@indigoai-us/hq-cli 5.345.113 → 5.345.115

package/dist/lib/capacity/lane-login.js

@@ -10,30 +10,76 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { createLaneAccountsHandlers } from "../../commands/lanes-accounts.js";
+import { effectiveAccountHome } from "../lanes/account-home.js";
+import { canonicalizeHome, DEFAULT_ACCOUNT_HOMES, loadLanesConfig } from "../lanes/config.js";
 import { resolveLanesHqRoot } from "../lanes/hq-root.js";
 import { defaultProbe } from "../lanes/models.js";
+import { parseLaneProvider } from "../lanes/types.js";
 const ACCOUNT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const RESERVED_ACCOUNT_IDS = new Set(["a", "default"]);
 export async function loginLaneAccount(input) {
-    if (!ACCOUNT_ID_PATTERN.test(input.accountId) || RESERVED_ACCOUNT_IDS.has(input.accountId)) {
-        throw new Error(`Refusing account id ${input.accountId}. Use letters, numbers, dots, underscores, or hyphens, and not a reserved id.`);
+    if (!ACCOUNT_ID_PATTERN.test(input.accountId)) {
+        throw new Error(`Refusing account id ${input.accountId}. Use letters, numbers, dots, underscores, or hyphens.`);
     }
     const hqRoot = input.hqRoot ?? resolveLanesHqRoot({ env: input.env });
+    const provider = parseLaneProvider(input.provider);
+    const homedir = input.homedir ?? os.homedir;
+    const hostname = input.hostname ?? os.hostname();
+    const existing = existingAccount(hqRoot, provider, input.accountId, hostname, homedir);
     let captured;
     const handlers = createLaneAccountsHandlers(handlerDeps((value) => {
         captured = value;
     }));
     // One registry write. capacityOnly stores enabled:false and the capacity-only
     // reason in that write, re-checking whether lanes already use the account.
-    await handlers.runAccountsLogin(loginCtx(input, hqRoot), input.provider, input.accountId, {
+    // A registered id signs in again into the home the registry already names.
+    await handlers.runAccountsLogin(loginCtx(input, hqRoot), provider, existing?.id ?? input.accountId, {
         capacityOnly: true,
     });
     const account = captured?.account;
     if (!account?.id || !account.home) {
-        throw new Error(`lanes accounts login did not register ${input.provider} ${input.accountId}`);
+        throw new Error(`lanes accounts login did not register ${provider} ${input.accountId}`);
+    }
+    if (existing && (account.id !== existing.id || account.home !== existing.home)) {
+        throw new Error(`Sign-in for ${provider} ${existing.id} moved it to ${account.id} at ${account.home}; expected ${existing.home}`);
     }
     return { id: account.id, home: account.home };
 }
+/**
+ * The registry account an id names, with the home lanes use on this host.
+ * `default` names the account registered at the provider's default home.
+ * Reserved ids sign in again only when they name a registered account, so a
+ * new account never takes `a` or `default`.
+ */
+function existingAccount(hqRoot, provider, accountId, hostname, homedir) {
+    const accounts = loadLanesConfig(hqRoot).providers[provider].accounts;
+    const canonical = (home) => canonicalHome(home, homedir);
+    if (accountId === "default") {
+        const defaultHome = canonical(DEFAULT_ACCOUNT_HOMES[provider]);
+        for (const [id, entry] of Object.entries(accounts)) {
+            if (!entry)
+                continue;
+            const home = canonical(effectiveAccountHome(entry, hostname).home);
+            if (home === defaultHome)
+                return { id, home };
+        }
+        throw new Error(`No ${provider} account is registered at the default home. Run hq capacity login ${provider} to add one.`);
+    }
+    const entry = accounts[accountId];
+    if (entry)
+        return { id: accountId, home: canonical(effectiveAccountHome(entry, hostname).home) };
+    if (RESERVED_ACCOUNT_IDS.has(accountId)) {
+        throw new Error(`Refusing account id ${accountId}. It is reserved and no ${provider} account uses it.`);
+    }
+    return null;
+}
+function canonicalHome(home, homedir) {
+    return canonicalizeHome(home, {
+        homedir,
+        realpathSync: (target) => fs.realpathSync(target),
+        existsSync: (target) => fs.existsSync(target),
+    });
+}
 function handlerDeps(printJson) {
     return {
         automaticBalanceMoveHistoryReason: () => unused("automaticBalanceMoveHistoryReason"),
@@ -59,8 +105,8 @@ function loginCtx(input, hqRoot) {
         hostname: () => input.hostname ?? os.hostname(),
         homedir: input.homedir ?? os.homedir,
         existsSync: (target) => fs.existsSync(target),
-        spawnLogin: input.spawnLogin ?? defaultSpawnLogin,
-        probeProvider: input.probeProvider ?? defaultProbe,
+        spawnLogin: defaultHomeEnv(input.spawnLogin ?? defaultSpawnLogin, input.homedir ?? os.homedir),
+        probeProvider: defaultHomeProbe(input.probeProvider ?? defaultProbe, input.homedir ?? os.homedir),
     };
     return new Proxy(fields, {
         get(target, prop) {
@@ -72,6 +118,27 @@ function loginCtx(input, hqRoot) {
         },
     });
 }
+/**
+ * Claude Code keys its Keychain item on CLAUDE_CONFIG_DIR. The default home
+ * keeps the plain `Claude Code-credentials` item only when the variable is
+ * unset, so a sign-in into ~/.claude runs without it.
+ */
+function defaultHomeEnv(spawnLogin, homedir) {
+    return (opts) => spawnLogin({ ...opts, env: withoutDefaultClaudeDir(opts.env, homedir) });
+}
+/** The sign-in check reads the same Keychain item the sign-in wrote. */
+function defaultHomeProbe(probe, homedir) {
+    return (command, args, env) => probe(command, args, withoutDefaultClaudeDir(env, homedir));
+}
+function withoutDefaultClaudeDir(env, homedir) {
+    const configDir = env.CLAUDE_CONFIG_DIR;
+    if (!configDir || canonicalHome(configDir, homedir) !== canonicalHome(DEFAULT_ACCOUNT_HOMES.claude, homedir)) {
+        return env;
+    }
+    const next = { ...env };
+    delete next.CLAUDE_CONFIG_DIR;
+    return next;
+}
 function defaultSpawnLogin(opts) {
     return new Promise((resolve, reject) => {
         const child = spawn(opts.command, opts.args, {

