@indigoai-us/hq-cli 5.345.152 → 5.345.153

package/CHANGELOG.md

@@ -2,6 +2,94 @@
 
 ## [Unreleased]
 
+## [5.345.153] — 2026-10-21
+- `hq-auth-refresh --min-validity-seconds N` now applies to person sessions,
+  not only machine tokens: a person session with less than N seconds left
+  (120 to 1800, default 120) is renewed. New `--force` renews a person session
+  even while it is still valid. The deploy identity resolver can use these to
+  stop returning `login_required` while `hq whoami` shows a valid session.
+- `hq doctor --fix` now rotates stale sync-manifest uploads across runs. Each
+  run starts after the last company it tried, so a machine with many stale
+  company manifests reaches all of them, and a company whose upload keeps
+  failing no longer blocks the rest. When stale journals and stale manifests
+  are both pending, one of the two network repair slots goes to a manifest
+  upload. The run still makes at most two network repairs in total.
+- Work Mesh sessions held because their company was missing now drain once
+  your membership confirms the company. Before this, after
+  `hq mesh daemon install` those sessions kept piling up in the held and
+  dead-letter queues when the session only knew the company's slug. The daemon
+  now looks the slug up through your membership, and retries the held backlog
+  every 15 minutes instead of only at start. Sessions whose company cannot be
+  confirmed stay held.
+- Each agent kit now keeps its machine sign-in tokens in its own folder
+  (`token-state/` inside the agent's directory) instead of the shared
+  `~/.hq/work-mesh/daemon/cognito-tokens.json`. Before this, an agent running on
+  your computer could write to that shared file and your own `hq` commands,
+  such as a deploy, would then act as a machine and fail with
+  `login_required`. Kits installed before this release pick up the new folder
+  without being reinstalled. A token file an agent already wrote to the shared
+  location is not removed by this change.
+- When a company's work registry is turned off, `hq doctor` no longer reports
+  the held work sessions as a login problem (`AUTH_DENIED`). It now says the
+  work registry is disabled and gives the setting a company admin can turn on:
+  `hq company --company <slug> settings set --work-registry-enabled true`.
+  Sessions held for this reason are re-sent by `hq mesh context requeue` once
+  the registry is on.
+- `hq agent enroll` on a computer that already has an enrolled bot now tells
+  you to add the new bot with `--name <bot>`, so it gets its own agent
+  identity. It no longer suggests `--replace`, which overwrites the first
+  bot's credentials. When more than one bot is enrolled on the computer,
+  enroll prints the `HQ_AGENT_DIR` value the new bot must run with. Every bot,
+  including the first one's MCP server, needs its own `HQ_AGENT_DIR`, or it
+  acts as another bot.
+- `hq doctor` no longer fails a hook just because it is left out of the
+  `minimal` hook profile on purpose. A hook must now be listed in the lowest
+  profile it appears in and every stricter one. Missing from the profile you are running
+  (`HQ_HOOK_PROFILE`, `standard` by default) is still a failure, because the
+  hook does not run; missing only from a profile you are not running is a
+  warning. A hook listed only in `strict` still fails under `standard`.
+  `hq doctor --fix` repairs both cases.
+- `hq integrations approve` now prints the provider result when the gateway
+  runs the approved call in the background. Before, the command waited for the
+  queue row to report `resumed` and then printed only "Approved — the call
+  completed.", so paid results such as Apollo matches were lost. The CLI now
+  reads the stored result back from the queue row (the call does not run
+  again) and prints it; `--json` adds it as `result`. For a call that already
+  ran, running `hq integrations approve <queueId>` again returns its stored
+  result.
+- `hq run` no longer refuses to start when varlock reports only warnings, such
+  as "Value is very short! Is it actually sensitive?" or a 2-character value
+  that is sensitive by default. Warnings are printed to stderr and the command
+  runs. Real errors still stop `hq run` with exit code 1.
+- Added `hq decide ask|list|show|answer|talk|withdraw|import-lanes` for owner Queue decisions. Release 1 accepts asks from personal local bots and lets the personal local bot import option-style questions addressed to that owner. Imported questions become read-only in legacy lanes; advanced questions are skipped with counts. Ask resolves --company and accepts --expires (default 72h), matching the US-001 decisions service contract. Requires that service before use.
