@indigoai-us/hq-cli 5.342.2 → 5.342.4

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.342.4] — 2026-10-04
+
+## [5.342.3] — 2026-10-04
+
+- Release package-use leases after daemon, bot, and mesh-daemon modules load; `hq mcp serve` starts its resident preload only after the first reply is written, so resident CLI processes do not block Desktop updates or slow MCP start-up.
+
+- `hq secrets env` now waits briefly for the company flag snapshot refresh before its synchronous exit, allowing the fast-path gate to use a persisted snapshot on later invocations.
+
 ## [5.342.2] — 2026-10-04
 - Load the shared `secrets env` action without importing the full secrets command module on the enabled fast route.
 

package/dist/commands/bot.js

@@ -26,6 +26,8 @@ import { hasPromotionHold, promotionHoldSummary } from "../lib/bot/promotion-hol
  * list (online flag), and rm. Secrets are never printed.
  */
 import { promoteLocalBot } from "../lib/bot/promote.js";
+import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
+import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
 import { CLI_UPDATE_DISABLE_ENV, createCliUpdateWatcher, handOffToUpdatedCli } from "../lib/bot/cli-update.js";
 import { createVaultObjectDownloader } from "../lib/agent-kit/attachment-download.js";
 import { addBotToCompanies, describeCompanyFailures, removeBotFromCompanies } from "./bot-companies.js";
@@ -854,6 +856,7 @@ export async function runBotWorkers(opts) {
 }
 // ── run (resident) ───────────────────────────────────────────────────────────
 async function runBotResident(nameArg) {
+    await releasePackageUseLeaseAfterResidentPreload(() => preloadResidentPackageModules("bot"), reportResidentPackagePreloadFailure, releaseCurrentPackageUseLease);
     const name = validateBotName(nameArg);
     const dir = botDir(name);
     const config = readBotConfig(dir);

package/dist/commands/daemon.d.ts

@@ -18,6 +18,9 @@ import { type LegacyUnit } from "../lib/daemon/legacy.js";
 import type { HostApp } from "../lib/daemon/supervisor.js";
 import { type SyncModeVaultClient } from "./sync-mode.js";
 import type { RunCommand } from "../lib/service-manager/launchd.js";
+type DaemonRunnerModule = typeof import("../lib/daemon/run.js");
+/** Load the daemon runtime without releasing its lease: it reads package files while resident. */
+export declare function loadDaemonRunner(_release?: () => void, load?: () => Promise<DaemonRunnerModule>): Promise<DaemonRunnerModule["runDaemon"]>;
 export interface DaemonCommandDeps {
     env: NodeJS.ProcessEnv;
     home: string;
@@ -62,4 +65,5 @@ export declare function resolveDaemonHqRoot(flag: string | undefined, where: {
     home: string;
 }): string | undefined;
 export declare function registerDaemonCommand(program: Command, over?: Partial<DaemonCommandDeps>): Command;
+export {};
 //# sourceMappingURL=daemon.d.ts.map

package/dist/commands/daemon.js

@@ -35,6 +35,11 @@ import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
 import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
 import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
+/** Load the daemon runtime without releasing its lease: it reads package files while resident. */
+export async function loadDaemonRunner(_release = () => undefined, load = () => import("../lib/daemon/run.js")) {
+    const { runDaemon } = await load();
+    return runDaemon;
+}
 class DaemonCommandError extends Error {
 }
 /**
@@ -778,7 +783,7 @@ export function registerDaemonCommand(program, over = {}) {
         .option("--host <app>", "Run as a child of this app (only \"desktop\"), which has handed sync over to the daemon")
         .action(wrap(async (d, opts) => {
         const host = parseDaemonHost(opts.host);
-        const { runDaemon } = await import("../lib/daemon/run.js");
+        const runDaemon = await loadDaemonRunner();
         // Services inherit this environment, so they see the same folder.
         const env = opts.daemonDir ? { ...d.env, HQ_DAEMON_DIR: opts.daemonDir } : d.env;
         process.exitCode = await runDaemon({

package/dist/commands/mcp-serve.d.ts

@@ -20,9 +20,21 @@ export interface McpServeOptions {
     cwd?: string;
     /** Per-call hqd budget. Default 120s; policy checks and hq-mcp tools can be slow. */
     timeoutMs?: number;
+    /** Test seam for the resident module preload; production uses the default loader. */
+    preloadResidentModules?: (residentPath: "mcp", modules: readonly string[]) => Promise<void>;
+    /** Test seam for releasing the process package lease after resident preload. */
+    releasePackageUseLease?: () => void;
 }
 /** HQ root for prompts: HQ_ROOT, else the ~/.hq/root pointer written by `hq install --global`. */
 export declare function readHqRoot(env: NodeJS.ProcessEnv, home: string): string | null;
+type McpToolsModule = typeof import("../lib/mcp/tools.js");
+type McpPromptsModule = typeof import("../lib/mcp/prompts.js");
+/** Load request handlers required to answer MCP requests. */
+export declare function loadMcpPackageHandlers(loadTools?: () => Promise<McpToolsModule>, loadPrompts?: () => Promise<McpPromptsModule>): Promise<{
+    tools: McpToolsModule;
+    prompts: McpPromptsModule;
+}>;
 /** Run the server until input ends. Resolves when stdin closes. */
 export declare function runMcpServe(opts?: McpServeOptions): Promise<void>;
+export {};
 //# sourceMappingURL=mcp-serve.d.ts.map

package/dist/commands/mcp-serve.js

@@ -18,6 +18,8 @@ import { CLI_VERSION } from "../cli-version.js";
 import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
 import { anywhereRuntimeEnabledFromSnapshot } from "../lib/anywhere-runtime-fast-flag.js";
 import { createLineSplitter, HqdClientError, hqdRequest, hqdSocketPath } from "../lib/daemon/protocol.js";
+import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
+import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, RESIDENT_PACKAGE_MODULES } from "../utils/resident-package-preload.js";
 export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
 const UNREACHABLE_CODES = new Set(["ENOENT", "ECONNREFUSED", "ECONNRESET", "EPIPE", "ETIMEDOUT", "ESOCKET", "EACCES"]);
 /** HQ root for prompts: HQ_ROOT, else the ~/.hq/root pointer written by `hq install --global`. */
@@ -39,8 +41,12 @@ function toolError(code, message) {
     const error = { code, message };
     return { content: [{ type: "text", text: JSON.stringify({ error }, null, 2) }], structuredContent: { error }, isError: true };
 }
+/** Load request handlers required to answer MCP requests. */
+export async function loadMcpPackageHandlers(loadTools = () => import("../lib/mcp/tools.js"), loadPrompts = () => import("../lib/mcp/prompts.js")) {
+    return Promise.all([loadTools(), loadPrompts()]).then(([tools, prompts]) => ({ tools, prompts }));
+}
 /** Run the server until input ends. Resolves when stdin closes. */
-export function runMcpServe(opts = {}) {
+export async function runMcpServe(opts = {}) {
     const input = opts.input ?? process.stdin;
     const output = opts.output ?? process.stdout;
     const env = opts.env ?? process.env;
@@ -51,15 +57,33 @@ export function runMcpServe(opts = {}) {
     if (!anywhereRuntimeEnabledFromSnapshot(env)) {
         process.stderr.write(`HQ Anywhere is not enabled. Enable the ${HQ_ANYWHERE_RUNTIME_FLAG} flag to use hq mcp serve.\n`);
         process.exitCode = 1;
-        return Promise.resolve();
+        return;
     }
-    const send = (msg) => output.write(`${JSON.stringify({ jsonrpc: "2.0", ...msg })}\n`);
+    const { tools, prompts } = await loadMcpPackageHandlers();
+    const preload = (residentPath, modules) => opts.preloadResidentModules
+        ? opts.preloadResidentModules(residentPath, modules)
+        : preloadResidentPackageModules(residentPath);
+    let residentPreloadStarted = false;
+    const startResidentPreload = () => {
+        if (residentPreloadStarted)
+            return;
+        residentPreloadStarted = true;
+        void releasePackageUseLeaseAfterResidentPreload(() => preload("mcp", RESIDENT_PACKAGE_MODULES.mcp), reportResidentPackagePreloadFailure, opts.releasePackageUseLease ?? releaseCurrentPackageUseLease).catch(() => {
+            process.exitCode = process.exitCode ?? 1;
+            process.emitWarning("hq-cli resident package preload completion failed (class=Error, module=unknown)");
+        });
+    };
+    const send = (msg) => {
+        const response = `${JSON.stringify({ jsonrpc: "2.0", ...msg })}\n`;
+        if (residentPreloadStarted)
+            return output.write(response);
+        return output.write(response, startResidentPreload);
+    };
     const reply = (id, result) => send({ id, result });
     const replyError = (id, code, message) => send({ id, error: { code, message } });
     const callTool = async (params) => {
-        const { MCP_TOOLS } = await import("../lib/mcp/tools.js");
         const name = params.name;
-        if (typeof name !== "string" || !MCP_TOOLS.some((t) => t.name === name)) {
+        if (typeof name !== "string" || !tools.MCP_TOOLS.some((t) => t.name === name)) {
             return toolError("unknown_tool", `unknown tool ${String(name)}`);
         }
         const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
@@ -95,22 +119,21 @@ export function runMcpServe(opts = {}) {
                 reply(id, {});
                 return;
             case "tools/list":
-                reply(id, { tools: (await import("../lib/mcp/tools.js")).MCP_TOOLS });
+                reply(id, { tools: tools.MCP_TOOLS });
                 return;
             case "tools/call":
                 reply(id, await callTool(params));
                 return;
             case "prompts/list":
-                reply(id, { prompts: (await import("../lib/mcp/prompts.js")).MCP_PROMPTS });
+                reply(id, { prompts: prompts.MCP_PROMPTS });
                 return;
             case "prompts/get": {
-                const { getPrompt, PromptNotFoundError } = await import("../lib/mcp/prompts.js");
                 const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
                 try {
-                    reply(id, getPrompt(String(params.name), args, readHqRoot(env, home)));
+                    reply(id, prompts.getPrompt(String(params.name), args, readHqRoot(env, home)));
                 }
                 catch (err) {
-                    if (!(err instanceof PromptNotFoundError))
+                    if (!(err instanceof prompts.PromptNotFoundError))
                         throw err;
                     replyError(id, -32602, err.message);
                 }

