@indigoai-us/hq-cli 5.345.18 → 5.345.20

package/dist/commands/pkg-install.js

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import { peekHqApiKey, requireApiKeyCapability, } from '../utils/resolve-vault-credential.js';
-import { MARKETPLACE_PREFIX, installPack, sourceMatchesPackPattern, } from './pack-install.js';
+import { MARKETPLACE_PREFIX, PINNED_HQ_ANYWHERE_SOURCE, installPack, sourceMatchesPackPattern, } from './pack-install.js';
 import { anywhereRuntimeEnabled } from './anywhere-runtime-flag.js';
 /**
  * True when `source` installs through the marketplace — an explicit
@@ -99,11 +99,12 @@ export function registerPackageInstallCommand(parent) {
                     console.error(chalk.red('Install failed:'), 'HQ Anywhere installation is disabled by the hq-anywhere-runtime flag.');
                     process.exit(1);
                 }
-                await installPack('github:indigoai-us/hq-packages#packages/hq-pack-hq-anywhere', {
+                await installPack(PINNED_HQ_ANYWHERE_SOURCE, {
                     company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
                     followBranch: opts.branch,
+                    allowPinnedHqAnywhereName: true,
                 });
                 return;
             }

package/dist/lib/daemon/run.d.ts

@@ -21,8 +21,8 @@ export interface DaemonLockConflictOutcome {
 }
 /** Preserve the legacy lock failure unless Anywhere explicitly enables the no-op behavior. */
 export declare function daemonLockConflictOutcome(lock: DaemonLockResult, anywhereEnabled: boolean): DaemonLockConflictOutcome | null;
-/** Node's Windows named-pipe API uses a default DACL that is not user-scoped. */
-export declare function hqdStartupRefusal(platform: NodeJS.Platform, anywhereEnabled: boolean): string | null;
+/** hqd is available on every platform while Anywhere is enabled; its listener fails closed if setup is unsafe. */
+export declare function shouldStartHqd(anywhereEnabled: boolean): boolean;
 /** Route an updater request through the daemon's existing graceful handoff. */
 export declare function handoffForPackageUpdateRequest(requested: boolean, restartDaemon: () => void): void;
 export interface RunDaemonOptions {

package/dist/lib/daemon/run.js

@@ -63,11 +63,9 @@ export function daemonLockConflictOutcome(lock, anywhereEnabled) {
             : "another hq daemon is starting up.\n",
     };
 }
-/** Node's Windows named-pipe API uses a default DACL that is not user-scoped. */
-export function hqdStartupRefusal(platform, anywhereEnabled) {
-    if (platform !== "win32" || !anywhereEnabled)
-        return null;
-    return "hqd is disabled on Windows because the default named-pipe ACL grants read access to Everyone and Anonymous accounts.";
+/** hqd is available on every platform while Anywhere is enabled; its listener fails closed if setup is unsafe. */
+export function shouldStartHqd(anywhereEnabled) {
+    return anywhereEnabled;
 }
 /** Route an updater request through the daemon's existing graceful handoff. */
 export function handoffForPackageUpdateRequest(requested, restartDaemon) {
@@ -838,8 +836,7 @@ export async function runDaemon(opts) {
     // hqd: the session/company socket every runtime talks to (hq-anywhere US-008).
     let hqd = null;
     let hqdShutdown = null;
-    if (anywhereRuntimeEnabled()) {
-        const refusal = hqdStartupRefusal(platform, true);
+    if (shouldStartHqd(anywhereRuntimeEnabled())) {
         try {
             const startConfig = readDaemonConfig(paths.configPath);
             hqd = await startHqdServer({
@@ -852,10 +849,7 @@ export async function runDaemon(opts) {
             });
         }
         catch (err) {
-            if (refusal && err.message === refusal)
-                log("error", refusal);
-            else
-                log("error", `hqd socket did not start; services run without it: ${err.message}`);
+            log("error", `hqd socket did not start; services run without it: ${err.message}`);
         }
     }
     // US-012: 60s presence heartbeat with version and session count.

package/dist/lib/doctor/checks/anywhere.js

@@ -182,7 +182,7 @@ function runtimeHealthCheck(health, healthUnsupported = false, serviceState) {
         ? "Windows named pipe (mode and owner are not reported)"
         : `mode ${socket.mode ?? "unknown"}; owner matches current user: ${socket.ownerMatchesUser === null ? "unknown" : socket.ownerMatchesUser ? "yes" : "no"}; user-only: ${socket.userOnly === null ? "unknown" : socket.userOnly ? "yes" : "no"}`;
     const unreachableMessage = socket.transport === "windows_named_pipe"
-        ? `hqd is not reachable on ${socket.path}; Windows daemon startup is refused because named-pipe ACLs are unsupported`
+        ? `hqd is not reachable on ${socket.path}; secure Windows named-pipe setup may have refused an unsafe ACL`
         : `hqd is not reachable on ${socket.path}; version, uptime, flag state, and cwd binding are unavailable`;
     const socketNotUserOnly = health.reachable && socket.transport === "unix_socket" && (socket.userOnly !== true || socket.ownerMatchesUser !== true);
     const warningNotes = [
@@ -192,7 +192,7 @@ function runtimeHealthCheck(health, healthUnsupported = false, serviceState) {
     const message = health.reachable
         ? `hqd reachable; version ${health.version ?? "unknown"}; uptime ${health.uptimeMs === null ? "unknown" : `${new Intl.NumberFormat("en-US").format(health.uptimeMs)} ms`}; runtime flag ${flagLabel}; last successful flag read ${age} ago; held through read error: ${flag.heldThroughReadError ? "yes" : "no"}; cwd binding ${binding}; socket ${socket.path}; ${socketSecurity}${warningNotes.length ? `; ${warningNotes.join("; ")}` : ""}`
         : unreachableMessage;
-    const remediation = !health.reachable && socket.transport === "unix_socket" && serviceState
+    const remediation = !health.reachable && serviceState
         ? serviceState.installed ? REMEDIATION.daemonRestart : REMEDIATION.daemonInstall
         : healthUnsupported || socketNotUserOnly ? REMEDIATION.daemonRestart : undefined;
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.18",
+  "version": "5.345.20",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {