@indigoai-us/hq-cli 5.341.2 → 5.341.3

package/dist/lib/doctor/checks/anywhere.js

@@ -18,11 +18,12 @@ import { HQ_MCP_SERVER_NAME, SKILL_LINK_PREFIX, claudeTargets } from "../../inst
 import { codexTargets } from "../../install/codex-targets.js";
 import { CHATGPT_MODE } from "../../install/chatgpt-targets.js";
 import { GROK_MODE } from "../../install/grok-targets.js";
-import { pingHqdVersion } from "../../daemon/convergence.js";
+import { HqdClientError, hqdRequest } from "../../daemon/protocol.js";
 import { daemonPresenceLabel, heartbeatFile, readHeartbeat } from "../../daemon/heartbeat.js";
 import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK } from "../../daemon/install.js";
 import { hqdSocketPath } from "../../daemon/protocol.js";
 import { readRegistry, registryDir, registryFile } from "../../registry/registry.js";
+import { anywhereRuntimeEnabled } from "../../../commands/anywhere-runtime-flag.js";
 export const ANYWHERE_FAMILY_ID = "anywhere";
 export const REMEDIATION = {
     installClaude: "hq install --global --runtime claude",
@@ -38,9 +39,69 @@ export const anywhereFamily = createAnywhereFamily();
 function result(status, checkId, message, remediation, target) {
     return { status, checkId: `anywhere.${checkId}`, message, ...(remediation ? { remediation } : {}), ...(target ? { target } : {}) };
 }
-export async function runAnywhereChecks(_context, deps = {}) {
+export async function runAnywhereChecks(context, deps = {}) {
     const home = deps.home ?? os.homedir();
     const env = deps.env ?? process.env;
+    const socketPath = hqdSocketPath(home, env);
+    const cwd = context.cwd ?? process.cwd();
+    const runtimeEnabled = (deps.runtimeEnabled ?? anywhereRuntimeEnabled)();
+    let health;
+    let healthUnsupported = false;
+    try {
+        if (deps.health) {
+            health = await deps.health(cwd);
+        }
+        else if (deps.ping) {
+            const version = await deps.ping();
+            health = {
+                reachable: true,
+                version,
+                uptimeMs: null,
+                flag: { enabled: runtimeEnabled, lastSuccessfulReadAgeMs: null, heldThroughReadError: false },
+                resolution: { scope: "personal", company: null, fallbackReason: "no_match" },
+                socket: { path: socketPath, transport: process.platform === "win32" ? "windows_named_pipe" : "unix_socket", mode: null, ownerMatchesUser: null, userOnly: null },
+            };
+        }
+        else {
+            health = await hqdRequest("health", { cwd }, { socketPath });
+        }
+    }
+    catch (error) {
+        if (error instanceof HqdClientError && error.code === "unknown_op") {
+            try {
+                let version = null;
+                let uptimeMs = null;
+                if (deps.ping) {
+                    version = await deps.ping();
+                }
+                else {
+                    const ping = await hqdRequest("ping", {}, { socketPath });
+                    if (typeof ping.version === "string")
+                        version = ping.version;
+                    if (typeof ping.uptimeMs === "number")
+                        uptimeMs = ping.uptimeMs;
+                }
+                health = {
+                    reachable: true,
+                    version,
+                    uptimeMs,
+                    flag: { enabled: null, lastSuccessfulReadAgeMs: null, heldThroughReadError: false },
+                    resolution: { scope: "unknown", company: null, fallbackReason: null },
+                    socket: { path: socketPath, transport: process.platform === "win32" ? "windows_named_pipe" : "unix_socket", mode: null, ownerMatchesUser: null, userOnly: null },
+                };
+                healthUnsupported = true;
+            }
+            catch {
+                health = unreachableHealth(socketPath);
+            }
+        }
+        else {
+            health = unreachableHealth(socketPath);
+        }
+    }
+    const healthCheck = runtimeHealthCheck(health, healthUnsupported);
+    if (!runtimeEnabled)
+        return [healthCheck];
     const claude = claudeTargets(home);
     const codex = codexTargets(home);
     const installed = [claude.hqPointer, claude.stateFile, codex.stateFile].some((p) => fs.existsSync(p));
@@ -48,10 +109,10 @@ export async function runAnywhereChecks(_context, deps = {}) {
         result("WARN", "chatgpt-mode", `ChatGPT integration mode: ${CHATGPT_MODE}; host connector setup is managed in ChatGPT`, "hq install --global --runtime chatgpt"),
         result("WARN", "grok-mode", `Grok integration mode: ${GROK_MODE}; host connector setup is managed in Grok`, "hq install --global --runtime grok"),
     ];
+    const out = [healthCheck, ...remoteModes];
     if (!installed) {
-        return [...remoteModes, result("NA", "installed", "HQ local anywhere runtime is not installed on this machine", REMEDIATION.installClaude)];
+        return [...out, result("NA", "installed", "HQ local anywhere runtime is not installed on this machine", REMEDIATION.installClaude)];
     }
-    const out = [...remoteModes];
     const pluginInstall = readClaudePluginInstall(claude.stateFile);
     out.push(checkInstallMode(claude.stateFile));
     out.push(checkPointer(claude.hqPointer));
@@ -63,16 +124,11 @@ export async function runAnywhereChecks(_context, deps = {}) {
         out.push(result("FAIL", "daemon-installed", `daemon service is installed but not loaded (${service.detail})`, REMEDIATION.daemonRestart));
     else
         out.push(result("PASS", "daemon-installed", `daemon service is installed and loaded (${service.detail})`));
-    const socketPath = hqdSocketPath(home, env);
-    const ping = deps.ping ?? (() => pingHqdVersion(socketPath, 2_000));
-    let running = null;
-    try {
-        running = await ping();
+    const running = health.reachable ? health.version : null;
+    if (health.reachable)
         out.push(result("PASS", "socket", `hqd answered on ${socketPath}`, undefined, socketPath));
-    }
-    catch (err) {
-        out.push(result("FAIL", "socket", `hqd is not reachable: ${err instanceof Error ? err.message : String(err)}`, REMEDIATION.daemonInstall, socketPath));
-    }
+    else
+        out.push(result("FAIL", "socket", `hqd is not reachable on ${socketPath}`, REMEDIATION.daemonInstall, socketPath));
     const cliVersion = deps.cliVersion ?? CLI_VERSION;
     if (running === null)
         out.push(result("FAIL", "version", `cannot compare versions: hqd did not answer (hq-cli is ${cliVersion})`, REMEDIATION.daemonInstall));
@@ -96,6 +152,68 @@ export async function runAnywhereChecks(_context, deps = {}) {
         out.push(checkSkillLinks("codex", codex.skillsDir, REMEDIATION.installCodex));
     return out;
 }
+function unreachableHealth(socketPath) {
+    return {
+        reachable: false,
+        version: null,
+        uptimeMs: null,
+        flag: { enabled: null, lastSuccessfulReadAgeMs: null, heldThroughReadError: false },
+        resolution: { scope: "unknown", company: null, fallbackReason: null },
+        socket: { path: socketPath, transport: process.platform === "win32" ? "windows_named_pipe" : "unix_socket", mode: null, ownerMatchesUser: null, userOnly: null },
+    };
+}
+function runtimeHealthCheck(health, healthUnsupported = false) {
+    const { flag, resolution, socket } = health;
+    const age = flag.lastSuccessfulReadAgeMs === null
+        ? "unknown"
+        : `${new Intl.NumberFormat("en-US").format(flag.lastSuccessfulReadAgeMs)} ms`;
+    const flagLabel = flag.enabled === null ? "unknown" : flag.enabled ? "on" : "off";
+    const binding = resolution.scope === "company"
+        ? `company ${resolution.company}`
+        : resolution.scope === "personal"
+            ? `personal (fallback: ${resolution.fallbackReason ?? "unspecified"})`
+            : health.reachable && healthUnsupported
+                ? "unknown (resident daemon lacks the health operation)"
+                : "unknown (daemon unavailable)";
+    const socketSecurity = socket.transport === "windows_named_pipe"
+        ? "Windows named pipe (mode and owner are not reported)"
+        : `mode ${socket.mode ?? "unknown"}; owner matches current user: ${socket.ownerMatchesUser === null ? "unknown" : socket.ownerMatchesUser ? "yes" : "no"}; user-only: ${socket.userOnly === null ? "unknown" : socket.userOnly ? "yes" : "no"}`;
+    const unreachableMessage = socket.transport === "windows_named_pipe"
+        ? `hqd is not reachable on ${socket.path}; Windows daemon startup is refused because named-pipe ACLs are unsupported`
+        : `hqd is not reachable on ${socket.path}; version, uptime, flag state, and cwd binding are unavailable`;
+    const socketNotUserOnly = health.reachable && socket.transport === "unix_socket" && (socket.userOnly !== true || socket.ownerMatchesUser !== true);
+    const warningNotes = [
+        healthUnsupported ? "resident hqd does not support detailed health; restart hqd for full diagnostics" : null,
+        socketNotUserOnly ? "socket is not confirmed user-only" : null,
+    ].filter((note) => note !== null);
+    const message = health.reachable
+        ? `hqd reachable; version ${health.version ?? "unknown"}; uptime ${health.uptimeMs === null ? "unknown" : `${new Intl.NumberFormat("en-US").format(health.uptimeMs)} ms`}; runtime flag ${flagLabel}; last successful flag read ${age} ago; held through read error: ${flag.heldThroughReadError ? "yes" : "no"}; cwd binding ${binding}; socket ${socket.path}; ${socketSecurity}${warningNotes.length ? `; ${warningNotes.join("; ")}` : ""}`
+        : unreachableMessage;
+    const remediation = healthUnsupported || socketNotUserOnly ? REMEDIATION.daemonRestart : undefined;
+    return {
+        status: health.reachable && warningNotes.length === 0 ? "PASS" : "WARN",
+        checkId: "anywhere.runtime-health",
+        target: socket.path,
+        message,
+        ...(remediation ? { remediation } : {}),
+        details: {
+            reachable: health.reachable,
+            version: health.version,
+            uptimeMs: health.uptimeMs,
+            flagEnabled: flag.enabled,
+            lastSuccessfulFlagReadAgeMs: flag.lastSuccessfulReadAgeMs,
+            flagHeldThroughReadError: flag.heldThroughReadError,
+            resolvedScope: resolution.scope,
+            company: resolution.company,
+            fallbackReason: resolution.fallbackReason,
+            socketPath: socket.path,
+            socketTransport: socket.transport,
+            socketMode: socket.mode,
+            socketOwnerMatchesUser: socket.ownerMatchesUser,
+            socketUserOnly: socket.userOnly,
+        },
+    };
+}
 function checkInstallMode(file) {
     try {
         const state = JSON.parse(fs.readFileSync(file, 'utf8'));

package/dist/lib/doctor/json-output.d.ts

@@ -58,6 +58,8 @@ export interface DoctorJsonResult {
     target?: string;
     /** Human-readable explanation. */
     message: string;
+    /** Safe structured diagnostic fields, when a check provides them. */
+    details?: Record<string, unknown>;
     /** Remediation hint. Present only when the result carries one. */
     remediation?: string;
     /** Structured remediation (US-011). Present on actionable findings only. */

package/dist/lib/doctor/json-output.js

@@ -60,6 +60,7 @@ function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds)
             : {}),
         ...(result.target !== undefined ? { target: result.target } : {}),
         message: result.message,
+        ...(result.details !== undefined ? { details: result.details } : {}),
         ...(result.remediation !== undefined
             ? { remediation: result.remediation }
             : {}),

package/dist/lib/doctor/registry.js

@@ -27,7 +27,6 @@ import { anywhereFamily } from "./checks/anywhere.js";
 import { scaffoldCliFloorFamily } from "./checks/scaffold-cli-floor.js";
 import { fixtureCoverageFamily } from "./fixtures/discover.js";
 import { checkClaudeWiring } from "./checks/claude-wiring.js";
-import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
 /**
  * An ordered, id-keyed set of check families. Registration order is preserved
  * (Map iteration order), and re-registering an id replaces the family in place
@@ -266,8 +265,7 @@ export function createDefaultRegistry() {
     registry.register(botsFamily);
     // HQ anywhere (US-012): pointer, registry, hqd service/socket/version,
     // heartbeat, MCP registrations and skill links. NA when not installed.
-    if (anywhereRuntimeEnabled())
-        registry.register(anywhereFamily);
+    registry.register(anywhereFamily);
     return registry;
 }
 //# sourceMappingURL=registry.js.map

package/dist/lib/doctor/types.d.ts

@@ -35,6 +35,8 @@ export interface CheckResult {
     target?: string;
     /** Human-readable one-line explanation of the result. */
     message: string;
+    /** Safe structured fields for machine-readable results. */
+    details?: Record<string, unknown>;
     /** Optional remediation hint (a command or instruction). */
     remediation?: string;
 }
@@ -47,6 +49,8 @@ export interface CheckResult {
 export interface CheckContext {
     /** Absolute, resolved HQ tree root every check reads from. */
     hqRoot: string;
+    /** Original caller working directory, used only for company/personal binding diagnostics. */
+    cwd?: string;
     /**
      * The detected host platform (id, and optionally the evidence behind it).
      * Host-specific live checks — the US-006 runtime probe — key their

package/dist/utils/run-bundled-script.d.ts

@@ -51,6 +51,8 @@ export type RunBundledScriptOptions = {
     hqRoot?: string;
     /** Extra environment for the child, applied last. */
     env?: Record<string, string | undefined>;
+    /** Convert the script path for Git Bash when the script resolves sibling assets from BASH_SOURCE. */
+    msysScriptPath?: boolean;
     /** Capture stdout and stderr as bytes instead of inheriting those streams. */
     captureOutput?: boolean;
     /** Bytes supplied on stdin. With no value, stdin is inherited as before. */