package/dist/commands/secrets-env-exit.d.ts

@@ -0,0 +1,6 @@
+import { writeSync } from "node:fs";
+/** Write the resolved exports synchronously and exit even if the pipe is closed. */
+export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
+/** Wait for a company snapshot before the synchronous env-command exit. */
+export declare function finishEnvExportsAndExit(payload: string, waitForSnapshot?: (timeoutMs?: number, companyUid?: string) => Promise<void>, exit?: (code: number) => never, write?: typeof writeSync, shouldWaitForSnapshot?: boolean, companyUid?: string): Promise<never>;
+//# sourceMappingURL=secrets-env-exit.d.ts.map

package/dist/commands/secrets-env-exit.js

@@ -0,0 +1,28 @@
+import { writeSync } from "node:fs";
+import { waitForRegisteredFlagRegistryRefresh } from "../lib/flag-registry-refresh-wait.js";
+/** Write the resolved exports synchronously and exit even if the pipe is closed. */
+export function emitEnvExportsAndExit(payload, exit = process.exit, write = writeSync) {
+    const buf = Buffer.from(payload, "utf8");
+    const MAX_EAGAIN_RETRIES = 10_000;
+    let offset = 0;
+    let eagainRetries = 0;
+    while (offset < buf.length) {
+        try {
+            offset += write(1, buf, offset, buf.length - offset);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "EAGAIN" && eagainRetries++ < MAX_EAGAIN_RETRIES)
+                continue;
+            break;
+        }
+    }
+    return exit(0);
+}
+/** Wait for a company snapshot before the synchronous env-command exit. */
+export async function finishEnvExportsAndExit(payload, waitForSnapshot = waitForRegisteredFlagRegistryRefresh, exit = process.exit, write = writeSync, shouldWaitForSnapshot = true, companyUid) {
+    if (shouldWaitForSnapshot)
+        await waitForSnapshot(500, companyUid);
+    return emitEnvExportsAndExit(payload, exit, write);
+}
+//# sourceMappingURL=secrets-env-exit.js.map

package/dist/lib/flag-registry-refresh-wait.d.ts

@@ -0,0 +1,7 @@
+type FlagRegistryRefreshWaiter = (timeoutMs?: number, companyUid?: string) => Promise<void>;
+/** Install the worker-backed waiter from the CLI's early registry bootstrap. */
+export declare function registerFlagRegistryRefreshWaiter(nextWaiter: FlagRegistryRefreshWaiter): void;
+/** Wait for a registry refresh when the CLI bootstrap installed a worker. */
+export declare function waitForRegisteredFlagRegistryRefresh(timeoutMs?: number, companyUid?: string): Promise<void>;
+export {};
+//# sourceMappingURL=flag-registry-refresh-wait.d.ts.map

package/dist/lib/flag-registry-refresh-wait.js

@@ -0,0 +1,10 @@
+let waiter = async () => { };
+/** Install the worker-backed waiter from the CLI's early registry bootstrap. */
+export function registerFlagRegistryRefreshWaiter(nextWaiter) {
+    waiter = nextWaiter;
+}
+/** Wait for a registry refresh when the CLI bootstrap installed a worker. */
+export function waitForRegisteredFlagRegistryRefresh(timeoutMs = 500, companyUid) {
+    return waiter(timeoutMs, companyUid);
+}
+//# sourceMappingURL=flag-registry-refresh-wait.js.map