@indigoai-us/hq-cli 5.345.104 → 5.345.105

package/dist/commands/daemon.js

@@ -16,6 +16,8 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { once } from "node:events";
 import { compare as semverCompare, major as semverMajor, valid as validSemver } from "semver";
 import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices, hqCloudUnits } from "../lib/daemon/catalog.js";
 import { applyServiceToggle, effectiveSyncOwner, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
@@ -26,7 +28,9 @@ import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
 import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
 import { bundledHqCloud, managedHqCloud, managedHqCloudRoot, readHqCloudCopy, readHqCloudUpdateState } from "../lib/daemon/hq-cloud.js";
 import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "../lib/daemon/machine-type.js";
-import { daemonPaths } from "../lib/daemon/paths.js";
+import { daemonPaths, ensurePrivateDir } from "../lib/daemon/paths.js";
+import { assertPersonalServiceSessionCapability, parseRemoteControlPoolsConfig, readRemoteControlPoolsConfig, writeRemoteControlPoolsConfig, isOwnedPoolForwarder, monitorOwnedPoolForwarder, assertDistinctRealMountPath, assertNoSymlinkPathComponents, poolHostsFile, remoteControlPoolSecretsEnv, remoteControlPoolArgs, } from "../lib/daemon/remote-control-pools.js";
+import { createInferenceForwarder } from "../lib/daemon/remote-control-forwarder.js";
 import { processCommandLine } from "../lib/daemon/lock.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
 import { runDaemonCall } from "../lib/daemon/command-call.js";
@@ -700,6 +704,53 @@ async function runPinHqCloud(d, version, opts) {
     }
     d.out("Run `hq daemon trigger updater`; wait for the hq-cloud update or current-version message in `hq daemon logs updater`, then restart `hq daemon restart sync`, `hq daemon restart heartbeat`, and `hq daemon restart session-host`.");
 }
+async function validateRemoteControlPools(d, file) {
+    let input;
+    try {
+        input = JSON.parse(d.readFile(path.resolve(file)));
+    }
+    catch (error) {
+        throw new DaemonCommandError(`could not read pool config: ${error.message}`);
+    }
+    const config = parseRemoteControlPoolsConfig(input, await knownClaudeAccountIds(d), d.home);
+    d.out(`Valid remote-control pool configuration (${config.pools.length} pool${config.pools.length === 1 ? "" : "s"}).`);
+}
+async function configureRemoteControlPools(d, file) {
+    const source = path.resolve(file);
+    let input;
+    try {
+        input = JSON.parse(d.readFile(source));
+    }
+    catch (error) {
+        throw new DaemonCommandError(`could not read pool config: ${error.message}`);
+    }
+    const config = parseRemoteControlPoolsConfig(input, await knownClaudeAccountIds(d), d.home);
+    const { paths } = currentHost(d);
+    writeRemoteControlPoolsConfig(paths.remoteControlPoolsPath, config, d.home);
+    d.out(`Saved ${config.pools.length} remote-control pool${config.pools.length === 1 ? "" : "s"} to ${paths.remoteControlPoolsPath}. Restart the daemon to apply.`);
+}
+async function knownClaudeAccountIds(d) {
+    const host = currentHost(d);
+    const root = readDaemonConfig(host.paths.configPath).hqRoot ?? d.resolveHqRoot(undefined);
+    if (!root)
+        throw new DaemonCommandError("Could not resolve the HQ folder needed to validate hq lanes Claude account IDs.");
+    const { loadLanesConfig } = await import("../lib/lanes/config.js");
+    return Object.keys(loadLanesConfig(root).providers.claude.accounts);
+}
+async function showRemoteControlPools(d, opts) {
+    const { paths } = currentHost(d);
+    const config = readRemoteControlPoolsConfig(paths.remoteControlPoolsPath, undefined, d.home);
+    if (opts.json) {
+        d.out(JSON.stringify(config, null, 2));
+        return;
+    }
+    d.out(config.pools.length === 0 ? "No remote-control pools are configured." : `Configured remote-control pools (${config.pools.length}):`);
+    if (config.serviceSessionId)
+        d.out(`  personal service session: ${config.serviceSessionId}`);
+    for (const pool of config.pools) {
+        d.out(`  ${pool.accountId}: capacity ${pool.capacity}, frontend https://${pool.frontendAddress}:${pool.frontendPort}, forwarder 127.0.0.1:${pool.forwarderPort}, mount ${pool.mountPath}, secret ${pool.secretName}`);
+    }
+}
 async function runMigrate(d, opts) {
     const host = currentHost(d);
     const units = legacyUnitsFor(d, host);
@@ -778,9 +829,12 @@ async function runTmuxService(d, opts) {
     const stop = () => controller.abort();
     process.once("SIGTERM", stop);
     process.once("SIGINT", stop);
+    opts.signal?.addEventListener("abort", stop, { once: true });
     try {
         process.exitCode = await runRemoteControlHost({
             tmux,
+            ...(opts.tmuxSocket ? { tmuxSocket: opts.tmuxSocket } : {}),
+            ...(opts.sessionEnv ? { sessionEnv: opts.sessionEnv } : {}),
             session: opts.session,
             cwd: hqRoot,
             argv: opts.argv,
@@ -803,6 +857,7 @@ async function runTmuxService(d, opts) {
         });
     }
     finally {
+        opts.signal?.removeEventListener("abort", stop);
         process.off("SIGTERM", stop);
         process.off("SIGINT", stop);
     }
@@ -830,6 +885,299 @@ async function runServiceRemoteControl(d, opts) {
         watch: claude,
     });
 }
+async function configuredRemoteControlPool(d, accountId) {
+    const host = currentHost(d);
+    const hqRoot = d.env.HQ_ROOT?.trim() || readDaemonConfig(host.paths.configPath).hqRoot;
+    if (!hqRoot)
+        throw new DaemonCommandError("Remote Control account pools need HQ_ROOT.");
+    const { loadLanesConfig } = await import("../lib/lanes/config.js");
+    const knownAccounts = Object.keys(loadLanesConfig(hqRoot).providers.claude.accounts);
+    const config = readRemoteControlPoolsConfig(host.paths.remoteControlPoolsPath, knownAccounts, d.home);
+    const pool = config.pools.find((candidate) => candidate.accountId === accountId);
+    if (!pool)
+        throw new DaemonCommandError(`Remote Control pool account "${accountId}" is not configured.`);
+    if (!config.serviceSessionId)
+        throw new DaemonCommandError("Remote Control pools require a configured personal service session ID.");
+    try {
+        assertPersonalServiceSessionCapability(hqRoot, config.serviceSessionId);
+    }
+    catch (error) {
+        throw new DaemonCommandError(`Remote Control pools cannot start: ${error.message}.`);
+    }
+    return { pool, paths: host.paths, hqRoot, frontendCaPath: config.frontendCaPath, serviceSessionId: config.serviceSessionId };
+}
+function forwardLines(stream, consume) {
+    let pending = "";
+    stream.on("data", (chunk) => {
+        pending += chunk.toString();
+        const lines = pending.split(/\r?\n/);
+        pending = lines.pop() ?? "";
+        for (const line of lines)
+            consume(line);
+    });
+    stream.on("end", () => { if (pending)
+        consume(pending); });
+}
+async function runServiceRemoteControlPool(d, accountId) {
+    const { pool, paths, hqRoot } = await configuredRemoteControlPool(d, accountId);
+    const expectedMountRoot = path.join(d.home, ".local", "state", "hq-remote-control");
+    if (path.dirname(pool.mountPath) !== expectedMountRoot || path.basename(pool.mountPath) !== pool.accountId) {
+        throw new DaemonCommandError(`Pool ${accountId} mountPath must be ${path.join(expectedMountRoot, pool.accountId)}.`);
+    }
+    assertNoSymlinkPathComponents(pool.mountPath);
+    ensurePrivateDir(pool.mountPath);
+    assertDistinctRealMountPath(pool.mountPath, hqRoot);
+    const overlayDir = path.join(paths.root, "remote-control-pools", "hosts");
+    ensurePrivateDir(overlayDir);
+    const overlayPath = path.join(overlayDir, `${pool.accountId}.hosts`);
+    fs.writeFileSync(overlayPath, poolHostsFile(fs.readFileSync("/etc/hosts", "utf8"), pool), { mode: 0o600 });
+    fs.chmodSync(overlayPath, 0o600);
+    const script = [
+        "set -eu",
+        "mount --make-rprivate /",
+        "mount --bind \"$1\" \"$2\"",
+        "mount --bind \"$3\" /etc/hosts",
+        "cd \"$2\"",
+        "export HQ_ROOT=\"$2\"",
+        "exec \"$4\" daemon service remote-control-pool-host --account-id \"$5\"",
+    ].join("\n");
+    const child = spawn("unshare", ["--map-root-user", "--mount", "--fork", "--kill-child=TERM", "sh", "-c", script,
+        "hq-remote-control-pool", hqRoot, pool.mountPath, overlayPath, d.hqBinary, pool.accountId,
+    ], { cwd: hqRoot, env: { ...d.env, HQ_ROOT: hqRoot }, stdio: ["ignore", "pipe", "pipe"] });
+    forwardLines(child.stdout, (line) => d.out(line));
+    forwardLines(child.stderr, (line) => d.err(line));
