@indigoai-us/hq-cli 5.341.1 → 5.341.3

package/docs/anywhere-runtime.md

@@ -1,8 +1,9 @@
 # HQ Anywhere runtime
 
 HQ Anywhere installs global hooks for supported agent runtimes and uses the
-local hqd daemon on macOS and Linux. Windows does not currently start hqd, so
-the daemon-backed routing described here is unavailable there. A per-user
+local hqd daemon on macOS, Linux, and Windows. On Windows, hqd uses a bundled
+PowerShell pipe host that applies and verifies a user-only named-pipe DACL
+before becoming ready. A per-user
 registry links repositories to HQ companies. The `hq-anywhere-runtime` flag
 controls these features and is off by default.
 
@@ -26,14 +27,57 @@ The CLI stores the HQ root at `~/.hq/root` and keeps the folder registry in
 `~/.hq/registry.json`. These files belong to the current host. They are not
 stored in a repository or synced HQ folder.
 
-On Windows, `hq daemon install` reports that hqd cannot start because its
-named-pipe ACL is not supported. Global hook installation may still configure
-local runtime hooks, but it does not provide the hqd routing described below.
+Windows requires Windows PowerShell 5.1 or PowerShell 7 for the bundled pipe
+host. If it is unavailable, the pipe cannot be created with a verified
+current-user-only DACL, or another process already owns the pipe name, hqd
+refuses to start. The `hq-anywhere-runtime` flag remains off by default on all
+platforms.
+
+On macOS and Linux, hqd checks the socket directory and socket path with
+`lstat` before serving. It refuses symlinked, shared, or foreign-owned paths.
+The default socket is under `~/.hq/daemon/`, separate from the registry directory;
+a directory created for the socket is set to `0700`. hqd replaces a stale
+socket only when the current user owns it, then verifies the listening socket
+is `0600`. If a check fails, hqd reports the path and stops without removing an
+unexpected file.
 
 When the flag is enabled, the global hook uses hqd for events outside the HQ
 root. Inside the root, the project hook routes through hqd when it is running
 and uses the direct master hook when it is stopped.
 
+## Flag revocation
+
+While hqd is running, it refreshes `hq-anywhere-runtime` every 30 seconds.
+Successful reads are never trusted for more than 60 seconds. This gives a
+healthy flag service a 30-second revocation window while limiting reads to two
+per minute per daemon; the five-second flag request timeout bounds the work
+when the service is slow. Staleness uses elapsed monotonic time, so wall-clock
+corrections cannot extend an ON decision.
+
+When a read fails, hqd keeps the last successful value only until it is 60
+seconds old. After that, it fails closed. An OFF decision refuses new daemon
+login and hosted MCP calls with `anywhere_disabled` and clears any stdin machine
+token held in memory. `auth.status` remains available and reports signed out.
+An authentication still in progress when revocation arrives fails cleanly;
+hosted MCP calls already forwarded are allowed to finish or return their normal
+request error. The daemon process itself does not terminate.
+
+## Diagnose the runtime
+
+`hq doctor` reports hqd reachability, version and uptime, the last successful
+runtime-flag read and its age, and whether hqd is holding that decision after a
+read error. It also reports the company selected for the current directory or
+the reason it fell back to personal context. On Unix, the socket line includes
+its permission mode, owner check and whether it is user-only. Windows reports
+the named-pipe transport without Unix mode or owner fields. Use `hq doctor
+--json` for the same fields as structured details. The hqd health operation is
+read-only and available while the runtime flag is off; it reports only the
+current directory's binding and never returns authentication tokens. A Unix
+socket that cannot be verified as user-only produces a warning. If an older
+resident daemon does not support the health operation, doctor falls back to
+`ping` for reachability, version and uptime, then warns that a restart is needed
+for full diagnostics.
+
 ## Link a repository
 
 Run `hq link <company>` from a repository to associate it with a company. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.341.1",
+  "version": "5.341.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -13,6 +13,7 @@
     "assets/scaffold",
     "assets/bot-workers",
     "assets/mesh-daemon",
+    "assets/hqd",
     "assets/lanes-reconcile",
     "assets/lanes-hooks",
     "templates",