@indigoai-us/hq-cli 5.345.106 → 5.345.108

package/dist/command-catalog.generated.d.ts

@@ -1407,6 +1407,22 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly arguments: readonly [];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "keychain";
+        readonly description: "Show or retry HQ's access to your sign-in in the macOS Keychain";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--retry";
+            readonly description: "Ask macOS again after Keychain access was denied";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "refresh";
         readonly description: "Ensure a valid cached Cognito session (refresh only if expiring; no-op if already valid)";
@@ -6932,7 +6948,7 @@ export declare const COMMAND_CATALOG: readonly [{
     }];
 }, {
     readonly name: "outposts";
-    readonly description: "Manage your personal HQ Outposts (EC2 boxes)";
+    readonly description: "Manage personal and company HQ Outposts (EC2 boxes)";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly helpOption: true;
@@ -7051,15 +7067,19 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly arguments: readonly [];
         readonly options: readonly [{
             readonly flags: "--runtime <runtime>";
-            readonly description: "Agent runtime: claude | codex (default claude)";
+            readonly description: "Agent runtime: claude | codex (default claude). Personal boxes only.";
             readonly hidden: false;
         }, {
             readonly flags: "--disk <gb>";
-            readonly description: "Root disk size in GB (EC2 only)";
+            readonly description: "Root disk size in GB (EC2 only). Personal boxes only.";
             readonly hidden: false;
         }, {
             readonly flags: "--client-ip <ip>";
-            readonly description: "Your public IP for the box's SSH ingress (optional; server derives it otherwise)";
+            readonly description: "Your public IP for the box's SSH ingress (optional; server derives it otherwise). Personal boxes only.";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--company <slug>";
+            readonly description: "Provision the company's Outpost instead of your personal box";
             readonly hidden: false;
         }, {
             readonly flags: "--yes";
@@ -7095,7 +7115,11 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly arguments: readonly [];
         readonly options: readonly [{
             readonly flags: "--id <outpostId>";
-            readonly description: "Outpost id (defaults to your primary box)";
+            readonly description: "Personal Outpost id (defaults to your primary box)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--company <slug>";
+            readonly description: "Show the company Outpost, its jobs, and each job's run status";
             readonly hidden: false;
         }, {
             readonly flags: "--json";
@@ -7103,6 +7127,62 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "jobs";
+        readonly description: "Register a job on a company Outpost";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: true;
+        readonly usage: "[options] [command]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "register";
+            readonly description: "Register a company job and print the accepted revision";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company that owns the Outpost";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--prompt <text>";
+                readonly description: "What the job should do";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--timezone <name>";
+                readonly description: "IANA timezone, such as America/New_York";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--cron <expr>";
+                readonly description: "Recurring schedule, such as rate(1 day) or a cron expression";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--at <iso>";
+                readonly description: "One-time ISO-8601 instant. Do not combine with --cron";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--script <text>";
+                readonly description: "Optional precondition script stored with the job";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--context <json>";
+                readonly description: "Optional JSON object stored with the job";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "Emit the job id and accepted revision as JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "exec";
         readonly description: "Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command). The command waits for the submitted job to finish. Use --wait-timeout-seconds to bound local waiting, or --detach to print the commandId and return immediately.";
@@ -8506,6 +8586,35 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "pipeline";
+        readonly description: "Pipeline orchestration helpers";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: true;
+        readonly usage: "[options] [command]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "workers";
+            readonly description: "Propose or render the pipeline worker engine table";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: false;
+            readonly helpCommand: false;
+            readonly usage: "[args...]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+                readonly description: "";
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "resolve-company";
         readonly description: "Resolve the active company for skills and routing";
@@ -9187,6 +9296,23 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "hq-task";
+        readonly description: "List and update tasks on personal or company boards";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: false;
+        readonly helpCommand: false;
+        readonly usage: "[args...]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+            readonly description: "arguments passed through to the script";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "checkpoint-stop-gate";
         readonly description: "Stop-hook checkpoint + company-scope gate (reads the hook payload on stdin)";
@@ -9504,6 +9630,45 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "route";
+        readonly description: "Pick the account with the most capacity for a new lane (read-only; port of boss-route)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--provider <list>";
+            readonly description: "Comma-separated list: any, claude, codex, grok";
+            readonly hidden: false;
+            readonly defaultValue: "any";
+        }, {
+            readonly flags: "--model <id>";
+            readonly description: "Model id. Narrows --provider any to the mapped provider";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--prefer <list>";
+            readonly description: "Comma-separated preferred provider order";
+            readonly hidden: false;
+            readonly defaultValue: "claude,codex,grok";
+        }, {
+            readonly flags: "--floor <percent>";
+            readonly description: "Minimum headroom percent the pick must clear (0-100)";
+            readonly hidden: false;
+            readonly defaultValue: "15";
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the route result as JSON (default)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--text";
+            readonly description: "Print a single-line text summary instead of JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "enable";
         readonly description: "Create the ledger directory and mark the collector on";
@@ -12950,9 +13115,13 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--provider <name>";
             readonly description: "claude | codex | grok";
             readonly hidden: false;
+        }, {
+            readonly flags: "--remote-control";
+            readonly description: "Open a Claude lane in Remote Control using account a for login and the selected account for inference";
+            readonly hidden: false;
         }, {
             readonly flags: "--account <id>";
-            readonly description: "Provider account id";
+            readonly description: "Provider account id, or 'auto' to pick the account with the most room (all accounts are one pool across companies)";
             readonly hidden: false;
         }, {
             readonly flags: "--model <id>";

package/dist/command-catalog.generated.js

@@ -1684,6 +1684,25 @@ export const COMMAND_CATALOG = [
                 "options": [],
                 "subcommands": []
             },
+            {
+                "name": "keychain",
+                "description": "Show or retry HQ's access to your sign-in in the macOS Keychain",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--retry",
+                        "description": "Ask macOS again after Keychain access was denied",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "refresh",
                 "description": "Ensure a valid cached Cognito session (refresh only if expiring; no-op if already valid)",
@@ -8447,7 +8466,7 @@ export const COMMAND_CATALOG = [
     },
     {
         "name": "outposts",
-        "description": "Manage your personal HQ Outposts (EC2 boxes)",
+        "description": "Manage personal and company HQ Outposts (EC2 boxes)",
         "aliases": [],
         "hidden": false,
         "helpOption": true,
@@ -8590,17 +8609,22 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--runtime <runtime>",
-                        "description": "Agent runtime: claude | codex (default claude)",
+                        "description": "Agent runtime: claude | codex (default claude). Personal boxes only.",
                         "hidden": false
                     },
                     {
                         "flags": "--disk <gb>",
-                        "description": "Root disk size in GB (EC2 only)",
+                        "description": "Root disk size in GB (EC2 only). Personal boxes only.",
                         "hidden": false
                     },
                     {
                         "flags": "--client-ip <ip>",
-                        "description": "Your public IP for the box's SSH ingress (optional; server derives it otherwise)",
+                        "description": "Your public IP for the box's SSH ingress (optional; server derives it otherwise). Personal boxes only.",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Provision the company's Outpost instead of your personal box",
                         "hidden": false
                     },
                     {
@@ -8643,7 +8667,12 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--id <outpostId>",
-                        "description": "Outpost id (defaults to your primary box)",
+                        "description": "Personal Outpost id (defaults to your primary box)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Show the company Outpost, its jobs, and each job's run status",
                         "hidden": false
                     },
                     {
@@ -8654,6 +8683,74 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "jobs",
+                "description": "Register a job on a company Outpost",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": true,
+                "usage": "[options] [command]",
+                "helpText": [],
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "register",
+                        "description": "Register a company job and print the accepted revision",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns the Outpost",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--prompt <text>",
+                                "description": "What the job should do",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--timezone <name>",
+                                "description": "IANA timezone, such as America/New_York",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--cron <expr>",
+                                "description": "Recurring schedule, such as rate(1 day) or a cron expression",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--at <iso>",
+                                "description": "One-time ISO-8601 instant. Do not combine with --cron",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--script <text>",
+                                "description": "Optional precondition script stored with the job",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--context <json>",
+                                "description": "Optional JSON object stored with the job",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit the job id and accepted revision as JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "exec",
                 "description": "Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command). The command waits for the submitted job to finish. Use --wait-timeout-seconds to bound local waiting, or --detach to print the commandId and return immediately.",
@@ -10339,6 +10436,40 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "pipeline",
+                "description": "Pipeline orchestration helpers",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": true,
+                "usage": "[options] [command]",
+                "helpText": [],
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "workers",
+                        "description": "Propose or render the pipeline worker engine table",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": false,
+                        "helpCommand": false,
+                        "usage": "[args...]",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "args",
+                                "required": false,
+                                "variadic": true,
+                                "description": ""
+                            }
+                        ],
+                        "options": [],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "resolve-company",
                 "description": "Resolve the active company for skills and routing",
@@ -11142,6 +11273,26 @@ export const COMMAND_CATALOG = [
                 "options": [],
                 "subcommands": []
             },
+            {
+                "name": "hq-task",
+                "description": "List and update tasks on personal or company boards",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": false,
+                "helpCommand": false,
+                "usage": "[args...]",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "args",
+                        "required": false,
+                        "variadic": true,
+                        "description": "arguments passed through to the script"
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "checkpoint-stop-gate",
                 "description": "Stop-hook checkpoint + company-scope gate (reads the hook payload on stdin)",
@@ -11524,6 +11675,53 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "route",
+                "description": "Pick the account with the most capacity for a new lane (read-only; port of boss-route)",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--provider <list>",
+                        "description": "Comma-separated list: any, claude, codex, grok",
+                        "hidden": false,
+                        "defaultValue": "any"
+                    },
+                    {
+                        "flags": "--model <id>",
+                        "description": "Model id. Narrows --provider any to the mapped provider",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--prefer <list>",
+                        "description": "Comma-separated preferred provider order",
+                        "hidden": false,
+                        "defaultValue": "claude,codex,grok"
+                    },
+                    {
+                        "flags": "--floor <percent>",
+                        "description": "Minimum headroom percent the pick must clear (0-100)",
+                        "hidden": false,
+                        "defaultValue": "15"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print the route result as JSON (default)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--text",
+                        "description": "Print a single-line text summary instead of JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "enable",
                 "description": "Create the ledger directory and mark the collector on",
@@ -15749,9 +15947,14 @@ export const COMMAND_CATALOG = [
                         "description": "claude | codex | grok",
                         "hidden": false
                     },
+                    {
+                        "flags": "--remote-control",
+                        "description": "Open a Claude lane in Remote Control using account a for login and the selected account for inference",
+                        "hidden": false
+                    },
                     {
                         "flags": "--account <id>",
-                        "description": "Provider account id",
+                        "description": "Provider account id, or 'auto' to pick the account with the most room (all accounts are one pool across companies)",
                         "hidden": false
                     },
                     {

package/dist/commands/auth.js

@@ -22,6 +22,9 @@ import path from "node:path";
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, } from "../utils/cognito-session.js";
+// Static (node builtins only): a lazy import here would need a resident
+// preload entry for the auth-login path.
+import * as tokenKeychain from "../utils/token-keychain.js";
 import { resolveLoginProviderSelection, } from "../utils/login-provider.js";
 import { getLastLoginProviderStatePath, loadLastLoginProvider, storeLastLoginProvider, } from "../lib/auth-login-provider-state.js";
 import { callbackPortBusyGuidance, DEFAULT_CALLBACK_PORT, isCallbackPortBusy, } from "../utils/callback-port-busy.js";
@@ -278,6 +281,45 @@ export function registerAuthCommands(program) {
         clearCachedTokens();
         console.log(chalk.green("Signed out — removed ~/.hq/cognito-tokens.json"));
     });
+    authCmd
+        .command("keychain")
+        .description("Show or retry HQ's access to your sign-in in the macOS Keychain")
+        .option("--retry", "Ask macOS again after Keychain access was denied")
+        .action(async (options) => {
+        const keychain = tokenKeychain;
+        if (!keychain.keychainTokenReadEnabled()) {
+            console.log("HQ reads your sign-in from ~/.hq/cognito-tokens.json here; the Keychain is only used on macOS.");
+            return;
+        }
+        if (!options.retry) {
+            const state = keychain.readKeychainAccessState();
+            if (state.deniedAt) {
+                console.log("Keychain access wasn't allowed, so HQ uses ~/.hq/cognito-tokens.json. Run `hq auth keychain --retry` to ask again.");
+            }
+            else if (state.allowedAt) {
+                console.log(chalk.green("HQ can read your sign-in from the Keychain."));
+            }
+            else {
+                console.log("HQ hasn't asked for Keychain access yet. It will ask the next time you run an hq command in a terminal.");
+            }
+            return;
+        }
+        const state = keychain.readKeychainAccessState();
+        if (!state.allowedAt)
+            console.error(keychain.KEYCHAIN_FIRST_READ_NOTE);
+        const result = keychain.readKeychainTokensDetailed({ retry: true, interactive: true, notify: () => { } });
+        if (result.outcome === "hit") {
+            console.log(result.tokens
+                ? chalk.green("HQ can read your sign-in from the Keychain.")
+                : chalk.yellow("HQ can read the Keychain, but the HQ sign-in saved there isn't usable. HQ will use ~/.hq/cognito-tokens.json."));
+        }
+        else if (result.outcome === "miss") {
+            console.log("No HQ sign-in is saved in the Keychain yet. HQ will use ~/.hq/cognito-tokens.json.");
+        }
+        else {
+            console.log(chalk.yellow("Keychain access wasn't allowed. HQ will use ~/.hq/cognito-tokens.json. Run `hq auth keychain --retry` to ask again."));
+        }
+    });
     authCmd
         .command("refresh")
         .description("Ensure a valid cached Cognito session (refresh only if expiring; no-op if already valid)")

package/dist/commands/capacity.d.ts

@@ -54,7 +54,7 @@ export interface DoctorReport {
     stale: boolean;
     ageMs: number;
 }
-export declare function capacityOptionsFromEnv(env?: NodeJS.ProcessEnv): LedgerOptions;
+export { capacityOptionsFromEnv } from "../lib/capacity/ledger.js";
 export declare function withSchemaVersion(view: NowView): Omit<CapacityJson, "stale" | "ageMs" | "collectorEnabled">;
 /** Stale when generatedAt is missing or older than five minutes. */
 export declare function capacityFreshness(generatedAt: string, nowMs: number): CapacityFreshness;