@indigoai-us/hq-cli 5.345.145 → 5.345.147

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.82","bundleSha256":"0bf6cd65150094c035cb4ee532c00bde78d030ad0d2132aa606c566f11997f41","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.87","bundleSha256":"916fb28a230f0f0dd83cfaa87366670512898636a137c74a4c989a261301cf5e","formatVersion":1}

package/dist/lib/bot/daemon.js

@@ -77,6 +77,8 @@ export function renderBotLaunchdPlist(p) {
         ["HOME", p.home],
         ["PATH", p.pathEntries.join(":")],
         ["HQ_NO_UPDATE_CHECK", "1"],
+        // Bots must never replace/relaunch the interactive desktop, including during setup.
+        ["HQ_NO_ENSURE_HQ_DESKTOP", "1"],
         ...(p.hqRoot ? [["HQ_ROOT", p.hqRoot]] : []),
     ]
         .map(([k, v]) => `    <key>${escapeXml(k)}</key>\n    <string>${escapeXml(v)}</string>`)
@@ -135,6 +137,7 @@ RestartSec=5
 Environment=HOME=${p.home}
 Environment=PATH=${p.pathEntries.join(":")}
 Environment=HQ_NO_UPDATE_CHECK=1
+Environment=HQ_NO_ENSURE_HQ_DESKTOP=1
 ${p.hqRoot ? `Environment=HQ_ROOT=${p.hqRoot}\n` : ""}StandardOutput=append:${p.logPath}
 StandardError=append:${p.logPath}
 

package/dist/lib/bot/runtime/index.js

@@ -345,7 +345,9 @@ export async function runRuntimeTurn(runtime, input, deps = {}) {
     const recheck = memo !== undefined && (nowMs() - memo.at >= MODEL_FALLBACK_RECHECK_MS || memo.turns >= MODEL_FALLBACK_RECHECK_TURNS);
     const remembered = memo && !recheck ? memo : undefined;
     const args = runtime.buildArgs(remembered ? { ...turnInput, model: remembered.to } : turnInput, { outputFile, newSessionId });
-    const env = input.env ?? deps.env ?? process.env;
+    // Enforce at the model boundary too: old plists and direct `bot run` callers
+    // may lack the guard. A bot prompt must never quit the user's desktop app.
+    const env = { ...(input.env ?? deps.env ?? process.env), HQ_NO_ENSURE_HQ_DESKTOP: "1" };
     const binary = runtime.resolveBinary?.(env, input.cwd, turnInput.platform) ?? runtime.binary;
     const stdin = runtime.stdinInput?.(turnInput);
     const protocol = runtime.spawnProtocol?.(turnInput);

package/dist/lib/capacity/route.d.ts

@@ -1,6 +1,6 @@
 import type { LaneRecord, LaneState, LanesConfig } from "../lanes/types.js";
 import { type LaneProvider } from "../lanes/types.js";
-import { type NowLimit, type NowView } from "./ledger.js";
+import { type NowAccount, type NowLimit, type NowView } from "./ledger.js";
 /** All lane providers, in the stable order boss-route uses for ranking ties. */
 export declare const ROUTE_PROVIDERS: readonly LaneProvider[];
 /** Lane states that count against an account's live load. */
@@ -28,6 +28,12 @@ export declare const OLD_READING_PENALTY = 10;
  * view stale). Sits below any account with fresh known headroom.
  */
 export declare const UNKNOWN_USAGE_SCORE = -100;
+/**
+ * Score for an account whose plan limit is used up but which still runs on
+ * paid extra usage. Ranked only with --allow-extra-usage, below every account
+ * with plan room or unknown usage.
+ */
+export declare const EXTRA_USAGE_SCORE = -200;
 /** Default --floor applied by the CLI (percent headroom to clear). */
 export declare const DEFAULT_FLOOR = 15;
 /** Default --prefer order applied by the CLI. */
@@ -85,6 +91,8 @@ export interface RouteRanked {
     lane_flags: string;
     /** True when no usable reading exists and the account is ranked as unknown. */
     usage_unknown: boolean;
+    /** True when a plan limit is used up and the lane would spend paid extra usage. */
+    extra_usage?: boolean;
 }
 /** Live lane on an account the router would avoid; command names a replacement. */
 export interface RouteMove {
@@ -130,6 +138,12 @@ export interface PickAccountInput {
     capacityStale?: boolean;
     /** Error summary when the lanes list could not be read. */
     lanesError?: string | null;
+    /**
+     * Owner opt-in (2026-10-17): rank an account whose plan limit is used up
+     * but whose Claude extra usage is enabled and not capped. Off by default so
+     * lanes never spend paid usage without being asked to.
+     */
+    allowExtraUsage?: boolean;
 }
 export declare class RouteUsageError extends Error {
     readonly code = "route_usage";
@@ -141,6 +155,12 @@ export declare function resolveRequestedProviders(raw: readonly string[] | undef
 export declare function resolvePreferOrder(raw: readonly string[] | undefined): LaneProvider[];
 /** Parse `--floor <n>`; 0..100 inclusive, default DEFAULT_FLOOR when missing. */
 export declare function resolveFloor(raw: string | number | undefined): number;
+/**
+ * True when the account's Claude extra usage reading says the provider will
+ * keep serving it after a plan limit runs out: enabled, not at its monthly
+ * cap, and not stopped by a spend control.
+ */
+export declare function hasExtraUsageRoom(account: NowAccount): boolean;
 /**
  * Pure routing decision over a snapshot: scores every signed-in lane account,
  * applies the --prefer order under the --floor headroom, returns the pick (or

package/dist/lib/capacity/route.js

@@ -47,6 +47,12 @@ export const OLD_READING_PENALTY = 10;
  * view stale). Sits below any account with fresh known headroom.
  */
 export const UNKNOWN_USAGE_SCORE = -100;
+/**
+ * Score for an account whose plan limit is used up but which still runs on
+ * paid extra usage. Ranked only with --allow-extra-usage, below every account
+ * with plan room or unknown usage.
+ */
+export const EXTRA_USAGE_SCORE = -200;
 /** Default --floor applied by the CLI (percent headroom to clear). */
 export const DEFAULT_FLOOR = 15;
 /** Default --prefer order applied by the CLI. */
@@ -178,6 +184,27 @@ function liveLaneCount(lanes, provider, account) {
     }
     return count;
 }
+/**
+ * True when the account's Claude extra usage reading says the provider will
+ * keep serving it after a plan limit runs out: enabled, not at its monthly
+ * cap, and not stopped by a spend control.
+ */
+export function hasExtraUsageRoom(account) {
+    const limits = account.limits ?? [];
+    const extra = limits.find((l) => l.kind === "credits" && l.limitId === "extra_usage");
+    if (!extra || extra.hasCredits !== true)
+        return false;
+    if (extra.spendControlReached === true)
+        return false;
+    if (typeof extra.usedPercent === "number" && extra.usedPercent >= 100)
+        return false;
+    const spend = limits.find((l) => l.kind === "credits" && l.limitId === "spend");
+    if (spend?.spendControlReached === true)
+        return false;
+    if (spend && typeof spend.usedPercent === "number" && spend.usedPercent >= 100)
+        return false;
+    return true;
+}
 function limitAgeMs(view, nowMs) {
     if (!view.resetPassed || !view.limit.resetsAt)
         return view.readAge;
@@ -368,9 +395,49 @@ export function pickAccount(input) {
                 && row.readAge <= LIMIT_STALE_MS
                 && (row.limit.state === "exhausted" || (typeof row.used === "number" && row.used >= 100)));
             if (exhausted) {
+                const extraRoom = providerId === "claude" && hasExtraUsageRoom(account);
+                if (extraRoom && input.allowExtraUsage === true) {
+                    const live = liveLaneCount(lanes, providerId, laneMatch.id);
+                    const weekly = applicable.find((l) => l.kind === "weekly_all");
+                    const whyParts = [
+                        `${labelLimit(exhausted.limit)} used up; runs on paid extra usage (--allow-extra-usage)`,
+                    ];
+                    if (live)
+                        whyParts.push(`${live} live lane${live === 1 ? "" : "s"} already on it`);
+                    if (tokenExpired)
+                        whyParts.push("sign-in renews when the lane starts");
+                    ranked.push({
+                        provider: providerId,
+                        account: laneMatch.id,
+                        label,
+                        organization: account.organization ?? null,
+                        headroom: 0,
+                        score: EXTRA_USAGE_SCORE - live * LANE_PENALTY,
+                        live_lanes: live,
+                        reset_soon: false,
+                        token_expired: tokenExpired,
+                        reading_age_h: Math.round(limitAgeMs(exhausted, nowMs) / 36e5),
+                        binding: {
+                            limit: labelLimit(exhausted.limit),
+                            used_percent: typeof exhausted.used === "number" ? exhausted.used : 100,
+                            resets_at: exhausted.limit.resetsAt ?? null,
+                        },
+                        weekly_resets_at: weekly?.resetsAt ?? null,
+                        why: whyParts.join("; "),
+                        lane_flags: `--provider ${providerId} --account ${laneMatch.id}`,
+                        usage_unknown: false,
+                        extra_usage: true,
+                    });
+                    continue;
+                }
                 skipped.push({
                     ...base,
-                    reason: `${labelLimit(exhausted.limit)} used up`,
+                    reason: extraRoom
+                        ? `${labelLimit(exhausted.limit)} used up; extra usage is on`
+                        : `${labelLimit(exhausted.limit)} used up`,
+                    ...(extraRoom
+                        ? { fix: "pass --allow-extra-usage to run on paid extra usage" }
+                        : {}),
                     resets_at: exhausted.limit.resetsAt ?? null,
                 });
                 continue;

package/dist/lib/doctor/checks/release-links.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Release-shipped links (hq-core mode 120000). An update that junctions a
+ * directory at the staging clone, then deletes that clone, leaves a link that
+ * does not resolve (feedback_3e1a7445). `hq doctor` reports those and the
+ * repair step. A link that resolves somewhere else inside the HQ root is a
+ * user customization and is left alone.
+ */
+import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
+export declare const RELEASE_LINKS_FAMILY_ID = "release-links";
+export declare const RELEASE_LINKS_FAMILY_TITLE = "Release links";
+export declare const RELEASE_LINKS_CHECK_ID = "release-links.resolve";
+export declare const RELEASE_LINK_REMEDIATION = "Run `hq rescue -y` again. On Windows without Developer Mode, a directory link is written as a junction and a file link as a copy.";
+interface ReleaseLink {
+    rel: string;
+    linkText: string;
+    kind: "dir" | "file";
+}
+/** Paths git records as symlinks in the hq-core release. */
+export declare const RELEASE_LINKS: readonly ReleaseLink[];
+export declare const releaseLinksFamily: CheckFamily;
+export declare function checkReleaseLinks(context: CheckContext): CheckResult[];
+export {};
+//# sourceMappingURL=release-links.d.ts.map

package/dist/lib/doctor/checks/release-links.js

@@ -0,0 +1,152 @@
+/**
+ * Release-shipped links (hq-core mode 120000). An update that junctions a
+ * directory at the staging clone, then deletes that clone, leaves a link that
+ * does not resolve (feedback_3e1a7445). `hq doctor` reports those and the
+ * repair step. A link that resolves somewhere else inside the HQ root is a
+ * user customization and is left alone.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const RELEASE_LINKS_FAMILY_ID = "release-links";
+export const RELEASE_LINKS_FAMILY_TITLE = "Release links";
+export const RELEASE_LINKS_CHECK_ID = "release-links.resolve";
+export const RELEASE_LINK_REMEDIATION = "Run `hq rescue -y` again. On Windows without Developer Mode, a directory link is written as a junction and a file link as a copy.";
+const CYGWIN_SYMLINK_COOKIE = Buffer.from("!<symlink>", "latin1");
+/** Paths git records as symlinks in the hq-core release. */
+export const RELEASE_LINKS = [
+    { rel: ".agents/skills", linkText: "../.claude/skills", kind: "dir" },
+    { rel: ".codex/claude", linkText: "../.claude", kind: "dir" },
+    {
+        rel: ".codex/output-style.md",
+        linkText: "../.claude/output-styles/hq.md",
+        kind: "file",
+    },
+    { rel: "AGENTS.md", linkText: ".claude/CLAUDE.md", kind: "file" },
+    {
+        rel: "companies/_template/.obsidian",
+        linkText: "../../.obsidian",
+        kind: "dir",
+    },
+];
+export const releaseLinksFamily = {
+    id: RELEASE_LINKS_FAMILY_ID,
+    title: RELEASE_LINKS_FAMILY_TITLE,
+    run: (context) => Promise.resolve(checkReleaseLinks(context)),
+};
+export function checkReleaseLinks(context) {
+    const present = RELEASE_LINKS.filter((entry) => lstatOrNull(path.join(context.hqRoot, entry.rel)) !== null);
+    if (present.length === 0) {
+        return [
+            {
+                status: "NA",
+                checkId: RELEASE_LINKS_CHECK_ID,
+                target: context.hqRoot,
+                message: "Skipped: this HQ root has none of the release-shipped links.",
+            },
+        ];
+    }
+    const failures = [];
+    for (const entry of present) {
+        const problem = releaseLinkProblem(context.hqRoot, entry);
+        if (!problem)
+            continue;
+        failures.push({
+            status: "FAIL",
+            checkId: RELEASE_LINKS_CHECK_ID,
+            target: entry.rel,
+            message: `${entry.rel} ${problem}`,
+            remediation: RELEASE_LINK_REMEDIATION,
+        });
+    }
+    if (failures.length > 0)
+        return failures;
+    return [
+        {
+            status: "PASS",
+            checkId: RELEASE_LINKS_CHECK_ID,
+            target: context.hqRoot,
+            message: "Release links resolve inside this HQ root.",
+        },
+    ];
+}
+function releaseLinkProblem(hqRoot, entry) {
+    const destination = path.join(hqRoot, entry.rel);
+    const lst = lstatOrNull(destination);
+    if (!lst)
+        return null;
+    if (lst.isSymbolicLink()) {
+        let resolved;
+        try {
+            resolved = fs.realpathSync.native(destination);
+        }
+        catch {
+            return "does not resolve. Its target is missing, often because an update linked it at a staging folder that was then deleted.";
+        }
+        if (!pathIsInside(hqRoot, resolved)) {
+            return "points outside this HQ root, so it does not resolve to the shipped target.";
+        }
+        return null;
+    }
+    if (lst.isFile()) {
+        const bytes = readFileOrNull(destination);
+        if (bytes && isSymlinkStub(bytes, entry.linkText)) {
+            return "is still a Git symlink stub, not a working link.";
+        }
+        if (entry.kind === "dir") {
+            return "is a file, not a directory link.";
+        }
+        const expected = containedTarget(hqRoot, entry);
+        if (expected) {
+            const target = readFileOrNull(expected);
+            if (target && bytes && bytes.equals(target))
+                return null;
+        }
+        // A regular file that is not the stub is a user edit or a Windows copy
+        // of the target. Either way the path is usable.
+        return null;
+    }
+    // A real directory in place of a directory link is a user replacement.
+    return null;
+}
+function containedTarget(hqRoot, entry) {
+    const destination = path.join(hqRoot, entry.rel);
+    const resolved = path.resolve(path.dirname(destination), entry.linkText);
+    return pathIsInside(hqRoot, resolved) ? resolved : null;
+}
+function isSymlinkStub(bytes, linkText) {
+    if (bytes.equals(Buffer.from(linkText, "utf8")))
+        return true;
+    return (bytes.length >= CYGWIN_SYMLINK_COOKIE.length &&
+        bytes.subarray(0, CYGWIN_SYMLINK_COOKIE.length).equals(CYGWIN_SYMLINK_COOKIE));
+}
+function pathIsInside(parent, child) {
+    const parentAbs = path.resolve(parent);
+    const childAbs = path.resolve(child);
+    if (childAbs === parentAbs || childAbs.startsWith(parentAbs + path.sep))
+        return true;
+    try {
+        const parentReal = fs.realpathSync.native(parentAbs);
+        const childReal = fs.realpathSync.native(childAbs);
+        return childReal === parentReal || childReal.startsWith(parentReal + path.sep);
+    }
+    catch {
+        return false;
+    }
+}
+function lstatOrNull(target) {
+    try {
+        return fs.lstatSync(target);
+    }
+    catch {
+        return null;
+    }
+}
+function readFileOrNull(target) {
+    try {
+        return fs.readFileSync(target);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=release-links.js.map

package/dist/lib/doctor/registry.js

@@ -26,6 +26,7 @@ import { botsFamily } from "./checks/bots.js";
 import { anywhereFamily } from "./checks/anywhere.js";
 import { scaffoldCliFloorFamily } from "./checks/scaffold-cli-floor.js";
 import { strandedLanesFamily } from "./checks/stranded-lanes.js";
+import { releaseLinksFamily } from "./checks/release-links.js";
 import { fixtureCoverageFamily } from "./fixtures/discover.js";
 import { checkClaudeWiring } from "./checks/claude-wiring.js";
 /**
@@ -270,6 +271,8 @@ export function createDefaultRegistry() {
     // Failed keep-alive lead lanes cannot recover themselves; make them visible
     // in the standard local doctor report with the senior recovery command.
     registry.register(strandedLanesFamily);
+    // Release symlinks left pointing at a deleted update staging folder.
+    registry.register(releaseLinksFamily);
     return registry;
 }
 //# sourceMappingURL=registry.js.map

package/dist/lib/workers-registry/index.d.ts

@@ -23,6 +23,12 @@ export interface GenerateWorkersRegistryResult {
  * own, and because duplicates resolve by path order — a tenant path sorts before
  * both `core` and `personal` — the checkout wins. The operator's actual worker
  * then silently vanishes from the registry every skill reads.
+ *
+ * Claude Code worktrees (`.claude/worktrees/<name>/`) and Codex worktrees
+ * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
+ * nested HQ root under a company project. Those copies land in the registry as
+ * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`.
  */
 export declare function isExcludedWorkerDirectory(relativeDirectory: string): boolean;
 /**

package/dist/lib/workers-registry/index.js

@@ -157,9 +157,17 @@ function withoutTimestamp(content) {
  * own, and because duplicates resolve by path order — a tenant path sorts before
  * both `core` and `personal` — the checkout wins. The operator's actual worker
  * then silently vanishes from the registry every skill reads.
+ *
+ * Claude Code worktrees (`.claude/worktrees/<name>/`) and Codex worktrees
+ * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
+ * nested HQ root under a company project. Those copies land in the registry as
+ * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`.
  */
 export function isExcludedWorkerDirectory(relativeDirectory) {
     const normalized = relativeDirectory.replaceAll('\\', '/');
+    if (/(?:^|\/)\.(?:claude|codex)\/worktrees(?:\/|$)/.test(normalized))
+        return true;
     const [root, tenant, nested] = normalized.split('/');
     if (root !== 'companies')
         return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);

package/dist/utils/headless.d.ts

@@ -0,0 +1,2 @@
+export declare function isHeadless(): boolean;
+//# sourceMappingURL=headless.d.ts.map

package/dist/utils/headless.js

@@ -0,0 +1,8 @@
+export function isHeadless() {
+    if (process.env.CI)
+        return true;
+    if (process.platform !== "linux")
+        return false;
+    return !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
+}
+//# sourceMappingURL=headless.js.map

package/dist/utils/login-browser.d.ts

@@ -0,0 +1,4 @@
+import type { CognitoAuthConfig, CognitoTokens } from "@indigoai-us/hq-cloud";
+/** Keep desktop login unchanged; manual login uses the same PKCE loopback flow. */
+export declare function loginWithBrowserPreference(config: CognitoAuthConfig, browser?: boolean): Promise<CognitoTokens>;
+//# sourceMappingURL=login-browser.d.ts.map

package/dist/utils/login-browser.js

@@ -0,0 +1,122 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { browserLogin, saveCachedTokens, CognitoAuthError } from "@indigoai-us/hq-cloud";
+import { isHeadless } from "./headless.js";
+function assertHumanLoginAllowed() {
+    // Preserve hq-cloud's company-machine boundary on the manual URL path.
+    if (["1", "true", "yes"].includes(process.env.HQ_MACHINE_AUTH_REQUIRED?.trim().toLowerCase() ?? "")) {
+        throw new CognitoAuthError("Human authentication is unavailable in required company machine mode");
+    }
+}
+/** Keep desktop login unchanged; manual login uses the same PKCE loopback flow. */
+export async function loginWithBrowserPreference(config, browser = true) {
+    if (browser && !isHeadless())
+        return browserLogin(config);
+    assertHumanLoginAllowed();
+    const port = config.port ?? 3000;
+    const redirectUri = `http://localhost:${port}/callback`;
+    const base = `https://${config.userPoolDomain}.auth.${config.region}.amazoncognito.com`;
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(16).toString("base64url");
+    const url = new URL(`${base}/oauth2/authorize`);
+    url.search = new URLSearchParams({
+        client_id: config.clientId,
+        response_type: "code",
+        scope: (config.scopes ?? ["openid", "email", "profile"]).join(" "),
+        redirect_uri: redirectUri,
+        code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+        code_challenge_method: "S256",
+        state,
+    }).toString();
+    if (config.identityProvider)
+        url.searchParams.set("identity_provider", config.identityProvider);
+    if (config.prompt)
+        url.searchParams.set("prompt", config.prompt);
+    const code = await new Promise((resolve, reject) => {
+        let settled = false;
+        const handler = (req, res) => {
+            if (settled) {
+                res.writeHead(410).end("Sign-in already finished");
+                return;
+            }
+            const callback = new URL(req.url ?? "/", redirectUri);
+            if (callback.pathname !== "/callback") {
+                res.writeHead(404).end("Not found");
+                return;
+            }
+            const receivedState = Buffer.from(callback.searchParams.get("state") ?? "");
+            const expectedState = Buffer.from(state);
+            const validState = receivedState.length === expectedState.length
+                && timingSafeEqual(receivedState, expectedState);
+            const code = callback.searchParams.get("code");
+            if (!validState || !code || callback.searchParams.has("error")) {
+                res.writeHead(400).end("Sign-in failed. Return to your terminal and try again.");
+                finish(new CognitoAuthError(validState ? "Sign-in callback was denied or missing a code" : "Cognito state parameter mismatch"));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/plain" }).end("Sign-in response received. Return to your terminal to finish.");
+            finish();
+            resolve(code);
+        };
+        const servers = [createServer(handler), createServer(handler)];
+        const timer = setTimeout(() => finish(new CognitoAuthError("Login timed out after 15 minutes")), 15 * 60 * 1000);
+        function finish(error) {
+            settled = true;
+            clearTimeout(timer);
+            for (const server of servers)
+                server.close();
+            if (error)
+                reject(error);
+        }
+        let attempts = 0;
+        let listening = 0;
+        let lastError;
+        const ready = () => {
+            if (++attempts !== servers.length)
+                return;
+            if (!listening) {
+                finish(lastError ?? new Error("Cannot bind login callback port"));
+                return;
+            }
+            try {
+                assertHumanLoginAllowed();
+                console.log(`Open this URL to sign in:\n${url.toString()}`);
+                console.log(`Waiting for sign-in. For a remote host, forward local port ${port} to this host's port ${port} before opening the URL.`);
+            }
+            catch (error) {
+                finish(error instanceof Error ? error : new Error("Sign-in unavailable"));
+            }
+        };
+        servers.forEach((server, index) => {
+            server.once("error", (error) => { lastError = error; ready(); });
+            server.listen(port, index === 0 ? "127.0.0.1" : "::1", () => { listening++; ready(); });
+        });
+    });
+    assertHumanLoginAllowed();
+    const response = await fetch(`${base}/oauth2/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ grant_type: "authorization_code", client_id: config.clientId, code, code_verifier: verifier, redirect_uri: redirectUri }),
+        signal: AbortSignal.timeout(30_000),
+    });
+    // Never echo an OAuth response body, which can contain credentials.
+    if (!response.ok)
+        throw new CognitoAuthError(`Token exchange failed (${response.status})`);
+    const data = await response.json().catch(() => {
+        throw new CognitoAuthError("Cognito returned an invalid token response");
+    });
+    if (!data || typeof data.access_token !== "string" || !data.access_token
+        || typeof data.id_token !== "string" || !data.id_token
+        || typeof data.refresh_token !== "string" || !data.refresh_token
+        || typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0) {
+        throw new CognitoAuthError("Cognito returned an incomplete token response");
+    }
+    const tokens = {
+        accessToken: data.access_token, idToken: data.id_token, refreshToken: data.refresh_token,
+        expiresAt: Date.now() + data.expires_in * 1000, tokenType: "Bearer",
+    };
+    assertHumanLoginAllowed();
+    saveCachedTokens(tokens);
+    return tokens;
+}
+//# sourceMappingURL=login-browser.js.map

package/dist/utils/team-upgrade.js

@@ -1,15 +1,9 @@
+import { isHeadless } from "./headless.js";
 import open from "open";
 import { ensureCognitoToken } from "./cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "./vault-api.js";
 const CHECKOUT_SUCCESS_URL = "https://hq.computer/billing?checkout=success";
 const CHECKOUT_CANCEL_URL = "https://hq.computer/billing?checkout=cancel";
-function isHeadless() {
-    if (process.env.CI)
-        return true;
-    if (process.platform !== "linux")
-        return false;
-    return !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
-}
 function ownerUpgradeError() {
     return Object.assign(new Error("Only a company owner can upgrade. Ask a company owner to upgrade."), { expected: true });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.145",
+  "version": "5.345.147",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.82",
+    "@indigoai-us/hq-cloud": "~6.18.87",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",