@indigoai-us/hq-cli 5.345.112 → 5.345.113

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [5.345.113] — 2026-10-13
+- `hq daemon sync now --company <slug>` asks the running sync daemon to sync one company right away, without restarting sync. It needs hq-cloud 6.18.68 or later in the daemon; with an older daemon it falls back to the previous restart. `--json` reports which path it took. The desktop app uses this for Sync on the "Added to" banner.
+
+- `hq capacity` no longer ranks a Claude account the ledger marks as stale
+  (sign-in expired and no reading since). The router skips it with "no fresh
+  reading (sign-in expired)" and prints the account's fix command.
+- A Claude home listed under `accounts` now clears an old revoked marker
+  once a new sign-in lands, including when a fresh usage poll would
+  otherwise skip reading the credential. A marker that still matches the
+  current refresh token keeps the account blocked as revoked.
+- After a token refresh, the account stays blocked as "missing profile
+  scope" when the refreshed grant lacks that scope, instead of being
+  cleared.
+- The live-lane gate finds the `hq` CLI from the running process instead of
+  `PATH`, so the refresh gate works when `PATH` is empty or minimal.
+- `hq capacity doctor` renames the "TOKEN AGE" column to "SINCE REFRESH".
+
 ## [5.345.112] — 2026-10-13
 - The bundled sync engine now uses hq-cloud 6.18.71. The hq-core update no longer replaces pack-installed worker links (for example `core/workers/public/qa-tester`) with a copy of the release folder.
 

package/dist/command-catalog.generated.d.ts

@@ -15484,6 +15484,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly helpText: readonly [];
             readonly arguments: readonly [];
             readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Sync one company";
+                readonly hidden: false;
+            }, {
                 readonly flags: "--json";
                 readonly description: "Print machine-readable JSON";
                 readonly hidden: false;

package/dist/command-catalog.generated.js

@@ -18848,6 +18848,11 @@ export const COMMAND_CATALOG = [
                         "helpText": [],
                         "arguments": [],
                         "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Sync one company",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--json",
                                 "description": "Print machine-readable JSON",

package/dist/commands/capacity.js

@@ -260,7 +260,7 @@ export function formatDoctor(report) {
         : report.providers.map((provider) => `${provider.provider}  ${provider.state}`).join("\n");
     const claudeAccounts = report.claudeAccounts.length === 0
         ? "none"
-        : formatTable(["ACCOUNT", "LAST ATTEMPT", "OUTCOME", "TOKEN AGE", "EXPIRES IN", "BACKOFF UNTIL"], report.claudeAccounts.map((account) => [
+        : formatTable(["ACCOUNT", "LAST ATTEMPT", "OUTCOME", "SINCE REFRESH", "EXPIRES IN", "BACKOFF UNTIL"], report.claudeAccounts.map((account) => [
             account.label,
             account.lastRefreshAttempt ?? "—",
             account.lastRefreshOutcome ?? "—",

package/dist/commands/daemon.d.ts

@@ -19,6 +19,8 @@ import type { HostApp } from "../lib/daemon/supervisor.js";
 import { type SyncModeVaultClient } from "./sync-mode.js";
 import type { RunCommand } from "../lib/service-manager/launchd.js";
 type DaemonRunnerModule = typeof import("../lib/daemon/run.js");
+/** First hq-cloud release whose watch runner accepts pass-request files. */
+export declare const PASS_REQUEST_MIN_HQ_CLOUD = "6.18.68";
 /** Load every lazy daemon runtime module before releasing its package-use lease. */
 export declare function loadDaemonRunner(release?: () => void, load?: () => Promise<DaemonRunnerModule>, preload?: () => Promise<void>, reportPreloadFailure?: (error: unknown) => void): Promise<DaemonRunnerModule["runDaemon"]>;
 export interface DaemonCommandDeps {

package/dist/commands/daemon.js

@@ -16,6 +16,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { randomBytes } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import { once } from "node:events";
 import { compare as semverCompare, major as semverMajor, valid as validSemver } from "semver";
@@ -38,6 +39,7 @@ import { acknowledgeConflictNotice, conflictNoticeStateDir } from "../lib/daemon
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, syncRunnerPathFromCommandLine, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { stagedSyncRunnerVersion, syncRunnerBundleStageRoot } from "../lib/daemon/sync-runner-bundle.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
+import { assertSafeCompanySlug } from "../utils/people.js";
 import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
 import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
@@ -45,6 +47,8 @@ import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { followLogFile } from "../lib/log-follow.js";
+/** First hq-cloud release whose watch runner accepts pass-request files. */
+export const PASS_REQUEST_MIN_HQ_CLOUD = "6.18.68";
 /** Load every lazy daemon runtime module before releasing its package-use lease. */
 export async function loadDaemonRunner(release = releaseCurrentPackageUseLease, load = () => import("../lib/daemon/run.js"), preload = () => preloadResidentPackageModules("daemon"), reportPreloadFailure = reportResidentPackagePreloadFailure) {
     const { runDaemon } = await load();
@@ -545,6 +549,11 @@ function daemonSyncStatus(d) {
         syncOwner: effectiveSyncOwner(config, host.detected.type),
         owner: ownerStatus?.owner ?? (syncUnit?.status === "running" ? "hq-daemon" : null),
         runnerPid: ownerStatus?.pid ?? syncUnit?.pid ?? null,
+        passRequestDir: syncUnit?.status === "running"
+            && syncUnit.pid !== undefined
+            && (ownerStatus === null || ownerStatus.pid === syncUnit.pid)
+            ? syncUnit.passRequestDir ?? null
+            : null,
         hqCloudVersion,
         hqCloudVersionSource,
         runnerMatchesPin,
@@ -592,6 +601,53 @@ function queueDaemonSyncControl(d, request) {
     handOver(d, host);
     return runningDaemonPid(host.paths.lockPath, d.daemonAlive) !== null;
 }
+function writeSyncPassRequest(paths, company, source) {
+    ensurePrivateDir(paths.syncPassRequestsDir);
+    const request = {
+        version: 1,
+        company,
+        requestedAt: new Date().toISOString(),
+        source,
+    };
+    const encoded = JSON.stringify(request);
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+        const basename = `${Date.now()}-${randomBytes(4).toString("hex")}`;
+        const temporary = path.join(paths.syncPassRequestsDir, `${basename}.tmp`);
+        const destination = path.join(paths.syncPassRequestsDir, `${basename}.json`);
+        try {
+            fs.writeFileSync(temporary, encoded, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            fs.renameSync(temporary, destination);
+            return;
+        }
+        catch (error) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch (cleanupError) {
+                if (cleanupError.code !== "ENOENT")
+                    throw cleanupError;
+            }
+            if (error.code === "EEXIST")
+                continue;
+            throw error;
+        }
+    }
+    throw new DaemonCommandError("could not allocate a unique sync pass request filename");
+}
+/**
+ * The version alone does not prove the runner reads requests: a runner adopted
+ * across a CLI update keeps the env it was started with. The daemon records the
+ * request folder for a child it started with one.
+ */
+function supportsPassRequests(status, paths) {
+    const version = status.hqCloudVersion;
+    return status.running
+        && status.passRequestDir !== null
+        && path.resolve(status.passRequestDir) === path.resolve(paths.syncPassRequestsDir)
+        && version !== null
+        && validSemver(version) !== null
+        && semverCompare(version, PASS_REQUEST_MIN_HQ_CLOUD) >= 0;
+}
 async function runDaemonSyncNow(d, opts) {
     const host = currentHost(d);
     const config = readDaemonConfig(host.paths.configPath);
@@ -600,8 +656,20 @@ async function runDaemonSyncNow(d, opts) {
     if (!enabledServices(host.detected.type, config).includes("sync")) {
         throw new DaemonCommandError("sync is disabled for this machine; run `hq daemon enable sync` first");
     }
+    const company = opts.company ?? null;
+    if (company !== null)
+        assertSafeCompanySlug(company);
+    const status = daemonSyncStatus(d);
+    if (supportsPassRequests(status, host.paths)) {
+        const source = d.env.HQ_SYNC_PASS_REQUEST_SOURCE === "desktop" ? "desktop" : "cli";
+        writeSyncPassRequest(host.paths, company, source);
+        handOver(d, host);
+        const result = { accepted: true, action: "pass-request", company, daemonRunning: true };
+        d.out(opts.json ? JSON.stringify(result, null, 2) : "Asked the daemon to run a fresh sync pass.");
+        return;
+    }
     const running = queueDaemonSyncControl(d, { action: "restart", unit: "sync" });
-    const result = { accepted: true, action: "restart-sync-runner", daemonRunning: running };
+    const result = { accepted: true, action: "restart-sync-runner", company, daemonRunning: running };
     d.out(opts.json ? JSON.stringify(result, null, 2) : running ? "Asked the daemon to start a fresh sync pass." : "Queued a fresh sync pass for the next daemon start.");
 }
 async function runDaemonSyncInstantSyncSet(d, enabled, opts) {
@@ -1336,6 +1404,7 @@ export function registerDaemonCommand(program, over = {}) {
     sync
         .command("now")
         .description("Start a fresh sync pass immediately")
+        .option("--company <slug>", "Sync one company")
         .option("--json", "Print machine-readable JSON")
         .action(wrap((d, opts) => runDaemonSyncNow(d, opts)));
     const instantSync = sync.command("instant-sync").description("Control daemon Instant Sync");

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -332,6 +332,22 @@ interface RawAccountRow {
     auth_state?: unknown;
     provider?: unknown;
 }
+/**
+ * How to re-invoke the running hq CLI without a PATH lookup. When argv[1] is
+ * the entry of an installed hq-cli package, run it with the same node binary;
+ * the collector runs under launchd and lane workers where PATH may be empty.
+ * Falls back to `hq` on PATH when this process is not the hq CLI (tests,
+ * embedders). Exported for tests.
+ */
+export declare function resolveHqInvocation(argv?: readonly string[], execPath?: string): {
+    command: string;
+    args: string[];
+};
+/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+export declare function execHqJson(args: readonly string[], invocation?: {
+    command: string;
+    args: string[];
+}, env?: NodeJS.ProcessEnv): unknown;
 /**
  * Parse `hq lanes list --json` payload into typed rows.
  * Exported for tests; fail-closed semantics live in defaultListLiveLanes.

package/dist/lib/capacity/collectors/claude-oauth.js

@@ -251,7 +251,12 @@ export async function collectClaudeOAuth(options = {}) {
             });
             if (refreshResult?.outcome === "refreshed" && refreshResult.newAccessToken) {
                 currentToken = refreshResult.newAccessToken;
-                currentBlocked = undefined;
+                // A refresh renews the token but does not grant scopes the sign-in
+                // lacked. Re-check the profile scope before clearing the block.
+                const refreshedScopes = refreshResult.newScopes && refreshResult.newScopes.length > 0
+                    ? refreshResult.newScopes
+                    : meta.scopes;
+                currentBlocked = hasProfileScope(refreshedScopes) ? undefined : "unavailable: missing_scope";
             }
             else if (refreshResult?.outcome === "revoked" || refreshResult?.outcome === "skipped-revoked") {
                 currentBlocked = SIGN_IN_REVOKED_REASON;
@@ -410,13 +415,17 @@ async function collectEnumeratedClaude(options, scoped, root, clock, cliVersion)
             if (refreshResult) {
                 if (refreshResult.outcome === "refreshed" && refreshResult.newAccessToken) {
                     account.token = refreshResult.newAccessToken;
-                    account.blocked = null;
                     if (refreshResult.newExpiresAt !== undefined)
                         account.expiresAt = refreshResult.newExpiresAt;
                     if (refreshResult.newRefreshToken)
                         account.refreshToken = refreshResult.newRefreshToken;
                     if (refreshResult.newScopes && refreshResult.newScopes.length > 0)
                         account.scopes = refreshResult.newScopes;
+                    // A refresh renews the token but does not grant scopes the sign-in
+                    // lacked. Re-check the profile scope before clearing the block.
+                    account.blocked = hasProfileScope(account.scopes)
+                        ? null
+                        : credentialBlockReason("unavailable: missing_scope");
                 }
                 else if (refreshResult.outcome === "revoked" || refreshResult.outcome === "skipped-revoked") {
                     account.blocked = SIGN_IN_REVOKED_REASON;
@@ -537,7 +546,10 @@ async function readEnumeratedHome(group, options, nowMs, root) {
             platform,
         };
     }
-    if (pollIsFresh(root, accountId, nowMs)) {
+    // A fresh poll normally skips the credential read. When a revoked marker
+    // exists, read anyway: the marker check needs the current refresh token to
+    // tell a re-sign-in (fingerprint changed) from the same revoked token.
+    if (pollIsFresh(root, accountId, nowMs) && revokedMarkerForCurrentCredential(root, accountId, null) === "none") {
         return {
             accountId,
             labels,
@@ -1623,6 +1635,10 @@ const defaultWriteClaudeCredentials = async (request) => {
             return { ok: false, raceDetected: true };
         }
         const body = JSON.stringify(request.document);
+        // `security add-generic-password` only takes the secret as `-w <value>`
+        // on argv, so the credential JSON is visible to `ps` for the duration of
+        // this call. Claude Code writes its own Keychain item the same way; this
+        // matches that exposure rather than adding a new one.
         const writeArgs = selector === "s"
             ? ["add-generic-password", "-U", "-s", request.service, "-w", body]
             : ["add-generic-password", "-U", "-s", request.service, "-a", username, "-w", body];
@@ -1670,8 +1686,44 @@ const defaultWriteClaudeCredentials = async (request) => {
         return { ok: false, error: message };
     }
 };
-function execHqJson(args) {
-    const result = spawnSync("hq", [...args], {
+const HQ_CLI_PACKAGE_NAME = "@indigoai-us/hq-cli";
+/**
+ * How to re-invoke the running hq CLI without a PATH lookup. When argv[1] is
+ * the entry of an installed hq-cli package, run it with the same node binary;
+ * the collector runs under launchd and lane workers where PATH may be empty.
+ * Falls back to `hq` on PATH when this process is not the hq CLI (tests,
+ * embedders). Exported for tests.
+ */
+export function resolveHqInvocation(argv = process.argv, execPath = process.execPath) {
+    const entry = argv[1];
+    if (entry) {
+        try {
+            const real = fs.realpathSync(entry);
+            let dir = path.dirname(real);
+            for (let depth = 0; depth < 4; depth += 1) {
+                const manifest = path.join(dir, "package.json");
+                if (fs.existsSync(manifest)) {
+                    const parsed = JSON.parse(fs.readFileSync(manifest, "utf8"));
+                    if (parsed.name === HQ_CLI_PACKAGE_NAME)
+                        return { command: execPath, args: [real] };
+                    break;
+                }
+                const parent = path.dirname(dir);
+                if (parent === dir)
+                    break;
+                dir = parent;
+            }
+        }
+        catch {
+            // Unresolvable entry: fall through to the PATH lookup below.
+        }
+    }
+    return { command: "hq", args: [] };
+}
+/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+export function execHqJson(args, invocation = resolveHqInvocation(), env = process.env) {
+    const result = spawnSync(invocation.command, [...invocation.args, ...args], {
+        env,
         encoding: "utf8",
         timeout: 5_000,
         windowsHide: true,

package/dist/lib/capacity/route.js

@@ -250,6 +250,17 @@ export function pickAccount(input) {
                 });
                 continue;
             }
+            // The ledger sets usageStale when the sign-in expired and no reading has
+            // landed since the expiry. The limits on file describe the old token, so
+            // the account cannot be ranked on them.
+            if (account.usageStale === true) {
+                skipped.push({
+                    ...base,
+                    reason: "no fresh reading (sign-in expired)",
+                    fix: account.fixCommand ?? null,
+                });
+                continue;
+            }
             const applicable = (account.limits ?? []).filter((l) => limitApplies(providerId, l, model));
             const viewRows = applicable.map((limit) => {
                 const resetMs = limit.resetsAt ? Date.parse(limit.resetsAt) : NaN;

package/dist/lib/daemon/catalog.d.ts

@@ -87,6 +87,8 @@ export interface PlanContext {
     platform: NodeJS.Platform;
     home: string;
     hqRoot: string | undefined;
+    /** Daemon-owned request directory consumed by the hq-cloud watch runner. */
+    syncPassRequestsDir: string;
     /** hq-cloud's sync-runner.js, or null when it cannot be found. */
     syncRunnerPath: string | null;
     /** hq-cloud's `hq-outpost-heartbeat` bin, when the hq-cloud in use has one. */

package/dist/lib/daemon/catalog.js

@@ -142,7 +142,7 @@ function planService(service, ctx) {
                         SYNC_RUNNER_OWNER,
                     ],
                 },
-                env: { ...ctx.legacySyncEnv },
+                env: { ...ctx.legacySyncEnv, HQ_SYNC_PASS_REQUEST_DIR: ctx.syncPassRequestsDir },
                 heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
             });
             let ownerBlock;

package/dist/lib/daemon/paths.d.ts

@@ -11,6 +11,8 @@ export interface DaemonPaths {
     lockPath: string;
     logsDir: string;
     requestsDir: string;
+    /** One-shot sync passes queued for the running hq-cloud watch runner. */
+    syncPassRequestsDir: string;
     supervisorLogPath: string;
     unitLogPath: (unitId: string) => string;
     /** The FIFO a unit that speaks the sync protocol writes its stdout to (see protocol-tail.ts); kept out of logs/ so nothing reading logs drains it. */

package/dist/lib/daemon/paths.js

@@ -17,6 +17,7 @@ export function daemonPaths(home = os.homedir(), env = process.env) {
         lockPath: path.join(root, "daemon.pid"),
         logsDir,
         requestsDir: path.join(root, "requests"),
+        syncPassRequestsDir: path.resolve(root, "sync-pass-requests"),
         supervisorLogPath: path.join(logsDir, "daemon.log"),
         unitLogPath: (unitId) => path.join(logsDir, `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.log`),
         unitProtocolPath: (unitId) => path.join(root, "protocol", `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.fifo`),

package/dist/lib/daemon/run.js

@@ -451,6 +451,7 @@ export async function runDaemon(opts) {
     const home = opts.home ?? os.homedir();
     const platform = process.platform;
     const paths = daemonPaths(home, env);
+    ensurePrivateDir(paths.syncPassRequestsDir);
     const log = makeLogger(paths, opts.foreground === true);
     const syncRunnerBundleDirectory = opts.syncRunnerBundleDirectory ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../hq-cloud-sync-runner");
     const cliPackageRoot = opts.cliPackageRoot === undefined ? resolveRunningInstall().packageRoot : opts.cliPackageRoot;
@@ -835,6 +836,7 @@ export async function runDaemon(opts) {
             platform,
             home,
             hqRoot,
+            syncPassRequestsDir: paths.syncPassRequestsDir,
             syncRunnerPath: runners.syncRunner,
             heartbeatRunnerPath: runners.heartbeat,
             sessionHostRunnerPath: runners.sessionHost,

package/dist/lib/daemon/supervisor.d.ts

@@ -63,6 +63,8 @@ interface UnitState {
     lastResult?: "ok" | "failed";
     lastHeartbeatAt?: string;
     lastPassResult?: ReturnType<typeof syncPassResult>;
+    /** The pass-request folder the running child was started with; absent when it was not. */
+    passRequestDir?: string;
 }
 /** An app that runs the daemon as its own child process instead of an OS unit. */
 export type HostApp = "desktop";

package/dist/lib/daemon/supervisor.js

@@ -37,6 +37,33 @@ const MESH_OWNER_LOG_INTERVAL_MS = 10 * 60_000;
 export const HANDOFF_STAGGER_MS = 15_000;
 /** How long a draining unit may take to finish its work before it gets SIGTERM. */
 export const HANDOFF_DRAIN_MAX_MS = 15 * 60_000;
+const PASS_REQUEST_DIR_ENV = "HQ_SYNC_PASS_REQUEST_DIR";
+function passRequestDirOf(env) {
+    const dir = env?.[PASS_REQUEST_DIR_ENV];
+    return dir ? dir : undefined;
+}
+/** An adopted child carries no env, only the key it was started with (see planKey). */
+function passRequestDirFromKey(key) {
+    try {
+        const fields = JSON.parse(key);
+        if (!Array.isArray(fields))
+            return undefined;
+        const env = fields[6];
+        if (!env || typeof env !== "object" || Array.isArray(env))
+            return undefined;
+        const dir = env[PASS_REQUEST_DIR_ENV];
+        return typeof dir === "string" && dir ? dir : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function recordPassRequestDir(state, dir) {
+    if (dir)
+        state.passRequestDir = dir;
+    else
+        delete state.passRequestDir;
+}
 /** Plan reads in a row that must find a running remote-control host blocked before it is paused. */
 const BLOCKED_READS_BEFORE_PAUSE = 2;
 function backoffMs(attempt) {
@@ -560,6 +587,7 @@ export function createSupervisor(deps) {
         }
         slot.child = child;
         slot.childKey = slot.key;
+        recordPassRequestDir(slot.state, passRequestDirOf(slot.plan.env));
         slot.childStartedAt = now();
         slot.state.status = "running";
         slot.state.startedAt = slot.childStartedAt;
@@ -651,6 +679,7 @@ export function createSupervisor(deps) {
         }
         slot.child = child;
         slot.childKey = slot.key;
+        recordPassRequestDir(slot.state, passRequestDirOf(slot.plan.env));
         slot.childStartedAt = now();
         slot.state.status = "running";
         delete slot.state.reason;
@@ -880,6 +909,7 @@ export function createSupervisor(deps) {
             slot.adopted = true;
             slot.child = unit.child;
             slot.childKey = unit.key;
+            recordPassRequestDir(slot.state, passRequestDirFromKey(unit.key));
             slot.childStartedAt = now();
             slot.state.status = "running";
             slot.state.startedAt = slot.childStartedAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.112",
+  "version": "5.345.113",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {