@indigoai-us/hq-cli 5.341.2 → 5.341.3

package/dist/commands/doctor.js

@@ -37,7 +37,6 @@ import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
 import { runSideEffectTests } from "../lib/doctor/deep/sandbox.js";
-import { anywhereRuntimeEnabled } from "./anywhere-runtime-flag.js";
 /**
  * Marker directories that identify an HQ tree root. A directory is an HQ root
  * only when it contains ALL of these. `.claude` + `core` are present in both
@@ -91,7 +90,7 @@ export async function runDoctor(options = {}) {
     const write = options.stdout ?? ((chunk) => void process.stdout.write(chunk));
     const writeErr = options.stderr ?? ((chunk) => void process.stderr.write(chunk));
     const hqRoot = options.root ?? resolveHqRoot(options.cwd);
-    const standaloneAnywhere = !hqRoot && options.only?.length === 1 && options.only[0] === "anywhere" && anywhereRuntimeEnabled();
+    const standaloneAnywhere = !hqRoot && options.only?.length === 1 && options.only[0] === "anywhere";
     if (!hqRoot && !standaloneAnywhere) {
         const from = options.cwd ?? process.cwd();
         writeErr(`hq doctor: not inside an HQ tree.\n` +
@@ -126,6 +125,7 @@ export async function runDoctor(options = {}) {
         // Anywhere checks inspect ~/.hq and are intentionally runnable from a foreign
         // repo. No other family is selected in this standalone path.
         hqRoot: hqRoot ?? "",
+        cwd: options.cwd ?? process.cwd(),
         platform: { id: platform.id, evidence: platform.evidence },
         sessionId: options.sessionId,
         liveRuntimes: options.liveRuntimes === true,

package/dist/lib/aws-sdk-node-warning-output.js

@@ -1,4 +1,5 @@
 import { companyErrorsSdkWarningEnabled } from "./company-errors-sdk-warning-flag.js";
+import { diagnosticsEnabled } from "./diagnostics.js";
 export const AWS_SDK_NODE_VERSION_WARNING_ENV = "AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED";
 /**
  * Configure the AWS SDK's documented, warning-specific switch before loading
@@ -10,9 +11,7 @@ export function configureAwsSdkNodeVersionWarningOutput(options = {}) {
     const enabled = options.enabled ?? companyErrorsSdkWarningEnabled();
     if (!enabled)
         return;
-    const verbose = argv.includes("--verbose");
-    const debug = /^(1|true|yes)$/i.test(env.HQ_DEBUG?.trim() ?? "");
-    if (verbose || debug) {
+    if (diagnosticsEnabled(env, argv)) {
         delete env[AWS_SDK_NODE_VERSION_WARNING_ENV];
     }
     else {

package/dist/lib/billing/plan-lock.js

@@ -21,6 +21,7 @@
  * missing data (hq-absent-field-never-means-constraining-value).
  */
 import chalk from "chalk";
+import { diagnosticsEnabled } from "../diagnostics.js";
 import { vaultApiFetch } from "../../utils/vault-api.js";
 import { parseFreeMonth } from "./free-month.js";
 import { selectPlanLimitUpgradeUrl } from "./plan-limit-upgrade-url.js";
@@ -212,6 +213,16 @@ function statusFromUsage(companySlug, companyUid, body, upgradeCompanySlug) {
         checkedAt: new Date().toISOString(),
     };
 }
+function isSilentPlanLimitBodyError(error) {
+    return (error instanceof Error &&
+        (error.name === "AbortError" || error.name === "TimeoutError"));
+}
+function notePlanLimitBodyUnreadable(error) {
+    if (isSilentPlanLimitBodyError(error) || !diagnosticsEnabled())
+        return;
+    const errorName = error instanceof Error ? error.name : "Error";
+    console.error(`plan-limit body unreadable errorName=${errorName}`);
+}
 /**
  * Read the live nag for one company from usage-limits. `/membership/me` is
  * used only to resolve slug → companyUid. Returns null when the server did
@@ -226,7 +237,10 @@ export async function fetchPlanLimitStatus(token, companyRef, opts = {}) {
     });
     if (!res.ok)
         return null;
-    const selected = selectCompanyMembership(await res.json().catch(() => null), companyRef);
+    const selected = selectCompanyMembership(await res.json().catch((error) => {
+        notePlanLimitBodyUnreadable(error);
+        return null;
+    }), companyRef);
     if (!selected?.companyUid)
         return null;
     try {
@@ -238,7 +252,10 @@ export async function fetchPlanLimitStatus(token, companyRef, opts = {}) {
         });
         if (!usage.ok)
             return null;
-        const body = await usage.json().catch(() => null);
+        const body = await usage.json().catch((error) => {
+            notePlanLimitBodyUnreadable(error);
+            return null;
+        });
         if (!body)
             return null;
         const selectedSlug = selected.companySlug ??

package/dist/lib/bot/owner-context.d.ts

@@ -67,6 +67,8 @@ export declare class OwnerContextCache {
     private value;
     private at;
     private pending;
+    /** True only after the wait ended before this lookup, so a later rejection is the hidden one. */
+    private waitEnded;
     constructor(lookup: () => Promise<OwnerContext>, nowMs?: () => number, waitMs?: number, ownerUid?: string);
     get(): Promise<OwnerContext>;
 }

package/dist/lib/bot/owner-context.js

@@ -13,6 +13,7 @@
  * slugs, uids, roles) reaches the model; the owner's token never does. A failed
  * lookup is reported as "could not check", never as "no companies".
  */
+import { diagnosticsEnabled } from "../diagnostics.js";
 import { ensureCognitoToken } from "../../utils/cognito-session.js";
 import { resolveCallerPersonUid, vaultApiFetch } from "../../utils/vault-api.js";
 function message(err) {
@@ -85,6 +86,12 @@ export const OWNER_CONTEXT_TTL_MS = 5 * 60_000;
 export const OWNER_CONTEXT_RETRY_MS = 60_000;
 /** A turn never waits longer than this for a refresh; the lookup keeps going in the background. */
 const OWNER_CONTEXT_WAIT_MS = 8_000;
+function noteOwnerContextLookupRejected(error) {
+    if (!diagnosticsEnabled())
+        return;
+    const errorName = error instanceof Error ? error.name : "Error";
+    console.error(`owner-context lookup failed errorName=${errorName}`);
+}
 export class OwnerContextCache {
     lookup;
     nowMs;
@@ -93,6 +100,8 @@ export class OwnerContextCache {
     value = null;
     at = 0;
     pending = null;
+    /** True only after the wait ended before this lookup, so a later rejection is the hidden one. */
+    waitEnded = false;
     constructor(lookup, nowMs = Date.now, waitMs = OWNER_CONTEXT_WAIT_MS, ownerUid = "") {
         this.lookup = lookup;
         this.nowMs = nowMs;
@@ -104,6 +113,7 @@ export class OwnerContextCache {
         if (this.value && age < (this.value.status === "ok" ? OWNER_CONTEXT_TTL_MS : OWNER_CONTEXT_RETRY_MS))
             return this.value;
         if (!this.pending) {
+            this.waitEnded = false;
             this.pending = this.lookup()
                 .then((v) => {
                 this.value = v;
@@ -113,7 +123,14 @@ export class OwnerContextCache {
                 .finally(() => {
                 this.pending = null;
             });
-            this.pending.catch(() => undefined);
+            // An in-time rejection is rethrown by the race below and leaves
+            // waitEnded false, so it is not logged. A rejection that lands after
+            // the wait already returned is otherwise invisible.
+            void this.pending.catch((error) => {
+                if (!this.waitEnded)
+                    return;
+                noteOwnerContextLookupRejected(error);
+            });
         }
         let timer;
         const slow = new Promise((resolve) => {
@@ -123,6 +140,7 @@ export class OwnerContextCache {
             const got = await Promise.race([this.pending, slow]);
             if (got)
                 return got;
+            this.waitEnded = true;
         }
         finally {
             if (timer)

package/dist/lib/daemon/flag-monitor.d.ts

@@ -8,6 +8,11 @@ export interface BoundedDaemonFlagMonitorOptions {
 }
 export interface BoundedDaemonFlagMonitor {
     enabled(): Promise<boolean>;
+    status(): {
+        enabled: boolean;
+        lastSuccessfulReadAgeMs: number | null;
+        heldThroughReadError: boolean;
+    };
     close(): void;
 }
 /**

package/dist/lib/daemon/flag-monitor.js

@@ -1,3 +1,4 @@
+import { performance } from "node:perf_hooks";
 export const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30_000;
 export const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
 /**
@@ -5,10 +6,11 @@ export const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
  * A failed read keeps the last successful decision only until its 60s age limit.
  */
 export function createBoundedDaemonFlagMonitor(options) {
-    const now = options.now ?? Date.now;
+    const now = options.now ?? (() => performance.now());
     let value;
     let lastSuccessAt;
     let lastAttemptAt;
+    let lastReadFailed = false;
     let successVersion = 0;
     let refreshInFlight;
     let expiryTimer;
@@ -34,6 +36,7 @@ export function createBoundedDaemonFlagMonitor(options) {
             if (closed)
                 return false;
             lastSuccessAt = now();
+            lastReadFailed = false;
             const thisSuccessVersion = ++successVersion;
             publish(next);
             if (expiryTimer)
@@ -46,6 +49,7 @@ export function createBoundedDaemonFlagMonitor(options) {
             expiryTimer.unref?.();
             return next;
         }).catch((error) => {
+            lastReadFailed = true;
             options.onReadError?.(error);
             expireIfStale();
             return value ?? false;
@@ -74,6 +78,15 @@ export function createBoundedDaemonFlagMonitor(options) {
             }
             return value;
         },
+        status() {
+            const age = lastSuccessAt === undefined ? null : Math.max(0, now() - lastSuccessAt);
+            const fresh = age !== null && age < HQ_ANYWHERE_FLAG_MAX_STALENESS_MS;
+            return {
+                enabled: value === true && fresh,
+                lastSuccessfulReadAgeMs: age,
+                heldThroughReadError: lastReadFailed && fresh,
+            };
+        },
         close() {
             closed = true;
             if (refreshTimer)

package/dist/lib/daemon/protocol.d.ts

@@ -7,8 +7,31 @@
  * out of order, so clients match them by `id`.
  */
 export declare const HQD_SOCKET_NAME = "hqd.sock";
-export declare const HQD_OPS: readonly ["ping", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "auth.login", "auth.status", "shutdown"];
+export declare const HQD_OPS: readonly ["ping", "health", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "auth.login", "auth.status", "shutdown"];
 export type HqdOp = (typeof HQD_OPS)[number];
+export type HqdHealthFallbackReason = "registry_unavailable" | "manifest_missing_or_malformed" | "company_not_in_manifest" | "no_match";
+export interface HqdHealthResult {
+    reachable: boolean;
+    version: string | null;
+    uptimeMs: number | null;
+    flag: {
+        enabled: boolean | null;
+        lastSuccessfulReadAgeMs: number | null;
+        heldThroughReadError: boolean;
+    };
+    resolution: {
+        scope: "company" | "personal" | "unknown";
+        company: string | null;
+        fallbackReason: HqdHealthFallbackReason | null;
+    };
+    socket: {
+        path: string;
+        transport: "unix_socket" | "windows_named_pipe";
+        mode: string | null;
+        ownerMatchesUser: boolean | null;
+        userOnly: boolean | null;
+    };
+}
 /** A request line larger than this is rejected and the connection closed. */
 export declare const HQD_MAX_LINE_BYTES: number;
 export declare const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2000;
@@ -31,10 +54,10 @@ export type HqdResponse = {
     error: HqdError;
 };
 /**
- * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
+ * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/daemon/hqd.sock.
  * On Windows the socket is a per-user named pipe.
  */
-export declare function hqdSocketPath(home?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+export declare function hqdSocketPath(home?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, currentUserSid?: () => string | null): string;
 export declare function encodeMessage(message: HqdRequest | HqdResponse): string;
 export type ParsedLine = {
     ok: true;