+    const stop = () => child.kill("SIGTERM");
+    process.once("SIGTERM", stop);
+    process.once("SIGINT", stop);
+    try {
+        const [code, signal] = await once(child, "exit");
+        if (code !== 0)
+            throw new DaemonCommandError(`Remote Control pool ${accountId} namespace exited ${code ?? signal ?? "unknown"}.`);
+    }
+    finally {
+        process.off("SIGTERM", stop);
+        process.off("SIGINT", stop);
+    }
+}
+function poolForwarderReadyFile(d, accountId) {
+    return path.join(currentHost(d).paths.root, "remote-control-pools", "forwarder", `${accountId}.json`);
+}
+function poolForwarderOwnsPort(readyFile, accountId) {
+    return isOwnedPoolForwarder(readyFile, accountId, (pid) => {
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }, (pid) => {
+        if (process.platform === "linux") {
+            try {
+                return fs.readFileSync(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ");
+            }
+            catch {
+                return null;
+            }
+        }
+        return processCommandLine(pid);
+    });
+}
+function waitForOwnedForwarder(readyFile, accountId, signal) {
+    return new Promise((resolve, reject) => {
+        const started = Date.now();
+        let finished = false;
+        let timer;
+        const done = (error) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        const onAbort = () => done(new Error("pool startup was stopped"));
+        const probe = () => {
+            if (signal.aborted)
+                return onAbort();
+            if (poolForwarderOwnsPort(readyFile, accountId))
+                return done();
+            if (Date.now() - started >= 10_000)
+                return done(new Error("owned pool inference forwarder did not become ready within 10 seconds"));
+            timer = setTimeout(probe, 100);
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        probe();
+    });
+}
+async function runServiceRemoteControlPoolHost(d, accountId) {
+    const { pool, frontendCaPath } = await configuredRemoteControlPool(d, accountId);
+    const claude = await hostTool(d, "claude", undefined);
+    const readyFile = poolForwarderReadyFile(d, accountId);
+    await waitForOwnedForwarder(readyFile, accountId, AbortSignal.timeout(10_500));
+    const controller = new AbortController();
+    const monitorForwarder = monitorOwnedPoolForwarder(() => poolForwarderOwnsPort(readyFile, accountId), controller.signal);
+    const host = runTmuxService(d, {
+        session: `remote-control-pool-${accountId}`,
+        tmuxSocket: `hq-daemon-pool-${accountId}`,
+        argv: [claude, ...remoteControlPoolArgs(pool)],
+        label: `claude remote-control pool ${accountId}`,
+        watch: claude,
+        signal: controller.signal,
+        sessionEnv: {
+            HOME: d.home,
+            CLAUDE_CONFIG_DIR: d.env.CLAUDE_CONFIG_DIR?.trim() || path.join(d.home, ".claude"),
+            NODE_EXTRA_CA_CERTS: frontendCaPath,
+            IS_SANDBOX: "1",
+            CLAUDE_CODE_OAUTH_TOKEN: null,
+            ANTHROPIC_AUTH_TOKEN: null,
+            ANTHROPIC_API_KEY: null,
+            ANTHROPIC_BASE_URL: null,
+        },
+    });
+    try {
+        d.out(`Remote Control pool ${accountId} is connected to its owned inference forwarder on 127.0.0.1:${pool.forwarderPort}.`);
+        try {
+            await Promise.race([host, monitorForwarder]);
+        }
+        catch (error) {
+            if (error.message.includes("owned pool inference forwarder"))
+                throw new DaemonCommandError(error.message);
+            throw error;
+        }
+    }
+    finally {
+        controller.abort();
+        await host;
+    }
+}
+async function runServiceRemoteControlPoolForwarderHost(d, accountId) {
+    const { pool, paths, hqRoot, serviceSessionId } = await configuredRemoteControlPool(d, accountId);
+    const secretEnv = remoteControlPoolSecretsEnv({
+        ...d.env,
+        HQ_ROOT: d.env.HQ_ROOT?.trim() || hqRoot,
+        HQ_NO_UPDATE_CHECK: "1",
+    }, serviceSessionId);
+    const scopeProbe = spawnSync(d.hqBinary, ["secrets", "--personal", "exists", pool.secretName, "--quiet"], {
+        cwd: paths.root,
+        env: secretEnv,
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 15_000,
+    });
+    if (scopeProbe.status !== 0) {
+        throw new DaemonCommandError(`Remote Control pool ${accountId} cannot start: configured service session "${serviceSessionId}" cannot access the configured HQ Secret.`);
+    }
+    const readyFile = poolForwarderReadyFile(d, accountId);
+    ensurePrivateDir(path.dirname(readyFile));
+    const child = spawn(d.hqBinary, [
+        "secrets", "--personal", "exec", "--only", pool.secretName, "--",
+        "/bin/sh", "-c", "unset HQ_SESSION_ID; exec \"$@\"", "hq-pool-forwarder",
+        d.nodeBinary, process.argv[1] ?? d.hqBinary, "daemon", "service", "remote-control-pool-forwarder",
+        "--account-id", accountId, "--port", String(pool.forwarderPort), "--secret-env", pool.secretName, "--ready-file", readyFile,
+    ], { cwd: paths.root, env: secretEnv, stdio: "ignore", detached: true });
+    const stopped = new AbortController();
+    const childExit = once(child, "exit");
+    child.once("exit", () => stopped.abort());
+    const signalForwarderGroup = (signal) => {
+        if (child.pid === undefined)
+            return;
+        try {
+            process.kill(-child.pid, signal);
+        }
+        catch (error) {
+            if (error.code !== "ESRCH")
+                throw error;
+        }
+    };
+    const stop = () => { stopped.abort(); signalForwarderGroup("SIGTERM"); };
+    process.once("SIGTERM", stop);
+    process.once("SIGINT", stop);
+    try {
+        try {
+            await waitForOwnedForwarder(readyFile, accountId, stopped.signal);
+        }
+        catch (error) {
+            if (child.exitCode !== null || child.signalCode !== null) {
+                throw new DaemonCommandError(`Remote Control pool ${accountId} inference forwarder exited before readiness.`);
+            }
+            throw error;
+        }
+        const [code, signal] = await childExit;
+        throw new DaemonCommandError(`Remote Control pool ${accountId} inference forwarder exited (${code ?? signal ?? "unknown"}).`);
+    }
+    finally {
+        process.off("SIGTERM", stop);
+        process.off("SIGINT", stop);
+        if (child.exitCode === null && child.signalCode === null) {
+            signalForwarderGroup("SIGTERM");
+            const exited = once(child, "exit").then(() => true);
+            const timeout = new Promise((resolve) => setTimeout(() => resolve(false), 5_000));
+            if (!(await Promise.race([exited, timeout]))) {
+                signalForwarderGroup("SIGKILL");
+                await exited;
+            }
+        }
+    }
+}
+async function runServiceRemoteControlPoolForwarder(d, opts) {
+    const secret = d.env[opts.secretEnv];
+    if (!secret)
+        throw new DaemonCommandError("The configured HQ Secret was not injected into the pool inference forwarder.");
+    const server = createInferenceForwarder({ port: Number(opts.port), secret: () => secret });
+    let markerWritten = false;
+    const writeReadyMarker = () => {
+        ensurePrivateDir(path.dirname(opts.readyFile));
+        const temp = `${opts.readyFile}.${process.pid}.tmp`;
+        fs.writeFileSync(temp, `${JSON.stringify({ accountId: opts.accountId, pid: process.pid })}\n`, { mode: 0o600 });
+        fs.renameSync(temp, opts.readyFile);
+        fs.chmodSync(opts.readyFile, 0o600);
+        markerWritten = true;
+    };
+    let stopping = false;
+    const stop = () => {
+        stopping = true;
+        if (server.listening)
+            server.close();
+    };
+    process.once("SIGTERM", stop);
+    process.once("SIGINT", stop);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("listening", () => {
+                if (stopping) {
+                    server.close();
+                    reject(new DaemonCommandError("The pool inference forwarder was stopped during startup."));
+                    return;
+                }
+                const address = server.address();
+                if (!address || typeof address === "string" || address.address !== "127.0.0.1") {
+                    reject(new DaemonCommandError("The pool inference forwarder did not bind loopback-only."));
+                    return;
+                }
+                writeReadyMarker();
+                resolve();
+            });
+            server.once("error", reject);
+        });
+        await once(server, "close");
+    }
+    finally {
+        if (markerWritten) {
+            try {
+                const marker = JSON.parse(fs.readFileSync(opts.readyFile, "utf8"));
+                if (marker.pid === process.pid)
+                    fs.unlinkSync(opts.readyFile);
+            }
+            catch { /* stale or already removed marker is harmless */ }
+        }
+        process.off("SIGTERM", stop);
+        process.off("SIGINT", stop);
+    }
+}
 async function runServiceCodexRemoteControl(d, opts) {
     const { CODEX_TMUX_SESSION } = await import("../lib/daemon/remote-control.js");
     const codex = await hostTool(d, "codex", opts.codex);
@@ -1063,6 +1411,19 @@ export function registerDaemonCommand(program, over = {}) {
         .description("List the older HQ background units the daemon would take over; --apply takes them over")
         .option("--apply", "Stop the older units and let the daemon run their services")
         .action(wrap((d, opts) => runMigrate(d, opts)));
+    const pools = daemon
+        .command("remote-control-pools")
+        .description("Validate, configure, and inspect opt-in Claude Remote Control account pools");
+    pools.command("validate <file>")
+        .description("Validate a host-local desired-state JSON file without saving it")
+        .action(wrap((d, file) => validateRemoteControlPools(d, file)));
+    pools.command("configure <file>")
+        .description("Save a validated host-local desired-state JSON file")
+        .action(wrap((d, file) => configureRemoteControlPools(d, file)));
+    pools.command("show")
+        .description("Show configured pool metadata (never secret values)")
+        .option("--json", "Print JSON")
+        .action(wrap((d, opts) => showRemoteControlPools(d, opts)));
     const service = daemon
         .command("service", { hidden: true })
         .description("Entry points the daemon runs for services that have no command of their own");
@@ -1077,6 +1438,29 @@ export function registerDaemonCommand(program, over = {}) {
         .requiredOption("--name <name>", "remote-control session name")
         .option("--permission-mode <mode>", "claude --permission-mode")
         .action(wrap((d, opts) => runServiceRemoteControl(d, opts)));
+    service
+        .command("remote-control-pool")
+        .description("Keep one configured Claude Remote Control account pool running in its private mount namespace")
+        .requiredOption("--account-id <id>", "Claude account ID from hq lanes accounts")
+        .action(wrap((d, opts) => runServiceRemoteControlPool(d, opts.accountId)));
+    service
+        .command("remote-control-pool-host")
+        .description("Run one pool's forwarder and Claude host inside its private namespace")
+        .requiredOption("--account-id <id>", "Claude account ID from hq lanes accounts")
+        .action(wrap((d, opts) => runServiceRemoteControlPoolHost(d, opts.accountId)));
+    service
+        .command("remote-control-pool-forwarder-host")
+        .description("Supervise one pool's personal HQ Secret injected inference forwarder")
+        .requiredOption("--account-id <id>", "Claude account ID from hq lanes accounts")
+        .action(wrap((d, opts) => runServiceRemoteControlPoolForwarderHost(d, opts.accountId)));
+    service
+        .command("remote-control-pool-forwarder")
+        .description("Run the loopback-only /v1/messages inference forwarder")
+        .requiredOption("--account-id <id>", "Claude account ID from hq lanes accounts")
+        .requiredOption("--port <port>", "loopback listener port")
+        .requiredOption("--secret-env <name>", "HQ Secrets injected environment variable name")
+        .requiredOption("--ready-file <path>", "private daemon state file for listener ownership")
+        .action(wrap((d, opts) => runServiceRemoteControlPoolForwarder(d, opts)));
     service
         .command("codex-remote-control")
         .description("Keep the box's Codex remote-control runner going in a tmux session, restarting it after a Codex update")

package/dist/commands/integrations-connect.d.ts

@@ -48,6 +48,12 @@ interface ConnectOptions {
     scopes?: string;
     /** Connect again even when this app is already connected. */
     force?: boolean;
+    /**
+     * Print the sign-in link and exit at once. The sign-in finishes on the HQ
+     * console, so nothing on this machine waits for it: a bot can send the link
+     * to a person and check `hq integrations list` afterwards.
+     */
+    linkOnly?: boolean;
 }
 /**
  * Validate `--auth` against the supported enum, rejecting an unknown value

package/dist/commands/integrations-connect.js

@@ -548,6 +548,8 @@ async function connectViaOAuth(token, companyUid, target, opts) {
         ...target.ref,
         ...(requestedScopes ? { scopes: requestedScopes } : {}),
     };
+    if (opts.linkOnly)
+        return await linkOnlySignIn(token, companyUid, target, opts, startInput);
     // A user-registered app pins the console callback and skips the loopback
     // entirely — see `userClientSignIn` for why an ephemeral port cannot be the
     // redirect URI here.
@@ -876,6 +878,39 @@ async function resolveUserOAuthClient(opts, appLabel) {
     // proceed with the id alone rather than inventing a blank secret.
     return { clientId };
 }
+/**
+ * `--link-only`: start the sign-in with hq-pro's console callback (no
+ * `redirectUri`, as `userClientSignIn` does), print the link and return. The
+ * console finishes the flow it did not start (hq-pro#2823, hq-console#783), so
+ * the caller confirms with `hq integrations list` once the person says done.
+ * The link goes to stdout (the whole line, unredacted: it is useless redacted)
+ * so a bot can read it; with --json it is `{ "app", "authorizationUrl" }`.
+ */
+async function linkOnlySignIn(token, companyUid, target, opts, startInput) {
+    let started;
+    try {
+        started = await startOAuth(token, companyUid, startInput);
+    }
+    catch (err) {
+        if (!(err instanceof IntegrationsCliError) || !err.code)
+            throw err;
+        if (BRING_YOUR_OWN_CLIENT_CODES.has(err.code))
+            return await bringYourOwnClientHandoff(target, opts, err.message, err.redirectUri);
+        if (!CONSOLE_HANDOFF_CODES.has(err.code))
+            throw err;
+        return await consoleHandoff(target, { ...opts, browser: false });
+    }
+    const app = started.displayName || target.label;
+    if (opts.json) {
+        console.log(JSON.stringify({ app, authorizationUrl: started.authorizationUrl }));
+    }
+    else {
+        console.error(`Sign-in link for ${redactUrlsInText(app)} (it finishes on the HQ console):`);
+        console.log(started.authorizationUrl);
+        console.error(chalk.dim("When the browser says it connected, run `hq integrations list` to confirm."));
+    }
+    return null;
+}
 /**
  * Sign in with an OAuth app the admin registered themselves.
  *
@@ -1361,6 +1396,7 @@ export function registerConnectCommands(integrations) {
         .option("--scopes <list>", "Permissions to request, space- or comma-separated (default: what the app needs)")
         .option("--no-browser", "Print the sign-in URL instead of opening a browser")
         .option("--timeout <seconds>", "How long to wait for a browser sign-in (default 300)")
+        .option("--link-only", "Print the sign-in link and exit without waiting; the sign-in finishes on the HQ console")
         .option("--force", "Connect again even if this app is already connected")
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {

package/dist/commands/integrations-slack.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `hq integrations slack` — connect a person's own Slack account to HQ from
+ * the command line, without the console's Add Integration dialog.
+ *
+ *   hq integrations slack connect [--company <slug>] [--open] [--json]
+ *   hq integrations slack accounts [--json]
+ *
+ * `connect` asks hq-pro for Slack's own sign-in link
+ * (`POST /v1/slack/personal/connect`, the same call the console makes) and
+ * prints it, or opens it with `--open`. Slack sends the person back to
+ * hq-pro's callback, which stores the user token in their personal vault and
+ * shows a "Connected" page; nothing here waits for that. `accounts` lists the
+ * connected Slack accounts (token-free summaries), so a caller can confirm.
+ */
+import { Command } from "commander";
+export interface SlackPersonalAccountSummary {
+    accountId?: string;
+    teamId?: string;
+    teamName?: string;
+    teamDomain?: string;
+    slackUserId?: string;
+    companyUid?: string;
+    companyName?: string;
+    companySlug?: string;
+    capabilities?: string[];
+}
+export declare function startSlackPersonalConnect(token: string, companyUid: string): Promise<string>;
+export declare function listSlackPersonalAccounts(token: string): Promise<SlackPersonalAccountSummary[]>;
+export declare function registerSlackCommands(integrations: Command): void;
+//# sourceMappingURL=integrations-slack.d.ts.map

package/dist/commands/integrations-slack.js

@@ -0,0 +1,81 @@
+import chalk from "chalk";
+import open from "open";
+import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+import { raiseForResponse } from "./integrations-core.js";
+export async function startSlackPersonalConnect(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/slack/personal/connect",
+        method: "POST",
+        body: { companyUid },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to start the Slack sign-in");
+    const body = (await res.json());
+    if (!body.url)
+        throw new Error("HQ did not return a Slack sign-in link.");
+    return body.url;
+}
+export async function listSlackPersonalAccounts(token) {
+    const res = await vaultApiFetch({ token, path: "/v1/slack/personal/accounts" });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to list Slack accounts");
+    const body = (await res.json());
+    return body.accounts ?? [];
+}
+export function registerSlackCommands(integrations) {
+    const slack = integrations
+        .command("slack")
+        .description("Connect your own Slack account to HQ (stored in your personal vault)");
+    slack
+        .command("connect")
+        .description("Get Slack's sign-in link for your account; the sign-in finishes on HQ")
+        .option("--company <slug>", "Company the Slack workspace belongs to (defaults to your single active company)")
+        .option("--open", "Open the link in the browser instead of only printing it")
+        .option("--json", "Machine-readable output: { url, opened }")
+        .action(async (opts) => {
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const url = await startSlackPersonalConnect(token, companyUid);
+        let opened = false;
+        if (opts.open) {
+            try {
+                await open(url);
+                opened = true;
+            }
+            catch {
+                opened = false;
+            }
+        }
+        if (opts.json) {
+            console.log(JSON.stringify({ url, opened }));
+            return;
+        }
+        console.error(opened ? "Opened Slack's sign-in page. If it did not appear, open:" : "Slack sign-in link:");
+        console.log(url);
+        console.error(chalk.dim("The link works for 10 minutes. Run `hq integrations slack accounts` to confirm once Slack says connected."));
+    });
+    slack
+        .command("accounts")
+        .description("List your connected Slack accounts")
+        .option("--json", "Machine-readable output")
+        .action(async (opts) => {
+        const token = await ensureCognitoIdToken();
+        const accounts = await listSlackPersonalAccounts(token);
+        if (opts.json) {
+            console.log(JSON.stringify({ accounts }));
+            return;
+        }
+        if (!accounts.length) {
+            console.log("No Slack accounts connected. Run `hq integrations slack connect`.");
+            return;
+        }
+        for (const a of accounts) {
+            const team = a.teamName || a.teamDomain || a.teamId || "Slack workspace";
+            const company = a.companyName || a.companySlug || a.companyUid || "";
+            console.log(`${team}${company ? `  → ${company}` : ""}`);
+        }
+    });
+}
+//# sourceMappingURL=integrations-slack.js.map

package/dist/commands/integrations.js

@@ -58,6 +58,7 @@ import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetc
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
+import { registerSlackCommands } from "./integrations-slack.js";
 import { fetchPendingApprovals } from "./integrations-api.js";
 export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 /**
@@ -469,5 +470,6 @@ export function registerIntegrationsCommand(program) {
     }
     registerConnectCommands(integrations);
     registerManageCommands(integrations);
+    registerSlackCommands(integrations);
 }
 //# sourceMappingURL=integrations.js.map