@indigoai-us/hq-cli 5.345.112 → 5.345.114

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.345.114] — 2026-10-13
+- `hq capacity login <provider> --account <id>` signs a registered account
+  in again into its existing home. The account id, home, and Keychain item
+  stay the same. `--account default` (or the id registered at `~/.claude`)
+  signs in the default home without setting `CLAUDE_CONFIG_DIR`. A reserved
+  id that names no registered account is refused before any sign-in runs.
+- `hq capacity login --repair` signs in each signed-out account one at a
+  time, keeps going when one fails, and ends with a Fixed/Skipped report.
+  It exits 1 when any signed-out account was skipped.
+- `hq capacity route` and `hq lanes create --account auto` list every
+  signed-out account under `skipped` with its reason and the exact
+  `hq capacity login <provider> --account <id>` fix, using the lanes
+  account id. The `no_account_with_room` error now carries `skipped`.
+
+## [5.345.113] — 2026-10-13
+- `hq daemon sync now --company <slug>` asks the running sync daemon to sync one company right away, without restarting sync. It needs hq-cloud 6.18.68 or later in the daemon; with an older daemon it falls back to the previous restart. `--json` reports which path it took. The desktop app uses this for Sync on the "Added to" banner.
+
+- `hq capacity` no longer ranks a Claude account the ledger marks as stale
+  (sign-in expired and no reading since). The router skips it with "no fresh
+  reading (sign-in expired)" and prints the account's fix command.
+- A Claude home listed under `accounts` now clears an old revoked marker
+  once a new sign-in lands, including when a fresh usage poll would
+  otherwise skip reading the credential. A marker that still matches the
+  current refresh token keeps the account blocked as revoked.
+- After a token refresh, the account stays blocked as "missing profile
+  scope" when the refreshed grant lacks that scope, instead of being
+  cleared.
+- The live-lane gate finds the `hq` CLI from the running process instead of
+  `PATH`, so the refresh gate works when `PATH` is empty or minimal.
+- `hq capacity doctor` renames the "TOKEN AGE" column to "SINCE REFRESH".
+
 ## [5.345.112] — 2026-10-13
 - The bundled sync engine now uses hq-cloud 6.18.71. The hq-core update no longer replaces pack-installed worker links (for example `core/workers/public/qa-tester`) with a copy of the release folder.
 

package/dist/command-catalog.generated.d.ts

@@ -15484,6 +15484,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly helpText: readonly [];
             readonly arguments: readonly [];
             readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Sync one company";
+                readonly hidden: false;
+            }, {
                 readonly flags: "--json";
                 readonly description: "Print machine-readable JSON";
                 readonly hidden: false;

package/dist/command-catalog.generated.js

@@ -18848,6 +18848,11 @@ export const COMMAND_CATALOG = [
                         "helpText": [],
                         "arguments": [],
                         "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Sync one company",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--json",
                                 "description": "Print machine-readable JSON",

package/dist/commands/capacity.js

@@ -260,7 +260,7 @@ export function formatDoctor(report) {
         : report.providers.map((provider) => `${provider.provider}  ${provider.state}`).join("\n");
     const claudeAccounts = report.claudeAccounts.length === 0
         ? "none"
-        : formatTable(["ACCOUNT", "LAST ATTEMPT", "OUTCOME", "TOKEN AGE", "EXPIRES IN", "BACKOFF UNTIL"], report.claudeAccounts.map((account) => [
+        : formatTable(["ACCOUNT", "LAST ATTEMPT", "OUTCOME", "SINCE REFRESH", "EXPIRES IN", "BACKOFF UNTIL"], report.claudeAccounts.map((account) => [
             account.label,
             account.lastRefreshAttempt ?? "—",
             account.lastRefreshOutcome ?? "—",
@@ -533,9 +533,11 @@ export function registerCapacityCommand(program) {
             });
             if (wantsJson(opts, command)) {
                 console.log(JSON.stringify(result.json ?? loginJson(rows, clock.nowMs, provider), null, 2));
+                process.exitCode = result.exitCode;
                 return;
             }
             console.log(result.text);
+            process.exitCode = result.exitCode;
         }
         catch (err) {
             failCapacity(err);

package/dist/commands/daemon.d.ts

@@ -19,6 +19,8 @@ import type { HostApp } from "../lib/daemon/supervisor.js";
 import { type SyncModeVaultClient } from "./sync-mode.js";
 import type { RunCommand } from "../lib/service-manager/launchd.js";
 type DaemonRunnerModule = typeof import("../lib/daemon/run.js");
+/** First hq-cloud release whose watch runner accepts pass-request files. */
+export declare const PASS_REQUEST_MIN_HQ_CLOUD = "6.18.68";
 /** Load every lazy daemon runtime module before releasing its package-use lease. */
 export declare function loadDaemonRunner(release?: () => void, load?: () => Promise<DaemonRunnerModule>, preload?: () => Promise<void>, reportPreloadFailure?: (error: unknown) => void): Promise<DaemonRunnerModule["runDaemon"]>;
 export interface DaemonCommandDeps {

package/dist/commands/daemon.js

@@ -16,6 +16,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { randomBytes } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import { once } from "node:events";
 import { compare as semverCompare, major as semverMajor, valid as validSemver } from "semver";
@@ -38,6 +39,7 @@ import { acknowledgeConflictNotice, conflictNoticeStateDir } from "../lib/daemon
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, syncRunnerPathFromCommandLine, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { stagedSyncRunnerVersion, syncRunnerBundleStageRoot } from "../lib/daemon/sync-runner-bundle.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
+import { assertSafeCompanySlug } from "../utils/people.js";
 import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
 import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
@@ -45,6 +47,8 @@ import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, runResidentCommandWithPackageLease, } from "../utils/resident-package-preload.js";
 import { followLogFile } from "../lib/log-follow.js";
+/** First hq-cloud release whose watch runner accepts pass-request files. */
+export const PASS_REQUEST_MIN_HQ_CLOUD = "6.18.68";
 /** Load every lazy daemon runtime module before releasing its package-use lease. */
 export async function loadDaemonRunner(release = releaseCurrentPackageUseLease, load = () => import("../lib/daemon/run.js"), preload = () => preloadResidentPackageModules("daemon"), reportPreloadFailure = reportResidentPackagePreloadFailure) {
     const { runDaemon } = await load();
@@ -545,6 +549,11 @@ function daemonSyncStatus(d) {
         syncOwner: effectiveSyncOwner(config, host.detected.type),
         owner: ownerStatus?.owner ?? (syncUnit?.status === "running" ? "hq-daemon" : null),
         runnerPid: ownerStatus?.pid ?? syncUnit?.pid ?? null,
+        passRequestDir: syncUnit?.status === "running"
+            && syncUnit.pid !== undefined
+            && (ownerStatus === null || ownerStatus.pid === syncUnit.pid)
+            ? syncUnit.passRequestDir ?? null
+            : null,
         hqCloudVersion,
         hqCloudVersionSource,
         runnerMatchesPin,
@@ -592,6 +601,53 @@ function queueDaemonSyncControl(d, request) {
     handOver(d, host);
     return runningDaemonPid(host.paths.lockPath, d.daemonAlive) !== null;
 }
+function writeSyncPassRequest(paths, company, source) {
+    ensurePrivateDir(paths.syncPassRequestsDir);
+    const request = {
+        version: 1,
+        company,
+        requestedAt: new Date().toISOString(),
+        source,
+    };
+    const encoded = JSON.stringify(request);
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+        const basename = `${Date.now()}-${randomBytes(4).toString("hex")}`;
+        const temporary = path.join(paths.syncPassRequestsDir, `${basename}.tmp`);
+        const destination = path.join(paths.syncPassRequestsDir, `${basename}.json`);
+        try {
+            fs.writeFileSync(temporary, encoded, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            fs.renameSync(temporary, destination);
+            return;
+        }
+        catch (error) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch (cleanupError) {
+                if (cleanupError.code !== "ENOENT")
+                    throw cleanupError;
+            }
+            if (error.code === "EEXIST")
+                continue;
+            throw error;
+        }
+    }
+    throw new DaemonCommandError("could not allocate a unique sync pass request filename");
+}
+/**
+ * The version alone does not prove the runner reads requests: a runner adopted
+ * across a CLI update keeps the env it was started with. The daemon records the
+ * request folder for a child it started with one.
+ */
+function supportsPassRequests(status, paths) {
+    const version = status.hqCloudVersion;
+    return status.running
+        && status.passRequestDir !== null
+        && path.resolve(status.passRequestDir) === path.resolve(paths.syncPassRequestsDir)
+        && version !== null
+        && validSemver(version) !== null
+        && semverCompare(version, PASS_REQUEST_MIN_HQ_CLOUD) >= 0;
+}
 async function runDaemonSyncNow(d, opts) {
     const host = currentHost(d);
     const config = readDaemonConfig(host.paths.configPath);
@@ -600,8 +656,20 @@ async function runDaemonSyncNow(d, opts) {
     if (!enabledServices(host.detected.type, config).includes("sync")) {
         throw new DaemonCommandError("sync is disabled for this machine; run `hq daemon enable sync` first");
     }
+    const company = opts.company ?? null;
+    if (company !== null)
+        assertSafeCompanySlug(company);
+    const status = daemonSyncStatus(d);
+    if (supportsPassRequests(status, host.paths)) {
+        const source = d.env.HQ_SYNC_PASS_REQUEST_SOURCE === "desktop" ? "desktop" : "cli";
+        writeSyncPassRequest(host.paths, company, source);
+        handOver(d, host);
+        const result = { accepted: true, action: "pass-request", company, daemonRunning: true };
+        d.out(opts.json ? JSON.stringify(result, null, 2) : "Asked the daemon to run a fresh sync pass.");
+        return;
+    }
     const running = queueDaemonSyncControl(d, { action: "restart", unit: "sync" });
-    const result = { accepted: true, action: "restart-sync-runner", daemonRunning: running };
+    const result = { accepted: true, action: "restart-sync-runner", company, daemonRunning: running };
     d.out(opts.json ? JSON.stringify(result, null, 2) : running ? "Asked the daemon to start a fresh sync pass." : "Queued a fresh sync pass for the next daemon start.");
 }
 async function runDaemonSyncInstantSyncSet(d, enabled, opts) {
@@ -1336,6 +1404,7 @@ export function registerDaemonCommand(program, over = {}) {
     sync
         .command("now")
         .description("Start a fresh sync pass immediately")
+        .option("--company <slug>", "Sync one company")
         .option("--json", "Print machine-readable JSON")
         .action(wrap((d, opts) => runDaemonSyncNow(d, opts)));
     const instantSync = sync.command("instant-sync").description("Control daemon Instant Sync");

package/dist/commands/lanes.js

@@ -3307,6 +3307,7 @@ async function runCreate(ctx, opts) {
             throw new LanesError("no_account_with_room", `No account has room${resetSuffix}`, {
                 next_reset: result.next_reset,
                 request: result.request,
+                skipped: result.skipped,
             });
         }
         autoChosenProvider = parseLaneProvider(result.pick.provider);

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -332,6 +332,22 @@ interface RawAccountRow {
     auth_state?: unknown;
     provider?: unknown;
 }
+/**
+ * How to re-invoke the running hq CLI without a PATH lookup. When argv[1] is
+ * the entry of an installed hq-cli package, run it with the same node binary;
+ * the collector runs under launchd and lane workers where PATH may be empty.
+ * Falls back to `hq` on PATH when this process is not the hq CLI (tests,
+ * embedders). Exported for tests.
+ */
+export declare function resolveHqInvocation(argv?: readonly string[], execPath?: string): {
+    command: string;
+    args: string[];
+};
+/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+export declare function execHqJson(args: readonly string[], invocation?: {
+    command: string;
+    args: string[];
+}, env?: NodeJS.ProcessEnv): unknown;
 /**
  * Parse `hq lanes list --json` payload into typed rows.
  * Exported for tests; fail-closed semantics live in defaultListLiveLanes.

package/dist/lib/capacity/collectors/claude-oauth.js

@@ -251,7 +251,12 @@ export async function collectClaudeOAuth(options = {}) {
             });
             if (refreshResult?.outcome === "refreshed" && refreshResult.newAccessToken) {
                 currentToken = refreshResult.newAccessToken;
-                currentBlocked = undefined;
+                // A refresh renews the token but does not grant scopes the sign-in
+                // lacked. Re-check the profile scope before clearing the block.
+                const refreshedScopes = refreshResult.newScopes && refreshResult.newScopes.length > 0
+                    ? refreshResult.newScopes
+                    : meta.scopes;
+                currentBlocked = hasProfileScope(refreshedScopes) ? undefined : "unavailable: missing_scope";
             }
             else if (refreshResult?.outcome === "revoked" || refreshResult?.outcome === "skipped-revoked") {
                 currentBlocked = SIGN_IN_REVOKED_REASON;
@@ -410,13 +415,17 @@ async function collectEnumeratedClaude(options, scoped, root, clock, cliVersion)
             if (refreshResult) {
                 if (refreshResult.outcome === "refreshed" && refreshResult.newAccessToken) {
                     account.token = refreshResult.newAccessToken;
-                    account.blocked = null;
                     if (refreshResult.newExpiresAt !== undefined)
                         account.expiresAt = refreshResult.newExpiresAt;
                     if (refreshResult.newRefreshToken)
                         account.refreshToken = refreshResult.newRefreshToken;
                     if (refreshResult.newScopes && refreshResult.newScopes.length > 0)
                         account.scopes = refreshResult.newScopes;
+                    // A refresh renews the token but does not grant scopes the sign-in
+                    // lacked. Re-check the profile scope before clearing the block.
+                    account.blocked = hasProfileScope(account.scopes)
+                        ? null
+                        : credentialBlockReason("unavailable: missing_scope");
                 }
                 else if (refreshResult.outcome === "revoked" || refreshResult.outcome === "skipped-revoked") {
                     account.blocked = SIGN_IN_REVOKED_REASON;
@@ -537,7 +546,10 @@ async function readEnumeratedHome(group, options, nowMs, root) {
             platform,
         };
     }
-    if (pollIsFresh(root, accountId, nowMs)) {
+    // A fresh poll normally skips the credential read. When a revoked marker
+    // exists, read anyway: the marker check needs the current refresh token to
+    // tell a re-sign-in (fingerprint changed) from the same revoked token.
+    if (pollIsFresh(root, accountId, nowMs) && revokedMarkerForCurrentCredential(root, accountId, null) === "none") {
         return {
             accountId,
             labels,
@@ -1623,6 +1635,10 @@ const defaultWriteClaudeCredentials = async (request) => {
             return { ok: false, raceDetected: true };
         }
         const body = JSON.stringify(request.document);
+        // `security add-generic-password` only takes the secret as `-w <value>`
+        // on argv, so the credential JSON is visible to `ps` for the duration of
+        // this call. Claude Code writes its own Keychain item the same way; this
+        // matches that exposure rather than adding a new one.
         const writeArgs = selector === "s"
             ? ["add-generic-password", "-U", "-s", request.service, "-w", body]
             : ["add-generic-password", "-U", "-s", request.service, "-a", username, "-w", body];
@@ -1670,8 +1686,44 @@ const defaultWriteClaudeCredentials = async (request) => {
         return { ok: false, error: message };
     }
 };
-function execHqJson(args) {
-    const result = spawnSync("hq", [...args], {
+const HQ_CLI_PACKAGE_NAME = "@indigoai-us/hq-cli";
+/**
+ * How to re-invoke the running hq CLI without a PATH lookup. When argv[1] is
+ * the entry of an installed hq-cli package, run it with the same node binary;
+ * the collector runs under launchd and lane workers where PATH may be empty.
+ * Falls back to `hq` on PATH when this process is not the hq CLI (tests,
+ * embedders). Exported for tests.
+ */
+export function resolveHqInvocation(argv = process.argv, execPath = process.execPath) {
+    const entry = argv[1];
+    if (entry) {
+        try {
+            const real = fs.realpathSync(entry);
+            let dir = path.dirname(real);
+            for (let depth = 0; depth < 4; depth += 1) {
+                const manifest = path.join(dir, "package.json");
+                if (fs.existsSync(manifest)) {
+                    const parsed = JSON.parse(fs.readFileSync(manifest, "utf8"));
+                    if (parsed.name === HQ_CLI_PACKAGE_NAME)
+                        return { command: execPath, args: [real] };
+                    break;
+                }
+                const parent = path.dirname(dir);
+                if (parent === dir)
+                    break;
+                dir = parent;
+            }
+        }
+        catch {
+            // Unresolvable entry: fall through to the PATH lookup below.
+        }
+    }
+    return { command: "hq", args: [] };
+}
+/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+export function execHqJson(args, invocation = resolveHqInvocation(), env = process.env) {
+    const result = spawnSync(invocation.command, [...invocation.args, ...args], {
+        env,
         encoding: "utf8",
         timeout: 5_000,
         windowsHide: true,

