@indigoai-us/hq-cli 5.345.111 → 5.345.113

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [5.345.113] — 2026-10-13
+- `hq daemon sync now --company <slug>` asks the running sync daemon to sync one company right away, without restarting sync. It needs hq-cloud 6.18.68 or later in the daemon; with an older daemon it falls back to the previous restart. `--json` reports which path it took. The desktop app uses this for Sync on the "Added to" banner.
+
+- `hq capacity` no longer ranks a Claude account the ledger marks as stale
+  (sign-in expired and no reading since). The router skips it with "no fresh
+  reading (sign-in expired)" and prints the account's fix command.
+- A Claude home listed under `accounts` now clears an old revoked marker
+  once a new sign-in lands, including when a fresh usage poll would
+  otherwise skip reading the credential. A marker that still matches the
+  current refresh token keeps the account blocked as revoked.
+- After a token refresh, the account stays blocked as "missing profile
+  scope" when the refreshed grant lacks that scope, instead of being
+  cleared.
+- The live-lane gate finds the `hq` CLI from the running process instead of
+  `PATH`, so the refresh gate works when `PATH` is empty or minimal.
+- `hq capacity doctor` renames the "TOKEN AGE" column to "SINCE REFRESH".
+
+## [5.345.112] — 2026-10-13
+- The bundled sync engine now uses hq-cloud 6.18.71. The hq-core update no longer replaces pack-installed worker links (for example `core/workers/public/qa-tester`) with a copy of the release folder.
+
 ## [5.345.111] — 2026-10-13
 - The local bot runs a Create brief job from the desktop app in a fresh model session of its own instead of resuming the owner's whole DM conversation, and schedules it like a DM rather than behind the job slot. A resumed session that fails twice in a row with the model CLI's "An unknown error occurred (Unexpected)" is cleared so the next turn starts fresh; a single failure never clears it.
 

package/dist/command-catalog.generated.d.ts

@@ -15484,6 +15484,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly helpText: readonly [];
             readonly arguments: readonly [];
             readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Sync one company";
+                readonly hidden: false;
+            }, {
                 readonly flags: "--json";
                 readonly description: "Print machine-readable JSON";
                 readonly hidden: false;

package/dist/command-catalog.generated.js

@@ -18848,6 +18848,11 @@ export const COMMAND_CATALOG = [
                         "helpText": [],
                         "arguments": [],
                         "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Sync one company",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--json",
                                 "description": "Print machine-readable JSON",

package/dist/commands/capacity.js

@@ -260,7 +260,7 @@ export function formatDoctor(report) {
         : report.providers.map((provider) => `${provider.provider}  ${provider.state}`).join("\n");
     const claudeAccounts = report.claudeAccounts.length === 0
         ? "none"
-        : formatTable(["ACCOUNT", "LAST ATTEMPT", "OUTCOME", "TOKEN AGE", "EXPIRES IN", "BACKOFF UNTIL"], report.claudeAccounts.map((account) => [
+        : formatTable(["ACCOUNT", "LAST ATTEMPT", "OUTCOME", "SINCE REFRESH", "EXPIRES IN", "BACKOFF UNTIL"], report.claudeAccounts.map((account) => [
             account.label,
             account.lastRefreshAttempt ?? "—",
             account.lastRefreshOutcome ?? "—",

package/dist/commands/daemon.d.ts

@@ -19,6 +19,8 @@ import type { HostApp } from "../lib/daemon/supervisor.js";
 import { type SyncModeVaultClient } from "./sync-mode.js";
 import type { RunCommand } from "../lib/service-manager/launchd.js";
 type DaemonRunnerModule = typeof import("../lib/daemon/run.js");
+/** First hq-cloud release whose watch runner accepts pass-request files. */
+export declare const PASS_REQUEST_MIN_HQ_CLOUD = "6.18.68";
 /** Load every lazy daemon runtime module before releasing its package-use lease. */
 export declare function loadDaemonRunner(release?: () => void, load?: () => Promise<DaemonRunnerModule>, preload?: () => Promise<void>, reportPreloadFailure?: (error: unknown) => void): Promise<DaemonRunnerModule["runDaemon"]>;
 export interface DaemonCommandDeps {

package/dist/commands/daemon.js

@@ -16,6 +16,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { randomBytes } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import { once } from "node:events";
 import { compare as semverCompare, major as semverMajor, valid as validSemver } from "semver";
@@ -38,6 +39,7 @@ import { acknowledgeConflictNotice, conflictNoticeStateDir } from "../lib/daemon
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, syncRunnerPathFromCommandLine, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { stagedSyncRunnerVersion, syncRunnerBundleStageRoot } from "../lib/daemon/sync-runner-bundle.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
+import { assertSafeCompanySlug } from "../utils/people.js";
 import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
 import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
@@ -45,6 +47,8 @@ import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { followLogFile } from "../lib/log-follow.js";
+/** First hq-cloud release whose watch runner accepts pass-request files. */
+export const PASS_REQUEST_MIN_HQ_CLOUD = "6.18.68";
 /** Load every lazy daemon runtime module before releasing its package-use lease. */
 export async function loadDaemonRunner(release = releaseCurrentPackageUseLease, load = () => import("../lib/daemon/run.js"), preload = () => preloadResidentPackageModules("daemon"), reportPreloadFailure = reportResidentPackagePreloadFailure) {
     const { runDaemon } = await load();
@@ -545,6 +549,11 @@ function daemonSyncStatus(d) {
         syncOwner: effectiveSyncOwner(config, host.detected.type),
         owner: ownerStatus?.owner ?? (syncUnit?.status === "running" ? "hq-daemon" : null),
         runnerPid: ownerStatus?.pid ?? syncUnit?.pid ?? null,
+        passRequestDir: syncUnit?.status === "running"
+            && syncUnit.pid !== undefined
+            && (ownerStatus === null || ownerStatus.pid === syncUnit.pid)
+            ? syncUnit.passRequestDir ?? null
+            : null,
         hqCloudVersion,
         hqCloudVersionSource,
         runnerMatchesPin,
@@ -592,6 +601,53 @@ function queueDaemonSyncControl(d, request) {
     handOver(d, host);
     return runningDaemonPid(host.paths.lockPath, d.daemonAlive) !== null;
 }
+function writeSyncPassRequest(paths, company, source) {
+    ensurePrivateDir(paths.syncPassRequestsDir);
+    const request = {
+        version: 1,
+        company,
+        requestedAt: new Date().toISOString(),
+        source,
+    };
+    const encoded = JSON.stringify(request);
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+        const basename = `${Date.now()}-${randomBytes(4).toString("hex")}`;
+        const temporary = path.join(paths.syncPassRequestsDir, `${basename}.tmp`);
+        const destination = path.join(paths.syncPassRequestsDir, `${basename}.json`);
+        try {
+            fs.writeFileSync(temporary, encoded, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            fs.renameSync(temporary, destination);
+            return;
+        }
+        catch (error) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch (cleanupError) {
+                if (cleanupError.code !== "ENOENT")
+                    throw cleanupError;
+            }
+            if (error.code === "EEXIST")
+                continue;
+            throw error;
+        }
+    }
+    throw new DaemonCommandError("could not allocate a unique sync pass request filename");
+}
+/**
+ * The version alone does not prove the runner reads requests: a runner adopted
+ * across a CLI update keeps the env it was started with. The daemon records the
+ * request folder for a child it started with one.
+ */
+function supportsPassRequests(status, paths) {
+    const version = status.hqCloudVersion;
+    return status.running
+        && status.passRequestDir !== null
+        && path.resolve(status.passRequestDir) === path.resolve(paths.syncPassRequestsDir)
+        && version !== null
+        && validSemver(version) !== null
+        && semverCompare(version, PASS_REQUEST_MIN_HQ_CLOUD) >= 0;
+}
 async function runDaemonSyncNow(d, opts) {
     const host = currentHost(d);
     const config = readDaemonConfig(host.paths.configPath);
@@ -600,8 +656,20 @@ async function runDaemonSyncNow(d, opts) {
     if (!enabledServices(host.detected.type, config).includes("sync")) {
         throw new DaemonCommandError("sync is disabled for this machine; run `hq daemon enable sync` first");
     }
+    const company = opts.company ?? null;
+    if (company !== null)
+        assertSafeCompanySlug(company);
+    const status = daemonSyncStatus(d);
+    if (supportsPassRequests(status, host.paths)) {
+        const source = d.env.HQ_SYNC_PASS_REQUEST_SOURCE === "desktop" ? "desktop" : "cli";
+        writeSyncPassRequest(host.paths, company, source);
+        handOver(d, host);
+        const result = { accepted: true, action: "pass-request", company, daemonRunning: true };
+        d.out(opts.json ? JSON.stringify(result, null, 2) : "Asked the daemon to run a fresh sync pass.");
+        return;
+    }
     const running = queueDaemonSyncControl(d, { action: "restart", unit: "sync" });
-    const result = { accepted: true, action: "restart-sync-runner", daemonRunning: running };
+    const result = { accepted: true, action: "restart-sync-runner", company, daemonRunning: running };
     d.out(opts.json ? JSON.stringify(result, null, 2) : running ? "Asked the daemon to start a fresh sync pass." : "Queued a fresh sync pass for the next daemon start.");
 }
 async function runDaemonSyncInstantSyncSet(d, enabled, opts) {
@@ -1336,6 +1404,7 @@ export function registerDaemonCommand(program, over = {}) {
     sync
         .command("now")
         .description("Start a fresh sync pass immediately")
+        .option("--company <slug>", "Sync one company")
         .option("--json", "Print machine-readable JSON")
         .action(wrap((d, opts) => runDaemonSyncNow(d, opts)));
     const instantSync = sync.command("instant-sync").description("Control daemon Instant Sync");