+- Company members can now add apps with `hq integrations connect`, `catalog`,
+  `inspect`, `discover`, `import`, and `reconnect --connect`; guests are still
+  refused by the server. Removing and governing apps is unchanged.
+- When a member tries to reconnect or replace an app someone else connected,
+  the CLI explains that an owner or admin has to reconnect it, instead of
+  printing the raw `INTEGRATION_RECONNECT_FORBIDDEN` refusal.
+- `hq integrations connect <app>` on an app someone else connected now tells a
+  member to ask an owner or admin, rather than suggesting `reconnect` or
+  `--force`, which the server would refuse.
+- `hq integrations import` skips a connector that someone else already
+  connected and keeps importing the rest.
+- `hq lanes message --project <p>` and `hq lanes resume --project <p>` now
+  work on a lane that has no story. Before this, moving a no-story lane to
+  another project appended a stories entry with an empty story id, the lane
+  schema rejected it, and the whole write rolled back. The lane now moves to
+  the new project, keeps its no-story reason, and gains no story entry.
+  `hq lanes stories add` refuses an empty story id with `missing_story`.
+- The unit suite now passes on a developer Mac with a temporary HOME. A setup file gives every test worker the canonical macOS temp directory (`/private/var/...`) and strips HQ, Claude Code and Codex session variables, so a run started from inside an HQ session behaves like CI. Local macOS runs use at most 4 workers unless `--maxWorkers` is passed. Tests no longer pick up Homebrew bash, `/opt/homebrew/bin`, an installed HQ.app, or BSD `stat` differences, and node stubs work when node's path contains a space. Every test worker also puts a stand-in `crontab` first on PATH, and a test fails if `crontab` would resolve to anything else, so no test can edit the real user crontab (a temp HOME does not isolate it). The agent-kit fallback install test now injects its own crontab runner. Linux-only tests (Linux login-home lanes accounts) and the clean-clone checks that need a case-sensitive, non-normalizing filesystem are skipped with a stated reason where they cannot run.
+- The daemon policy index notices a policy file added or removed even when the file watcher misses the event, which macOS FSEvents can do right after a watcher starts. `list()` compares directory stamps taken at the last rebuild.
+- An autopilot lock records the real time it was taken, not the injected clock value.
+- The registry canonicalises directories with the native realpath on macOS, so `/var` and `/private/var` spellings of one directory map to the same key. A registry entry saved with letter case that differs from the disk may need re-registering.
+- The provider wrapper's perl timeout fallback (used where `timeout` is not installed, such as macOS) no longer prints "Alarm clock" to the terminal. The exit status is still 142.
+- `hq core policy` age report prints the awk error for the platform it ran on, and the differential corpus recorder maps both macOS spellings of `$HOME` to `<HOME>`.
+- `hq mesh context organize` now lists fresh candidates when the session's pending decision has expired, instead of returning the same expired decision. Choosing an option or `--create-project` after that no longer fails with `DECISION_EXPIRED` or `DECISION_WINDOW_MISSING`.
+- The published core E2E harness tears down reliably on macOS.
+- Windows lock acquisition now waits out transient EPERM/EBUSY instead of failing early.
+- Worker registry rebuild no longer walks into nested git checkouts. A folder below the scan root that holds a `.git` file (linked worktree) or `.git` folder (clone) is treated as a separate checkout: a `worker.yaml` directly inside it still registers, but nothing beneath it is read. `workspace/worktrees/`, `node_modules/`, and `.git/` folders are skipped wherever they appear. A company folder (`companies/<slug>`) or its `workers/` folder kept as its own repository still registers every worker. The worker-id clash check in `hq core scan-packages` uses the same rule.
+
 ## [5.345.152] — 2026-10-20
 - The bundled sync engine now uses hq-cloud 6.18.91. When a company Outpost
   fails to start and the server has already cleaned it up,

package/dist/bin/hq-auth-refresh.d.ts

@@ -6,6 +6,9 @@
  * shell out to a plain binary instead of a subcommand. Equivalent to
  * `hq auth refresh`.
  *
+ * Flags: `--min-validity-seconds N` renews a person session that has less than
+ * N seconds left (default 120); `--force` renews it even when still valid.
+ *
  * Exit 0 if a valid session is ensured now (healthy cache hit, refresh, or
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
@@ -16,6 +19,7 @@ import "../node-network-compat.js";
 import type { refreshCachedSession } from "../utils/cognito-session.js";
 type RefreshSession = (options?: {
     minValiditySeconds?: number;
+    force?: boolean;
 }) => ReturnType<typeof refreshCachedSession>;
 export declare function runAuthRefresh(refreshSession?: RefreshSession): Promise<number>;
 export declare function startAuthRefresh(acquireLease?: typeof acquireCurrentPackageUseLease, updateRequestPending?: () => boolean): Promise<number>;

package/dist/bin/hq-auth-refresh.js

@@ -6,6 +6,9 @@
  * shell out to a plain binary instead of a subcommand. Equivalent to
  * `hq auth refresh`.
  *
+ * Flags: `--min-validity-seconds N` renews a person session that has less than
+ * N seconds left (default 120); `--force` renews it even when still valid.
+ *
  * Exit 0 if a valid session is ensured now (healthy cache hit, refresh, or
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
@@ -17,6 +20,7 @@ import { acquireCurrentPackageUseLease, currentPackageUseUpdatePending, } from "
 import "../node-network-compat.js";
 import { isMainModule } from "../utils/is-main-module.js";
 const MIN_VALIDITY_FLAG = "--min-validity-seconds";
+const FORCE_FLAG = "--force";
 function parseMinimumValiditySeconds(argv, env) {
     let raw;
     let fromFlag = false;
@@ -53,7 +57,11 @@ export async function runAuthRefresh(refreshSession) {
     let exitCode = 1;
     try {
         const minValiditySeconds = parseMinimumValiditySeconds(process.argv.slice(2), process.env);
-        const result = await (refreshSession ?? refresh)(minValiditySeconds === undefined ? {} : { minValiditySeconds });
+        const force = process.argv.slice(2).includes(FORCE_FLAG);
+        const result = await (refreshSession ?? refresh)({
+            ...(minValiditySeconds === undefined ? {} : { minValiditySeconds }),
+            ...(force ? { force } : {}),
+        });
         if (result.refreshed) {
             exitCode = 0;
         }

package/dist/command-catalog.generated.d.ts

@@ -27,6 +27,191 @@ export type CommandCatalogEntry = {
     readonly subcommands: readonly CommandCatalogEntry[];
 };
 export declare const COMMAND_CATALOG: readonly [{
+    readonly name: "decide";
+    readonly description: "Ask and answer owner decisions in the HQ Queue";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly helpOption: true;
+    readonly helpCommand: true;
+    readonly usage: "[options] [command]";
+    readonly helpText: readonly [];
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "ask";
+        readonly description: "Create an option-choice owner decision as the personal local bot";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <statement>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "statement";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--to <audience>";
+            readonly description: "Decision audience";
+            readonly hidden: false;
+            readonly choices: readonly ["me"];
+            readonly defaultValue: "me";
+        }, {
+            readonly flags: "--option <id|label>";
+            readonly description: "Choice, repeatable";
+            readonly hidden: false;
+            readonly defaultValue: readonly [];
+        }, {
+            readonly flags: "--recommend <id>";
+            readonly description: "Recommended option id";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--context-link <url>";
+            readonly description: "Context link, repeatable";
+            readonly hidden: false;
+            readonly defaultValue: readonly [];
+        }, {
+            readonly flags: "--context <text>";
+            readonly description: "Short context brief";
+            readonly hidden: false;
+            readonly defaultValue: "";
+        }, {
+            readonly flags: "--company <slug|uid>";
+            readonly description: "Company (defaults to the active company)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--expires <duration|iso>";
+            readonly description: "Expiry duration (m, h, d) or ISO date-time";
+            readonly hidden: false;
+            readonly defaultValue: "72h";
+        }, {
+            readonly flags: "--commitment <id>";
+            readonly description: "Related commitment";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the decision record";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "list";
+        readonly description: "Read your decisions across companies, oldest first";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--open";
+            readonly description: "List open decisions";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "show";
+        readonly description: "Show a visible decision, including its options and answer";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "answer";
+        readonly description: "Answer with an option ID; the server enforces expiry and first answer";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--choice <id>";
+            readonly description: "Option id";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--source <source>";
+            readonly description: "Answer surface";
+            readonly hidden: false;
+            readonly choices: readonly ["desktop", "thread"];
+            readonly defaultValue: "desktop";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "talk";
+        readonly description: "Open the decision's bot conversation";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "withdraw";
+        readonly description: "Withdraw a decision you asked";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "import-lanes";
+        readonly description: "Import option-style legacy questions once; report skipped advanced questions";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print import counts and skipped question reasons";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }];
+}, {
     readonly name: "modules";
     readonly description: "Module management commands";
     readonly aliases: readonly [];

