@indigoai-us/hq-cli 5.345.104 → 5.345.105

package/dist/lib/bot/worker-source.js

@@ -111,7 +111,13 @@ function scanCoreWorkerDirs(hqRoot, io) {
             return;
         }
         for (const e of entries) {
-            if (!e.isDirectory() || e.name.startsWith(".") || SKIP_DIRS.has(e.name))
+            if (e.name.startsWith(".") || SKIP_DIRS.has(e.name))
+                continue;
+            // A pack worker is a symlink (core/workers/public/<id> ->
+            // core/packages/<pack>/workers/<id>); a Dirent reports it as a link, not a
+            // directory, so follow it when it holds a worker.yaml.
+            const linkedWorker = !e.isDirectory() && e.isSymbolicLink?.() === true && io.existsSync(path.join(hqRoot, rel, e.name, "worker.yaml"));
+            if (!e.isDirectory() && !linkedWorker)
                 continue;
             walk(path.join(rel, e.name), depth + 1);
         }

package/dist/lib/daemon/catalog.d.ts

@@ -11,6 +11,7 @@
  */
 import type { MachineType } from "./machine-type.js";
 import type { SyncOwner } from "./config.js";
+import type { RemoteControlPoolsConfig } from "./remote-control-pools.js";
 import { type SyncRunnerProcess } from "./sync-runner.js";
 export declare const SERVICE_NAMES: readonly ["sync", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
 export type ServiceName = (typeof SERVICE_NAMES)[number];
@@ -125,6 +126,20 @@ export interface PlanContext {
     tmuxPath: string | null;
     /** Short host name, used to name this machine's remote-control session. */
     hostName: string;
+    /** Main A Claude config dir shared by the pool's control plane. */
+    claudeConfigDir?: string;
+    /** Optional host-local RC pool desired state; absent/empty keeps legacy behavior. */
+    remoteControlPools?: RemoteControlPoolsConfig;
+    /** Invalid host-local desired state remains visible instead of disappearing. */
+    remoteControlPoolsError?: string;
+    /** Secret names whose presence was verified through HQ Secrets. */
+    availablePoolSecrets?: ReadonlySet<string>;
+    /** Secret names whose presence check failed for a reason other than absence. */
+    unverifiablePoolSecrets?: ReadonlySet<string>;
+    /** Pool accounts whose configured personal service-session capability is invalid or missing. */
+    invalidPoolServiceSessions?: ReadonlySet<string>;
+    availablePoolFrontends?: ReadonlySet<string>;
+    unverifiablePoolFrontends?: ReadonlySet<string>;
     /** The session name the box's own runner used (`--name` in its script), kept when the daemon takes over. */
     remoteControlName: string | null;
     /** Absolute path of the login user's codex binary, or null. */