package/dist/lib/capacity/route.d.ts

@@ -1,6 +1,6 @@
 import type { LaneRecord, LaneState, LanesConfig } from "../lanes/types.js";
 import { type LaneProvider } from "../lanes/types.js";
-import type { NowLimit, NowView } from "./ledger.js";
+import { type NowLimit, type NowView } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export declare const ROUTE_PROVIDERS: readonly LaneProvider[];
 /** Lane states that count against an account's live load. */

package/dist/lib/capacity/route.js

@@ -15,6 +15,7 @@
  */
 import { canonicalizeHome } from "../lanes/config.js";
 import { LANE_PROVIDERS } from "../lanes/types.js";
+import { capacityLoginCommand } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export const ROUTE_PROVIDERS = LANE_PROVIDERS;
 /** Lane states that count against an account's live load. */
@@ -225,7 +226,10 @@ export function pickAccount(input) {
                 skipped.push({
                     ...base,
                     reason: account.reason ?? `sign-in ${authState}`,
-                    fix: account.fixCommand ?? null,
+                    // Every signed-out reason (revoked, missing credential, missing
+                    // scope, auth-failed lane) is fixed by signing the lane account in
+                    // again, so the fix names the registry id lanes use.
+                    fix: capacityLoginCommand(providerId, laneMatch.id),
                 });
                 continue;
             }

package/dist/lib/capacity/sign-in.d.ts

@@ -88,6 +88,18 @@ export interface CapacityLoginResult {
     json?: unknown;
 }
 export declare function executeCapacityLogin(request: CapacityLoginRequest, deps: CapacityLoginDeps): Promise<CapacityLoginResult>;
+export interface RepairFixed {
+    provider: string;
+    label: string;
+    account: string;
+    home: string;
+}
+export interface RepairSkipped {
+    provider: string;
+    label: string;
+    reason: string;
+    fix: string | null;
+}
 export declare function organizationFor(view: NowView, provider: string, home: string): string | null;
 export declare function renameCapacityAccount(hqRoot: string, providerRaw: string, fromRaw: string, toRaw: string, options?: {
     force?: boolean;

