@indigoai-us/hq-cli 5.341.2 → 5.341.4

package/dist/commands/doctor.js

@@ -37,7 +37,6 @@ import { isCompanyJournalSlug } from "../lib/doctor/checks/sync-health.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
 import { runSideEffectTests } from "../lib/doctor/deep/sandbox.js";
-import { anywhereRuntimeEnabled } from "./anywhere-runtime-flag.js";
 /**
  * Marker directories that identify an HQ tree root. A directory is an HQ root
  * only when it contains ALL of these. `.claude` + `core` are present in both
@@ -91,7 +90,7 @@ export async function runDoctor(options = {}) {
     const write = options.stdout ?? ((chunk) => void process.stdout.write(chunk));
     const writeErr = options.stderr ?? ((chunk) => void process.stderr.write(chunk));
     const hqRoot = options.root ?? resolveHqRoot(options.cwd);
-    const standaloneAnywhere = !hqRoot && options.only?.length === 1 && options.only[0] === "anywhere" && anywhereRuntimeEnabled();
+    const standaloneAnywhere = !hqRoot && options.only?.length === 1 && options.only[0] === "anywhere";
     if (!hqRoot && !standaloneAnywhere) {
         const from = options.cwd ?? process.cwd();
         writeErr(`hq doctor: not inside an HQ tree.\n` +
@@ -126,6 +125,7 @@ export async function runDoctor(options = {}) {
         // Anywhere checks inspect ~/.hq and are intentionally runnable from a foreign
         // repo. No other family is selected in this standalone path.
         hqRoot: hqRoot ?? "",
+        cwd: options.cwd ?? process.cwd(),
         platform: { id: platform.id, evidence: platform.evidence },
         sessionId: options.sessionId,
         liveRuntimes: options.liveRuntimes === true,

package/dist/lib/aws-sdk-node-warning-output.js

@@ -1,4 +1,5 @@
 import { companyErrorsSdkWarningEnabled } from "./company-errors-sdk-warning-flag.js";
+import { diagnosticsEnabled } from "./diagnostics.js";
 export const AWS_SDK_NODE_VERSION_WARNING_ENV = "AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED";
 /**
  * Configure the AWS SDK's documented, warning-specific switch before loading
@@ -10,9 +11,7 @@ export function configureAwsSdkNodeVersionWarningOutput(options = {}) {
     const enabled = options.enabled ?? companyErrorsSdkWarningEnabled();
     if (!enabled)
         return;
-    const verbose = argv.includes("--verbose");
-    const debug = /^(1|true|yes)$/i.test(env.HQ_DEBUG?.trim() ?? "");
-    if (verbose || debug) {
+    if (diagnosticsEnabled(env, argv)) {
         delete env[AWS_SDK_NODE_VERSION_WARNING_ENV];
     }
     else {

package/dist/lib/billing/plan-lock.js

@@ -21,6 +21,7 @@
  * missing data (hq-absent-field-never-means-constraining-value).
  */
 import chalk from "chalk";
+import { diagnosticsEnabled } from "../diagnostics.js";
 import { vaultApiFetch } from "../../utils/vault-api.js";
 import { parseFreeMonth } from "./free-month.js";
 import { selectPlanLimitUpgradeUrl } from "./plan-limit-upgrade-url.js";
@@ -212,6 +213,16 @@ function statusFromUsage(companySlug, companyUid, body, upgradeCompanySlug) {
         checkedAt: new Date().toISOString(),
     };
 }
+function isSilentPlanLimitBodyError(error) {
+    return (error instanceof Error &&
+        (error.name === "AbortError" || error.name === "TimeoutError"));
+}
+function notePlanLimitBodyUnreadable(error) {
+    if (isSilentPlanLimitBodyError(error) || !diagnosticsEnabled())
+        return;
+    const errorName = error instanceof Error ? error.name : "Error";
+    console.error(`plan-limit body unreadable errorName=${errorName}`);
+}
 /**
  * Read the live nag for one company from usage-limits. `/membership/me` is
  * used only to resolve slug → companyUid. Returns null when the server did
@@ -226,7 +237,10 @@ export async function fetchPlanLimitStatus(token, companyRef, opts = {}) {
     });
     if (!res.ok)
         return null;
-    const selected = selectCompanyMembership(await res.json().catch(() => null), companyRef);
+    const selected = selectCompanyMembership(await res.json().catch((error) => {
+        notePlanLimitBodyUnreadable(error);
+        return null;
+    }), companyRef);
     if (!selected?.companyUid)
         return null;
     try {
@@ -238,7 +252,10 @@ export async function fetchPlanLimitStatus(token, companyRef, opts = {}) {
         });
         if (!usage.ok)
             return null;
-        const body = await usage.json().catch(() => null);
+        const body = await usage.json().catch((error) => {
+            notePlanLimitBodyUnreadable(error);
+            return null;
+        });
         if (!body)
             return null;
         const selectedSlug = selected.companySlug ??

package/dist/lib/bot/owner-context.d.ts

@@ -67,6 +67,8 @@ export declare class OwnerContextCache {
     private value;
     private at;
     private pending;
+    /** True only after the wait ended before this lookup, so a later rejection is the hidden one. */
+    private waitEnded;
     constructor(lookup: () => Promise<OwnerContext>, nowMs?: () => number, waitMs?: number, ownerUid?: string);
     get(): Promise<OwnerContext>;
 }

package/dist/lib/bot/owner-context.js

@@ -13,6 +13,7 @@
  * slugs, uids, roles) reaches the model; the owner's token never does. A failed
  * lookup is reported as "could not check", never as "no companies".
  */
+import { diagnosticsEnabled } from "../diagnostics.js";
 import { ensureCognitoToken } from "../../utils/cognito-session.js";
 import { resolveCallerPersonUid, vaultApiFetch } from "../../utils/vault-api.js";
 function message(err) {
@@ -85,6 +86,12 @@ export const OWNER_CONTEXT_TTL_MS = 5 * 60_000;
 export const OWNER_CONTEXT_RETRY_MS = 60_000;
 /** A turn never waits longer than this for a refresh; the lookup keeps going in the background. */
 const OWNER_CONTEXT_WAIT_MS = 8_000;
+function noteOwnerContextLookupRejected(error) {
+    if (!diagnosticsEnabled())
+        return;
+    const errorName = error instanceof Error ? error.name : "Error";
+    console.error(`owner-context lookup failed errorName=${errorName}`);
+}
 export class OwnerContextCache {
     lookup;
     nowMs;
@@ -93,6 +100,8 @@ export class OwnerContextCache {
     value = null;
     at = 0;
     pending = null;
+    /** True only after the wait ended before this lookup, so a later rejection is the hidden one. */
+    waitEnded = false;
     constructor(lookup, nowMs = Date.now, waitMs = OWNER_CONTEXT_WAIT_MS, ownerUid = "") {
         this.lookup = lookup;
         this.nowMs = nowMs;
@@ -104,6 +113,7 @@ export class OwnerContextCache {
         if (this.value && age < (this.value.status === "ok" ? OWNER_CONTEXT_TTL_MS : OWNER_CONTEXT_RETRY_MS))
             return this.value;
         if (!this.pending) {
+            this.waitEnded = false;
             this.pending = this.lookup()
                 .then((v) => {
                 this.value = v;
@@ -113,7 +123,14 @@ export class OwnerContextCache {
                 .finally(() => {
                 this.pending = null;
             });
-            this.pending.catch(() => undefined);
+            // An in-time rejection is rethrown by the race below and leaves
+            // waitEnded false, so it is not logged. A rejection that lands after
+            // the wait already returned is otherwise invisible.
+            void this.pending.catch((error) => {
+                if (!this.waitEnded)
+                    return;
+                noteOwnerContextLookupRejected(error);
+            });
         }
         let timer;
         const slow = new Promise((resolve) => {
@@ -123,6 +140,7 @@ export class OwnerContextCache {
             const got = await Promise.race([this.pending, slow]);
             if (got)
                 return got;
+            this.waitEnded = true;
         }
         finally {
             if (timer)

package/dist/lib/daemon/flag-monitor.d.ts

@@ -8,6 +8,11 @@ export interface BoundedDaemonFlagMonitorOptions {
 }
 export interface BoundedDaemonFlagMonitor {
     enabled(): Promise<boolean>;
+    status(): {
+        enabled: boolean;
+        lastSuccessfulReadAgeMs: number | null;
+        heldThroughReadError: boolean;
+    };
     close(): void;
 }
 /**

package/dist/lib/daemon/flag-monitor.js

@@ -1,3 +1,4 @@
+import { performance } from "node:perf_hooks";
 export const HQ_ANYWHERE_FLAG_REFRESH_INTERVAL_MS = 30_000;
 export const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
 /**
@@ -5,10 +6,11 @@ export const HQ_ANYWHERE_FLAG_MAX_STALENESS_MS = 60_000;
  * A failed read keeps the last successful decision only until its 60s age limit.
  */
 export function createBoundedDaemonFlagMonitor(options) {
-    const now = options.now ?? Date.now;
+    const now = options.now ?? (() => performance.now());
     let value;
     let lastSuccessAt;
     let lastAttemptAt;
+    let lastReadFailed = false;
     let successVersion = 0;
     let refreshInFlight;
     let expiryTimer;
@@ -34,6 +36,7 @@ export function createBoundedDaemonFlagMonitor(options) {
             if (closed)
                 return false;
             lastSuccessAt = now();
+            lastReadFailed = false;
             const thisSuccessVersion = ++successVersion;
             publish(next);
             if (expiryTimer)
@@ -46,6 +49,7 @@ export function createBoundedDaemonFlagMonitor(options) {
             expiryTimer.unref?.();
             return next;
         }).catch((error) => {
+            lastReadFailed = true;
             options.onReadError?.(error);
             expireIfStale();
             return value ?? false;
@@ -74,6 +78,15 @@ export function createBoundedDaemonFlagMonitor(options) {
             }
             return value;
         },
+        status() {
+            const age = lastSuccessAt === undefined ? null : Math.max(0, now() - lastSuccessAt);
+            const fresh = age !== null && age < HQ_ANYWHERE_FLAG_MAX_STALENESS_MS;
+            return {
+                enabled: value === true && fresh,
+                lastSuccessfulReadAgeMs: age,
+                heldThroughReadError: lastReadFailed && fresh,
+            };
+        },
         close() {
             closed = true;
             if (refreshTimer)

package/dist/lib/daemon/protocol.d.ts

@@ -7,8 +7,31 @@
  * out of order, so clients match them by `id`.
  */
 export declare const HQD_SOCKET_NAME = "hqd.sock";
-export declare const HQD_OPS: readonly ["ping", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "auth.login", "auth.status", "shutdown"];
+export declare const HQD_OPS: readonly ["ping", "health", "resolve", "session.open", "session.get", "session.close", "policy.check", "policy.index", "journal.append", "memory.get", "memory.put", "mesh.presence", "mcp.call", "auth.login", "auth.status", "shutdown"];
 export type HqdOp = (typeof HQD_OPS)[number];
+export type HqdHealthFallbackReason = "registry_unavailable" | "manifest_missing_or_malformed" | "company_not_in_manifest" | "no_match";
+export interface HqdHealthResult {
+    reachable: boolean;
+    version: string | null;
+    uptimeMs: number | null;
+    flag: {
+        enabled: boolean | null;
+        lastSuccessfulReadAgeMs: number | null;
+        heldThroughReadError: boolean;
+    };
+    resolution: {
+        scope: "company" | "personal" | "unknown";
+        company: string | null;
+        fallbackReason: HqdHealthFallbackReason | null;
+    };
+    socket: {
+        path: string;
+        transport: "unix_socket" | "windows_named_pipe";
+        mode: string | null;
+        ownerMatchesUser: boolean | null;
+        userOnly: boolean | null;
+    };
+}
 /** A request line larger than this is rejected and the connection closed. */
 export declare const HQD_MAX_LINE_BYTES: number;
 export declare const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2000;
@@ -31,10 +54,10 @@ export type HqdResponse = {
     error: HqdError;
 };
 /**
- * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
+ * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/daemon/hqd.sock.
  * On Windows the socket is a per-user named pipe.
  */
-export declare function hqdSocketPath(home?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+export declare function hqdSocketPath(home?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, currentUserSid?: () => string | null): string;
 export declare function encodeMessage(message: HqdRequest | HqdResponse): string;
 export type ParsedLine = {
     ok: true;