package/dist/lib/daemon/catalog.js

@@ -364,6 +364,55 @@ export function planUnits(services, ctx) {
             units.push(unit);
         }
     }
+    // Pool units are desired-state instances rather than service-name toggles.
+    // This leaves the existing A unit and no-pools plan byte-for-byte unchanged.
+    for (const pool of ctx.remoteControlPools?.pools ?? []) {
+        units.push(base("remote-control", {
+            id: `remote-control-pool-forwarder:${pool.accountId}`,
+            description: `keeps the account ${pool.accountId} inference forwarder on 127.0.0.1:${pool.forwarderPort}`,
+            command: { type: "hq", args: ["daemon", "service", "remote-control-pool-forwarder-host", "--account-id", pool.accountId] },
+            env: { ...(ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {}), HQ_POOL_CONFIG: JSON.stringify([pool, ctx.remoteControlPools?.frontendCaPath, ctx.remoteControlPools?.serviceSessionId]) },
+            keepAcrossCliUpdates: true,
+            blocked: firstBlock([
+                [ctx.platform !== "linux", "Remote Control account pools require Linux mount namespaces"],
+                [!ctx.hqRoot, NO_HQ_ROOT],
+                [ctx.invalidPoolServiceSessions?.has(pool.accountId) === true, "configured serviceSessionId must reference an existing personal-only scope capability"],
+                [ctx.unverifiablePoolSecrets?.has(pool.secretName) === true, "could not verify the configured HQ Secret"],
+                [ctx.availablePoolSecrets?.has(pool.secretName) !== true, "the configured HQ Secret is missing"],
+            ]),
+        }));
+        const unit = base("remote-control", {
+            id: `remote-control-pool:${pool.accountId}`,
+            description: `keeps Claude remote control running for account ${pool.accountId}`,
+            command: { type: "hq", args: ["daemon", "service", "remote-control-pool", "--account-id", pool.accountId] },
+            env: {
+                ...(ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {}),
+                ...(ctx.claudeConfigDir ? { CLAUDE_CONFIG_DIR: ctx.claudeConfigDir } : {}),
+                HQ_POOL_CONFIG: JSON.stringify([pool, ctx.remoteControlPools?.frontendCaPath, ctx.remoteControlPools?.serviceSessionId]),
+            },
+            keepAcrossCliUpdates: true,
+            blocked: firstBlock([
+                [ctx.platform !== "linux", "Remote Control account pools require Linux mount namespaces"],
+                [!ctx.claudePath, "the claude CLI is not installed"],
+                [!ctx.tmuxPath, "tmux is not installed (remote control runs Claude inside tmux)"],
+                [!ctx.hqRoot, NO_HQ_ROOT],
+                [ctx.invalidPoolServiceSessions?.has(pool.accountId) === true, "configured serviceSessionId must reference an existing personal-only scope capability"],
+                [ctx.unverifiablePoolSecrets?.has(pool.secretName) === true, "could not verify the configured HQ Secret"],
+                [ctx.availablePoolSecrets?.has(pool.secretName) !== true, "the configured HQ Secret is missing"],
+                [ctx.unverifiablePoolFrontends?.has(pool.accountId) === true, "could not verify the configured nginx frontend"],
+                [ctx.availablePoolFrontends?.has(pool.accountId) !== true, "the configured nginx frontend is not responding on HTTPS port 443"],
+            ]),
+        });
+        units.push(unit);
+    }
+    if (ctx.remoteControlPoolsError) {
+        units.push(base("remote-control", {
+            id: "remote-control-pools:config",
+            description: "validates Claude Remote Control account pool desired state",
+            command: null,
+            blocked: { state: "unavailable", reason: `invalid remote-control pool config: ${ctx.remoteControlPoolsError}` },
+        }));
+    }
     return units;
 }
 //# sourceMappingURL=catalog.js.map

package/dist/lib/daemon/paths.d.ts

@@ -6,6 +6,7 @@
 export interface DaemonPaths {
     root: string;
     configPath: string;
+    remoteControlPoolsPath: string;
     statePath: string;
     lockPath: string;
     logsDir: string;

package/dist/lib/daemon/paths.js

@@ -12,6 +12,7 @@ export function daemonPaths(home = os.homedir(), env = process.env) {
     return {
         root,
         configPath: path.join(root, "config.json"),
+        remoteControlPoolsPath: path.join(root, "remote-control-pools.json"),
         statePath: path.join(root, "state.json"),
         lockPath: path.join(root, "daemon.pid"),
         logsDir,

package/dist/lib/daemon/remote-control-forwarder.d.ts

@@ -0,0 +1,14 @@
+/** A narrow, loopback-only Anthropic inference proxy for one RC account pool. */
+import * as https from "node:https";
+import { type IncomingMessage, type Server } from "node:http";
+export declare const POOL_UPSTREAM_TIMEOUT_MS = 600000;
+export declare const POOL_UPSTREAM_CONNECT_TIMEOUT_MS = 30000;
+export declare function inferenceForwardHeaders(incoming: IncomingMessage["headers"], secret: string): Record<string, string | string[]>;
+export declare function poolInferencePathAllowed(method: string | undefined, requestUrl: string | undefined): boolean;
+export declare function createInferenceForwarder(options: {
+    port: number;
+    secret: () => string | undefined;
+    upstream?: typeof https.request;
+    upstreamTimeoutMs?: number;
+}): Server;
+//# sourceMappingURL=remote-control-forwarder.d.ts.map

package/dist/lib/daemon/remote-control-forwarder.js

@@ -0,0 +1,104 @@
+/** A narrow, loopback-only Anthropic inference proxy for one RC account pool. */
+import * as https from "node:https";
+import * as dns from "node:dns";
+import { createServer } from "node:http";
+const STRIPPED_HEADERS = new Set([
+    "authorization", "x-api-key", "proxy-authorization", "proxy-authenticate", "proxy-connection", "host", "content-length",
+    "connection", "keep-alive", "te", "trailer", "transfer-encoding", "upgrade",
+]);
+export const POOL_UPSTREAM_TIMEOUT_MS = 600_000;
+export const POOL_UPSTREAM_CONNECT_TIMEOUT_MS = 30_000;
+export function inferenceForwardHeaders(incoming, secret) {
+    if (!secret)
+        throw new Error("the configured HQ Secret is empty");
+    const headers = {};
+    const hopByHop = new Set(STRIPPED_HEADERS);
+    const connection = incoming.connection;
+    for (const value of Array.isArray(connection) ? connection : connection ? [connection] : []) {
+        for (const name of value.split(","))
+            if (name.trim())
+                hopByHop.add(name.trim().toLowerCase());
+    }
+    for (const [name, value] of Object.entries(incoming)) {
+        if (value === undefined || hopByHop.has(name.toLowerCase()))
+            continue;
+        headers[name] = value;
+    }
+    headers.host = "api.anthropic.com";
+    headers.authorization = `Bearer ${secret}`;
+    return headers;
+}
+export function poolInferencePathAllowed(method, requestUrl) {
+    if (method !== "POST")
+        return false;
+    const pathname = new URL(requestUrl ?? "/", "http://127.0.0.1").pathname;
+    return pathname === "/v1/messages" || pathname.startsWith("/v1/messages/");
+}
+function sendJson(response, status, message) {
+    response.writeHead(status, { "content-type": "application/json", connection: "close" });
+    response.end(JSON.stringify({ error: { type: "proxy_error", message } }));
+}
+export function createInferenceForwarder(options) {
+    const requestUpstream = options.upstream ?? https.request;
+    const server = createServer((incoming, response) => {
+        if (!poolInferencePathAllowed(incoming.method, incoming.url)) {
+            sendJson(response, 404, "only POST /v1/messages is available through this inference forwarder");
+            incoming.resume();
+            return;
+        }
+        const secret = options.secret();
+        if (!secret) {
+            sendJson(response, 503, "the pool inference secret is unavailable");
+            incoming.resume();
+            return;
+        }
+        const headers = inferenceForwardHeaders(incoming.headers, secret);
+        const upstream = requestUpstream({
+            protocol: "https:",
+            hostname: "api.anthropic.com",
+            lookup: (hostname, _options, callback) => {
+                // The host can map this name to A's local proxy in /etc/hosts. DNS
+                // resolution bypasses that mapping for the pool's outbound request.
+                dns.resolve4(hostname, (error, addresses) => {
+                    if (_options.all)
+                        callback(error, addresses?.map((address) => ({ address, family: 4 })) ?? []);
+                    else
+                        callback(error, addresses?.[0] ?? "", 4);
+                });
+            },
+            port: 443,
+            method: "POST",
+            path: incoming.url,
+            headers,
+        }, (upstreamResponse) => {
+            response.writeHead(upstreamResponse.statusCode ?? 502, upstreamResponse.headers);
+            upstreamResponse.pipe(response);
+        });
+        const connectTimeout = setTimeout(() => {
+            upstream.destroy(new Error("pool inference upstream connection timed out"));
+        }, POOL_UPSTREAM_CONNECT_TIMEOUT_MS);
+        upstream.once("socket", (socket) => {
+            socket.once("secureConnect", () => clearTimeout(connectTimeout));
+        });
+        upstream.setTimeout(options.upstreamTimeoutMs ?? POOL_UPSTREAM_TIMEOUT_MS, () => {
+            upstream.destroy(new Error("pool inference upstream timed out"));
+        });
+        upstream.on("error", () => {
+            clearTimeout(connectTimeout);
+            if (!response.headersSent && !response.destroyed)
+                sendJson(response, 502, "the pool inference backend is unavailable");
+            else
+                response.destroy();
+        });
+        upstream.once("close", () => clearTimeout(connectTimeout));
+        response.once("close", () => {
+            clearTimeout(connectTimeout);
+            if (!response.writableEnded)
+                upstream.destroy();
+        });
+        incoming.pipe(upstream);
+    });
+    server.listen(options.port, "127.0.0.1");
+    return server;
+}
+//# sourceMappingURL=remote-control-forwarder.js.map

package/dist/lib/daemon/remote-control-pools.d.ts

@@ -0,0 +1,44 @@
+/** Host-local desired state for opt-in Claude Remote Control account pools. */
+export interface RemoteControlPool {
+    accountId: string;
+    capacity: number;
+    /** Private loopback address bound by the external nginx TLS listener. */
+    frontendAddress: string;
+    /** The Anthropic API hostname is HTTPS and the hosts overlay cannot set a port. */
+    frontendPort: 443;
+    /** Loopback-only inference forwarder owned by hq daemon. */
+    forwarderPort: number;
+    /** A real mount-point path, not a symlink, populated in a private namespace. */
+    mountPath: string;
+    /** HQ Secrets name; the secret value is never part of this file. */
+    secretName: string;
+}
+export interface RemoteControlPoolsConfig {
+    version: 1;
+    /** CA certificate trusted by Claude and used to verify the external nginx TLS listener. */
+    frontendCaPath?: string;
+    /** Stable HQ session whose scope capability is locked to personal for Secrets access. */
+    serviceSessionId?: string;
+    pools: RemoteControlPool[];
+}
+/** Parse and validate the complete desired state; unknown keys fail closed. */
+export declare function parseRemoteControlPoolsConfig(value: unknown, knownAccountIds?: Iterable<string>, home?: string): RemoteControlPoolsConfig;
+/** Override ambient session selection only for a Secrets child process. */
+export declare function remoteControlPoolSecretsEnv(env: NodeJS.ProcessEnv, serviceSessionId: string): NodeJS.ProcessEnv;
+/** Require an explicit, existing capability; never inherit the mutable .current session. */
+export declare function assertPersonalServiceSessionCapability(root: string, serviceSessionId: string): void;
+/** Hosts file overlay consumed inside this pool's private mount namespace. */
+export declare function remoteControlPoolHostsOverlay(pool: RemoteControlPool): string;
+export declare function poolHostsFile(baseHosts: string, pool: RemoteControlPool): string;
+export declare function readRemoteControlPoolsConfig(file: string, knownAccountIds?: Iterable<string>, home?: string): RemoteControlPoolsConfig;
+export declare function writeRemoteControlPoolsConfig(file: string, config: RemoteControlPoolsConfig, home?: string): void;
+export declare function remoteControlPoolArgs(pool: RemoteControlPool): string[];
+/** Reject an existing symlink anywhere in the requested path. */
+export declare function assertNoSymlinkPathComponents(target: string): void;
+/** Compare paths after resolving their real filesystem identities. */
+export declare function assertDistinctRealMountPath(mountPath: string, hqRoot: string): void;
+/** Validate the private readiness marker against the live forwarder process identity. */
+export declare function isOwnedPoolForwarder(readyFile: string, accountId: string, isAlive: (pid: number) => boolean, commandLine: (pid: number) => string | null): boolean;
+/** Fail the pool host when its separately supervised inference process disappears. */
+export declare function monitorOwnedPoolForwarder(isOwned: () => boolean, signal: AbortSignal, sleep?: () => Promise<void>): Promise<void>;
+//# sourceMappingURL=remote-control-pools.d.ts.map

package/dist/lib/daemon/remote-control-pools.js

@@ -0,0 +1,245 @@
+/** Host-local desired state for opt-in Claude Remote Control account pools. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { isIPv4 } from "node:net";
+import { readSessionCompanyLock } from "../session-company-lock.js";
+import { ensurePrivateDir } from "./paths.js";
+const ACCOUNT_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const SECRET_NAME = /^[A-Z][A-Z0-9_]{0,127}$/;
+const CAPACITY_MIN = 1;
+const CAPACITY_MAX = 100;
+const PORT_MIN = 1024;
+const PORT_MAX = 65535;
+function object(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function absoluteRealPath(value, field) {
+    if (typeof value !== "string" || !path.isAbsolute(value) || value.includes("\0")) {
+        throw new Error(`${field} must be an absolute path`);
+    }
+    return path.normalize(value);
+}
+function port(value, field) {
+    if (!Number.isInteger(value) || value < PORT_MIN || value > PORT_MAX) {
+        throw new Error(`${field} must be an integer from ${PORT_MIN} to ${PORT_MAX}`);
+    }
+    return value;
+}
+function frontendAddress(value, field) {
+    if (typeof value !== "string" || !isIPv4(value) || !value.startsWith("127.")) {
+        throw new Error(`${field} must be a distinct 127.0.0.0/8 IPv4 loopback address`);
+    }
+    return value;
+}
+/** Parse and validate the complete desired state; unknown keys fail closed. */
+export function parseRemoteControlPoolsConfig(value, knownAccountIds, home = os.homedir()) {
+    if (!object(value))
+        throw new Error("remote-control pools config must be a JSON object");
+    if (Object.keys(value).some((key) => !["version", "pools", "frontendCaPath", "serviceSessionId"].includes(key))) {
+        throw new Error("remote-control pools config contains an unknown field");
+    }
+    if (value.version !== 1)
+        throw new Error("remote-control pools config version must be 1");
+    if (!Array.isArray(value.pools))
+        throw new Error("remote-control pools config pools must be an array");
+    let frontendCaPath;
+    if (value.frontendCaPath !== undefined)
+        frontendCaPath = absoluteRealPath(value.frontendCaPath, "frontendCaPath");
+    if (value.pools.length > 0 && !frontendCaPath)
+        throw new Error("frontendCaPath is required when remote-control pools are configured");
+    let serviceSessionId;
+    if (value.serviceSessionId !== undefined) {
+        if (typeof value.serviceSessionId !== "string" || !/^[A-Za-z0-9._-]+$/.test(value.serviceSessionId) || value.serviceSessionId === "." || value.serviceSessionId === "..") {
+            throw new Error("serviceSessionId must be a valid HQ session ID");
+        }
+        serviceSessionId = value.serviceSessionId;
+    }
+    if (value.pools.length > 0 && !serviceSessionId) {
+        throw new Error("serviceSessionId is required when remote-control pools are configured");
+    }
+    const seenAccounts = new Set();
+    const known = knownAccountIds === undefined ? null : new Set(knownAccountIds);
+    const seenEndpoints = new Set();
+    const seenPaths = new Set();
+    const pools = value.pools.map((raw, index) => {
+        const prefix = `pools[${index}]`;
+        if (!object(raw))
+            throw new Error(`${prefix} must be a JSON object`);
+        const allowed = ["accountId", "capacity", "frontendAddress", "frontendPort", "forwarderPort", "mountPath", "secretName"];
+        if (Object.keys(raw).some((key) => !allowed.includes(key)))
+            throw new Error(`${prefix} contains an unknown field`);
+        if (typeof raw.accountId !== "string" || !ACCOUNT_ID.test(raw.accountId)) {
+            throw new Error(`${prefix}.accountId is invalid`);
+        }
+        if (known && !known.has(raw.accountId))
+            throw new Error(`${prefix}.accountId "${raw.accountId}" is not configured in hq lanes accounts`);
+        if (seenAccounts.has(raw.accountId))
+            throw new Error(`duplicate accountId "${raw.accountId}"`);
+        seenAccounts.add(raw.accountId);
+        if (!Number.isInteger(raw.capacity) || raw.capacity < CAPACITY_MIN || raw.capacity > CAPACITY_MAX) {
+            throw new Error(`${prefix}.capacity must be an integer from ${CAPACITY_MIN} to ${CAPACITY_MAX}`);
+        }
+        const address = frontendAddress(raw.frontendAddress, `${prefix}.frontendAddress`);
+        if (raw.frontendPort !== 443)
+            throw new Error(`${prefix}.frontendPort must be 443`);
+        const frontendPort = 443;
+        const forwarderPort = port(raw.forwarderPort, `${prefix}.forwarderPort`);
+        const forwarderEndpoint = `127.0.0.1:${forwarderPort}`;
+        if (seenEndpoints.has(forwarderEndpoint))
+            throw new Error(`duplicate pool endpoint ${forwarderEndpoint}`);
+        seenEndpoints.add(forwarderEndpoint);
+        const endpoint = `${address}:${frontendPort}`;
+        if (seenEndpoints.has(endpoint))
+            throw new Error(`duplicate pool frontend endpoint ${endpoint}`);
+        seenEndpoints.add(endpoint);
+        const mountPath = absoluteRealPath(raw.mountPath, `${prefix}.mountPath`);
+        if (mountPath !== path.join(home, ".local", "state", "hq-remote-control", raw.accountId)) {
+            throw new Error(`${prefix}.mountPath must be ${path.join(home, ".local", "state", "hq-remote-control", raw.accountId)}`);
+        }
+        if (seenPaths.has(mountPath))
+            throw new Error(`duplicate mountPath "${mountPath}"`);
+        seenPaths.add(mountPath);
+        if (typeof raw.secretName !== "string" || !SECRET_NAME.test(raw.secretName)) {
+            throw new Error(`${prefix}.secretName is invalid`);
+        }
+        return {
+            accountId: raw.accountId,
+            capacity: raw.capacity,
+            frontendAddress: address,
+            frontendPort,
+            forwarderPort,
+            mountPath,
+            secretName: raw.secretName,
+        };
+    });
+    return { version: 1, ...(frontendCaPath ? { frontendCaPath } : {}), ...(serviceSessionId ? { serviceSessionId } : {}), pools };
+}
+/** Override ambient session selection only for a Secrets child process. */
+export function remoteControlPoolSecretsEnv(env, serviceSessionId) {
+    return { ...env, HQ_SESSION_ID: serviceSessionId };
+}
+/** Require an explicit, existing capability; never inherit the mutable .current session. */
+export function assertPersonalServiceSessionCapability(root, serviceSessionId) {
+    if (!/^[A-Za-z0-9._-]+$/.test(serviceSessionId) || serviceSessionId === "." || serviceSessionId === "..") {
+        throw new Error("configured serviceSessionId is not a valid HQ session ID");
+    }
+    const capabilityPath = path.join(root, "workspace", "sessions", serviceSessionId, "scope-capability.json");
+    let stat;
+    try {
+        stat = fs.lstatSync(capabilityPath);
+    }
+    catch {
+        throw new Error("configured serviceSessionId has no readable scope capability");
+    }
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error("configured serviceSessionId has no readable scope capability");
+    }
+    const lock = readSessionCompanyLock({ ...process.env, HQ_ROOT: root, HQ_SESSION_ID: serviceSessionId });
+    if (!lock || lock.sessionId !== serviceSessionId || lock.companies.length !== 1 || lock.companies[0] !== "personal") {
+        throw new Error("configured serviceSessionId must have a personal-only scope capability");
+    }
+}
+/** Hosts file overlay consumed inside this pool's private mount namespace. */
+export function remoteControlPoolHostsOverlay(pool) {
+    return `${pool.frontendAddress} api.anthropic.com\n`;
+}
+export function poolHostsFile(baseHosts, pool) {
+    const retained = baseHosts
+        .split(/\r?\n/)
+        .filter((line) => !/(^|\s)api\.anthropic\.com(?:\s|$)/.test(line))
+        .filter((line) => line.trim() !== "");
+    return `${retained.join("\n")}\n${remoteControlPoolHostsOverlay(pool)}`;
+}
+export function readRemoteControlPoolsConfig(file, knownAccountIds, home = os.homedir()) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { version: 1, pools: [] };
+        throw new Error(`could not read remote-control pools config: ${error.message}`);
+    }
+    return parseRemoteControlPoolsConfig(parsed, knownAccountIds, home);
+}
+export function writeRemoteControlPoolsConfig(file, config, home = os.homedir()) {
+    const validated = parseRemoteControlPoolsConfig(config, undefined, home);
+    ensurePrivateDir(path.dirname(file));
+    const temp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(temp, `${JSON.stringify(validated, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(temp, file);
+    fs.chmodSync(file, 0o600);
+}
+export function remoteControlPoolArgs(pool) {
+    return [
+        "remote-control",
+        "--no-create-session-in-dir",
+        "--capacity",
+        String(pool.capacity),
+        "--name",
+        `hq-${pool.accountId}`,
+        "--spawn=same-dir",
+        "--permission-mode",
+        "bypassPermissions",
+    ];
+}
+/** Reject an existing symlink anywhere in the requested path. */
+export function assertNoSymlinkPathComponents(target) {
+    const parsed = path.parse(target);
+    let cursor = parsed.root;
+    for (const part of target.slice(parsed.root.length).split(path.sep).filter(Boolean)) {
+        cursor = path.join(cursor, part);
+        try {
+            if (fs.lstatSync(cursor).isSymbolicLink())
+                throw new Error("pool mountPath cannot contain symlinks");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+/** Compare paths after resolving their real filesystem identities. */
+export function assertDistinctRealMountPath(mountPath, hqRoot) {
+    const realRoot = fs.realpathSync(hqRoot);
+    assertNoSymlinkPathComponents(mountPath);
+    let resolvedMount;
+    try {
+        resolvedMount = fs.realpathSync(mountPath);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        const parent = path.dirname(mountPath);
+        resolvedMount = path.join(fs.realpathSync(parent), path.basename(mountPath));
+    }
+    if (resolvedMount === realRoot || resolvedMount.startsWith(`${realRoot}${path.sep}`) || realRoot.startsWith(`${resolvedMount}${path.sep}`)) {
+        throw new Error("pool mountPath must be distinct from the HQ root after realpath resolution");
+    }
+}
+/** Validate the private readiness marker against the live forwarder process identity. */
+export function isOwnedPoolForwarder(readyFile, accountId, isAlive, commandLine) {
+    try {
+        const marker = JSON.parse(fs.readFileSync(readyFile, "utf8"));
+        if (marker.accountId !== accountId || !Number.isSafeInteger(marker.pid) || marker.pid <= 0)
+            return false;
+        const pid = marker.pid;
+        const line = isAlive(pid) ? commandLine(pid) : null;
+        const args = line?.split(/\s+/) ?? [];
+        const accountFlag = args.indexOf("--account-id");
+        return args.includes("remote-control-pool-forwarder") && accountFlag >= 0 && args[accountFlag + 1] === accountId;
+    }
+    catch {
+        return false;
+    }
+}
+/** Fail the pool host when its separately supervised inference process disappears. */
+export async function monitorOwnedPoolForwarder(isOwned, signal, sleep = () => new Promise((resolve) => setTimeout(resolve, 500))) {
+    while (!signal.aborted) {
+        if (!isOwned())
+            throw new Error("the owned pool inference forwarder exited or lost its listener");
+        await sleep();
+    }
+}
+//# sourceMappingURL=remote-control-pools.js.map

package/dist/lib/daemon/remote-control.d.ts

@@ -53,6 +53,10 @@ export declare const IDLE_BEFORE_RESTART_MS: number;
 export declare const MAX_RESTART_WAIT_MS: number;
 export interface RemoteControlHostDeps {
     tmux: string;
+    /** Optional private tmux server per managed pool; A keeps the legacy socket. */
+    tmuxSocket?: string;
+    /** Environment applied only to this private tmux server before its session starts. */
+    sessionEnv?: Record<string, string | null>;
     /** tmux session name on the daemon's private socket. */
     session: string;
     /** Folder the command starts in (the HQ folder). */

package/dist/lib/daemon/remote-control.js

@@ -204,7 +204,7 @@ function safePaneTail(output) {
         .join("\n");
 }
 export async function runRemoteControlHost(deps) {
-    const tmux = (...args) => deps.run(deps.tmux, ["-L", TMUX_SOCKET, ...args]);
+    const tmux = (...args) => deps.run(deps.tmux, ["-L", deps.tmuxSocket ?? TMUX_SOCKET, ...args]);
     const invokerPid = process.pid;
     const killSession = () => {
         if (tmux("has-session", "-t", deps.session).status !== 0)
@@ -279,11 +279,26 @@ export async function runRemoteControlHost(deps) {
         await deps.sleep(deps.pollMs);
     }
     // Start the replacement only after no live foreign Claude owner remains.
-    const created = tmux("new-session", "-d", "-s", deps.session, "-x", "200", "-y", "50", "-c", deps.cwd);
+    // A private pool socket has no server until its first session is created.
+    // Keep that first pane inert, then set only this session's environment before
+    // replacing it with the actual command. The ordinary A service keeps its
+    // existing shell startup path when no session environment is configured.
+    const bootstrap = deps.sessionEnv ? ["/usr/bin/sleep", "2147483647"] : [];
+    const created = tmux("new-session", "-d", "-s", deps.session, "-x", "200", "-y", "50", "-c", deps.cwd, ...bootstrap);
     if (created.status !== 0) {
         deps.log(`could not create the tmux session: ${created.stderr.trim() || `tmux exited ${created.status}`}`);
         return 1;
     }
+    for (const [name, value] of Object.entries(deps.sessionEnv ?? {})) {
+        const result = value === null
+            ? tmux("set-environment", "-u", "-t", deps.session, name)
+            : tmux("set-environment", "-t", deps.session, name, value);
+        if (result.status !== 0) {
+            deps.log(`could not configure the private tmux environment for ${name}`);
+            tmux("kill-session", "-t", deps.session);
+            return 1;
+        }
+    }
     const creatorRecord = JSON.stringify({ pid: invokerPid, cwd: deps.cwd });
     const recorded = tmux("set-option", "-t", deps.session, TMUX_CREATOR_OPTION, creatorRecord);
     if (recorded.status !== 0) {