package/dist/lib/capacity/sign-in.js

@@ -278,8 +278,11 @@ export async function executeCapacityLogin(request, deps) {
     if (request.account && !request.provider) {
         throw new SignInUsageError("Pass a provider before --account.");
     }
+    // A reserved id (a, default) is accepted here so a registered account can
+    // sign in again into its home. The lane login refuses one that names no
+    // registered account.
     if (request.account)
-        assertRegistryAccountId(request.account);
+        assertAccountIdShape(request.account);
     const providerFilter = request.provider;
     const wantsSignIn = Boolean(request.provider || request.account || request.repair);
     if (!request.interactive && wantsSignIn && !request.json) {
@@ -308,19 +311,69 @@ export async function executeCapacityLogin(request, deps) {
     }
     return { exitCode: 0, text: lines.join("\n\n") };
 }
+/**
+ * Signs in again for each signed-out account, one at a time, in roster order.
+ * A failed sign-in is reported and the next account still runs. Expired
+ * accounts are reported as skipped: opening the account refreshes them.
+ */
 async function runRepair(request, deps) {
     const plan = repairSelection(deps.rows, request.provider);
     const lines = [formatRepairPlan(plan)];
+    const fixed = [];
+    const skipped = [];
     for (const row of plan.signedOut) {
-        if (row.label === "default" || RESERVED_IDS.has(row.label)) {
-            lines.push(`${row.provider} ${row.label}: ${defaultVendorLogin(row.provider)}`);
+        const fix = row.command ?? `hq capacity login ${row.provider} --account ${row.label}`;
+        let logged;
+        try {
+            logged = await deps.loginAccount(row.provider, row.label);
+        }
+        catch (err) {
+            skipped.push({ provider: row.provider, label: row.label, reason: errorText(err), fix });
             continue;
         }
-        const logged = await deps.loginAccount(row.provider, row.label);
-        const view = await deps.readAccount(row.provider, row.label, logged.home);
-        lines.push(deps.formatReading(view, row.provider, row.label, logged.home));
+        fixed.push({ provider: row.provider, label: row.label, account: logged.id, home: logged.home });
+        try {
+            const view = await deps.readAccount(row.provider, logged.id, logged.home);
+            lines.push(deps.formatReading(view, row.provider, row.label, logged.home));
+        }
+        catch (err) {
+            lines.push(`${row.provider} ${row.label}: signed in; usage read failed: ${errorText(err)}`);
+        }
     }
-    return { exitCode: 0, text: lines.join("\n\n") };
+    for (const row of plan.expired) {
+        skipped.push({
+            provider: row.provider,
+            label: row.label,
+            reason: row.reason ?? EXPIRED_REASON,
+            fix: row.command ? formatRefreshLine(row.provider, row.command) : null,
+        });
+    }
+    lines.push(formatRepairSummary(fixed, skipped));
+    const failed = skipped.some((item) => plan.signedOut.some((row) => row.provider === item.provider && row.label === item.label));
+    return {
+        exitCode: failed ? 1 : 0,
+        text: lines.join("\n\n"),
+        json: { repair: { fixed, skipped } },
+    };
+}
+function formatRepairSummary(fixed, skipped) {
+    const lines = ["Fixed:"];
+    if (fixed.length === 0)
+        lines.push("  none");
+    for (const item of fixed)
+        lines.push(`  ${item.provider} ${item.label}`);
+    lines.push("Skipped:");
+    if (skipped.length === 0)
+        lines.push("  none");
+    for (const item of skipped) {
+        lines.push(`  ${item.provider} ${item.label}: ${item.reason}`);
+        if (item.fix)
+            lines.push(`    ${item.fix}`);
+    }
+    return lines.join("\n");
+}
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
 }
 async function signInOne(provider, account, deps) {
     const id = account ?? deps.newAccountId();
@@ -489,20 +542,16 @@ function isAncestor(parent, child) {
     const relative = path.relative(parent, child);
     return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
 }
+function assertAccountIdShape(id) {
+    if (!ID_PATTERN.test(id)) {
+        throw new SignInUsageError("Account id must start with a letter or number and contain only letters, numbers, dots, underscores, or hyphens.");
+    }
+}
 function assertRegistryAccountId(id) {
     if (!ID_PATTERN.test(id) || RESERVED_IDS.has(id)) {
         throw new SignInUsageError("Account id must start with a letter or number, contain only letters, numbers, dots, underscores, or hyphens, and must not be reserved (a, default).");
     }
 }
-function defaultVendorLogin(provider) {
-    if (provider === "claude")
-        return "claude auth login";
-    if (provider === "codex")
-        return "codex login";
-    if (provider === "grok")
-        return "grok login";
-    return `hq capacity login ${provider}`;
-}
 function requiredId(value, name) {
     const id = value.trim();
     if (!id || id !== value)