package/dist/lib/daemon/protocol.js

@@ -9,9 +9,11 @@
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
+import { readCurrentUserSid } from "../work-context/windows-acl.js";
 export const HQD_SOCKET_NAME = "hqd.sock";
 export const HQD_OPS = [
     "ping",
+    "health",
     "resolve",
     "session.open",
     "session.get",
@@ -31,19 +33,21 @@ export const HQD_OPS = [
 export const HQD_MAX_LINE_BYTES = 1024 * 1024;
 export const HQD_DEFAULT_REQUEST_TIMEOUT_MS = 2_000;
 /**
- * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/hqd.sock.
+ * Socket path: HQ_HQD_SOCKET, else <HQ_REGISTRY_DIR or ~/.hq>/daemon/hqd.sock.
  * On Windows the socket is a per-user named pipe.
  */
-export function hqdSocketPath(home = os.homedir(), env = process.env, platform = process.platform) {
+export function hqdSocketPath(home = os.homedir(), env = process.env, platform = process.platform, currentUserSid = readCurrentUserSid) {
     const override = env.HQ_HQD_SOCKET?.trim();
     if (override)
         return override;
     if (platform === "win32") {
-        const user = (env.USERNAME ?? os.userInfo().username).replace(/[^A-Za-z0-9_.-]/g, "-");
-        return `\\\\.\\pipe\\hqd-${user}`;
+        const userSid = currentUserSid();
+        if (!userSid)
+            throw new Error("Cannot determine the current Windows user SID for the hqd pipe name");
+        return `\\\\.\\pipe\\hqd-${userSid.toLowerCase()}`;
     }
     const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
-    return path.join(dir, HQD_SOCKET_NAME);
+    return path.join(dir, "daemon", HQD_SOCKET_NAME);
 }
 export function encodeMessage(message) {
     return `${JSON.stringify(message)}\n`;

package/dist/lib/daemon/remote-control.d.ts

@@ -69,6 +69,13 @@ export interface RemoteControlHostDeps {
     pollMs: number;
     signal: AbortSignal;
     log: (line: string) => void;
+    /** Claude's per-folder bridge pointer. Codex hosts leave this unset. */
+    bridgePointerPath?: string | null;
+    /** Process probes are injectable so ownership checks are deterministic in tests. */
+    pidAlive?: (pid: number) => boolean;
+    processCommandLine?: (pid: number) => string[] | null;
+    /** Process start identity, when the pointer carries one; injectable for tests. */
+    processStartTime?: (pid: number) => string | null;
 }
 export declare function runRemoteControlHost(deps: RemoteControlHostDeps): Promise<number>;
 //# sourceMappingURL=remote-control.d.ts.map

package/dist/lib/daemon/remote-control.js

@@ -21,6 +21,7 @@
  * user's own tmux sessions.
  */
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 const TMUX_SOCKET = "hq-daemon";
 export const TMUX_SESSION = "remote-control";
@@ -101,6 +102,106 @@ export function serviceTool(name, given, find) {
 export const IDLE_BEFORE_RESTART_MS = 10 * 60_000;
 /** ...or after this long, however busy the session is. */
 export const MAX_RESTART_WAIT_MS = 2 * 60 * 60_000;
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function commandLine(pid, run) {
+    try {
+        if (process.platform === "linux") {
+            return fs.readFileSync(`/proc/${pid}/cmdline`, "utf8").split("\0").filter(Boolean);
+        }
+        const result = run("ps", ["-p", String(pid), "-o", "command="]);
+        return result.status === 0 ? result.stdout.trim().split(/\s+/).filter(Boolean) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function defaultBridgePointerPath(cwd) {
+    const project = path.resolve(cwd).replace(/[^A-Za-z0-9]/g, "-");
+    return path.join(os.homedir(), ".claude", "projects", project, "bridge-pointer.json");
+}
+function processStartTime(pid, log) {
+    if (process.platform !== "linux")
+        return null;
+    try {
+        const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf8");
+        const close = stat.lastIndexOf(")");
+        if (close < 0) {
+            log("could not parse Linux process start time");
+            return null;
+        }
+        // The remaining fields start at field 3; starttime is field 22 (index 19).
+        const startTime = stat.slice(close + 1).trim().split(/\s+/)[19];
+        if (startTime === undefined)
+            log("Linux process stat did not include a start time");
+        return startTime ?? null;
+    }
+    catch {
+        log("could not read Linux process start time");
+        return null;
+    }
+}
+function foreignClaudeOwner(deps) {
+    if (deps.session !== TMUX_SESSION)
+        return null;
+    const pointerPath = deps.bridgePointerPath === undefined ? defaultBridgePointerPath(deps.cwd) : deps.bridgePointerPath;
+    if (!pointerPath)
+        return null;
+    let pointer;
+    try {
+        pointer = JSON.parse(fs.readFileSync(pointerPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    const pid = pointer.pid;
+    if (!Number.isSafeInteger(pid) || pid <= 0 || pid === process.pid)
+        return null;
+    const numericPid = pid;
+    if (!(deps.pidAlive ?? processAlive)(numericPid))
+        return null;
+    const args = (deps.processCommandLine ?? ((processId) => commandLine(processId, deps.run)))(numericPid);
+    if (!args)
+        return null;
+    const claudeIndex = args.findIndex((arg) => path.basename(arg) === "claude");
+    if (claudeIndex < 0)
+        return null;
+    const pointerStart = typeof pointer.procStart === "string" || typeof pointer.procStart === "number"
+        ? String(pointer.procStart)
+        : null;
+    if (pointerStart !== null) {
+        const liveStart = deps.processStartTime
+            ? deps.processStartTime(numericPid)
+            : processStartTime(numericPid, deps.log);
+        if (liveStart !== null && liveStart !== pointerStart)
+            return null;
+    }
+    if (pointer.source !== "repl" && !args.slice(claudeIndex + 1).includes("remote-control"))
+        return null;
+    return numericPid;
+}
+function safePaneTail(output) {
+    const rows = output.split(/\r?\n/);
+    while (rows.length > 0 && rows.at(-1)?.trim() === "")
+        rows.pop();
+    return rows
+        .slice(-20)
+        .map((line) => line
+        .replace(/https?:\/\/\S+/gi, "[redacted URL]")
+        .replace(/\b[0-9a-f]{8}-[0-9a-f-]{27,}\b/gi, "[redacted session id]")
+        .replace(/\b(authorization\s*[:=]\s*(?:(?:basic|bearer)\s+)?)[^\r\n]+/gi, "$1[redacted]")
+        .replace(/\b(session[ _-]?id|token|api[ _-]?key|secret)\s*[:=]\s*\S+/gi, "$1=[redacted]")
+        .replace(/\b[A-Za-z0-9_-]{32,}\b/g, "[redacted token]")
+        .slice(0, 400))
+        .join("\n");
+}
 export async function runRemoteControlHost(deps) {
     const tmux = (...args) => deps.run(deps.tmux, ["-L", TMUX_SOCKET, ...args]);
     const killSession = () => tmux("kill-session", "-t", deps.session);
@@ -110,10 +211,34 @@ export async function runRemoteControlHost(deps) {
         const secs = r.status === 0 ? Number.parseInt(r.stdout.trim(), 10) : Number.NaN;
         return Number.isFinite(secs) ? secs * 1000 : null;
     };
-    // A session left by an earlier host (for example after a crash) is replaced.
+    // Remove this daemon's leftover private session before checking the process
+    // pointer, so its previous command is not mistaken for a foreign owner.
     killSession();
-    const started = tmux("new-session", "-d", "-s", deps.session, "-x", "200", "-y", "50", "-c", deps.cwd, ...deps.argv);
+    let waitingFor = null;
+    for (;;) {
+        if (deps.signal.aborted)
+            return 0;
+        const owner = foreignClaudeOwner(deps);
+        if (owner === null)
+            break;
+        if (waitingFor !== owner) {
+            deps.log(`${deps.cwd} is already served by claude remote-control pid ${owner} (not started by this daemon); waiting`);
+            waitingFor = owner;
+        }
+        await deps.sleep(deps.pollMs);
+    }
+    // Start the replacement only after no live foreign Claude owner remains.
+    const created = tmux("new-session", "-d", "-s", deps.session, "-x", "200", "-y", "50", "-c", deps.cwd);
+    if (created.status !== 0) {
+        deps.log(`could not create the tmux session: ${created.stderr.trim() || `tmux exited ${created.status}`}`);
+        return 1;
+    }
+    const retained = tmux("set-window-option", "-t", deps.session, "remain-on-exit", "on");
+    const started = retained.status === 0
+        ? tmux("respawn-pane", "-k", "-t", deps.session, ...deps.argv)
+        : retained;
     if (started.status !== 0) {
+        killSession();
         deps.log(`could not start the tmux session: ${started.stderr.trim() || `tmux exited ${started.status}`}`);
         return 1;
     }
@@ -130,6 +255,14 @@ export async function runRemoteControlHost(deps) {
             deps.log(`the ${deps.label} session ended`);
             return 1;
         }
+        const paneDead = tmux("display-message", "-p", "-t", deps.session, "#{pane_dead}");
+        if (paneDead.status === 0 && paneDead.stdout.trim() === "1") {
+            const pane = tmux("capture-pane", "-p", "-S", "-20", "-t", deps.session);
+            const tail = pane.status === 0 ? safePaneTail(pane.stdout) : "";
+            deps.log(`the ${deps.label} session ended${tail ? `\n${tail}` : ""}`);
+            killSession();
+            return 1;
+        }
         const now = deps.now();
         if (updatedAt === null) {
             const current = deps.binaryFingerprint();

package/dist/lib/daemon/run.js

@@ -693,24 +693,22 @@ export async function runDaemon(opts) {
     let hqdShutdown = null;
     if (anywhereRuntimeEnabled()) {
         const refusal = hqdStartupRefusal(platform, true);
-        if (refusal) {
-            log("error", refusal);
+        try {
+            const startConfig = readDaemonConfig(paths.configPath);
+            hqd = await startHqdServer({
+                socketPath: hqdSocketPath(home, env),
+                registryPath: registryFile(registryDir(home, env)),
+                hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
+                log,
+                onShutdown: () => hqdShutdown?.(),
+                reportError: reportHqdCrash,
+            });
         }
-        else {
-            try {
-                const startConfig = readDaemonConfig(paths.configPath);
-                hqd = await startHqdServer({
-                    socketPath: hqdSocketPath(home, env),
-                    registryPath: registryFile(registryDir(home, env)),
-                    hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
-                    log,
-                    onShutdown: () => hqdShutdown?.(),
-                    reportError: reportHqdCrash,
-                });
-            }
-            catch (err) {
+        catch (err) {
+            if (refusal && err.message === refusal)
+                log("error", refusal);
+            else
                 log("error", `hqd socket did not start; services run without it: ${err.message}`);
-            }
         }
     }
     // US-012: 60s presence heartbeat with version and session count.

package/dist/lib/daemon/server.d.ts

@@ -6,13 +6,26 @@
  * machine. Sessions in any repo ask it which company they belong to and
  * register themselves here.
  */
+import * as fs from "node:fs";
 import { readRegistry, type ResolveResult } from "../registry/registry.js";
 import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
 import { type StdinMachineCredentials } from "./machine-login.js";
+import { type WindowsPipeAclReport, type WindowsPipeHost } from "./windows-pipe-host.js";
 export interface HqdServerOptions {
     socketPath: string;
+    /** Test seam for selecting the Windows transport without changing host behavior. */
+    platform?: NodeJS.Platform;
+    /** Test seam for verifying socket ownership without changing the host uid. */
+    socketLstat?: (path: string) => fs.Stats;
+    /** Test seam for helper startup and its OS-read ACL report. */
+    windowsPipeHostFactory?: (socketPath: string) => Promise<{
+        host: WindowsPipeHost;
+        acl: WindowsPipeAclReport;
+    }>;
+    /** Test seam for rejecting an invalid helper ACL report. */
+    windowsPipeAclCheck?: (report: WindowsPipeAclReport) => WindowsPipeAclReport;
     /** registry.json to resolve against (US-004). */
     registryPath?: string;
     hqRoot?: string;