package/dist/lib/daemon/protocol.js

@@ -9,9 +9,11 @@
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readCurrentUserSid } from "../work-context/windows-acl.js";
 export const HQD_SOCKET_NAME = "hqd.sock";
 export const HQD_OPS = [
     "ping",
+    "health",
     "resolve",
     "session.open",
     "session.get",
@@ -31,19 +33,21 @@ export const HQD_OPS = [
 export const HQD_MAX_LINE_BYTES = 1024 * 1024;
 export const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2_000;
 /**
- * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
+ * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/daemon/hqd.sock.
  * On Windows the socket is a per-user named pipe.
  */
-export function hqdSocketPath(home = os.homedir(), env = process.env, platform = process.platform) {
+export function hqdSocketPath(home = os.homedir(), env = process.env, platform = process.platform, currentUserSid = readCurrentUserSid) {
     const override = env.HQ_HQD_SOCKET?.trim();
     if (override)
         return override;
     if (platform === "win32") {
-        const user = (env.USERNAME ?? os.userInfo().username).replace(/[^A-Za-z0-9_.-]/g, "-");
-        return `\\\\.\\pipe\\hqd-${user}`;
+        const userSid = currentUserSid();
+        if (!userSid)
+            throw new Error("Cannot determine the current Windows user SID for the hqd pipe name");
+        return `\\\\.\\pipe\\hqd-${userSid.toLowerCase()}`;
     }
     const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
-    return path.join(dir, HQD_SOCKET_NAME);
+    return path.join(dir, "daemon", HQD_SOCKET_NAME);
 }
 export function encodeMessage(message) {
     return `${JSON.stringify(message)}\n`;

package/dist/lib/daemon/run.js

@@ -693,24 +693,22 @@ export async function runDaemon(opts) {
     let hqdShutdown = null;
     if (anywhereRuntimeEnabled()) {
         const refusal = hqdStartupRefusal(platform, true);
-        if (refusal) {
-            log("error", refusal);
+        try {
+            const startConfig = readDaemonConfig(paths.configPath);
+            hqd = await startHqdServer({
+                socketPath: hqdSocketPath(home, env),
+                registryPath: registryFile(registryDir(home, env)),
+                hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
+                log,
+                onShutdown: () => hqdShutdown?.(),
+                reportError: reportHqdCrash,
+            });
         }
-        else {
-            try {
-                const startConfig = readDaemonConfig(paths.configPath);
-                hqd = await startHqdServer({
-                    socketPath: hqdSocketPath(home, env),
-                    registryPath: registryFile(registryDir(home, env)),
-                    hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
-                    log,
-                    onShutdown: () => hqdShutdown?.(),
-                    reportError: reportHqdCrash,
-                });
-            }
-            catch (err) {
+        catch (err) {
+            if (refusal && err.message === refusal)
+                log("error", refusal);
+            else
                 log("error", `hqd socket did not start; services run without it: ${err.message}`);
-            }
         }
     }
     // US-012: 60s presence heartbeat with version and session count.

package/dist/lib/daemon/server.d.ts

@@ -6,13 +6,26 @@
  * machine. Sessions in any repo ask it which company they belong to and
  * register themselves here.
  */
+import * as fs from "node:fs";
 import { readRegistry, type ResolveResult } from "../registry/registry.js";
 import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
 import { type StdinMachineCredentials } from "./machine-login.js";
+import { type WindowsPipeAclReport, type WindowsPipeHost } from "./windows-pipe-host.js";
 export interface HqdServerOptions {
     socketPath: string;
+    /** Test seam for selecting the Windows transport without changing host behavior. */
+    platform?: NodeJS.Platform;
+    /** Test seam for verifying socket ownership without changing the host uid. */
+    socketLstat?: (path: string) => fs.Stats;
+    /** Test seam for helper startup and its OS-read ACL report. */
+    windowsPipeHostFactory?: (socketPath: string) => Promise<{
+        host: WindowsPipeHost;
+        acl: WindowsPipeAclReport;
+    }>;
+    /** Test seam for rejecting an invalid helper ACL report. */
+    windowsPipeAclCheck?: (report: WindowsPipeAclReport) => WindowsPipeAclReport;
     /** registry.json to resolve against (US-004). */
     registryPath?: string;
     hqRoot?: string;