package/dist/utils/run-bundled-script.js

@@ -44,6 +44,14 @@ export function interpreterFor(asset) {
     const ext = path.extname(asset).toLowerCase();
     return ext === ".mjs" || ext === ".js" || ext === ".cjs" ? "node" : "bash";
 }
+/** Git Bash expects drive paths in MSYS form when an interpreter arg is a script path. */
+function scriptPathForBash(script) {
+    if (process.platform !== "win32")
+        return script;
+    const normalized = script.replaceAll("\\", "/");
+    const drivePath = normalized.match(/^([A-Za-z]):\/(.*)$/);
+    return drivePath ? `/${drivePath[1].toLowerCase()}/${drivePath[2]}` : normalized;
+}
 function envValue(env, name) {
     const key = Object.keys(env).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
     return key ? env[key] : undefined;
@@ -176,7 +184,8 @@ export function runBundledScript(opts) {
             : inputDescriptor !== undefined
                 ? [stdinStdio, "inherit", "inherit"]
                 : "inherit";
-        result = spawnSync(executable, [script, ...(opts.args ?? [])], {
+        const scriptArg = interpreter === "bash" && opts.msysScriptPath ? scriptPathForBash(script) : script;
+        result = spawnSync(executable, [scriptArg, ...(opts.args ?? [])], {
             cwd: opts.cwd,
             env,
             stdio,

package/docs/anywhere-runtime.md

@@ -1,8 +1,9 @@
 # HQ Anywhere runtime
 
 HQ Anywhere installs global hooks for supported agent runtimes and uses the
-local hqd daemon on macOS and Linux. Windows does not currently start hqd, so
-the daemon-backed routing described here is unavailable there. A per-user
+local hqd daemon on macOS, Linux, and Windows. On Windows, hqd uses a bundled
+PowerShell pipe host that applies and verifies a user-only named-pipe DACL
+before becoming ready. A per-user
 registry links repositories to HQ companies. The `hq-anywhere-runtime` flag
 controls these features and is off by default.
 
@@ -26,9 +27,19 @@ The CLI stores the HQ root at `~/.hq/root` and keeps the folder registry in
 `~/.hq/registry.json`. These files belong to the current host. They are not
 stored in a repository or synced HQ folder.
 
-On Windows, `hq daemon install` reports that hqd cannot start because its
-named-pipe ACL is not supported. Global hook installation may still configure
-local runtime hooks, but it does not provide the hqd routing described below.
+Windows requires Windows PowerShell 5.1 or PowerShell 7 for the bundled pipe
+host. If it is unavailable, the pipe cannot be created with a verified
+current-user-only DACL, or another process already owns the pipe name, hqd
+refuses to start. The `hq-anywhere-runtime` flag remains off by default on all
+platforms.
+
+On macOS and Linux, hqd checks the socket directory and socket path with
+`lstat` before serving. It refuses symlinked, shared, or foreign-owned paths.
+The default socket is under `~/.hq/daemon/`, separate from the registry directory;
+a directory created for the socket is set to `0700`. hqd replaces a stale
+socket only when the current user owns it, then verifies the listening socket
+is `0600`. If a check fails, hqd reports the path and stops without removing an
+unexpected file.
 
 When the flag is enabled, the global hook uses hqd for events outside the HQ
 root. Inside the root, the project hook routes through hqd when it is running
@@ -51,6 +62,22 @@ An authentication still in progress when revocation arrives fails cleanly;
 hosted MCP calls already forwarded are allowed to finish or return their normal
 request error. The daemon process itself does not terminate.
 
+## Diagnose the runtime
+
+`hq doctor` reports hqd reachability, version and uptime, the last successful
+runtime-flag read and its age, and whether hqd is holding that decision after a
+read error. It also reports the company selected for the current directory or
+the reason it fell back to personal context. On Unix, the socket line includes
+its permission mode, owner check and whether it is user-only. Windows reports
+the named-pipe transport without Unix mode or owner fields. Use `hq doctor
+--json` for the same fields as structured details. The hqd health operation is
+read-only and available while the runtime flag is off; it reports only the
+current directory's binding and never returns authentication tokens. A Unix
+socket that cannot be verified as user-only produces a warning. If an older
+resident daemon does not support the health operation, doctor falls back to
+`ping` for reachability, version and uptime, then warns that a restart is needed
+for full diagnostics.
+
 ## Link a repository
 
 Run `hq link <company>` from a repository to associate it with a company. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.341.2",
+  "version": "5.341.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -13,6 +13,7 @@
     "assets/scaffold",
     "assets/bot-workers",
     "assets/mesh-daemon",
+    "assets/hqd",
     "assets/lanes-reconcile",
     "assets/lanes-hooks",
     "templates",