package/dist/lib/daemon/catalog.d.ts

@@ -121,8 +121,6 @@ export interface PlanContext {
     legacyOwner: (unitId: string) => string | null;
     /** This CLI is a global install the updater can replace (not a project dependency). */
     cliSelfUpdatable: boolean;
-    /** `<hqRoot>/core/scripts/outpost-jobs-reconcile.sh` when it exists. */
-    jobsReconcileScript: string | null;
     /** Absolute paths of the claude and tmux binaries, or null when not installed. */
     claudePath: string | null;
     tmuxPath: string | null;

package/dist/lib/daemon/catalog.js

@@ -279,21 +279,18 @@ function planService(service, ctx) {
         case "jobs-reconcile": {
             if (ctx.platform === "win32")
                 return [unavailable(service, "needs bash; not supported on Windows")];
-            const script = ctx.jobsReconcileScript;
             return [
                 base(service, {
                     kind: "scheduled",
                     intervalSec: 600,
                     initialDelaySec: 600,
                     command: {
-                        type: "exec",
-                        file: "bash",
-                        args: [script ?? "", "--hq-root", ctx.hqRoot ?? "", "--ensure-hook", "--after-sync"],
+                        type: "hq",
+                        args: ["core", "--hq-root", ctx.hqRoot ?? "", "jobs", "reconcile", "--ensure-hook", "--after-sync"],
                     },
-                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot, HQ_NO_UPDATE_CHECK: "1" } : { HQ_NO_UPDATE_CHECK: "1" },
                     blocked: firstBlock([
                         [!ctx.hqRoot, NO_HQ_ROOT],
-                        [!script, "this HQ folder has no core/scripts/outpost-jobs-reconcile.sh"],
                     ]),
                 }),
             ];

package/dist/lib/daemon/run.js

@@ -350,12 +350,6 @@ export function desktopAppManagesSync(opts) {
         return false;
     return opts.legacy.some((u) => u.service === "sync" && !u.migratable) || opts.appRunning();
 }
-function jobsReconcileScript(hqRoot) {
-    if (!hqRoot)
-        return null;
-    const script = path.join(hqRoot, "core", "scripts", "outpost-jobs-reconcile.sh");
-    return fs.existsSync(script) ? script : null;
-}
 function signedIn(env, home, log) {
     if (fs.existsSync(agentKitPaths(home, env).machineCredsPath))
         return true;
@@ -859,7 +853,6 @@ export async function runDaemon(opts) {
             bots: listLocalBots(),
             legacyOwner: legacyOwnerLookup(legacy),
             cliSelfUpdatable: updatable,
-            jobsReconcileScript: jobsReconcileScript(hqRoot),
             claudePath: findUserBinary("claude", env, home),
             codexPath: findUserBinary("codex", env, home),
             codexRunnerScript: platform === "linux" && fs.existsSync(CODEX_RUNNER_SCRIPT) ? CODEX_RUNNER_SCRIPT : null,

package/dist/utils/resident-package-preload.js

@@ -42,7 +42,7 @@ export const RESIDENT_PACKAGE_MODULES = {
     "bot-logs-follow": [],
     mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../lib/anywhere-person-setting.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client"],
     childWrapper: ["../main.js", "../lib/service-manager/startup-migration.js", "../commands/storage-gate.js", "../lib/storage-feature-flag.js"],
-    coreJobRun: ["../commands/core-native-jobs-flag.js", "../commands/core-native-family-flag.js", "../lib/flag-registry.js", "../lib/flag-snapshot-file.js"],
+    coreJobRun: [],
     "daemon-call": ["../lib/daemon/protocol.js"],
     daemon: [
         "../sentry.js",
@@ -204,12 +204,7 @@ const LOADERS = {
         () => import("../commands/storage-gate.js"),
         () => import("../lib/storage-feature-flag.js"),
     ],
-    coreJobRun: [
-        () => import("../commands/core-native-jobs-flag.js"),
-        () => import("../commands/core-native-family-flag.js"),
-        () => import("../lib/flag-registry.js"),
-        () => import("../lib/flag-snapshot-file.js"),
-    ],
+    coreJobRun: [],
     "daemon-call": [
         () => import("../lib/daemon/protocol.js"),
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.113",
+  "version": "5.345.115",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {