@indigoai-us/hq-cli 5.345.146 → 5.345.148

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.82","bundleSha256":"0bf6cd65150094c035cb4ee532c00bde78d030ad0d2132aa606c566f11997f41","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.88","bundleSha256":"7e9ee380eae55e059a474fd5f415e8aeb16088805b761d791318d5299645becd","formatVersion":1}

package/dist/index.js

@@ -16,6 +16,7 @@ import { installWindowsHideDefault } from "./utils/windows-hide-default.js";
 import { fileURLToPath } from "node:url";
 import { parseMonitorCheckFastRequest } from "./lanes-monitor-check-argv.js";
 import { createRequire } from "node:module";
+import { hookEnginePathArgs, runHookEnginePath } from "./hook-engine-path.js";
 function cygpathMixedPath(value) {
     // Require only a Node builtin: the package supports Node releases before
     // require(ESM) became available, and this runs in the synchronous dispatcher.
@@ -159,6 +160,11 @@ function dispatchCliEntry() {
     // Before anything spawns: a background hq on Windows (no terminal) hides the
     // console window of every child it starts (feedback_351a40d5).
     installWindowsHideDefault();
+    const engineArgs = hookEnginePathArgs(process.argv);
+    if (engineArgs !== null) {
+        void runHookEnginePath(engineArgs);
+        return;
+    }
     if (process.platform === "win32" && coreCommandHasPathOperands(process.argv)) {
         // Keep cygpath off non-Windows and non-path command routes.
         process.argv = normalizeCorePathOperands(process.argv, "win32", cygpathMixedPath);

package/dist/lib/agent-kit/inbox-redact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Owner STS credentials ride on an agent inbox item as
+ * `actingContext.credentials`. The mirror files are readable by whatever
+ * model has file tools, so those credentials are removed before a write and
+ * again on read. Only `mode`, `ownerPersonUid`, `ownerRole`, and `expiresAt`
+ * stay on `actingContext`. Any other key under that object is dropped.
+ *
+ * A scrub that cannot write (EPERM, ENOSPC, and the same class) is counted
+ * and skipped. It does not throw into the poller or a reader. The next poll
+ * or read tries again. Failure logs are a count and errno codes, never a
+ * path or a file byte.
+ *
+ * `hq dm` output drops the rest of `actingContext` as well. That stricter
+ * stdout rule lives with the command; credential removal has this one
+ * implementation.
+ */
+import type { AgentKitPaths } from "./paths.js";
+export interface InboxScrubReport {
+    scrubbed: number;
+    failures: number;
+    /** Errno names only. Never paths, file names, or file contents. */
+    codes: string[];
+}
+/**
+ * One writer at a time for the mirror directory. The journal is rewritten
+ * in place when credentials are scrubbed and appended when a message arrives;
+ * those two must not overlap or the rewrite can drop the append.
+ * Returns undefined when the directory is missing or the lock is not acquired.
+ */
+export declare function withInboxMirrorLock<T>(inboxDir: string, waitMs: number, fn: () => T): T | undefined;
+/**
+ * Remove credential and unknown `actingContext` keys. Allowed delegation
+ * fields are copied through. Does not mutate `item`.
+ */
+export declare function redactAgentInboxItem<T>(item: T): T;
+/**
+ * Rewrite mirror files that still contain delegated credentials, drop torn
+ * journal lines that contain them, and delete stale `*.json.tmp.*` files.
+ * A clean directory is left untouched, so repeating the call is a no-op.
+ * Returns how many records were rewritten or removed. Write and rename
+ * errors are counted on the report and are not thrown.
+ */
+export declare function scrubInboxMirror(paths: Pick<AgentKitPaths, "inboxDir">, log?: (report: InboxScrubReport) => void): number;
+//# sourceMappingURL=inbox-redact.d.ts.map

package/dist/lib/agent-kit/inbox-redact.js

@@ -0,0 +1,361 @@
+/**
+ * Owner STS credentials ride on an agent inbox item as
+ * `actingContext.credentials`. The mirror files are readable by whatever
+ * model has file tools, so those credentials are removed before a write and
+ * again on read. Only `mode`, `ownerPersonUid`, `ownerRole`, and `expiresAt`
+ * stay on `actingContext`. Any other key under that object is dropped.
+ *
+ * A scrub that cannot write (EPERM, ENOSPC, and the same class) is counted
+ * and skipped. It does not throw into the poller or a reader. The next poll
+ * or read tries again. Failure logs are a count and errno codes, never a
+ * path or a file byte.
+ *
+ * `hq dm` output drops the rest of `actingContext` as well. That stricter
+ * stdout rule lives with the command; credential removal has this one
+ * implementation.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writePrivateFile } from "./private-file.js";
+const INBOX_JSONL_NAME = "inbox.jsonl";
+const STATE_FILES = new Set(["seen-ids.json", "done-ids.json"]);
+const LOCK_DIR_NAME = ".inbox-write.lock";
+const LOCK_STALE_MS = 30_000;
+const ACTING_CONTEXT_KEYS = ["mode", "ownerPersonUid", "ownerRole", "expiresAt"];
+const ALLOWED_ACTING_KEYS = new Set(ACTING_CONTEXT_KEYS);
+/** Substrings that mark a torn line or temp. The values themselves are not logged. */
+const CREDENTIAL_MARKERS = ["\"credentials\"", "secretAccessKey", "sessionToken", "accessKeyId"];
+function emptyTally() {
+    return { scrubbed: 0, failures: 0, codes: [] };
+}
+function errnoCode(err) {
+    const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
+    return typeof code === "string" && /^[A-Z][A-Z0-9]{1,15}$/.test(code) ? code : "ERR";
+}
+function noteFailure(tally, err) {
+    tally.failures += 1;
+    const code = errnoCode(err);
+    if (!tally.codes.includes(code))
+        tally.codes.push(code);
+}
+function sleepMs(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * One writer at a time for the mirror directory. The journal is rewritten
+ * in place when credentials are scrubbed and appended when a message arrives;
+ * those two must not overlap or the rewrite can drop the append.
+ * Returns undefined when the directory is missing or the lock is not acquired.
+ */
+export function withInboxMirrorLock(inboxDir, waitMs, fn) {
+    let dirStat;
+    try {
+        dirStat = fs.lstatSync(inboxDir);
+    }
+    catch {
+        return undefined;
+    }
+    if (!dirStat.isDirectory())
+        return undefined;
+    const lockDir = path.join(inboxDir, LOCK_DIR_NAME);
+    const deadline = Date.now() + Math.max(0, waitMs);
+    for (;;) {
+        try {
+            fs.mkdirSync(lockDir);
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                return undefined;
+            try {
+                if (Date.now() - fs.statSync(lockDir).mtimeMs > LOCK_STALE_MS)
+                    fs.rmdirSync(lockDir);
+            }
+            catch {
+                /* the holder released it, or it is not a directory */
+            }
+            if (Date.now() >= deadline)
+                return undefined;
+            sleepMs(20);
+            continue;
+        }
+        try {
+            return fn();
+        }
+        finally {
+            try {
+                fs.rmdirSync(lockDir);
+            }
+            catch {
+                /* already released */
+            }
+        }
+    }
+}
+function actingContextRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const acting = value.actingContext;
+    if (!acting || typeof acting !== "object" || Array.isArray(acting))
+        return null;
+    return acting;
+}
+function actingNeedsRewrite(acting) {
+    return Object.keys(acting).some((key) => !ALLOWED_ACTING_KEYS.has(key));
+}
+function allowlistedActing(acting) {
+    const kept = {};
+    for (const key of ACTING_CONTEXT_KEYS) {
+        if (Object.prototype.hasOwnProperty.call(acting, key))
+            kept[key] = acting[key];
+    }
+    return kept;
+}
+function textHasCredentialMaterial(text) {
+    return CREDENTIAL_MARKERS.some((marker) => text.includes(marker));
+}
+function isStaleJsonTemp(name) {
+    return (name.includes(".json.tmp.") ||
+        name.includes(".jsonl.tmp.") ||
+        name.endsWith(".json.tmp") ||
+        name.endsWith(".jsonl.tmp"));
+}
+/**
+ * Remove credential and unknown `actingContext` keys. Allowed delegation
+ * fields are copied through. Does not mutate `item`.
+ */
+export function redactAgentInboxItem(item) {
+    const acting = actingContextRecord(item);
+    if (!acting || !actingNeedsRewrite(acting))
+        return item;
+    const record = item;
+    const kept = allowlistedActing(acting);
+    if (Object.keys(kept).length === 0) {
+        const { actingContext: _actingContext, ...without } = record;
+        return without;
+    }
+    return { ...record, actingContext: kept };
+}
+/**
+ * One journal record per line. A torn line cannot be parsed, and an
+ * interrupted append can still hold a credential on that line. Drop those
+ * lines. A torn line with no credential marker stays, so a truncated
+ * message that is not a secret is not thrown away.
+ */
+function redactJsonl(text) {
+    let changed = 0;
+    const kept = [];
+    for (const line of text.split("\n")) {
+        if (!line.trim()) {
+            kept.push(line);
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            if (!textHasCredentialMaterial(line)) {
+                kept.push(line);
+                continue;
+            }
+            changed += 1;
+            continue;
+        }
+        const acting = actingContextRecord(parsed);
+        if (!acting || !actingNeedsRewrite(acting)) {
+            kept.push(line);
+            continue;
+        }
+        changed += 1;
+        kept.push(JSON.stringify(redactAgentInboxItem(parsed)));
+    }
+    return { text: kept.join("\n"), changed };
+}
+function scrubJsonFile(file, tally) {
+    let text;
+    try {
+        const st = fs.lstatSync(file);
+        if (!st.isFile())
+            return;
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        noteFailure(tally, err);
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        if (!textHasCredentialMaterial(text))
+            return;
+        try {
+            fs.unlinkSync(file);
+            tally.scrubbed += 1;
+        }
+        catch (err) {
+            noteFailure(tally, err);
+        }
+        return;
+    }
+    const acting = actingContextRecord(parsed);
+    if (!acting || !actingNeedsRewrite(acting))
+        return;
+    try {
+        // The temp writePrivateFile creates is the redacted body, not the original.
+        writePrivateFile(file, `${JSON.stringify(redactAgentInboxItem(parsed), null, 2)}\n`, 0o600);
+        tally.scrubbed += 1;
+    }
+    catch (err) {
+        noteFailure(tally, err);
+    }
+}
+function redactedTempBody(text) {
+    try {
+        return `${JSON.stringify(redactAgentInboxItem(JSON.parse(text)), null, 2)}\n`;
+    }
+    catch {
+        return "\n";
+    }
+}
+/** Delete a leftover `*.json.tmp.*` from a crashed atomic write. Rewrite it if it cannot be removed. */
+function discardStaleTemp(file, tally) {
+    let text;
+    try {
+        const st = fs.lstatSync(file);
+        if (!st.isFile())
+            return;
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        text = undefined;
+    }
+    const poisoned = text !== undefined && textHasCredentialMaterial(text);
+    try {
+        fs.unlinkSync(file);
+        if (poisoned)
+            tally.scrubbed += 1;
+        return;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return;
+        if (text === undefined) {
+            noteFailure(tally, err);
+            return;
+        }
+    }
+    if (text === undefined)
+        return;
+    try {
+        writePrivateFile(file, redactedTempBody(text), 0o600);
+        if (poisoned)
+            tally.scrubbed += 1;
+    }
+    catch (err) {
+        noteFailure(tally, err);
+    }
+}
+function scrubJournal(journal, tally) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+        let before;
+        try {
+            before = fs.readFileSync(journal, "utf8");
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return;
+            noteFailure(tally, err);
+            return;
+        }
+        const redacted = redactJsonl(before);
+        if (redacted.changed === 0)
+            return;
+        let latest;
+        try {
+            latest = fs.readFileSync(journal, "utf8");
+        }
+        catch (err) {
+            noteFailure(tally, err);
+            return;
+        }
+        if (latest !== before)
+            continue;
+        try {
+            writePrivateFile(journal, redacted.text, 0o600);
+        }
+        catch (err) {
+            noteFailure(tally, err);
+            return;
+        }
+        try {
+            if (fs.readFileSync(journal, "utf8") === redacted.text) {
+                tally.scrubbed += redacted.changed;
+                return;
+            }
+        }
+        catch {
+            /* the next pass, or the next read, rewrites whatever landed */
+        }
+    }
+    noteFailure(tally, Object.assign(new Error("inbox scrub did not land"), { code: "EAGAIN" }));
+}
+function scanInboxDir(inboxDir) {
+    const tally = emptyTally();
+    let names;
+    try {
+        names = fs.readdirSync(inboxDir);
+    }
+    catch (err) {
+        noteFailure(tally, err);
+        return tally;
+    }
+    for (const name of names) {
+        if (isStaleJsonTemp(name)) {
+            discardStaleTemp(path.join(inboxDir, name), tally);
+            continue;
+        }
+        if (!name.endsWith(".json") || STATE_FILES.has(name))
+            continue;
+        scrubJsonFile(path.join(inboxDir, name), tally);
+    }
+    scrubJournal(path.join(inboxDir, INBOX_JSONL_NAME), tally);
+    return tally;
+}
+function defaultScrubLog(report) {
+    if (report.scrubbed > 0) {
+        console.error(`inbox: scrubbed ${report.scrubbed} mirrored record(s) containing delegated credentials`);
+    }
+    if (report.failures > 0) {
+        const codes = report.codes.length > 0 ? report.codes.join(",") : "ERR";
+        console.error(`inbox: scrub failed for ${report.failures} file(s) (${codes})`);
+    }
+}
+/**
+ * Rewrite mirror files that still contain delegated credentials, drop torn
+ * journal lines that contain them, and delete stale `*.json.tmp.*` files.
+ * A clean directory is left untouched, so repeating the call is a no-op.
+ * Returns how many records were rewritten or removed. Write and rename
+ * errors are counted on the report and are not thrown.
+ */
+export function scrubInboxMirror(paths, log = defaultScrubLog) {
+    let tally = emptyTally();
+    try {
+        // Missing directory: do not create it. Lock not acquired: leave the files
+        // for the next read rather than rewriting the journal without the lock.
+        tally = withInboxMirrorLock(paths.inboxDir, 2_000, () => scanInboxDir(paths.inboxDir)) ?? tally;
+    }
+    catch (err) {
+        noteFailure(tally, err);
+    }
+    if (tally.scrubbed > 0 || tally.failures > 0) {
+        log({ scrubbed: tally.scrubbed, failures: tally.failures, codes: tally.codes });
+    }
+    return tally.scrubbed;
+}
+//# sourceMappingURL=inbox-redact.js.map

package/dist/lib/agent-kit/inbox-state.js

@@ -10,6 +10,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { redactAgentInboxItem, scrubInboxMirror } from "./inbox-redact.js";
 import { writePrivateFile } from "./private-file.js";
 const DONE_IDS_NAME = "done-ids.json";
 const MAX_DONE_IDS = 5000;
@@ -37,6 +38,14 @@ export function markInboxDone(paths, ids) {
 }
 /** Every mirrored entry, oldest first, de-duplicated by id (last write wins). */
 export function readMirroredInbox(paths) {
+    // Files written before credential redaction are rewritten here. A failed
+    // rewrite is retried on the next read. It must not hide mail already on disk.
+    try {
+        scrubInboxMirror(paths);
+    }
+    catch {
+        /* scrubInboxMirror records write failures and does not throw them */
+    }
     let text;
     try {
         text = fs.readFileSync(path.join(paths.inboxDir, INBOX_JSONL), "utf8");
@@ -49,7 +58,7 @@ export function readMirroredInbox(paths) {
         if (!line.trim())
             continue;
         try {
-            const entry = JSON.parse(line);
+            const entry = redactAgentInboxItem(JSON.parse(line));
             if (typeof entry.id === "string" && entry.id) {
                 byId.delete(entry.id);
                 byId.set(entry.id, entry);
@@ -144,7 +153,7 @@ export async function mergeAgentInbox(paths, fetchServerInbox) {
                 const raw = m;
                 const id = typeof raw.id === "string" ? raw.id : typeof raw.messageId === "string" ? raw.messageId : null;
                 if (id && !byId.has(id))
-                    byId.set(id, { ...raw, id });
+                    byId.set(id, redactAgentInboxItem({ ...raw, id }));
             }
         }
         else {

package/dist/lib/agent-kit/mcp/tools.js

@@ -18,6 +18,7 @@
 import { CLI_VERSION } from "../../../cli-version.js";
 import { peekIdToken } from "../../../utils/id-token.js";
 import { isRecipientUid } from "../../../lib/notify-recipient.js";
+import { redactAgentInboxItem } from "../inbox-redact.js";
 import { markInboxDone, mergeAgentInbox, readDoneIds, summarizeInboxEntry } from "../inbox-state.js";
 import { AttachmentCompanyUnresolvedError, fetchChatAttachment } from "./attachments.js";
 import { errorResult, McpToolInputError, textResult } from "./jsonrpc.js";
@@ -287,7 +288,7 @@ export function buildAgentMcpTools(clients) {
                 const rows = [...byId.values()]
                     .filter((e) => includeDone || !done.has(e.id))
                     .slice(0, limit)
-                    .map((e) => summarizeInboxEntry(e, done.has(e.id)));
+                    .map((e) => summarizeInboxEntry(redactAgentInboxItem(e), done.has(e.id)));
                 const hasFiles = rows.some((r) => r.attachments?.length);
                 return textResult(clampOutput(JSON.stringify({
                     count: rows.length,

package/dist/lib/agent-kit/run/inbox.js

@@ -20,7 +20,8 @@ import * as path from "node:path";
 import { vaultApiFetch } from "../../../utils/vault-api.js";
 import { writeComponentStatus } from "../creds.js";
 import { pendingInbox } from "../inbox-state.js";
-import { writePrivateFile } from "./../private-file.js";
+import { redactAgentInboxItem, scrubInboxMirror, withInboxMirrorLock } from "../inbox-redact.js";
+import { mkdirPrivate, writePrivateFile } from "./../private-file.js";
 import { createAgentKitInboxBackoffFlagReader } from "../inbox-poll-backoff-flag.js";
 import { buildWakeNotice, currentWakeState, fireWake, readWakeConfig, shouldWake, } from "../wake.js";
 export const SEEN_IDS_NAME = "seen-ids.json";
@@ -79,12 +80,22 @@ function inboxJournalContains(paths, id) {
 }
 export function mirrorInboxItem(paths, item) {
     const dest = path.join(paths.inboxDir, `${item.id}.json`);
-    const recoveringInterruptedMirror = fs.existsSync(dest);
-    writePrivateFile(dest, `${JSON.stringify(item.raw, null, 2)}\n`, 0o600);
-    if (!recoveringInterruptedMirror || !inboxJournalContains(paths, item.id)) {
-        fs.appendFileSync(path.join(paths.inboxDir, INBOX_JSONL_NAME), `${JSON.stringify({ id: item.id, mirroredAt: new Date().toISOString(), ...item.raw })}\n`, { mode: 0o600 });
-    }
-    return dest;
+    // One redaction covers the per-id file and the journal line. The journal
+    // spreads this object, so a credential left on `raw` would be written twice.
+    const safeRaw = redactAgentInboxItem(item.raw);
+    const write = () => {
+        const recoveringInterruptedMirror = fs.existsSync(dest);
+        writePrivateFile(dest, `${JSON.stringify(safeRaw, null, 2)}\n`, 0o600);
+        if (!recoveringInterruptedMirror || !inboxJournalContains(paths, item.id)) {
+            fs.appendFileSync(path.join(paths.inboxDir, INBOX_JSONL_NAME), `${JSON.stringify({ id: item.id, mirroredAt: new Date().toISOString(), ...safeRaw })}\n`, { mode: 0o600 });
+        }
+        return dest;
+    };
+    // Create the directory first so the scrub lock has somewhere to live.
+    // The write still runs without the lock if the directory cannot be locked;
+    // dropping the message is worse than a rare overlapping rewrite.
+    mkdirPrivate(paths.inboxDir);
+    return withInboxMirrorLock(paths.inboxDir, 10_000, write) ?? write();
 }
 export const INBOX_ERROR_BODY_MAX = 300;
 /**
@@ -142,6 +153,24 @@ export function defaultAckItem(agentUid, apiBaseUrl) {
 export async function pollInboxOnce(deps) {
     if (deps.signal?.aborted)
         return { ok: false, mirrored: 0 };
+    // Mirrors written before credential redaction are scrubbed on the next poll,
+    // before a wake can send the bot at the files. A write or rename error is
+    // counted and retried on the next poll. The log is a count and errno codes,
+    // never a path or a file byte.
+    try {
+        scrubInboxMirror(deps.paths, (report) => {
+            if (report.scrubbed > 0) {
+                deps.log("info", `inbox scrubbed ${report.scrubbed} mirrored record(s) containing delegated credentials`);
+            }
+            if (report.failures > 0) {
+                const codes = report.codes.length > 0 ? report.codes.join(",") : "ERR";
+                deps.log("warn", `inbox scrub failed for ${report.failures} file(s) (${codes})`);
+            }
+        });
+    }
+    catch {
+        deps.log("warn", "inbox scrub failed for 1 file(s) (ERR)");
+    }
     const fetchInbox = deps.fetchInbox ?? defaultFetchInbox(deps.agentUid, deps.apiBaseUrl);
     const ackItem = deps.ackItem ?? defaultAckItem(deps.agentUid, deps.apiBaseUrl);
     // No default cache warm: the human conversation routes 403 for agent callers.

package/dist/lib/anywhere-runtime-flag-key.d.ts

@@ -1,6 +1,9 @@
 /** hq-flags key for the staged HQ Anywhere runtime. The registry default is on. */
 export declare const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
 export declare const HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER = "hq-anywhere-runtime.revoked";
+export declare const HQ_ANYWHERE_RUNTIME_FALSE_MAX_AGE_MS: number;
+/** An old disable decision must not survive an unavailable registry indefinitely. */
+export declare function freshAnywhereRuntimeFlags(flags: Record<string, boolean>, fetchedAt: number, now?: number): Record<string, boolean>;
 /** The HQ Anywhere environment kill switch stays compatible with managed provider wrappers. */
 export declare function hqAnywhereRuntimeLocallyDisabled(env?: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=anywhere-runtime-flag-key.d.ts.map

package/dist/lib/anywhere-runtime-flag-key.js

@@ -1,6 +1,15 @@
 /** hq-flags key for the staged HQ Anywhere runtime. The registry default is on. */
 export const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
 export const HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER = "hq-anywhere-runtime.revoked";
+export const HQ_ANYWHERE_RUNTIME_FALSE_MAX_AGE_MS = 60 * 60 * 1000;
+/** An old disable decision must not survive an unavailable registry indefinitely. */
+export function freshAnywhereRuntimeFlags(flags, fetchedAt, now = Date.now()) {
+    if (flags[HQ_ANYWHERE_RUNTIME_FLAG] !== false || now - fetchedAt < HQ_ANYWHERE_RUNTIME_FALSE_MAX_AGE_MS)
+        return flags;
+    const fresh = { ...flags };
+    delete fresh[HQ_ANYWHERE_RUNTIME_FLAG];
+    return fresh;
+}
 /** The HQ Anywhere environment kill switch stays compatible with managed provider wrappers. */
 export function hqAnywhereRuntimeLocallyDisabled(env = process.env) {
     const value = env.HQ_FLAG_HQ_ANYWHERE_RUNTIME;

package/dist/lib/bot/daemon.js

@@ -77,6 +77,8 @@ export function renderBotLaunchdPlist(p) {
         ["HOME", p.home],
         ["PATH", p.pathEntries.join(":")],
         ["HQ_NO_UPDATE_CHECK", "1"],
+        // Bots must never replace/relaunch the interactive desktop, including during setup.
+        ["HQ_NO_ENSURE_HQ_DESKTOP", "1"],
         ...(p.hqRoot ? [["HQ_ROOT", p.hqRoot]] : []),
     ]
         .map(([k, v]) => `    <key>${escapeXml(k)}</key>\n    <string>${escapeXml(v)}</string>`)
@@ -135,6 +137,7 @@ RestartSec=5
 Environment=HOME=${p.home}
 Environment=PATH=${p.pathEntries.join(":")}
 Environment=HQ_NO_UPDATE_CHECK=1
+Environment=HQ_NO_ENSURE_HQ_DESKTOP=1
 ${p.hqRoot ? `Environment=HQ_ROOT=${p.hqRoot}\n` : ""}StandardOutput=append:${p.logPath}
 StandardError=append:${p.logPath}
 

package/dist/lib/bot/runtime/index.js

@@ -345,7 +345,9 @@ export async function runRuntimeTurn(runtime, input, deps = {}) {
     const recheck = memo !== undefined && (nowMs() - memo.at >= MODEL_FALLBACK_RECHECK_MS || memo.turns >= MODEL_FALLBACK_RECHECK_TURNS);
     const remembered = memo && !recheck ? memo : undefined;
     const args = runtime.buildArgs(remembered ? { ...turnInput, model: remembered.to } : turnInput, { outputFile, newSessionId });
-    const env = input.env ?? deps.env ?? process.env;
+    // Enforce at the model boundary too: old plists and direct `bot run` callers
+    // may lack the guard. A bot prompt must never quit the user's desktop app.
+    const env = { ...(input.env ?? deps.env ?? process.env), HQ_NO_ENSURE_HQ_DESKTOP: "1" };
     const binary = runtime.resolveBinary?.(env, input.cwd, turnInput.platform) ?? runtime.binary;
     const stdin = runtime.stdinInput?.(turnInput);
     const protocol = runtime.spawnProtocol?.(turnInput);

package/dist/lib/company-skill-wrapper.js

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { removeEntryNoFollow } from "../utils/safe-link.js";
 const WIN32_RESERVED_CHARS = /[<>:"/\\|?*]/;
 const WIN32_DEVICE_NAME = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i;
 const LOCAL_SLUG = /^[a-z0-9][a-z0-9-]*$/;
@@ -227,7 +228,8 @@ function pruneStaleNamespacedWrappers(runtimeRoot, currentWrapperName, hqRoot, c
         if (LOCAL_SLUG.test(skillSlug) &&
             !fs.existsSync(canonicalSkill) &&
             isGeneratedNamespacedWrapper(candidate, hqRoot, companySlug)) {
-            fs.rmSync(candidate, { recursive: true, force: false });
+            // A Windows wrapper is a junction; never recurse into its target.
+            removeEntryNoFollow(candidate);
             removeGeneratedMarker(candidate);
         }
     }
@@ -340,7 +342,7 @@ export function surfaceCompanySkill(input) {
         }
         if (previousMoved) {
             try {
-                fs.rmSync(backupPath, { recursive: true, force: true });
+                removeEntryNoFollow(backupPath, { force: true });
             }
             catch {
                 // The new wrapper is already committed. A hidden generated backup is
@@ -354,13 +356,13 @@ export function surfaceCompanySkill(input) {
             for (const legacyPath of [legacyBase, `${legacyBase}.md`]) {
                 if (legacyPath !== wrapperPath &&
                     isGeneratedLegacyEntry(legacyPath, sourceDir, skillFile)) {
-                    fs.rmSync(legacyPath, { recursive: true, force: false });
+                    removeEntryNoFollow(legacyPath);
                 }
             }
         }
     }
     catch (error) {
-        fs.rmSync(stagingPath, { recursive: true, force: true });
+        removeEntryNoFollow(stagingPath, { force: true });
         throw error;
     }
     return { status: 0, wrapperPath };