package/dist/command-catalog.generated.js

@@ -1,5 +1,232 @@
 // This file is generated by scripts/generate-command-catalog.mjs. Do not edit.
 export const COMMAND_CATALOG = [
+    {
+        "name": "decide",
+        "description": "Ask and answer owner decisions in the HQ Queue",
+        "aliases": [],
+        "hidden": false,
+        "helpOption": true,
+        "helpCommand": true,
+        "usage": "[options] [command]",
+        "helpText": [],
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "ask",
+                "description": "Create an option-choice owner decision as the personal local bot",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <statement>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "statement",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--to <audience>",
+                        "description": "Decision audience",
+                        "hidden": false,
+                        "choices": [
+                            "me"
+                        ],
+                        "defaultValue": "me"
+                    },
+                    {
+                        "flags": "--option <id|label>",
+                        "description": "Choice, repeatable",
+                        "hidden": false,
+                        "defaultValue": []
+                    },
+                    {
+                        "flags": "--recommend <id>",
+                        "description": "Recommended option id",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--context-link <url>",
+                        "description": "Context link, repeatable",
+                        "hidden": false,
+                        "defaultValue": []
+                    },
+                    {
+                        "flags": "--context <text>",
+                        "description": "Short context brief",
+                        "hidden": false,
+                        "defaultValue": ""
+                    },
+                    {
+                        "flags": "--company <slug|uid>",
+                        "description": "Company (defaults to the active company)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--expires <duration|iso>",
+                        "description": "Expiry duration (m, h, d) or ISO date-time",
+                        "hidden": false,
+                        "defaultValue": "72h"
+                    },
+                    {
+                        "flags": "--commitment <id>",
+                        "description": "Related commitment",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print the decision record",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "list",
+                "description": "Read your decisions across companies, oldest first",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--open",
+                        "description": "List open decisions",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "show",
+                "description": "Show a visible decision, including its options and answer",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "answer",
+                "description": "Answer with an option ID; the server enforces expiry and first answer",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--choice <id>",
+                        "description": "Option id",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--source <source>",
+                        "description": "Answer surface",
+                        "hidden": false,
+                        "choices": [
+                            "desktop",
+                            "thread"
+                        ],
+                        "defaultValue": "desktop"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "talk",
+                "description": "Open the decision's bot conversation",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "withdraw",
+                "description": "Withdraw a decision you asked",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "import-lanes",
+                "description": "Import option-style legacy questions once; report skipped advanced questions",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print import counts and skipped question reasons",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            }
+        ]
+    },
     {
         "name": "modules",
         "description": "Module management commands",

package/dist/command-registration-plan.d.ts

@@ -4,6 +4,12 @@ import type { Command } from "commander";
  * invocation. Multi-module roots keep the old registration order here.
  */
 export declare const REGISTRATION_PLAN: readonly [{
+    readonly type: "registrar";
+    readonly root: "decide";
+    readonly parent: "program";
+    readonly module: "./commands/decide.js";
+    readonly exportName: "registerDecideCommand";
+}, {
     readonly type: "group";
     readonly root: "modules";
     readonly id: "modules";

package/dist/command-registration-plan.js

@@ -3,6 +3,7 @@
  * invocation. Multi-module roots keep the old registration order here.
  */
 export const REGISTRATION_PLAN = [
+    { type: "registrar", root: "decide", parent: "program", module: "./commands/decide.js", exportName: "registerDecideCommand" },
     { type: "group", root: "modules", id: "modules", name: "modules", description: "Module management commands" },
     { type: "registrar", root: "modules", parent: "modules", module: "./commands/add.js", exportName: "registerAddCommand" },
     { type: "registrar", root: "modules", parent: "modules", module: "./commands/sync.js", exportName: "registerSyncCommand" },

package/dist/commands/agent-enroll.d.ts

@@ -138,7 +138,19 @@ export interface EnrollResult {
     permissionsError?: string;
     /** The tree this identity lives in. */
     agentDir: string;
+    /**
+     * Other agent trees on this host that already hold an identity. When this is
+     * non-empty, `hq agent …` cannot tell the bots apart on its own (the root
+     * identity wins, or two local bots are ambiguous), so this bot must run with
+     * HQ_AGENT_DIR=agentDir or it acts as one of the others.
+     */
+    otherAgentDirs: string[];
 }
+/**
+ * Agent trees under `home` holding an identity, other than `self`. Existence
+ * checks only; no creds file is opened.
+ */
+export declare function otherAgentDirsOnHost(self: string, home?: string): string[];
 /** Pure-ish orchestration so tests can drive it without a TTY or network. */
 export declare function enrollHost(opts: EnrollOptions, deps?: EnrollDeps): Promise<EnrollResult>;
 export declare function registerAgentEnrollCommand(agent: Command): void;