@indigoai-us/hq-cli 5.345.111 → 5.345.113

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.69","bundleSha256":"f061a19c14325b3ae076aa6277c2f60269976ef43ef7ce79be2140d0ba2927a6","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.71","bundleSha256":"809fe7fd214f197c14df0586b2bf4e4536002cd122eb61a6817af4f7ba478637","formatVersion":1}

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -332,6 +332,22 @@ interface RawAccountRow {
     auth_state?: unknown;
     provider?: unknown;
 }
+/**
+ * How to re-invoke the running hq CLI without a PATH lookup. When argv[1] is
+ * the entry of an installed hq-cli package, run it with the same node binary;
+ * the collector runs under launchd and lane workers where PATH may be empty.
+ * Falls back to `hq` on PATH when this process is not the hq CLI (tests,
+ * embedders). Exported for tests.
+ */
+export declare function resolveHqInvocation(argv?: readonly string[], execPath?: string): {
+    command: string;
+    args: string[];
+};
+/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+export declare function execHqJson(args: readonly string[], invocation?: {
+    command: string;
+    args: string[];
+}, env?: NodeJS.ProcessEnv): unknown;
 /**
  * Parse `hq lanes list --json` payload into typed rows.
  * Exported for tests; fail-closed semantics live in defaultListLiveLanes.

package/dist/lib/capacity/collectors/claude-oauth.js

@@ -251,7 +251,12 @@ export async function collectClaudeOAuth(options = {}) {
             });
             if (refreshResult?.outcome === "refreshed" && refreshResult.newAccessToken) {
                 currentToken = refreshResult.newAccessToken;
-                currentBlocked = undefined;
+                // A refresh renews the token but does not grant scopes the sign-in
+                // lacked. Re-check the profile scope before clearing the block.
+                const refreshedScopes = refreshResult.newScopes && refreshResult.newScopes.length > 0
+                    ? refreshResult.newScopes
+                    : meta.scopes;
+                currentBlocked = hasProfileScope(refreshedScopes) ? undefined : "unavailable: missing_scope";
             }
             else if (refreshResult?.outcome === "revoked" || refreshResult?.outcome === "skipped-revoked") {
                 currentBlocked = SIGN_IN_REVOKED_REASON;
@@ -410,13 +415,17 @@ async function collectEnumeratedClaude(options, scoped, root, clock, cliVersion)
             if (refreshResult) {
                 if (refreshResult.outcome === "refreshed" && refreshResult.newAccessToken) {
                     account.token = refreshResult.newAccessToken;
-                    account.blocked = null;
                     if (refreshResult.newExpiresAt !== undefined)
                         account.expiresAt = refreshResult.newExpiresAt;
                     if (refreshResult.newRefreshToken)
                         account.refreshToken = refreshResult.newRefreshToken;
                     if (refreshResult.newScopes && refreshResult.newScopes.length > 0)
                         account.scopes = refreshResult.newScopes;
+                    // A refresh renews the token but does not grant scopes the sign-in
+                    // lacked. Re-check the profile scope before clearing the block.
+                    account.blocked = hasProfileScope(account.scopes)
+                        ? null
+                        : credentialBlockReason("unavailable: missing_scope");
                 }
                 else if (refreshResult.outcome === "revoked" || refreshResult.outcome === "skipped-revoked") {
                     account.blocked = SIGN_IN_REVOKED_REASON;
@@ -537,7 +546,10 @@ async function readEnumeratedHome(group, options, nowMs, root) {
             platform,
         };
     }
-    if (pollIsFresh(root, accountId, nowMs)) {
+    // A fresh poll normally skips the credential read. When a revoked marker
+    // exists, read anyway: the marker check needs the current refresh token to
+    // tell a re-sign-in (fingerprint changed) from the same revoked token.
+    if (pollIsFresh(root, accountId, nowMs) && revokedMarkerForCurrentCredential(root, accountId, null) === "none") {
         return {
             accountId,
             labels,
@@ -1623,6 +1635,10 @@ const defaultWriteClaudeCredentials = async (request) => {
             return { ok: false, raceDetected: true };
         }
         const body = JSON.stringify(request.document);
+        // `security add-generic-password` only takes the secret as `-w <value>`
+        // on argv, so the credential JSON is visible to `ps` for the duration of
+        // this call. Claude Code writes its own Keychain item the same way; this
+        // matches that exposure rather than adding a new one.
         const writeArgs = selector === "s"
             ? ["add-generic-password", "-U", "-s", request.service, "-w", body]
             : ["add-generic-password", "-U", "-s", request.service, "-a", username, "-w", body];
@@ -1670,8 +1686,44 @@ const defaultWriteClaudeCredentials = async (request) => {
         return { ok: false, error: message };
     }
 };
-function execHqJson(args) {
-    const result = spawnSync("hq", [...args], {
+const HQ_CLI_PACKAGE_NAME = "@indigoai-us/hq-cli";
+/**
+ * How to re-invoke the running hq CLI without a PATH lookup. When argv[1] is
+ * the entry of an installed hq-cli package, run it with the same node binary;
+ * the collector runs under launchd and lane workers where PATH may be empty.
+ * Falls back to `hq` on PATH when this process is not the hq CLI (tests,
+ * embedders). Exported for tests.
+ */
+export function resolveHqInvocation(argv = process.argv, execPath = process.execPath) {
+    const entry = argv[1];
+    if (entry) {
+        try {
+            const real = fs.realpathSync(entry);
+            let dir = path.dirname(real);
+            for (let depth = 0; depth < 4; depth += 1) {
+                const manifest = path.join(dir, "package.json");
+                if (fs.existsSync(manifest)) {
+                    const parsed = JSON.parse(fs.readFileSync(manifest, "utf8"));
+                    if (parsed.name === HQ_CLI_PACKAGE_NAME)
+                        return { command: execPath, args: [real] };
+                    break;
+                }
+                const parent = path.dirname(dir);
+                if (parent === dir)
+                    break;
+                dir = parent;
+            }
+        }
+        catch {
+            // Unresolvable entry: fall through to the PATH lookup below.
+        }
+    }
+    return { command: "hq", args: [] };
+}
+/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+export function execHqJson(args, invocation = resolveHqInvocation(), env = process.env) {
+    const result = spawnSync(invocation.command, [...invocation.args, ...args], {
+        env,
         encoding: "utf8",
         timeout: 5_000,
         windowsHide: true,

package/dist/lib/capacity/route.js

@@ -250,6 +250,17 @@ export function pickAccount(input) {
                 });
                 continue;
             }
+            // The ledger sets usageStale when the sign-in expired and no reading has
+            // landed since the expiry. The limits on file describe the old token, so
+            // the account cannot be ranked on them.
+            if (account.usageStale === true) {
+                skipped.push({
+                    ...base,
+                    reason: "no fresh reading (sign-in expired)",
+                    fix: account.fixCommand ?? null,
+                });
+                continue;
+            }
             const applicable = (account.limits ?? []).filter((l) => limitApplies(providerId, l, model));
             const viewRows = applicable.map((limit) => {
                 const resetMs = limit.resetsAt ? Date.parse(limit.resetsAt) : NaN;

package/dist/lib/daemon/catalog.d.ts

@@ -87,6 +87,8 @@ export interface PlanContext {
     platform: NodeJS.Platform;
     home: string;
     hqRoot: string | undefined;
+    /** Daemon-owned request directory consumed by the hq-cloud watch runner. */
+    syncPassRequestsDir: string;
     /** hq-cloud's sync-runner.js, or null when it cannot be found. */
     syncRunnerPath: string | null;
     /** hq-cloud's `hq-outpost-heartbeat` bin, when the hq-cloud in use has one. */

package/dist/lib/daemon/catalog.js

@@ -142,7 +142,7 @@ function planService(service, ctx) {
                         SYNC_RUNNER_OWNER,
                     ],
                 },
-                env: { ...ctx.legacySyncEnv },
+                env: { ...ctx.legacySyncEnv, HQ_SYNC_PASS_REQUEST_DIR: ctx.syncPassRequestsDir },
                 heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
             });
             let ownerBlock;

package/dist/lib/daemon/paths.d.ts

@@ -11,6 +11,8 @@ export interface DaemonPaths {
     lockPath: string;
     logsDir: string;
     requestsDir: string;
+    /** One-shot sync passes queued for the running hq-cloud watch runner. */
+    syncPassRequestsDir: string;
     supervisorLogPath: string;
     unitLogPath: (unitId: string) => string;
     /** The FIFO a unit that speaks the sync protocol writes its stdout to (see protocol-tail.ts); kept out of logs/ so nothing reading logs drains it. */

package/dist/lib/daemon/paths.js

@@ -17,6 +17,7 @@ export function daemonPaths(home = os.homedir(), env = process.env) {
         lockPath: path.join(root, "daemon.pid"),
         logsDir,
         requestsDir: path.join(root, "requests"),
+        syncPassRequestsDir: path.resolve(root, "sync-pass-requests"),
         supervisorLogPath: path.join(logsDir, "daemon.log"),
         unitLogPath: (unitId) => path.join(logsDir, `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.log`),
         unitProtocolPath: (unitId) => path.join(root, "protocol", `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.fifo`),

package/dist/lib/daemon/run.js

@@ -451,6 +451,7 @@ export async function runDaemon(opts) {
     const home = opts.home ?? os.homedir();
     const platform = process.platform;
     const paths = daemonPaths(home, env);
+    ensurePrivateDir(paths.syncPassRequestsDir);
     const log = makeLogger(paths, opts.foreground === true);
     const syncRunnerBundleDirectory = opts.syncRunnerBundleDirectory ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../hq-cloud-sync-runner");
     const cliPackageRoot = opts.cliPackageRoot === undefined ? resolveRunningInstall().packageRoot : opts.cliPackageRoot;
@@ -835,6 +836,7 @@ export async function runDaemon(opts) {
             platform,
             home,
             hqRoot,
+            syncPassRequestsDir: paths.syncPassRequestsDir,
             syncRunnerPath: runners.syncRunner,
             heartbeatRunnerPath: runners.heartbeat,
             sessionHostRunnerPath: runners.sessionHost,

package/dist/lib/daemon/supervisor.d.ts

@@ -63,6 +63,8 @@ interface UnitState {
     lastResult?: "ok" | "failed";
     lastHeartbeatAt?: string;
     lastPassResult?: ReturnType<typeof syncPassResult>;
+    /** The pass-request folder the running child was started with; absent when it was not. */
+    passRequestDir?: string;
 }
 /** An app that runs the daemon as its own child process instead of an OS unit. */
 export type HostApp = "desktop";

package/dist/lib/daemon/supervisor.js

@@ -37,6 +37,33 @@ const MESH_OWNER_LOG_INTERVAL_MS = 10 * 60_000;
 export const HANDOFF_STAGGER_MS = 15_000;
 /** How long a draining unit may take to finish its work before it gets SIGTERM. */
 export const HANDOFF_DRAIN_MAX_MS = 15 * 60_000;
+const PASS_REQUEST_DIR_ENV = "HQ_SYNC_PASS_REQUEST_DIR";
+function passRequestDirOf(env) {
+    const dir = env?.[PASS_REQUEST_DIR_ENV];
+    return dir ? dir : undefined;
+}
+/** An adopted child carries no env, only the key it was started with (see planKey). */
+function passRequestDirFromKey(key) {
+    try {
+        const fields = JSON.parse(key);
+        if (!Array.isArray(fields))
+            return undefined;
+        const env = fields[6];
+        if (!env || typeof env !== "object" || Array.isArray(env))
+            return undefined;
+        const dir = env[PASS_REQUEST_DIR_ENV];
+        return typeof dir === "string" && dir ? dir : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function recordPassRequestDir(state, dir) {
+    if (dir)
+        state.passRequestDir = dir;
+    else
+        delete state.passRequestDir;
+}
 /** Plan reads in a row that must find a running remote-control host blocked before it is paused. */
 const BLOCKED_READS_BEFORE_PAUSE = 2;
 function backoffMs(attempt) {
@@ -560,6 +587,7 @@ export function createSupervisor(deps) {
         }
         slot.child = child;
         slot.childKey = slot.key;
+        recordPassRequestDir(slot.state, passRequestDirOf(slot.plan.env));
         slot.childStartedAt = now();
         slot.state.status = "running";
         slot.state.startedAt = slot.childStartedAt;
@@ -651,6 +679,7 @@ export function createSupervisor(deps) {
         }
         slot.child = child;
         slot.childKey = slot.key;
+        recordPassRequestDir(slot.state, passRequestDirOf(slot.plan.env));
         slot.childStartedAt = now();
         slot.state.status = "running";
         delete slot.state.reason;
@@ -880,6 +909,7 @@ export function createSupervisor(deps) {
             slot.adopted = true;
             slot.child = unit.child;
             slot.childKey = unit.key;
+            recordPassRequestDir(slot.state, passRequestDirFromKey(unit.key));
             slot.childStartedAt = now();
             slot.state.status = "running";
             slot.state.startedAt = slot.childStartedAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.111",
+  "version": "5.345.113",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.69",
+    "@indigoai-us/hq-cloud": "~6.18.71",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",