@indigoai-us/hq-cli 5.345.146 → 5.345.148

package/dist/commands/core-refresh-vault-access-native.js

@@ -1,6 +1,8 @@
 /** Native local manifest refresh for core/scripts/refresh-vault-access.sh. */
 import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
 import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
@@ -36,6 +38,11 @@ export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
 # the authoritative security boundary — this manifest only powers the local
 # early-warning block for read-only shares.
 #
+# Scope: with no --company the roll-up rewrites the whole manifest. With
+# --company, only the named companies' entries are replaced; every other
+# company's entry is kept as it was. Writes are atomic and serialized by a
+# lock file next to the manifest.
+#
 # Usage:
 #   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
 #
@@ -189,8 +196,13 @@ export function runRefreshVaultAccess(args, deps) {
     const runHq = deps.runHq ?? ((hqArgs, cwd) => defaultHq(hqArgs, cwd, deps.env));
     const identity = resolveEmail(deps, runHq);
     let stderr = identity.stderr;
-    const explicit = parsed.slugs;
+    const explicit = [...new Set(parsed.slugs)];
     const allGrants = new Map();
+    // Companies whose entry this run replaces. A scoped run (--company) owns only
+    // the companies it queried successfully; every other company already in the
+    // manifest is carried over untouched. The unscoped roll-up owns the whole
+    // manifest, so a company that lost all its grants drops out of it.
+    const refreshed = new Set();
     if (explicit.length > 0) {
         for (const slug of explicit) {
             const result = runHq(["files", "shared-with-me", "--company", slug], deps.cwd);
@@ -198,45 +210,228 @@ export function runRefreshVaultAccess(args, deps) {
                 stderr += log(`skipping ${slug} — shared-with-me query failed`);
                 continue;
             }
-            const rows = parseGrantTable(result.stdout);
-            for (const [company, grants] of rows)
-                allGrants.set(company, [...(allGrants.get(company) ?? []), ...grants]);
+            refreshed.add(slug);
+            const grants = parseGrantTable(result.stdout).get(slug) ?? [];
+            allGrants.set(slug, [...(allGrants.get(slug) ?? []), ...grants]);
         }
     }
     else {
         const result = runHq(["files", "shared-with-me"], deps.cwd);
         if (result.code !== 0)
             return { code: 0, stdout: "", stderr: `${stderr}${log("shared-with-me roll-up failed — nothing refreshed")}` };
-        for (const [company, grants] of parseGrantTable(result.stdout))
+        for (const [company, grants] of parseGrantTable(result.stdout)) {
             allGrants.set(company, grants);
+            refreshed.add(company);
+        }
     }
-    const companies = new Set(allGrants.keys());
-    for (const slug of explicit)
-        companies.add(slug);
-    const sortedSlugs = [...companies].sort();
-    if (sortedSlugs.length === 0)
+    if (explicit.length > 0 && refreshed.size === 0)
+        return { code: 0, stdout: "", stderr: `${stderr}${log("no requested company could be queried — nothing refreshed")}` };
+    if (explicit.length === 0 && refreshed.size === 0)
         stderr += log("no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)");
-    const companyData = {};
-    for (const slug of sortedSlugs) {
+    const fresh = new Map();
+    for (const slug of [...refreshed].sort()) {
         let role = "unknown";
         if (identity.email) {
             const result = runHq(["members", "--company", slug, "list"], deps.cwd);
             role = result.code === 0 ? roleFromTable(result.stdout, identity.email) : "unknown";
         }
         const grants = (allGrants.get(slug) ?? []).map((grant) => ({ path: grant.path, permission: grant.permission }));
-        companyData[slug] = { role, grants };
+        fresh.set(slug, { role, grants });
     }
-    const manifest = { version: 1, generatedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"), companies: companyData };
     const directory = path.join(root, ".hq");
     fs.mkdirSync(directory, { recursive: true });
     const target = path.join(directory, "vault-access.json");
-    const temp = `${target}.${process.pid}.${Math.random().toString(16).slice(2)}`;
-    fs.writeFileSync(temp, serializeJqJson(manifest, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
-    fs.chmodSync(temp, 0o600);
-    fs.renameSync(temp, target);
-    stderr += log(`wrote .hq/vault-access.json (${sortedSlugs.length} companies, identity: ${identity.email || "unknown"})`);
+    // Read the current manifest only once the lock is held, after the slow hq
+    // queries, so a refresh for another company that finished meanwhile is kept.
+    const written = withManifestLock(target, deps.lockWaitMs ?? LOCK_WAIT_MS, (stillOwned) => {
+        // Company slugs come from --company and from the manifest, so they are
+        // kept in a Map and a null-prototype object; "__proto__" stays a plain key.
+        const companyData = new Map();
+        if (explicit.length > 0) {
+            const existing = readCompanies(target);
+            stderr += existing.warning;
+            for (const [slug, entry] of Object.entries(existing.companies))
+                if (!refreshed.has(slug))
+                    companyData.set(slug, entry);
+        }
+        for (const [slug, entry] of fresh)
+            companyData.set(slug, entry);
+        const sorted = Object.create(null);
+        for (const slug of [...companyData.keys()].sort())
+            sorted[slug] = companyData.get(slug);
+        const manifest = { version: 1, generatedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"), companies: sorted };
+        const temp = `${target}.${process.pid}.${randomBytes(8).toString("hex")}`;
+        fs.writeFileSync(temp, serializeJqJson(manifest, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
+        try {
+            fs.chmodSync(temp, 0o600);
+            // A refresh that held the lock past the stale threshold may have been
+            // taken over; it must not overwrite the new holder's merge.
+            if (!stillOwned()) {
+                fs.rmSync(temp, { force: true });
+                return undefined;
+            }
+            fs.renameSync(temp, target);
+        }
+        catch (err) {
+            fs.rmSync(temp, { force: true });
+            throw err;
+        }
+        return companyData.size;
+    });
+    if (written === undefined)
+        return { code: 0, stdout: "", stderr: `${stderr}${log("another refresh is still writing .hq/vault-access.json — nothing refreshed")}` };
+    const scope = explicit.length > 0 ? `, refreshed: ${[...refreshed].sort().join(", ")}` : "";
+    stderr += log(`wrote .hq/vault-access.json (${written} companies${scope}, identity: ${identity.email || "unknown"})`);
     return { code: 0, stdout: "", stderr };
 }
+/** Company entries already in the manifest; empty, with a warning, when it is missing or unreadable. */
+function readCompanies(target) {
+    let text;
+    try {
+        text = fs.readFileSync(target, "utf8");
+    }
+    catch (err) {
+        const code = err.code;
+        return { companies: {}, warning: code === "ENOENT" ? "" : log(`could not read the existing manifest (${code ?? "error"}) — other companies' entries are not carried over`) };
+    }
+    try {
+        const companies = JSON.parse(text)?.companies;
+        if (companies && typeof companies === "object" && !Array.isArray(companies))
+            return { companies: companies, warning: "" };
+    }
+    catch { /* reported below */ }
+    return { companies: {}, warning: log("the existing manifest is not valid — other companies' entries are not carried over") };
+}
+/** A lock older than this belongs to a refresh that died holding it. */
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 5_000;
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function readLockToken(lock) {
+    try {
+        return fs.readFileSync(lock, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/** True when the token names a process on this host that no longer exists. */
+function holderIsGone(token) {
+    const match = /^(\d+):(.*):[0-9a-f]+$/.exec(token);
+    if (!match || match[2] !== os.hostname())
+        return false;
+    const pid = Number(match[1]);
+    if (pid === process.pid)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (err) {
+        return err.code === "ESRCH";
+    }
+}
+/**
+ * Remove the lock only if it still carries `expected`. The lock is first
+ * renamed to a name private to this caller, which only one process can do for
+ * a given lock file. If the moved file is not the expected lock (another
+ * process replaced it in the meantime), it is linked back under the lock name
+ * unchanged.
+ */
+function removeLockIf(lock, expected, id) {
+    const moved = `${lock}.${id}.moved`;
+    try {
+        fs.renameSync(lock, moved);
+    }
+    catch {
+        return false;
+    }
+    const ours = readLockToken(moved) === expected;
+    if (!ours) {
+        try {
+            fs.linkSync(moved, lock);
+        }
+        catch { /* a newer lock already exists; leave it */ }
+    }
+    fs.rmSync(moved, { force: true });
+    return ours;
+}
+/**
+ * Take the manifest lock and return its owner token, or undefined when the
+ * lock stays busy past `waitMs`. The lock file is created by hard-linking a
+ * file that already holds the token, so it never exists without an owner. A
+ * stale lock (older than LOCK_STALE_MS, or whose holder on this host has
+ * exited) is taken over through removeLockIf, so two waiters that both judge
+ * it stale cannot remove each other's new lock.
+ */
+export function acquireManifestLock(lock, waitMs, hooks = {}) {
+    const nonce = randomBytes(8).toString("hex");
+    const id = `${process.pid}.${nonce}`;
+    const token = `${process.pid}:${os.hostname()}:${nonce}`;
+    const pending = `${lock}.${id}.new`;
+    const deadline = Date.now() + Math.max(0, waitMs);
+    fs.writeFileSync(pending, token, { flag: "wx", mode: 0o600 });
+    try {
+        for (;;) {
+            try {
+                fs.linkSync(pending, lock);
+                return token;
+            }
+            catch (err) {
+                if (err.code !== "EEXIST")
+                    throw err;
+            }
+            const held = readLockToken(lock);
+            let age;
+            // lstat, so a lock name that is a dangling link still counts as held.
+            try {
+                age = Date.now() - fs.lstatSync(lock).mtimeMs;
+            }
+            catch {
+                continue;
+            }
+            if (held !== undefined && (age > LOCK_STALE_MS || holderIsGone(held))) {
+                hooks.afterStaleCheck?.();
+                if (removeLockIf(lock, held, id))
+                    continue;
+            }
+            // Every path that did not just free the lock waits and honours the
+            // deadline, so a lock that cannot be read or taken over never spins.
+            if (Date.now() >= deadline)
+                return undefined;
+            sleepSync(25);
+        }
+    }
+    finally {
+        fs.rmSync(pending, { force: true });
+    }
+}
+/** Release the lock if `token` still owns it. Returns false when another process has taken it over. */
+export function releaseManifestLock(lock, token) {
+    if (readLockToken(lock) !== token)
+        return false;
+    return removeLockIf(lock, token, `${process.pid}.${randomBytes(8).toString("hex")}`);
+}
+/**
+ * Serialize the read-merge-write of the manifest across processes. Without it
+ * two scoped refreshes for different companies can each read the old file and
+ * the second rename drops the first one's company. `fn` gets a check that the
+ * lock is still held, to call just before it commits. Returns undefined when
+ * the lock stays busy past `waitMs`.
+ */
+function withManifestLock(target, waitMs, fn) {
+    const lock = `${target}.lock`;
+    const token = acquireManifestLock(lock, waitMs);
+    if (token === undefined)
+        return undefined;
+    try {
+        return fn(() => readLockToken(lock) === token);
+    }
+    finally {
+        releaseManifestLock(lock, token);
+    }
+}
 export function registerCoreRefreshVaultAccessNative(core) {
     registerNativeUtility(core, {
         name: "refresh-vault-access", root: "cwd", summary: "Refresh the local vault access manifest",

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -45,6 +45,15 @@ type DetachedSpawnOptions = {
     };
 };
 export declare function spawnWorkMeshHqDetached(args: string[], options: DetachedSpawnOptions): void;
+/**
+ * Resolve the bind session. Only a session id the caller owns (the process env)
+ * is trusted; workspace/sessions/.current is last-writer-wins and can name
+ * another session, so it is a fallback that never carries trusted authority.
+ */
+export declare function resolveWorkMeshBindSession(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): {
+    sid: string;
+    trusted: boolean;
+};
 export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
 export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
 export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -3,6 +3,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { sessionIdFromEnv, validSessionId } from "../lib/core-utils/session-id.js";
 import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
@@ -72,20 +73,26 @@ export function spawnWorkMeshHqDetached(args, options) {
     });
     child.unref();
 }
-export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
-    for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
-        const value = (env[key] ?? "").replace(/\s/g, "");
-        if (value)
-            return value;
-    }
+/**
+ * Resolve the bind session. Only a session id the caller owns (the process env)
+ * is trusted; workspace/sessions/.current is last-writer-wins and can name
+ * another session, so it is a fallback that never carries trusted authority.
+ */
+export function resolveWorkMeshBindSession(root, env, fileSystem = fs) {
+    const fromEnv = sessionIdFromEnv(env);
+    if (fromEnv)
+        return { sid: fromEnv, trusted: true };
     try {
-        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
-        return value;
+        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/[\t\n\v\f\r ]/g, "");
+        return { sid: validSessionId(value) ? value : "", trusted: false };
     }
     catch {
-        return "";
+        return { sid: "", trusted: false };
     }
 }
+export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
+    return resolveWorkMeshBindSession(root, env, fileSystem).sid;
+}
 function hasExecutable(deps, command) {
     if (process.platform === "win32") {
         return Boolean(resolveWindowsExecutable(command, deps.env, (candidate) => {
@@ -158,17 +165,15 @@ export function runWorkMeshBindTrusted(args, deps) {
         else
             i += 1;
     }
-    if (!sid) {
-        sid = resolveWorkMeshBindSessionId(root, deps.env, deps.fs);
-        if (!sid) {
-            try {
-                sid = deps.fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
-            }
-            catch {
-                sid = "";
-            }
-        }
+    // Trusted authority needs a session id the caller owns: --session or the
+    // process env. An invalid --session stops the bind, so it cannot fall back to
+    // whichever session .current names.
+    if (sid && !validSessionId(sid)) {
+        return { code: 2, stdout: "", stderr: "work-mesh-live-bind-trusted: invalid --session id\n" };
     }
+    let sessionTrusted = Boolean(sid);
+    if (!sid)
+        ({ sid, trusted: sessionTrusted } = resolveWorkMeshBindSession(root, deps.env, deps.fs));
     const childEnv = { ...deps.env, HQ_ROOT: root };
     const pin = sid ? ["--session-id", sid] : [];
     let stderr = "";
@@ -207,6 +212,8 @@ export function runWorkMeshBindTrusted(args, deps) {
             trusted.project = project;
         if (task)
             trusted.task = task;
+        if (project && sessionTrusted)
+            trusted.authority = "trusted";
         observation.trustedContext = trusted;
     }
     const directory = path.join(deps.tmpDir, "hq-work-mesh-obs");

package/dist/commands/core.js

@@ -30,6 +30,7 @@
  */
 import { Option } from "commander";
 import { registerCoreCheckpointCommand } from "./core-checkpoint.js";
+import { runHookEnginePath } from '../hook-engine-path.js';
 import { registerCoreDelegateCommand } from "./core-delegate.js";
 import { registerCoreDelegateW1b } from "./core-delegate-w1b.js";
 import { registerCoreHandoffCommand } from "./core-handoff.js";
@@ -439,6 +440,11 @@ export function registerCoreCommands(program) {
     // This group primarily hosts manifest-driven bundled assets, but it also
     // hosts native TypeScript plumbing when a scaffold contract needs it.
     registerCoreCheckpointCommand(core);
+    const hookEnginePath = core.command('hook-engine-path')
+        .description('Print the offline, version-pinned native hook engine path')
+        .option('--repair', 'Repair the pinned copy after closing running hook processes')
+        .action((options) => runHookEnginePath(options.repair ? ['--repair'] : []));
+    describeCoreCommand(hookEnginePath, { execution: 'native', root: 'cwd' });
     registerCoreOntologyCommand(core);
     registerCoreCheckpointGateSettingCommand(core);
     registerCoreDelegateCommand(core, registerCoreDelegateW1b);

package/dist/commands/daemon.d.ts

@@ -45,6 +45,13 @@ export interface DaemonCommandDeps {
     userHome: (user: string) => string;
     /** The pid is a live `hq daemon run`. */
     daemonAlive: (pid: number) => boolean;
+    /** Blocking sleep for install's wait for the Windows task to start (tests inject). */
+    sleep?: (ms: number) => void;
+    /**
+     * Windows: this user has an active signed-in session, so the logon task
+     * can start now. Null when the sessions cannot be listed.
+     */
+    interactiveSession?: () => boolean | null | "unavailable";
     /** Test seam for the combined hq-flags and person-setting gate. */
     runtimeAllowed?: () => boolean | Promise<boolean>;
     /** Test seam for the company sync-mode commands. */

package/dist/commands/daemon.js

@@ -24,9 +24,9 @@ import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices, hqCloudUnits }
 import { applyServiceToggle, effectiveSyncOwner, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
 import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
 import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/daemon/migrate.js";
-import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, daemonRootRefusal, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
+import { DAEMON_WINDOWS_TASK, ROOT_REFUSAL, SYSTEM_UNIT_DIR, WINDOWS_START_WAIT_MS, daemonRootRefusal, installDaemonUnit, installScopeFor, uninstallDaemonUnit, windowsInteractiveSession, } from "../lib/daemon/install.js";
 import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
-import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
+import { isDaemonProcess, liveDaemonLock, runningDaemonPid } from "../lib/daemon/lock.js";
 import { bundledHqCloud, managedHqCloud, managedHqCloudRoot, readHqCloudCopy, readHqCloudUpdateState } from "../lib/daemon/hq-cloud.js";
 import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "../lib/daemon/machine-type.js";
 import { daemonPaths, ensurePrivateDir } from "../lib/daemon/paths.js";
@@ -137,6 +137,8 @@ async function loadDefaults(over) {
         resolveHqRoot: over.resolveHqRoot ?? ((flag) => resolveDaemonHqRoot(flag, { env, cwd: process.cwd(), home })),
         userHome: over.userHome ?? ((user) => loginHome(user, run)),
         daemonAlive: over.daemonAlive ?? ((pid) => isDaemonProcess(pid)),
+        sleep: over.sleep,
+        interactiveSession: over.interactiveSession,
         windowsUser: over.windowsUser ?? (platform === "win32" ? mesh.resolveWindowsUser(env) : ""),
         windowsHeadlessLauncher: over.windowsHeadlessLauncher ?? (platform === "win32" ? mesh.resolveWindowsHeadlessLauncher(env) : undefined),
         systemUnitDir: over.systemUnitDir ?? SYSTEM_UNIT_DIR,
@@ -298,12 +300,42 @@ async function runInstall(d, opts) {
         d.writeFile(MACHINE_TYPE_MARKER_PATH, `type=${detected.type}\nuser=${runAsUser}\n`);
     }
     const runAsHome = runAsUser ? d.userHome(runAsUser) : undefined;
-    const result = installDaemonUnit(hostFor(d, paths, scope === "user"), { scope, runAsUser, runAsHome }, { run: d.run });
+    const result = installDaemonUnit(hostFor(d, paths, scope === "user"), { scope, runAsUser, runAsHome }, {
+        run: d.run,
+        sleep: d.sleep,
+        runningDaemon: () => liveDaemonLock(paths.lockPath, d.daemonAlive),
+    });
     handOver(d, { paths, detected, runAsUser });
+    if (result.warning)
+        d.err(result.warning);
     if (result.kind === "manual") {
         d.out(`This platform has no supported service manager. Start the daemon yourself with:\n  ${result.manualCommand}`);
         return;
     }
+    if (result.startPending) {
+        const signedIn = (d.interactiveSession ?? (() => windowsInteractiveSession(d.run, d.windowsUser ?? "")))();
+        // A missing daemon is not a failure when the user is signed out, or when
+        // Constrained Language Mode refuses the session check; the latter says the
+        // check did not run. A check that failed for any other reason (null) is
+        // treated like a known sign-in and exits non-zero.
+        if (signedIn === false || signedIn === "unavailable") {
+            d.out(`Installed: ${result.unitPath}`);
+            if (signedIn === "unavailable") {
+                d.out("HQ could not check whether you are signed in to Windows, so it could not confirm the daemon started.");
+            }
+            d.out("The daemon starts at your next sign-in to Windows. It is not running yet.");
+            d.out("Check it with: hq daemon status");
+            return;
+        }
+        const seconds = WINDOWS_START_WAIT_MS / 1000;
+        throw new DaemonCommandError([
+            signedIn
+                ? `Installed ${result.unitPath}, but the daemon did not start within ${seconds} seconds although you are signed in to Windows.`
+                : `Installed ${result.unitPath}, but the daemon did not start within ${seconds} seconds, and HQ could not check whether you are signed in to Windows.`,
+            "Check it with: hq daemon status",
+            `The task's last result: powershell -NoProfile -Command "(Get-ScheduledTaskInfo -TaskName '${DAEMON_WINDOWS_TASK}').LastTaskResult"`,
+        ].join("\n"));
+    }
     if (!result.running) {
         throw new DaemonCommandError(`Installed ${result.unitPath}, but it did not start: ${result.error ?? "unknown error"}`);
     }
@@ -354,6 +386,8 @@ async function runUninstall(d, opts) {
     }
     const result = uninstallDaemonUnit(hostFor(d, paths, false), { scope: installScopeFor(detected.type) }, { run: d.run });
     d.out(result.removed ? `Removed ${result.unitPath}` : "hq daemon was not installed.");
+    if (result.warning)
+        d.err(result.warning);
     if (opts.restoreLegacy) {
         const restored = restoreLegacyUnits(migrate);
         for (const u of restored.restored)

package/dist/commands/dm.js

@@ -4,6 +4,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
+import { redactAgentInboxItem as redactInboxCredentials } from "../lib/agent-kit/inbox-redact.js";
 import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
 import { dmForwardCliEnabled } from "./dm-forward-flag.js";
 /**
@@ -1281,9 +1282,15 @@ function formatAgentInboxItem(item) {
     const text = str("text") || str("body") || str("subject");
     return `${chalk.bold(from)} ${chalk.dim(`[${channel}] ${id}${when ? ` ${when}` : ""}`)}\n  ${firstLine(text)}`;
 }
-/** Remove delegated execution context before agent inbox items can be emitted. */
+/**
+ * Stdout for `hq dm` drops the whole actingContext. Credential removal itself
+ * is redactInboxCredentials, shared with the mirror, so a later edit cannot
+ * leave a credential key on one path only. The extra omit stays here because
+ * terminal output must not grow the delegation block back.
+ */
 function redactAgentInboxItem(item) {
-    const { actingContext: _actingContext, ...safe } = item;
+    const redacted = redactInboxCredentials(item);
+    const { actingContext: _actingContext, ...safe } = redacted;
     return safe;
 }
 async function runAgentInbox(token, agentUid, opts) {

package/dist/commands/doctor.d.ts

@@ -25,6 +25,7 @@ import { Command } from "commander";
 import { type DoctorRegistry } from "../lib/doctor/registry.js";
 import type { FamilyRun } from "../lib/doctor/types.js";
 import { type DoctorPlatform } from "../lib/doctor/report.js";
+import { type TempHomeSweepResult } from "../lib/doctor/temp-home-sweeper.js";
 /**
  * Marker directories that identify an HQ tree root. A directory is an HQ root
  * only when it contains ALL of these. `.claude` + `core` are present in both
@@ -126,6 +127,15 @@ export interface RunDoctorResult {
 export declare function runDoctor(options?: RunDoctorOptions): Promise<RunDoctorResult>;
 export declare function createClientHealthReasonCodeCompanyResolver(hqRoot: string): (companySlug: string | null) => Promise<boolean>;
 export declare function createClientHealthCheckStatusCompanyResolver(hqRoot: string): (companySlug: string | null) => Promise<boolean>;
+/** Test seams for {@link registerDoctorCommand}. */
+export interface DoctorCommandDeps {
+    /** Runs the temp-home sweep for `--sweep-temp-homes`. */
+    sweepTempHomes?: (options: {
+        dryRun: boolean;
+    }) => TempHomeSweepResult;
+}
+/** Text report for `hq doctor --sweep-temp-homes`. */
+export declare function renderTempHomeSweepText(result: TempHomeSweepResult): string;
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
-export declare function registerDoctorCommand(program: Command): void;
+export declare function registerDoctorCommand(program: Command, deps?: DoctorCommandDeps): void;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.js

@@ -37,6 +37,7 @@ import { clientHealthCompanyScopeFromCheckId } from "../lib/doctor/checks/sync-h
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import * as readline from "node:readline";
 import { runSideEffectTests } from "../lib/doctor/deep/sandbox.js";
+import { sweepTempHomes, } from "../lib/doctor/temp-home-sweeper.js";
 /**
  * Marker directories that identify an HQ tree root. A directory is an HQ root
  * only when it contains ALL of these. `.claude` + `core` are present in both
@@ -315,8 +316,33 @@ export function createClientHealthCheckStatusCompanyResolver(hqRoot) {
         });
     };
 }
+/** Text report for `hq doctor --sweep-temp-homes`. */
+export function renderTempHomeSweepText(result) {
+    const lines = [];
+    const verb = result.dryRun ? "Would remove" : "Removed";
+    for (const entry of result.entries) {
+        if (entry.action === "removed" || entry.action === "would-remove") {
+            lines.push(`  ${verb.toLowerCase()} ${entry.path}`);
+        }
+        else if (entry.action === "failed") {
+            lines.push(`  failed ${entry.path}: ${entry.error ?? "unknown error"}`);
+        }
+        else if (entry.reason === "in-use") {
+            lines.push(`  kept ${entry.path} (in use)`);
+        }
+        else if (entry.reason === "in-use-unknown") {
+            lines.push(`  kept ${entry.path} (could not check whether it is in use: ${entry.error ?? "unknown error"})`);
+        }
+    }
+    const count = result.entries.filter((entry) => entry.action === "removed" || entry.action === "would-remove").length;
+    const failed = result.entries.filter((entry) => entry.action === "failed").length;
+    lines.push(`${verb} ${count} idle temp home${count === 1 ? "" : "s"}; ` +
+        `${result.dryRun ? "would free" : "freed"} ${result.gbFreed.toFixed(2)} GB.` +
+        (failed > 0 ? ` ${failed} could not be removed.` : ""));
+    return `${lines.join("\n")}\n`;
+}
 /** Register the top-level `hq doctor` command so it appears in `hq --help`. */
-export function registerDoctorCommand(program) {
+export function registerDoctorCommand(program, deps = {}) {
     program
         .command("doctor")
         .description("Verify HQ hook wiring, runtimes, and connection health (read-only; integrations uses one control-plane inventory read).")
@@ -330,9 +356,38 @@ export function registerDoctorCommand(program) {
         .option("--only <families>", "Run only these comma-separated check families (e.g. hooks). Unknown names are rejected; --json then records the scope.")
         .option("--fix", "Apply the allowlisted safe repairs (backs up first; read-only without this flag).")
         .addOption(new Option("--client-health-report", "Resolve the opt-in hq-flags gate used by the client-health report hook.").hideHelp())
+        .option("--sweep-temp-homes", "Delete idle temp homes (90+ minutes untouched, not in use): tmp.* folders holding .rustup or .cargo, and hq-temp-home.* folders left by the wrapper. Reports GB freed.")
+        .option("--dry-run", "With --sweep-temp-homes, list what would be removed and delete nothing.")
         .option("--yes", "Skip the interactive --fix confirmation (non-interactive use).")
         .option("--force", "Let --fix run despite uncommitted changes under .claude/, .codex/, or .grok/.")
         .action(async (opts, command) => {
+        // `--sweep-temp-homes` is a second write path with its own fixed
+        // scope (idle, unused temp homes in the temp dirs). Like `--fix`,
+        // it refuses a family scope it would otherwise ignore, and it does not
+        // combine with `--fix`.
+        if (opts.sweepTempHomes === true) {
+            if (parseOnly(opts.only) !== undefined || opts.fix === true) {
+                process.stderr.write(`hq doctor: --sweep-temp-homes cannot be combined with --only or --fix.\n` +
+                    `  It removes only idle temp homes in the temp folders; run it on its own.\n`);
+                process.exitCode = 1;
+                return;
+            }
+            const sweep = deps.sweepTempHomes ?? ((options) => sweepTempHomes(options));
+            const result = sweep({ dryRun: opts.dryRun === true });
+            if (opts.json === true) {
+                process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(renderTempHomeSweepText(result));
+            }
+            process.exitCode = result.entries.some((entry) => entry.action === "failed") ? 1 : 0;
+            return;
+        }
+        if (opts.dryRun === true) {
+            process.stderr.write(`hq doctor: --dry-run only applies to --sweep-temp-homes.\n`);
+            process.exitCode = 1;
+            return;
+        }
         // `--fix` repairs the whole tree from its own allowlist and has no
         // notion of a check family, so a scope passed alongside it could only
         // be ignored. Ignoring it silently is the dangerous reading: an