@indigoai-us/hq-cli 5.345.152 → 5.345.153

package/dist/lib/workers-registry/index.js

@@ -59,7 +59,13 @@ function workerYamlFiles(root, relativeRoot) {
             return;
         }
         entries.sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
+        // A `.git` file (linked worktree) or folder (clone) below the scan root marks
+        // a separate checkout. Its worker.yaml files belong to that checkout, so the
+        // walk stops there. A checkout that is itself one worker keeps its own entry.
+        const isNestedCheckout = isNestedWorkerCheckout(relativeRoot, relative, entries.map((entry) => entry.name));
         for (const entry of entries) {
+            if (isNestedCheckout && entry.name !== 'worker.yaml')
+                continue;
             const childRelative = path.join(relative, entry.name);
             const child = path.join(root, childRelative);
             if (entry.name === 'worker.yaml' && (entry.isFile() || isFile(child))) {
@@ -162,12 +168,21 @@ function withoutTimestamp(content) {
  * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
  * nested HQ root under a company project. Those copies land in the registry as
  * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
- * `hq lanes create` then fails with `worker_tenancy_unresolved`.
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`. HQ's own
+ * `workspace/worktrees/<name>/` is the same shape.
+ *
+ * `node_modules` and `.git` never hold workers and are large, so they are
+ * skipped wherever they appear. Any other checkout (a directory holding `.git`)
+ * is caught by the walk itself, because only the filesystem can tell.
  */
 export function isExcludedWorkerDirectory(relativeDirectory) {
     const normalized = relativeDirectory.replaceAll('\\', '/');
     if (/(?:^|\/)\.(?:claude|codex)\/worktrees(?:\/|$)/.test(normalized))
         return true;
+    if (/(?:^|\/)workspace\/worktrees(?:\/|$)/.test(normalized))
+        return true;
+    if (/(?:^|\/)(?:node_modules|\.git)(?:\/|$)/.test(normalized))
+        return true;
     const [root, tenant, nested] = normalized.split('/');
     if (root !== 'companies')
         return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
@@ -177,6 +192,29 @@ export function isExcludedWorkerDirectory(relativeDirectory) {
         return true;
     return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
 }
+/**
+ * Directories that may be git repositories without being a nested checkout.
+ *
+ * An operator can keep a whole tenant (`companies/<slug>`) or a tenant's
+ * `workers` folder in its own repository. Treating either as a checkout would
+ * drop every real worker in that tenant.
+ */
+function isCheckoutBoundaryExempt(relativeDirectory) {
+    const parts = relativeDirectory.replaceAll('\\', '/').split('/');
+    if (parts[0] !== 'companies')
+        return false;
+    return parts.length === 2 || (parts.length === 3 && parts[2] === 'workers');
+}
+/**
+ * True when `relativeDirectory`, found while walking `scanRoot`, is a separate
+ * git checkout (its listing `names` holds `.git`). The caller may still take a
+ * `worker.yaml` directly inside it, but must not descend any further.
+ */
+export function isNestedWorkerCheckout(scanRoot, relativeDirectory, names) {
+    return relativeDirectory !== scanRoot
+        && !isCheckoutBoundaryExempt(relativeDirectory)
+        && names.includes('.git');
+}
 /**
  * Every exclusion is a property of the directory holding the `worker.yaml`, so
  * the file rule is the directory rule applied to its parent. Deriving it keeps

package/dist/utils/cognito-session.d.ts

@@ -294,7 +294,10 @@ export declare function buildVaultConfig(authToken: string): VaultServiceConfig;
  * means no valid session could be ensured non-interactively; the caller gets a
  * reason string and can decide what to do next. Never opens a browser.
  */
-type MachineRefreshOptions = Pick<EnsureCognitoTokenOptions, "tokenSource"> & MachineTokenValidityOptions;
+type MachineRefreshOptions = Pick<EnsureCognitoTokenOptions, "tokenSource"> & MachineTokenValidityOptions & {
+    /** Refresh the person session even when the cached token is still valid. */
+    force?: boolean;
+};
 export declare function refreshCachedSession(options?: MachineRefreshOptions): Promise<{
     refreshed: boolean;
     reason?: string;

package/dist/utils/cognito-session.js

@@ -1158,6 +1158,15 @@ export function buildVaultConfig(authToken) {
         clientInfo: CLI_CLIENT_INFO,
     };
 }
+/** Person sessions renew below this many seconds of validity by default. */
+const PERSON_REFRESH_DEFAULT_SECONDS = 120;
+/** Person tokens last one hour; a caller minimum above this would always refresh. */
+const MAX_PERSON_MIN_VALIDITY_SECONDS = 1800;
+function personRefreshThresholdSeconds(minValiditySeconds) {
+    if (minValiditySeconds === undefined)
+        return PERSON_REFRESH_DEFAULT_SECONDS;
+    return Math.max(PERSON_REFRESH_DEFAULT_SECONDS, Math.min(minValiditySeconds, MAX_PERSON_MIN_VALIDITY_SECONDS));
+}
 export async function refreshCachedSession(options = {}) {
     if (wantsMachineCognitoTokens(options))
         return refreshCachedSessionUnserialized(options);
@@ -1198,7 +1207,8 @@ async function refreshCachedSessionUnserialized(options) {
         }
         return { refreshed: false, reason: "no cached session" };
     }
-    if (!isExpiring(cached, 120)) {
+    if (!options.force &&
+        !isExpiring(cached, personRefreshThresholdSeconds(options.minValiditySeconds))) {
         return { refreshed: true };
     }
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.152",
+  "version": "5.345.153",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.152",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.152",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.152",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.152",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.152",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.152"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.153",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.153",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.153",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.153",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.153",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.153"
   }
 }