package/dist/lib/capacity/lane-login.js

@@ -10,30 +10,76 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { createLaneAccountsHandlers } from "../../commands/lanes-accounts.js";
+import { effectiveAccountHome } from "../lanes/account-home.js";
+import { canonicalizeHome, DEFAULT_ACCOUNT_HOMES, loadLanesConfig } from "../lanes/config.js";
 import { resolveLanesHqRoot } from "../lanes/hq-root.js";
 import { defaultProbe } from "../lanes/models.js";
+import { parseLaneProvider } from "../lanes/types.js";
 const ACCOUNT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const RESERVED_ACCOUNT_IDS = new Set(["a", "default"]);
 export async function loginLaneAccount(input) {
-    if (!ACCOUNT_ID_PATTERN.test(input.accountId) || RESERVED_ACCOUNT_IDS.has(input.accountId)) {
-        throw new Error(`Refusing account id ${input.accountId}. Use letters, numbers, dots, underscores, or hyphens, and not a reserved id.`);
+    if (!ACCOUNT_ID_PATTERN.test(input.accountId)) {
+        throw new Error(`Refusing account id ${input.accountId}. Use letters, numbers, dots, underscores, or hyphens.`);
     }
     const hqRoot = input.hqRoot ?? resolveLanesHqRoot({ env: input.env });
+    const provider = parseLaneProvider(input.provider);
+    const homedir = input.homedir ?? os.homedir;
+    const hostname = input.hostname ?? os.hostname();
+    const existing = existingAccount(hqRoot, provider, input.accountId, hostname, homedir);
     let captured;
     const handlers = createLaneAccountsHandlers(handlerDeps((value) => {
         captured = value;
     }));
     // One registry write. capacityOnly stores enabled:false and the capacity-only
     // reason in that write, re-checking whether lanes already use the account.
-    await handlers.runAccountsLogin(loginCtx(input, hqRoot), input.provider, input.accountId, {
+    // A registered id signs in again into the home the registry already names.
+    await handlers.runAccountsLogin(loginCtx(input, hqRoot), provider, existing?.id ?? input.accountId, {
         capacityOnly: true,
     });
     const account = captured?.account;
     if (!account?.id || !account.home) {
-        throw new Error(`lanes accounts login did not register ${input.provider} ${input.accountId}`);
+        throw new Error(`lanes accounts login did not register ${provider} ${input.accountId}`);
+    }
+    if (existing && (account.id !== existing.id || account.home !== existing.home)) {
+        throw new Error(`Sign-in for ${provider} ${existing.id} moved it to ${account.id} at ${account.home}; expected ${existing.home}`);
     }
     return { id: account.id, home: account.home };
 }
+/**
+ * The registry account an id names, with the home lanes use on this host.
+ * `default` names the account registered at the provider's default home.
+ * Reserved ids sign in again only when they name a registered account, so a
+ * new account never takes `a` or `default`.
+ */
+function existingAccount(hqRoot, provider, accountId, hostname, homedir) {
+    const accounts = loadLanesConfig(hqRoot).providers[provider].accounts;
+    const canonical = (home) => canonicalHome(home, homedir);
+    if (accountId === "default") {
+        const defaultHome = canonical(DEFAULT_ACCOUNT_HOMES[provider]);
+        for (const [id, entry] of Object.entries(accounts)) {
+            if (!entry)
+                continue;
+            const home = canonical(effectiveAccountHome(entry, hostname).home);
+            if (home === defaultHome)
+                return { id, home };
+        }
+        throw new Error(`No ${provider} account is registered at the default home. Run hq capacity login ${provider} to add one.`);
+    }
+    const entry = accounts[accountId];
+    if (entry)
+        return { id: accountId, home: canonical(effectiveAccountHome(entry, hostname).home) };
+    if (RESERVED_ACCOUNT_IDS.has(accountId)) {
+        throw new Error(`Refusing account id ${accountId}. It is reserved and no ${provider} account uses it.`);
+    }
+    return null;
+}
+function canonicalHome(home, homedir) {
+    return canonicalizeHome(home, {
+        homedir,
+        realpathSync: (target) => fs.realpathSync(target),
+        existsSync: (target) => fs.existsSync(target),
+    });
+}
 function handlerDeps(printJson) {
     return {
         automaticBalanceMoveHistoryReason: () => unused("automaticBalanceMoveHistoryReason"),
@@ -59,8 +105,8 @@ function loginCtx(input, hqRoot) {
         hostname: () => input.hostname ?? os.hostname(),
         homedir: input.homedir ?? os.homedir,
         existsSync: (target) => fs.existsSync(target),
-        spawnLogin: input.spawnLogin ?? defaultSpawnLogin,
-        probeProvider: input.probeProvider ?? defaultProbe,
+        spawnLogin: defaultHomeEnv(input.spawnLogin ?? defaultSpawnLogin, input.homedir ?? os.homedir),
+        probeProvider: defaultHomeProbe(input.probeProvider ?? defaultProbe, input.homedir ?? os.homedir),
     };
     return new Proxy(fields, {
         get(target, prop) {
@@ -72,6 +118,27 @@ function loginCtx(input, hqRoot) {
         },
     });
 }
+/**
+ * Claude Code keys its Keychain item on CLAUDE_CONFIG_DIR. The default home
+ * keeps the plain `Claude Code-credentials` item only when the variable is
+ * unset, so a sign-in into ~/.claude runs without it.
+ */
+function defaultHomeEnv(spawnLogin, homedir) {
+    return (opts) => spawnLogin({ ...opts, env: withoutDefaultClaudeDir(opts.env, homedir) });
+}
+/** The sign-in check reads the same Keychain item the sign-in wrote. */
+function defaultHomeProbe(probe, homedir) {
+    return (command, args, env) => probe(command, args, withoutDefaultClaudeDir(env, homedir));
+}
+function withoutDefaultClaudeDir(env, homedir) {
+    const configDir = env.CLAUDE_CONFIG_DIR;
+    if (!configDir || canonicalHome(configDir, homedir) !== canonicalHome(DEFAULT_ACCOUNT_HOMES.claude, homedir)) {
+        return env;
+    }
+    const next = { ...env };
+    delete next.CLAUDE_CONFIG_DIR;
+    return next;
+}
 function defaultSpawnLogin(opts) {
     return new Promise((resolve, reject) => {
         const child = spawn(opts.command, opts.args, {

package/dist/lib/capacity/route.d.ts

@@ -1,6 +1,6 @@
 import type { LaneRecord, LaneState, LanesConfig } from "../lanes/types.js";
 import { type LaneProvider } from "../lanes/types.js";
-import type { NowLimit, NowView } from "./ledger.js";
+import { type NowLimit, type NowView } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export declare const ROUTE_PROVIDERS: readonly LaneProvider[];
 /** Lane states that count against an account's live load. */

package/dist/lib/capacity/route.js

@@ -15,6 +15,7 @@
  */
 import { canonicalizeHome } from "../lanes/config.js";
 import { LANE_PROVIDERS } from "../lanes/types.js";
+import { capacityLoginCommand } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export const ROUTE_PROVIDERS = LANE_PROVIDERS;
 /** Lane states that count against an account's live load. */
@@ -225,7 +226,10 @@ export function pickAccount(input) {
                 skipped.push({
                     ...base,
                     reason: account.reason ?? `sign-in ${authState}`,
-                    fix: account.fixCommand ?? null,
+                    // Every signed-out reason (revoked, missing credential, missing
+                    // scope, auth-failed lane) is fixed by signing the lane account in
+                    // again, so the fix names the registry id lanes use.
+                    fix: capacityLoginCommand(providerId, laneMatch.id),
                 });
                 continue;
             }
@@ -250,6 +254,17 @@ export function pickAccount(input) {
                 });
                 continue;
             }
+            // The ledger sets usageStale when the sign-in expired and no reading has
+            // landed since the expiry. The limits on file describe the old token, so
+            // the account cannot be ranked on them.
+            if (account.usageStale === true) {
+                skipped.push({
+                    ...base,
+                    reason: "no fresh reading (sign-in expired)",
+                    fix: account.fixCommand ?? null,
+                });
+                continue;
+            }
             const applicable = (account.limits ?? []).filter((l) => limitApplies(providerId, l, model));
             const viewRows = applicable.map((limit) => {
                 const resetMs = limit.resetsAt ? Date.parse(limit.resetsAt) : NaN;

package/dist/lib/capacity/sign-in.d.ts

@@ -88,6 +88,18 @@ export interface CapacityLoginResult {
     json?: unknown;
 }
 export declare function executeCapacityLogin(request: CapacityLoginRequest, deps: CapacityLoginDeps): Promise<CapacityLoginResult>;
+export interface RepairFixed {
+    provider: string;
+    label: string;
+    account: string;
+    home: string;
+}
+export interface RepairSkipped {
+    provider: string;
+    label: string;
+    reason: string;
+    fix: string | null;
+}
 export declare function organizationFor(view: NowView, provider: string, home: string): string | null;
 export declare function renameCapacityAccount(hqRoot: string, providerRaw: string, fromRaw: string, toRaw: string, options?: {
     force?: boolean;

package/dist/lib/capacity/sign-in.js

@@ -278,8 +278,11 @@ export async function executeCapacityLogin(request, deps) {
     if (request.account && !request.provider) {
         throw new SignInUsageError("Pass a provider before --account.");
     }
+    // A reserved id (a, default) is accepted here so a registered account can
+    // sign in again into its home. The lane login refuses one that names no
+    // registered account.
     if (request.account)
-        assertRegistryAccountId(request.account);
+        assertAccountIdShape(request.account);
     const providerFilter = request.provider;
     const wantsSignIn = Boolean(request.provider || request.account || request.repair);
     if (!request.interactive && wantsSignIn && !request.json) {
@@ -308,19 +311,69 @@ export async function executeCapacityLogin(request, deps) {
     }
     return { exitCode: 0, text: lines.join("\n\n") };
 }
+/**
+ * Signs in again for each signed-out account, one at a time, in roster order.
+ * A failed sign-in is reported and the next account still runs. Expired
+ * accounts are reported as skipped: opening the account refreshes them.
+ */
 async function runRepair(request, deps) {
     const plan = repairSelection(deps.rows, request.provider);
     const lines = [formatRepairPlan(plan)];
+    const fixed = [];
+    const skipped = [];
     for (const row of plan.signedOut) {
-        if (row.label === "default" || RESERVED_IDS.has(row.label)) {
-            lines.push(`${row.provider} ${row.label}: ${defaultVendorLogin(row.provider)}`);
+        const fix = row.command ?? `hq capacity login ${row.provider} --account ${row.label}`;
+        let logged;
+        try {
+            logged = await deps.loginAccount(row.provider, row.label);
+        }
+        catch (err) {
+            skipped.push({ provider: row.provider, label: row.label, reason: errorText(err), fix });
             continue;
         }
-        const logged = await deps.loginAccount(row.provider, row.label);
-        const view = await deps.readAccount(row.provider, row.label, logged.home);
-        lines.push(deps.formatReading(view, row.provider, row.label, logged.home));
+        fixed.push({ provider: row.provider, label: row.label, account: logged.id, home: logged.home });
+        try {
+            const view = await deps.readAccount(row.provider, logged.id, logged.home);
+            lines.push(deps.formatReading(view, row.provider, row.label, logged.home));
+        }
+        catch (err) {
+            lines.push(`${row.provider} ${row.label}: signed in; usage read failed: ${errorText(err)}`);
+        }
     }
-    return { exitCode: 0, text: lines.join("\n\n") };
+    for (const row of plan.expired) {
+        skipped.push({
+            provider: row.provider,
+            label: row.label,
+            reason: row.reason ?? EXPIRED_REASON,
+            fix: row.command ? formatRefreshLine(row.provider, row.command) : null,
+        });
+    }
+    lines.push(formatRepairSummary(fixed, skipped));
+    const failed = skipped.some((item) => plan.signedOut.some((row) => row.provider === item.provider && row.label === item.label));
+    return {
+        exitCode: failed ? 1 : 0,
+        text: lines.join("\n\n"),
+        json: { repair: { fixed, skipped } },
+    };
+}
+function formatRepairSummary(fixed, skipped) {
+    const lines = ["Fixed:"];
+    if (fixed.length === 0)
+        lines.push("  none");
+    for (const item of fixed)
+        lines.push(`  ${item.provider} ${item.label}`);
+    lines.push("Skipped:");
+    if (skipped.length === 0)
+        lines.push("  none");
+    for (const item of skipped) {
+        lines.push(`  ${item.provider} ${item.label}: ${item.reason}`);
+        if (item.fix)
+            lines.push(`    ${item.fix}`);
+    }
+    return lines.join("\n");
+}
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
 }
 async function signInOne(provider, account, deps) {
     const id = account ?? deps.newAccountId();
@@ -489,20 +542,16 @@ function isAncestor(parent, child) {
     const relative = path.relative(parent, child);
     return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
 }
+function assertAccountIdShape(id) {
+    if (!ID_PATTERN.test(id)) {
+        throw new SignInUsageError("Account id must start with a letter or number and contain only letters, numbers, dots, underscores, or hyphens.");
+    }
+}
 function assertRegistryAccountId(id) {
     if (!ID_PATTERN.test(id) || RESERVED_IDS.has(id)) {
         throw new SignInUsageError("Account id must start with a letter or number, contain only letters, numbers, dots, underscores, or hyphens, and must not be reserved (a, default).");
     }
 }
-function defaultVendorLogin(provider) {
-    if (provider === "claude")
-        return "claude auth login";
-    if (provider === "codex")
-        return "codex login";
-    if (provider === "grok")
-        return "grok login";
-    return `hq capacity login ${provider}`;
-}
 function requiredId(value, name) {
     const id = value.trim();
     if (!id || id !== value)

package/dist/lib/daemon/catalog.d.ts

@@ -87,6 +87,8 @@ export interface PlanContext {
     platform: NodeJS.Platform;
     home: string;
     hqRoot: string | undefined;
+    /** Daemon-owned request directory consumed by the hq-cloud watch runner. */
+    syncPassRequestsDir: string;
     /** hq-cloud's sync-runner.js, or null when it cannot be found. */
     syncRunnerPath: string | null;
     /** hq-cloud's `hq-outpost-heartbeat` bin, when the hq-cloud in use has one. */

package/dist/lib/daemon/catalog.js

@@ -142,7 +142,7 @@ function planService(service, ctx) {
                         SYNC_RUNNER_OWNER,
                     ],
                 },
-                env: { ...ctx.legacySyncEnv },
+                env: { ...ctx.legacySyncEnv, HQ_SYNC_PASS_REQUEST_DIR: ctx.syncPassRequestsDir },
                 heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
             });
             let ownerBlock;

package/dist/lib/daemon/paths.d.ts

@@ -11,6 +11,8 @@ export interface DaemonPaths {
     lockPath: string;
     logsDir: string;
     requestsDir: string;
+    /** One-shot sync passes queued for the running hq-cloud watch runner. */
+    syncPassRequestsDir: string;
     supervisorLogPath: string;
     unitLogPath: (unitId: string) => string;
     /** The FIFO a unit that speaks the sync protocol writes its stdout to (see protocol-tail.ts); kept out of logs/ so nothing reading logs drains it. */

