ export async function startHqdServer(opts) {
         return explicit ?? boundCompany;
     };
     let hqMcp = opts.mcpBridge;
-    const mcpEnabled = opts.mcpEnabled ?? (() => anywhereRuntimeEnabled(env));
     if (!isPipe) {
-        fs.mkdirSync(path.dirname(socketPath), { recursive: true, mode: 0o700 });
-        if (fs.existsSync(socketPath)) {
+        const directory = path.dirname(socketPath);
+        if (currentUid === undefined)
+            throw new Error(`${directory}: cannot verify current uid for Unix socket directory`);
+        prepareSocketDirectory(directory, lstatSocketPath, currentUid);
+        const existing = socketLstatOrMissing(socketPath, lstatSocketPath);
+        if (existing) {
+            assertOwnedUnixSocket(socketPath, existing, currentUid);
             if (await socketIsLive(socketPath))
                 throw new Error(`hqd is already listening on ${socketPath}`);
-            fs.unlinkSync(socketPath);
+            const beforeUnlink = socketLstatOrMissing(socketPath, lstatSocketPath);
+            if (beforeUnlink) {
+                assertOwnedUnixSocket(socketPath, beforeUnlink, currentUid);
+                if (await socketIsLive(socketPath))
+                    throw new Error(`hqd is already listening on ${socketPath}`);
+                try {
+                    fs.unlinkSync(socketPath);
+                }
+                catch (err) {
+                    const detail = err instanceof Error ? err.message : String(err);
+                    throw new Error(`${socketPath}: cannot remove stale owned Unix socket: ${detail}`);
+                }
+            }
         }
     }
+    const runtimeFlagMonitor = opts.mcpEnabled ? undefined : createBoundedDaemonFlagMonitor({
+        read: opts.runtimeFlagReader ?? (() => readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, {
+            env,
+            throwOnError: true,
+        })),
+        onChange: (enabled) => {
+            if (!enabled) {
+                flagRevocationGeneration += 1;
+                ephemeralMachineToken = undefined;
+            }
+        },
+        onReadError: (error) => {
+            log("warn", `hqd runtime flag refresh failed (${error instanceof Error ? error.name : "UnknownError"}); retaining the last decision only until its 60-second limit`);
+        },
+    });
+    const mcpEnabled = opts.mcpEnabled ?? (() => runtimeFlagMonitor.enabled());
+    const health = async (cwd) => {
+        const flag = runtimeFlagMonitor?.status() ?? {
+            enabled: await mcpEnabled(),
+            lastSuccessfulReadAgeMs: null,
+            heldThroughReadError: false,
+        };
+        return {
+            reachable: true,
+            version: opts.version ?? CLI_VERSION,
+            uptimeMs: Math.max(0, Math.round(performance.now() - startedMonotonicMs)),
+            flag,
+            resolution: healthResolution(resolve(cwd)),
+            socket: healthSocket(socketPath, isPipe),
+        };
+    };
     /** Synchronous ops answer in request order; policy.check and mcp.call may return a promise. */
     const handle = (req) => {
         const args = req.args ?? {};
@@ -159,10 +438,12 @@ export async function startHqdServer(opts) {
                     pid: process.pid,
                     sessions: sessions.size,
                 };
+            case "health":
+                return health(stringArg(args, "cwd"));
             case "auth.status":
                 return Promise.resolve(mcpEnabled()).then((enabled) => {
                     if (!enabled)
-                        throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                        ephemeralMachineToken = undefined;
                     if (ephemeralMachineToken && ephemeralMachineToken.expiresAt <= clock().getTime())
                         ephemeralMachineToken = undefined;
                     return { signedIn: Boolean(ephemeralMachineToken), tokenSource: ephemeralMachineToken ? "stdin-memory" : null };
@@ -171,10 +452,12 @@ export async function startHqdServer(opts) {
                 return Promise.resolve(mcpEnabled()).then(async (enabled) => {
                     if (!enabled)
                         throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                    const loginGeneration = flagRevocationGeneration;
                     const credentials = parseStdinMachineCredentials(JSON.stringify(args.credentials) ?? "");
                     const controller = new AbortController();
                     const timeoutMs = opts.machineAuthTimeoutMs ?? 25_000;
                     let timer;
+                    let authenticatedToken;
                     try {
                         const authentication = (opts.machineAuthenticator ?? ((input, signal) => authenticateMachineCredentials(input, { env, signal })))(credentials, controller.signal);
                         const deadline = new Promise((_, reject) => {
@@ -183,11 +466,10 @@ export async function startHqdServer(opts) {
                                 reject(new MachineLoginError("auth_timeout", "hqd sign-in timed out; try again"));
                             }, timeoutMs);
                         });
-                        const token = await Promise.race([authentication, deadline]);
-                        const expiresAt = machineTokenExpiresAt(token);
+                        authenticatedToken = await Promise.race([authentication, deadline]);
+                        const expiresAt = machineTokenExpiresAt(authenticatedToken);
                         if (expiresAt <= clock().getTime())
                             throw new MachineLoginError("auth_failed", "hqd sign-in failed; the identity provider returned an expired token");
-                        ephemeralMachineToken = { value: token, expiresAt };
                     }
                     catch {
                         throw new MachineLoginError("auth_failed", "hqd sign-in failed; check the machine credentials and try again");
@@ -196,6 +478,10 @@ export async function startHqdServer(opts) {
                         if (timer)
                             clearTimeout(timer);
                     }
+                    if (loginGeneration !== flagRevocationGeneration || !(await mcpEnabled())) {
+                        throw new OpError("anywhere_disabled", `Daemon login is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                    }
+                    ephemeralMachineToken = { value: authenticatedToken, expiresAt: machineTokenExpiresAt(authenticatedToken) };
                     return { signedIn: true, tokenSource: "stdin-memory" };
                 });
             case "resolve": {
@@ -344,7 +630,7 @@ export async function startHqdServer(opts) {
                         const deadline = requestStartedAt + timeoutMs;
                         const forward = () => Promise.resolve(mcpEnabled()).then((enabled) => {
                             if (!enabled) {
-                                throw new McpOpError("hq_mcp_unavailable", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
                             }
                             const remainingMs = Math.floor(deadline - Date.now());
                             if (remainingMs <= 0) {
@@ -365,9 +651,14 @@ export async function startHqdServer(opts) {
                             });
                             return hqMcp.callTool(name, raw, remainingMs);
                         });
-                        return !MCP_READ_ONLY_TOOL_NAMES.has(name)
-                            ? policyGuardedCall(forward)
-                            : forward();
+                        return Promise.resolve(mcpEnabled()).then((enabled) => {
+                            if (!enabled) {
+                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                            }
+                            return !MCP_READ_ONLY_TOOL_NAMES.has(name)
+                                ? policyGuardedCall(forward)
+                                : forward();
+                        });
                     }
                 }
             }
@@ -382,7 +673,7 @@ export async function startHqdServer(opts) {
             socket.write(encodeMessage(msg));
     };
     const clients = new Set();
-    const server = net.createServer((socket) => {
+    const accept = (socket) => {
         clients.add(socket);
         socket.on("close", () => clients.delete(socket));
         socket.on("error", (err) => log("warn", `hqd client error: ${err.message}`));
@@ -438,24 +729,76 @@ export async function startHqdServer(opts) {
             socket.end();
         }, HQD_MAX_LINE_BYTES);
         socket.on("data", push);
-    });
-    await new Promise((resolveListen, rejectListen) => {
-        server.once("error", rejectListen);
-        // Bind with a user-only umask so the socket is never briefly group/world accessible.
-        const prior = isPipe ? null : process.umask(0o177);
+    };
+    if (!isPipe) {
+        if (currentUid === undefined)
+            throw new Error(`${path.dirname(socketPath)}: cannot verify current uid for Unix socket directory`);
+        assertTrustedSocketPathComponents(path.dirname(socketPath), lstatSocketPath, currentUid);
+        const directoryStat = socketLstatOrMissing(path.dirname(socketPath), lstatSocketPath);
+        if (!directoryStat)
+            throw new Error(`${path.dirname(socketPath)}: socket directory is missing before listen`);
+        assertPrivateSocketDirectory(path.dirname(socketPath), directoryStat, currentUid);
+    }
+    let server = null;
+    let windowsPipeHost = null;
+    if (isPipe) {
+        let started;
         try {
-            server.listen(socketPath, () => {
-                server.off("error", rejectListen);
-                resolveListen();
+            const startHost = opts.windowsPipeHostFactory ?? startWindowsPipeHost;
+            started = await startHost(socketPath);
+            (opts.windowsPipeAclCheck ?? validateWindowsPipeAcl)(started.acl);
+            windowsPipeHost = started.host;
+            windowsPipeHost.on("connection", accept);
+            windowsPipeHost.on("failure", (err) => {
+                log("error", `hqd Windows named-pipe helper failed: ${err.message}`);
+                for (const client of clients)
+                    client.destroy(err);
+                opts.onShutdown?.();
             });
+            windowsPipeHost.on("rejectedRemoteClient", (message) => {
+                log("warn", `hqd rejected a remote Windows named-pipe client: ${message}`);
+            });
+            windowsPipeHost.startAccepting();
         }
-        finally {
-            if (prior !== null)
+        catch (err) {
+            if (started)
+                await started.host.close().catch((closeErr) => {
+                    log("warn", `hqd Windows named-pipe helper did not close after security setup failed: ${closeErr.message}`);
+                });
+            policyIndex?.close();
+            hqMcp?.close();
+            log("error", `hqd Windows named-pipe security setup failed: ${err.message}`);
+            throw new Error(WINDOWS_PIPE_STARTUP_REFUSAL);
+        }
+    }
+    else {
+        server = net.createServer(accept);
+        await new Promise((resolveListen, rejectListen) => {
+            server.once("error", rejectListen);
+            // Bind with a user-only umask so the socket is never briefly group/world accessible.
+            const prior = process.umask(0o177);
+            try {
+                server.listen(socketPath, () => {
+                    server.off("error", rejectListen);
+                    resolveListen();
+                });
+            }
+            finally {
                 process.umask(prior);
+            }
+        });
+    }
+    if (!isPipe) {
+        try {
+            verifyUserOnlySocket(socketPath, lstatSocketPath, currentUid);
         }
-    });
-    if (!isPipe)
-        fs.chmodSync(socketPath, 0o600);
+        catch (err) {
+            await new Promise((resolveClose) => server.close(() => resolveClose()));
+            if (currentUid !== undefined)
+                unlinkOwnedSocketIfPresent(socketPath, lstatSocketPath, currentUid, log);
+            throw err;
+        }
+    }
     log("info", `hqd listening on ${socketPath}`);
     let closing = null;
     return {
@@ -463,20 +806,22 @@ export async function startHqdServer(opts) {
         sessions,
         close: () => (closing ??= new Promise((done) => {
             policyIndex?.close();
+            runtimeFlagMonitor?.close();
             hqMcp?.close();
-            server.close(() => done());
             // Answered-but-idle clients would otherwise hold close() open.
             for (const client of clients)
                 client.destroy();
-            if (!isPipe) {
-                try {
-                    fs.unlinkSync(socketPath);
-                }
-                catch (err) {
-                    if (err.code !== "ENOENT")
-                        log("warn", `could not remove ${socketPath}: ${err.message}`);
-                }
+            if (windowsPipeHost) {
+                void windowsPipeHost.close().then(done, (err) => {
+                    log("warn", `hqd Windows named-pipe helper did not close cleanly: ${err.message}`);
+                    done();
+                });
+            }
+            else {
+                server.close(() => done());
             }
+            if (!isPipe && currentUid !== undefined)
+                unlinkOwnedSocketIfPresent(socketPath, lstatSocketPath, currentUid, log);
         })),
     };
 }

package/dist/lib/daemon/windows-pipe-host.d.ts

@@ -0,0 +1,17 @@
+export declare const WINDOWS_PIPE_STARTUP_REFUSAL = "hqd is disabled on Windows because the default named-pipe ACL grants read access to Everyone and Anonymous accounts.";
+export interface WindowsPipeAclReport {
+    userSid: string;
+    sddl: string;
+}
+export interface WindowsPipeHost extends NodeJS.EventEmitter {
+    startAccepting(): void;
+    write(connectionId: number, data: Buffer, callback: (err?: Error | null) => void): void;
+    closeConnection(connectionId: number): void;
+    close(): Promise<void>;
+}
+export declare function validateWindowsPipeAcl(report: WindowsPipeAclReport): WindowsPipeAclReport;
+export declare function startWindowsPipeHost(pipePath: string): Promise<{
+    host: WindowsPipeHost;
+    acl: WindowsPipeAclReport;
+}>;
+//# sourceMappingURL=windows-pipe-host.d.ts.map