@indigoai-us/hq-cli 5.345.146 → 5.345.147

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [5.345.147] — 2026-10-18
+
+- Worker registry rebuild now also skips Codex worktrees (`.codex/worktrees/`). Same nested-checkout trap as `.claude/worktrees/`.
+- Worker registry rebuild now skips Claude Code worktrees (`.claude/worktrees/`). A nested HQ checkout under a company project used to land in `core/workers/registry.yaml`, and `hq lanes create` then failed with `worker_tenancy_unresolved`.
+
+- HQ bots no longer quit and relaunch the HQ desktop app when they answer a message. Bots now run with the desktop update check turned off, so the app is never restarted in the middle of onboarding or a conversation; the app still updates itself as usual.
+- `hq doctor` now reports a release link that does not open, including one left pointing at a deleted update folder. The result tells you to run `hq rescue -y` again. On Windows without Developer Mode, that retry writes a directory link as a junction and a file link as a copy.
+- The bundled sync engine now uses hq-cloud 6.18.85. `hq outposts refresh-config --company <slug>` re-applies the server's job runner configuration to a running company Outpost without rebuilding it (owner or admin).
+- The bundled sync engine now uses hq-cloud 6.18.87. Sync reports every refused stale upload as a failure instead of skipping it quietly.
+- `hq login --no-browser` and `hq auth login --no-browser` print the sign-in URL and wait without launching a browser. CI and Linux sessions without a display use the same behavior. Remote sign-in instructions include SSH port forwarding.
+- `hq files unshare <path>` reports the number of empty entries removed, distinguishes retained grants from a deleted share, and shows the server’s owner/admin-only reason when cleanup is forbidden.
+- Added the native hook engine scaffold and six-platform build checks, including
+  Windows GUI-subsystem builds and a 50-launch no-console test. This prepares
+  Windows hook parity; installed hook settings and behavior are unchanged.
+
 ## [5.345.146] — 2026-10-17
 - `hq capacity route` and `hq lanes create --account auto` can now use a Claude account whose weekly limit is used up but whose paid extra usage is on. Pass `--allow-extra-usage` to allow it; the account is picked last. Without the flag, the refusal now says extra usage is on and names the flag.
 

package/README.md

@@ -163,3 +163,17 @@ Use `--target lane:<lane-id>` or
 `--target session:<claude|codex|grok>:<session-id>` when automatic target
 detection is not appropriate. Monitor output is framed as script data before
 it is added to an agent's context.
+
+### Sign in without opening a browser
+
+Run `hq login --no-browser` or `hq auth login --no-browser` to print a sign-in
+URL and wait for completion. Open the URL in your browser. HQ also uses this
+mode in CI and on Linux without DISPLAY or WAYLAND_DISPLAY. Existing cached
+sessions are reused.
+
+For an SSH host, first connect with `ssh -L 8765:localhost:8765 user@host`,
+then run the login command there and open the printed URL on your computer.
+If your callback port is configured differently, forward that port instead.
+Keep the SSH connection open until login finishes. The sign-in uses a localhost
+callback with PKCE, so there is no device code to enter. It times out after
+15 minutes. Tokens are cached locally and never printed.

package/dist/command-catalog.generated.d.ts

@@ -1170,6 +1170,10 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly flags: "--provider <provider>";
         readonly description: "OAuth provider to use: google, microsoft, or picker";
         readonly hidden: false;
+    }, {
+        readonly flags: "--no-browser";
+        readonly description: "Print the sign-in URL without opening a browser";
+        readonly hidden: false;
     }];
     readonly subcommands: readonly [];
 }, {
@@ -1603,6 +1607,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--provider <provider>";
             readonly description: "OAuth provider to use: google, microsoft, or picker";
             readonly hidden: false;
+        }, {
+            readonly flags: "--no-browser";
+            readonly description: "Print the sign-in URL without opening a browser";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -2836,7 +2844,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "unshare";
-        readonly description: "Remove a named file access grant, or remove an empty ACL row without --with.";
+        readonly description: "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -7590,6 +7598,26 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "refresh-config";
+        readonly description: "Re-apply the server's job runner configuration to the company Outpost (owner or admin)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--company <slug>";
+            readonly description: "Company slug";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Emit raw JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "codex-enable";
         readonly description: "Enable (or retry) Codex on an Outpost";

package/dist/command-catalog.generated.js

@@ -1402,6 +1402,11 @@ export const COMMAND_CATALOG = [
                 "flags": "--provider <provider>",
                 "description": "OAuth provider to use: google, microsoft, or picker",
                 "hidden": false
+            },
+            {
+                "flags": "--no-browser",
+                "description": "Print the sign-in URL without opening a browser",
+                "hidden": false
             }
         ],
         "subcommands": []
@@ -1917,6 +1922,11 @@ export const COMMAND_CATALOG = [
                         "flags": "--provider <provider>",
                         "description": "OAuth provider to use: google, microsoft, or picker",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--no-browser",
+                        "description": "Print the sign-in URL without opening a browser",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -3409,7 +3419,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "unshare",
-                "description": "Remove a named file access grant, or remove an empty ACL row without --with.",
+                "description": "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -9245,6 +9255,30 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "refresh-config",
+                "description": "Re-apply the server's job runner configuration to the company Outpost (owner or admin)",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Company slug",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Emit raw JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "codex-enable",
                 "description": "Enable (or retry) Codex on an Outpost",

package/dist/commands/auth.js

@@ -14,13 +14,14 @@
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
  */
+import { loginWithBrowserPreference } from "../utils/login-browser.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
 import * as fs from "node:fs";
 import { open, realpath } from "node:fs/promises";
 import path from "node:path";
 import chalk from "chalk";
-import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
+import { clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, loadMachineCachedTokens, } from "../utils/cognito-session.js";
 // Static (node builtins only): a lazy import here would need a resident
 // preload entry for the auth-login path.
@@ -212,6 +213,7 @@ export function registerAuthCommands(program) {
         .command("login")
         .description("Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally")
         .option("--provider <provider>", "OAuth provider to use: google, microsoft, or picker")
+        .option("--no-browser", "Print the sign-in URL without opening a browser")
         .action(async (options) => {
         if (resolveCognitoTokenSource() === "machine") {
             console.log(chalk.green(`Running as ${machineIdentityLabel()} — sessions mint automatically; no browser login needed.`));
@@ -237,7 +239,7 @@ export function registerAuthCommands(program) {
             }
             const selection = resolveLoginProviderSelection(options.provider, process.env, rememberedProvider);
             await releasePackageUseLeaseAfterResidentPreload(() => preloadResidentPackageModules("auth-login"), reportResidentPackagePreloadFailure, releaseCurrentPackageUseLease);
-            const tokens = await browserLogin(selection.config);
+            const tokens = await loginWithBrowserPreference(selection.config, options.browser);
             try {
                 storeLastLoginProvider(providerFromIdToken(tokens.idToken) ?? selection.providerToRemember);
             }

package/dist/commands/bot.js

@@ -243,7 +243,7 @@ export function spawnDetachedRun(name, dir) {
         detached: true,
         windowsHide: true,
         stdio: ["ignore", fd, fd],
-        env: { ...process.env, HQ_NO_UPDATE_CHECK: "1" },
+        env: { ...process.env, HQ_NO_UPDATE_CHECK: "1", HQ_NO_ENSURE_HQ_DESKTOP: "1" },
     });
     fs.closeSync(fd);
     child.unref();

package/dist/commands/files.js

@@ -267,7 +267,7 @@ export function registerFilesCommand(program) {
     });
     files
         .command("unshare <prefix>")
-        .description("Remove a named file access grant, or remove an empty ACL row without --with.")
+        .description("Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.")
         .option("--with <principal>", "Person uid, agent uid, email address, group id, or '@all' to remove the grant")
         .action(async (prefix, opts) => {
         try {
@@ -328,17 +328,21 @@ export function registerFilesCommand(program) {
                 }
                 if (!res.ok) {
                     if (res.status === 403) {
-                        console.error(chalk.red("Not authorized to remove this ACL row"));
-                        await offerAccessLadder(canonicalPrefix, {
-                            company: files.opts().company,
-                        });
+                        console.error(chalk.red(body.error ?? "Not authorized to remove this ACL row"));
+                        console.error(chalk.dim("Ask a company admin to remove this entry."));
                     }
                     else {
                         console.error(chalk.red(body.error ?? "Unable to remove ACL row"));
                     }
                     process.exit(1);
                 }
-                console.log(chalk.green(`Removed empty ACL pattern '${canonicalPrefix}'. It now follows its parent folder's access, so anyone who can see that parent can see this folder.`));
+                const removedCount = body.removedEntries;
+                const cleanupMessage = typeof removedCount === "number" && removedCount > 0
+                    ? `Removed ${removedCount} empty ${removedCount === 1 ? "entry" : "entries"} from '${canonicalPrefix}'. `
+                    : "";
+                console.log(chalk.green(body.aclRemoved === false
+                    ? `${cleanupMessage || `Removed grantee-less entries from '${canonicalPrefix}'. `}Existing grants remain.`
+                    : `${cleanupMessage || `Removed empty ACL pattern '${canonicalPrefix}'. `}It now follows its parent folder's access, so anyone who can see that parent can see this folder.`));
                 return;
             }
             const res = await vaultApiFetch({

package/dist/commands/login.js

@@ -1,10 +1,11 @@
 /**
  * hq login — opens browser for Cognito auth.
  */
+import { loginWithBrowserPreference } from "../utils/login-browser.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
 import chalk from 'chalk';
-import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
+import { loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
 import * as readline from "node:readline/promises";
 import { listActiveMembershipCompanies } from "../lib/mesh/api.js";
@@ -31,6 +32,7 @@ export function registerLoginCommand(program) {
         .command('login')
         .description('Authenticate with HQ via Cognito')
         .option('--provider <provider>', 'OAuth provider to use: google, microsoft, or picker')
+        .option("--no-browser", "Print the sign-in URL without opening a browser")
         .action(async (options) => {
         let accessToken;
         let packageUseLeaseReleased = false;
@@ -51,8 +53,7 @@ export function registerLoginCommand(program) {
             }
             else {
                 await releaseForInteractiveWait();
-                console.log('Opening browser for authentication...');
-                const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
+                const tokens = await loginWithBrowserPreference(cognitoConfigForLoginProvider(options.provider), options.browser);
                 const who = peekIdToken(tokens.idToken).email ?? 'HQ';
                 console.log(chalk.green(`Logged in as ${who}`));
                 accessToken = tokens.accessToken;