package/dist/lib/daemon/paths.js

@@ -17,6 +17,7 @@ export function daemonPaths(home = os.homedir(), env = process.env) {
         lockPath: path.join(root, "daemon.pid"),
         logsDir,
         requestsDir: path.join(root, "requests"),
+        syncPassRequestsDir: path.resolve(root, "sync-pass-requests"),
         supervisorLogPath: path.join(logsDir, "daemon.log"),
         unitLogPath: (unitId) => path.join(logsDir, `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.log`),
         unitProtocolPath: (unitId) => path.join(root, "protocol", `${unitId.replace(/[^A-Za-z0-9_.-]/g, "-")}.fifo`),

package/dist/lib/daemon/run.js

@@ -451,6 +451,7 @@ export async function runDaemon(opts) {
     const home = opts.home ?? os.homedir();
     const platform = process.platform;
     const paths = daemonPaths(home, env);
+    ensurePrivateDir(paths.syncPassRequestsDir);
     const log = makeLogger(paths, opts.foreground === true);
     const syncRunnerBundleDirectory = opts.syncRunnerBundleDirectory ?? path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../hq-cloud-sync-runner");
     const cliPackageRoot = opts.cliPackageRoot === undefined ? resolveRunningInstall().packageRoot : opts.cliPackageRoot;
@@ -835,6 +836,7 @@ export async function runDaemon(opts) {
             platform,
             home,
             hqRoot,
+            syncPassRequestsDir: paths.syncPassRequestsDir,
             syncRunnerPath: runners.syncRunner,
             heartbeatRunnerPath: runners.heartbeat,
             sessionHostRunnerPath: runners.sessionHost,

package/dist/lib/daemon/supervisor.d.ts

@@ -63,6 +63,8 @@ interface UnitState {
     lastResult?: "ok" | "failed";
     lastHeartbeatAt?: string;
     lastPassResult?: ReturnType<typeof syncPassResult>;
+    /** The pass-request folder the running child was started with; absent when it was not. */
+    passRequestDir?: string;
 }
 /** An app that runs the daemon as its own child process instead of an OS unit. */
 export type HostApp = "desktop";

package/dist/lib/daemon/supervisor.js

@@ -37,6 +37,33 @@ const MESH_OWNER_LOG_INTERVAL_MS = 10 * 60_000;
 export const HANDOFF_STAGGER_MS = 15_000;
 /** How long a draining unit may take to finish its work before it gets SIGTERM. */
 export const HANDOFF_DRAIN_MAX_MS = 15 * 60_000;
+const PASS_REQUEST_DIR_ENV = "HQ_SYNC_PASS_REQUEST_DIR";
+function passRequestDirOf(env) {
+    const dir = env?.[PASS_REQUEST_DIR_ENV];
+    return dir ? dir : undefined;
+}
+/** An adopted child carries no env, only the key it was started with (see planKey). */
+function passRequestDirFromKey(key) {
+    try {
+        const fields = JSON.parse(key);
+        if (!Array.isArray(fields))
+            return undefined;
+        const env = fields[6];
+        if (!env || typeof env !== "object" || Array.isArray(env))
+            return undefined;
+        const dir = env[PASS_REQUEST_DIR_ENV];
+        return typeof dir === "string" && dir ? dir : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function recordPassRequestDir(state, dir) {
+    if (dir)
+        state.passRequestDir = dir;
+    else
+        delete state.passRequestDir;
+}
 /** Plan reads in a row that must find a running remote-control host blocked before it is paused. */
 const BLOCKED_READS_BEFORE_PAUSE = 2;
 function backoffMs(attempt) {
@@ -560,6 +587,7 @@ export function createSupervisor(deps) {
         }
         slot.child = child;
         slot.childKey = slot.key;
+        recordPassRequestDir(slot.state, passRequestDirOf(slot.plan.env));
         slot.childStartedAt = now();
         slot.state.status = "running";
         slot.state.startedAt = slot.childStartedAt;
@@ -651,6 +679,7 @@ export function createSupervisor(deps) {
         }
         slot.child = child;
         slot.childKey = slot.key;
+        recordPassRequestDir(slot.state, passRequestDirOf(slot.plan.env));
         slot.childStartedAt = now();
         slot.state.status = "running";
         delete slot.state.reason;
@@ -880,6 +909,7 @@ export function createSupervisor(deps) {
             slot.adopted = true;
             slot.child = unit.child;
             slot.childKey = unit.key;
+            recordPassRequestDir(slot.state, passRequestDirFromKey(unit.key));
             slot.childStartedAt = now();
             slot.state.status = "running";
             slot.state.startedAt = slot.childStartedAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.112",
+  "version": "5.345.114",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {