@indigoai-us/hq-cli 5.345.183 → 5.345.188

package/dist/lib/hot-channels/schedule.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `hq sources schedule`: find a company's hot-signal-sync job across the
+ * local bots, show when it runs and how each adapter's last run went, and
+ * reschedule it to a daily time.
+ *
+ * Jobs live in each bot's `jobs.json` (lib/bot/local-jobs.ts). Reads go
+ * straight to the file; the reschedule goes through `rescheduleLocalJob`,
+ * which takes the job list's lock.
+ */
+import { type LocalJob } from "../bot/local-jobs.js";
+/** How many UTC days of the run ledger `lastRuns` looks back over, today included. */
+export declare const SCHEDULE_LOOKBACK_DAYS = 7;
+export interface ScheduleJobView {
+    botName: string;
+    jobId: string;
+    cron: string;
+    timezone: string;
+    dailyAt: string | null;
+    nextRunAt: string | null;
+    lastRunAt: string | null;
+}
+export interface ScheduleLastRun {
+    adapter: string;
+    finishedAt: string;
+    ok: boolean;
+    sourcesLanded: number;
+    signalsGenerated: number | null;
+}
+export interface ScheduleReport {
+    company: string;
+    job: ScheduleJobView | null;
+    lastRuns: ScheduleLastRun[];
+}
+export interface FoundHotSignalSyncJob {
+    botName: string;
+    dir: string;
+    job: LocalJob;
+}
+/** Parse `HH:MM` (24-hour). Throws a plain error on anything else. */
+export declare function parseDailyAt(at: string): {
+    hour: number;
+    minute: number;
+};
+/** The stored EventBridge form of "every day at H:M". */
+export declare function dailyCron(hour: number, minute: number): string;
+/** `HH:MM` when the cron fires once a day at a fixed time; null for any other schedule. */
+export declare function dailyAtOf(cron: string): string | null;
+/** Every local bot's hot-signal-sync job for `company`, ordered by bot name. */
+export declare function findHotSignalSyncJobs(botsRoot: string, company: string): FoundHotSignalSyncJob[];
+export declare function toJobView(found: FoundHotSignalSyncJob, now: Date): ScheduleJobView;
+/**
+ * Reschedule each found job to daily at `at`, keeping its time zone. Returns
+ * the jobs as stored after the change.
+ */
+export declare function rescheduleDaily(found: readonly FoundHotSignalSyncJob[], at: string, now: Date): FoundHotSignalSyncJob[];
+/**
+ * The newest ledger entry per adapter over the last `SCHEDULE_LOOKBACK_DAYS`
+ * UTC days, today included. Skipped runs (another sync held the lock) are not
+ * adapter runs and are left out. Sorted by adapter id.
+ */
+export declare function lastRunsPerAdapter(vaultRoot: string, personKey: string, now: Date): Promise<ScheduleLastRun[]>;
+/** Plain lines for the terminal. */
+export declare function renderScheduleReport(report: ScheduleReport, extraBots?: readonly string[]): string;
+//# sourceMappingURL=schedule.d.ts.map

package/dist/lib/hot-channels/schedule.js

@@ -0,0 +1,162 @@
+/**
+ * `hq sources schedule`: find a company's hot-signal-sync job across the
+ * local bots, show when it runs and how each adapter's last run went, and
+ * reschedule it to a daily time.
+ *
+ * Jobs live in each bot's `jobs.json` (lib/bot/local-jobs.ts). Reads go
+ * straight to the file; the reschedule goes through `rescheduleLocalJob`,
+ * which takes the job list's lock.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { hotSignalSyncJobCompany } from "../bot/jobs/hot-signal-sync.js";
+import { nextDueFire, readLocalJobs, rescheduleLocalJob } from "../bot/local-jobs.js";
+import { ledgerDay, readRunLedger } from "./ledger.js";
+/** How many UTC days of the run ledger `lastRuns` looks back over, today included. */
+export const SCHEDULE_LOOKBACK_DAYS = 7;
+/** Parse `HH:MM` (24-hour). Throws a plain error on anything else. */
+export function parseDailyAt(at) {
+    const match = /^(\d{1,2}):(\d{2})$/.exec(at.trim());
+    const hour = match ? Number(match[1]) : NaN;
+    const minute = match ? Number(match[2]) : NaN;
+    if (!match || hour > 23 || minute > 59) {
+        throw new Error(`--at must be a 24-hour time HH:MM, such as 06:30 or 18:05 (got '${at}').`);
+    }
+    return { hour, minute };
+}
+/** The stored EventBridge form of "every day at H:M". */
+export function dailyCron(hour, minute) {
+    return `cron(${minute} ${hour} * * ? *)`;
+}
+function hhmm(hour, minute) {
+    return `${String(hour).padStart(2, "0")}:${String(minute).padStart(2, "0")}`;
+}
+/** `HH:MM` when the cron fires once a day at a fixed time; null for any other schedule. */
+export function dailyAtOf(cron) {
+    const match = /^cron\((\d{1,2}) (\d{1,2}) \* \* \? \*\)$/.exec(cron.trim()) ?? /^(\d{1,2}) (\d{1,2}) \* \* \*$/.exec(cron.trim());
+    if (!match)
+        return null;
+    const minute = Number(match[1]);
+    const hour = Number(match[2]);
+    return hour <= 23 && minute <= 59 ? hhmm(hour, minute) : null;
+}
+/** Every local bot's hot-signal-sync job for `company`, ordered by bot name. */
+export function findHotSignalSyncJobs(botsRoot, company) {
+    let names;
+    try {
+        names = fs.readdirSync(botsRoot);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const found = [];
+    for (const botName of names.sort()) {
+        const dir = path.join(botsRoot, botName);
+        let isDir;
+        try {
+            isDir = fs.statSync(dir).isDirectory();
+        }
+        catch {
+            // Gone between readdir and stat: not a bot.
+            isDir = false;
+        }
+        if (!isDir)
+            continue;
+        for (const job of readLocalJobs(dir)) {
+            if (hotSignalSyncJobCompany(job.context) === company)
+                found.push({ botName, dir, job });
+        }
+    }
+    return found;
+}
+export function toJobView(found, now) {
+    const next = nextDueFire(found.job, now);
+    return {
+        botName: found.botName,
+        jobId: found.job.jobId,
+        cron: found.job.cron,
+        timezone: found.job.timezone,
+        dailyAt: dailyAtOf(found.job.cron),
+        nextRunAt: next ? next.toISOString() : null,
+        lastRunAt: found.job.lastRunAt ?? null,
+    };
+}
+/**
+ * Reschedule each found job to daily at `at`, keeping its time zone. Returns
+ * the jobs as stored after the change.
+ */
+export function rescheduleDaily(found, at, now) {
+    const { hour, minute } = parseDailyAt(at);
+    const cron = dailyCron(hour, minute);
+    const out = [];
+    for (const f of found) {
+        // The time zone is read under the job-list lock, not from the earlier
+        // read, so a concurrent change to it is never overwritten.
+        const updated = rescheduleLocalJob(f.dir, f.job.jobId, { cron }, now);
+        if (!updated)
+            throw new Error(`The hot-signal-sync job ${f.job.jobId} on bot ${f.botName} was removed while rescheduling.`);
+        out.push({ ...f, job: updated });
+    }
+    return out;
+}
+/**
+ * The newest ledger entry per adapter over the last `SCHEDULE_LOOKBACK_DAYS`
+ * UTC days, today included. Skipped runs (another sync held the lock) are not
+ * adapter runs and are left out. Sorted by adapter id.
+ */
+export async function lastRunsPerAdapter(vaultRoot, personKey, now) {
+    const latest = new Map();
+    for (let i = 0; i < SCHEDULE_LOOKBACK_DAYS; i += 1) {
+        const day = ledgerDay(new Date(now.getTime() - i * 24 * 60 * 60 * 1000));
+        const { entries } = await readRunLedger(vaultRoot, personKey, day);
+        for (const entry of entries) {
+            if (entry.status === "skipped")
+                continue;
+            const seen = latest.get(entry.adapter);
+            if (!seen || entry.finishedAt > seen.finishedAt)
+                latest.set(entry.adapter, entry);
+        }
+    }
+    return [...latest.values()]
+        .sort((a, b) => (a.adapter < b.adapter ? -1 : a.adapter > b.adapter ? 1 : 0))
+        .map((e) => ({
+        adapter: e.adapter,
+        finishedAt: e.finishedAt,
+        ok: e.status === "ok",
+        sourcesLanded: e.sourcesLanded,
+        signalsGenerated: typeof e.signalsGenerated === "number" ? e.signalsGenerated : null,
+    }));
+}
+/** Plain lines for the terminal. */
+export function renderScheduleReport(report, extraBots = []) {
+    const lines = [];
+    const job = report.job;
+    if (!job) {
+        lines.push(`No hot-channel sync job for ${report.company} on any local bot.`);
+    }
+    else if (job.dailyAt) {
+        lines.push(`Syncs daily at ${job.dailyAt} (${job.timezone}) on bot ${job.botName}`);
+    }
+    else {
+        lines.push(`Syncs on schedule ${job.cron} (${job.timezone}) on bot ${job.botName}`);
+    }
+    if (job) {
+        if (extraBots.length > 0)
+            lines.push(`Also scheduled on bot ${extraBots.join(", ")}`);
+        lines.push(`Next run: ${job.nextRunAt ?? "not within the next week"}`);
+        lines.push(`Last run: ${job.lastRunAt ?? "never"}`);
+    }
+    if (report.lastRuns.length === 0) {
+        lines.push(`No runs logged in the last ${SCHEDULE_LOOKBACK_DAYS} days.`);
+    }
+    else {
+        for (const run of report.lastRuns) {
+            const signals = run.signalsGenerated === null ? "unknown" : String(run.signalsGenerated);
+            lines.push(`${run.adapter}: ${run.ok ? "ok" : "failed"} at ${run.finishedAt}, ${run.sourcesLanded} source(s), ${signals} signal(s)`);
+        }
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=schedule.js.map

package/dist/lib/hot-channels/selection.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Saved hot-channel selections (hq-pro US-014).
+ *
+ * A person can pick which channels, issues or records to watch on each
+ * connection. hq-pro stores the pick as
+ * `integrations/hot-channels/<connectionId>.json` in that person's own vault
+ * bucket (hq-pro `hotChannelSelectionKey`), shaped
+ * `{ schemaVersion: 1, connectionId, provider, hotChannelId, selected: [{ id, label, source }], updatedAt }`.
+ *
+ * The sync reads it once per connection per run. A missing file (404) means
+ * "no choice made": the adapter lands everything. A file that may exist but
+ * cannot be read (an error, a read slower than 5 seconds, malformed content,
+ * or a file naming another connection) fails closed: the loader throws
+ * `SelectionUnreadableError`, the loop skips that connection's adapter run
+ * and the ledger records it as failed with reason `selection-unreadable`.
+ * Nothing lands that the person may have excluded.
+ *
+ * An empty `selected` list on a connection's own channel (Slack, Linear,
+ * Attio) also means "no choice made" and lands everything: hq-pro saves `[]`
+ * when the person accepts defaults before any suggestions are listed, and has
+ * no delete, so `[]` must not silently stop the channel. Meetings keep their
+ * own rule (`meetingsSelection`): an empty pick on every recorder excludes them.
+ */
+export declare const HOT_CHANNEL_SELECTION_SCHEMA_VERSION = 1;
+export declare const HOT_CHANNEL_SELECTION_PREFIX = "integrations/hot-channels/";
+/** Upper bound on one selection read. */
+export declare const DEFAULT_SELECTION_READ_TIMEOUT_MS = 5000;
+export interface HotChannelSelectionEntry {
+    id: string;
+    label: string;
+    source: "suggested" | "added";
+}
+export interface HotChannelSelectionFile {
+    schemaVersion: typeof HOT_CHANNEL_SELECTION_SCHEMA_VERSION;
+    connectionId: string;
+    provider: string;
+    hotChannelId: string;
+    selected: HotChannelSelectionEntry[];
+    updatedAt: string;
+}
+/** Bucket-relative key of a connection's selection; null for an id hq-pro would never write. */
+export declare function hotChannelSelectionKey(connectionId: string): string | null;
+/**
+ * Parse a stored selection the way hq-pro's `parseSelectionFile` does.
+ * Anything unexpected (bad JSON, other schema version, a bad entry) is null.
+ */
+export declare function parseHotChannelSelection(text: string | null | undefined): HotChannelSelectionFile | null;
+/**
+ * Reads one object from the signed-in person's vault bucket by
+ * bucket-relative key. Resolves null when the object does not exist.
+ */
+export type PersonVaultObjectReader = (key: string) => Promise<string | null>;
+export interface SelectionLoaderOptions {
+    timeoutMs?: number;
+    log?: (message: string) => void;
+}
+export declare const SELECTION_UNREADABLE_REASON = "selection-unreadable";
+/** A saved selection may exist but could not be read; the connection is skipped. */
+export declare class SelectionUnreadableError extends Error {
+    readonly code = "selection-unreadable";
+    constructor(connectionId: string, detail: string);
+}
+/**
+ * Selected ids for one connection; undefined means no saved choice (land
+ * everything). Rejects with `SelectionUnreadableError` when a saved choice may
+ * exist but could not be read.
+ */
+export type SelectionLoader = (connectionId: string) => Promise<ReadonlySet<string> | undefined>;
+/**
+ * A loader for one run. Each connection's file is read at most once, and the
+ * cache dies with the loader, so the next run reads the file again. Rejects
+ * only with `SelectionUnreadableError`.
+ */
+export declare function createSelectionLoader(read: PersonVaultObjectReader, options?: SelectionLoaderOptions): SelectionLoader;
+/**
+ * The selection a connection's own channel lands by: the saved ids, or
+ * undefined (land everything) when nothing was saved or the saved list is empty.
+ */
+export declare function connectionSelection(saved: ReadonlySet<string> | undefined): ReadonlySet<string> | undefined;
+/**
+ * The meetings channel has no connection of its own; its checklist is an
+ * include/exclude choice saved on each meeting-recorder connection. Meetings
+ * are excluded (an empty set) when at least one recorder connection saved an
+ * empty selection and none saved a non-empty one. Otherwise undefined: include.
+ */
+export declare function meetingsSelection(selections: ReadonlyArray<ReadonlySet<string> | undefined>): ReadonlySet<string> | undefined;
+//# sourceMappingURL=selection.d.ts.map

package/dist/lib/hot-channels/selection.js

@@ -0,0 +1,175 @@
+/**
+ * Saved hot-channel selections (hq-pro US-014).
+ *
+ * A person can pick which channels, issues or records to watch on each
+ * connection. hq-pro stores the pick as
+ * `integrations/hot-channels/<connectionId>.json` in that person's own vault
+ * bucket (hq-pro `hotChannelSelectionKey`), shaped
+ * `{ schemaVersion: 1, connectionId, provider, hotChannelId, selected: [{ id, label, source }], updatedAt }`.
+ *
+ * The sync reads it once per connection per run. A missing file (404) means
+ * "no choice made": the adapter lands everything. A file that may exist but
+ * cannot be read (an error, a read slower than 5 seconds, malformed content,
+ * or a file naming another connection) fails closed: the loader throws
+ * `SelectionUnreadableError`, the loop skips that connection's adapter run
+ * and the ledger records it as failed with reason `selection-unreadable`.
+ * Nothing lands that the person may have excluded.
+ *
+ * An empty `selected` list on a connection's own channel (Slack, Linear,
+ * Attio) also means "no choice made" and lands everything: hq-pro saves `[]`
+ * when the person accepts defaults before any suggestions are listed, and has
+ * no delete, so `[]` must not silently stop the channel. Meetings keep their
+ * own rule (`meetingsSelection`): an empty pick on every recorder excludes them.
+ */
+export const HOT_CHANNEL_SELECTION_SCHEMA_VERSION = 1;
+export const HOT_CHANNEL_SELECTION_PREFIX = "integrations/hot-channels/";
+/** Upper bound on one selection read. */
+export const DEFAULT_SELECTION_READ_TIMEOUT_MS = 5_000;
+const CONNECTION_ID_PATTERN = /^[A-Za-z0-9_-]{1,256}$/;
+const ENTRY_ID_PATTERN = /^[^\s/\\]{1,256}$/;
+/** Bucket-relative key of a connection's selection; null for an id hq-pro would never write. */
+export function hotChannelSelectionKey(connectionId) {
+    return CONNECTION_ID_PATTERN.test(connectionId) ? `${HOT_CHANNEL_SELECTION_PREFIX}${connectionId}.json` : null;
+}
+/**
+ * Parse a stored selection the way hq-pro's `parseSelectionFile` does.
+ * Anything unexpected (bad JSON, other schema version, a bad entry) is null.
+ */
+export function parseHotChannelSelection(text) {
+    if (!text)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const file = parsed;
+    if (file.schemaVersion !== HOT_CHANNEL_SELECTION_SCHEMA_VERSION)
+        return null;
+    if (typeof file.connectionId !== "string" || typeof file.provider !== "string")
+        return null;
+    if (typeof file.hotChannelId !== "string" || typeof file.updatedAt !== "string")
+        return null;
+    if (!Array.isArray(file.selected))
+        return null;
+    const selected = [];
+    const seen = new Set();
+    for (const item of file.selected) {
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            return null;
+        const { id, label, source } = item;
+        if (typeof id !== "string" || !ENTRY_ID_PATTERN.test(id.trim()))
+            return null;
+        if (source !== "suggested" && source !== "added")
+            return null;
+        const cleanId = id.trim();
+        if (seen.has(cleanId))
+            continue;
+        seen.add(cleanId);
+        selected.push({ id: cleanId, label: typeof label === "string" && label.trim() ? label.trim() : cleanId, source });
+    }
+    return {
+        schemaVersion: HOT_CHANNEL_SELECTION_SCHEMA_VERSION,
+        connectionId: file.connectionId,
+        provider: file.provider,
+        hotChannelId: file.hotChannelId,
+        selected,
+        updatedAt: file.updatedAt,
+    };
+}
+export const SELECTION_UNREADABLE_REASON = "selection-unreadable";
+/** A saved selection may exist but could not be read; the connection is skipped. */
+export class SelectionUnreadableError extends Error {
+    code = SELECTION_UNREADABLE_REASON;
+    constructor(connectionId, detail) {
+        super(`saved selection for ${connectionId} could not be read (${detail}); skipped this connection`);
+        this.name = "SelectionUnreadableError";
+    }
+}
+class SelectionReadTimeoutError extends Error {
+    constructor(ms) {
+        super(`timed out after ${ms}ms`);
+        this.name = "SelectionReadTimeoutError";
+    }
+}
+async function withTimeout(work, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new SelectionReadTimeoutError(ms)), ms);
+    });
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/**
+ * A loader for one run. Each connection's file is read at most once, and the
+ * cache dies with the loader, so the next run reads the file again. Rejects
+ * only with `SelectionUnreadableError`.
+ */
+export function createSelectionLoader(read, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SELECTION_READ_TIMEOUT_MS;
+    const log = options.log ?? ((message) => void process.stderr.write(`${message}\n`));
+    const cache = new Map();
+    async function load(connectionId) {
+        const key = hotChannelSelectionKey(connectionId);
+        if (key === null)
+            return undefined;
+        let text;
+        try {
+            text = await withTimeout(Promise.resolve().then(() => read(key)), timeoutMs);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            log(`hot-channel selection for ${connectionId} could not be read (${reason}); skipping this connection`);
+            throw new SelectionUnreadableError(connectionId, reason);
+        }
+        if (text === null)
+            return undefined;
+        const file = parseHotChannelSelection(text);
+        if (!file) {
+            log(`hot-channel selection for ${connectionId} is malformed; skipping this connection`);
+            throw new SelectionUnreadableError(connectionId, "malformed");
+        }
+        if (file.connectionId !== connectionId) {
+            log(`hot-channel selection for ${connectionId} names connection ${file.connectionId}; skipping this connection`);
+            throw new SelectionUnreadableError(connectionId, `names connection ${file.connectionId}`);
+        }
+        return new Set(file.selected.map((entry) => entry.id));
+    }
+    return (connectionId) => {
+        let hit = cache.get(connectionId);
+        if (!hit) {
+            hit = load(connectionId);
+            cache.set(connectionId, hit);
+        }
+        return hit;
+    };
+}
+/**
+ * The selection a connection's own channel lands by: the saved ids, or
+ * undefined (land everything) when nothing was saved or the saved list is empty.
+ */
+export function connectionSelection(saved) {
+    return saved && saved.size > 0 ? saved : undefined;
+}
+/**
+ * The meetings channel has no connection of its own; its checklist is an
+ * include/exclude choice saved on each meeting-recorder connection. Meetings
+ * are excluded (an empty set) when at least one recorder connection saved an
+ * empty selection and none saved a non-empty one. Otherwise undefined: include.
+ */
+export function meetingsSelection(selections) {
+    const saved = selections.filter((s) => s !== undefined);
+    if (saved.length === 0)
+        return undefined;
+    return saved.every((s) => s.size === 0) ? new Set() : undefined;
+}
+//# sourceMappingURL=selection.js.map

package/dist/utils/cognito-session.d.ts

@@ -267,7 +267,7 @@ export declare function buildVaultConfig(authToken: string): VaultServiceConfig;
  * means no valid session could be ensured non-interactively; the caller gets a
  * reason string and can decide what to do next. Never opens a browser.
  */
-type MachineRefreshOptions = Pick<EnsureCognitoTokenOptions, "tokenSource"> & MachineTokenValidityOptions & {
+type MachineRefreshOptions = Pick<EnsureCognitoTokenOptions, "tokenSource" | "signal"> & MachineTokenValidityOptions & {
     /** Refresh the person session even when the cached token is still valid. */
     force?: boolean;
 };

package/dist/utils/cognito-session.js

@@ -780,11 +780,21 @@ function withTokenStateDirSection(fn) {
     return run;
 }
 const MAX_MACHINE_TOKEN_MIN_VALIDITY_SECONDS = 1800;
-async function ensureMachineTokens(minValiditySeconds) {
+/**
+ * `signal` cancels only this caller's wait inside hq-cloud (a mint shared with
+ * other callers keeps running). Without it a bounded caller such as `hq agent
+ * inbox` timed out, retried, and its retry queued behind the orphaned first
+ * mint, which still held the lock.
+ */
+async function ensureMachineTokens(minValiditySeconds, signal) {
     const resolverMinimum = minValiditySeconds === undefined
         ? undefined
         : Math.min(minValiditySeconds, MAX_MACHINE_TOKEN_MIN_VALIDITY_SECONDS);
-    return withMachineTokenStateDir(() => getValidMachineTokens(DEFAULT_COGNITO, resolverMinimum === undefined ? undefined : { minValiditySeconds: resolverMinimum }));
+    const resolverOptions = {
+        ...(resolverMinimum === undefined ? {} : { minValiditySeconds: resolverMinimum }),
+        ...(signal ? { signal } : {}),
+    };
+    return withMachineTokenStateDir(() => getValidMachineTokens(DEFAULT_COGNITO, Object.keys(resolverOptions).length === 0 ? undefined : resolverOptions));
 }
 /**
  * Ensure the current machine identity has a valid session and return only the
@@ -803,7 +813,7 @@ async function ensureMachineTokensMaybeFallback(options = {}) {
     if (isDefaultMachineCredsFallback(options)) {
         logDefaultMachineCredsFallback();
     }
-    return ensureMachineTokens(options.minValiditySeconds);
+    return ensureMachineTokens(options.minValiditySeconds, options.signal);
 }
 /**
  * After a person-cache miss or refresh failure: if the default machine-creds
@@ -818,7 +828,7 @@ async function tryDefaultMachineCredsFallback(options = {}) {
     if (!isMachineIdentity())
         return null;
     logDefaultMachineCredsFallback();
-    return ensureMachineTokens(options.minValiditySeconds);
+    return ensureMachineTokens(options.minValiditySeconds, options.signal);
 }
 /**
  * True when a person-token refresh failed with a definitive Cognito auth
@@ -880,6 +890,8 @@ function resolvePersonSessionAfterRefreshRejection(cached) {
  * a browser.
  */
 export async function ensureCognitoToken(options = {}) {
+    if (options.signal?.aborted)
+        throw options.signal.reason ?? new Error("Token acquisition was aborted");
     if (wantsMachineCognitoTokens(options))
         return ensureCognitoTokenUnserialized(options);
     return withTokenStateDirSection(() => ensureCognitoTokenUnserialized(options));

package/dist/utils/shipped-codex-hooks.js

@@ -18,7 +18,7 @@ const CORE_SOURCES = [PROD_SOURCE, STAGING_SOURCE];
 /** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
 export function resolveGhToken() {
     try {
-        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
+        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8', timeout: 5_000 });
         if (res.status === 0) {
             const tok = res.stdout.trim();
             if (tok)

package/dist/utils/version-report.d.ts

@@ -16,7 +16,7 @@ export interface VersionReportDeps {
     printUpdateNudge?: (stderr: Pick<NodeJS.WriteStream, "write">) => Promise<void>;
 }
 export declare function normalizeHqCoreTag(tag: string): string | null;
-export declare function fetchLatestHqCoreRelease(fetchImpl?: typeof fetch, timeoutMs?: number): Promise<string | null>;
+export declare function fetchLatestHqCoreRelease(fetchImpl?: typeof fetch, timeoutMs?: number, token?: string | undefined): Promise<string | null>;
 export declare function collectVersionReport(deps?: VersionReportDeps): Promise<VersionReport>;
 export declare function formatVersionReport(report: VersionReport): string;
 export declare function versionReportJson(report: VersionReport): string;

package/dist/utils/version-report.js

@@ -13,22 +13,35 @@ import { CLI_VERSION } from "../cli-version.js";
 import { wantsJson } from "../version-request.js";
 import { findHqRoot } from "./manifest.js";
 import { readHqVersion } from "./hq-core-yaml.js";
+import { resolveGhToken } from "./shipped-codex-hooks.js";
 export const HQ_CORE_LATEST_URL = "https://api.github.com/repos/indigoai-us/hq-core/releases/latest";
 export const LATEST_FETCH_TIMEOUT_MS = 3_000;
 export function normalizeHqCoreTag(tag) {
     const version = tag.trim().replace(/^v/i, "");
     return semver.valid(version) ? version : null;
 }
-export async function fetchLatestHqCoreRelease(fetchImpl = fetch, timeoutMs = LATEST_FETCH_TIMEOUT_MS) {
+export async function fetchLatestHqCoreRelease(fetchImpl = fetch, timeoutMs = LATEST_FETCH_TIMEOUT_MS, token = resolveGhToken()) {
     try {
-        const res = await fetchImpl(HQ_CORE_LATEST_URL, {
-            headers: {
-                Accept: "application/vnd.github+json",
-                "User-Agent": "hq-cli-version",
-                "X-GitHub-Api-Version": "2022-11-28",
-            },
+        const headers = {
+            Accept: "application/vnd.github+json",
+            "User-Agent": "hq-cli-version",
+            "X-GitHub-Api-Version": "2022-11-28",
+        };
+        if (token)
+            headers.Authorization = `Bearer ${token}`;
+        let res = await fetchImpl(HQ_CORE_LATEST_URL, {
+            headers,
             signal: AbortSignal.timeout(timeoutMs),
         });
+        // hq-core is public. A stale GH_TOKEN 401/403 should not hide the anonymous
+        // lookup that used to work.
+        if (token && (res.status === 401 || res.status === 403)) {
+            const { Authorization: _drop, ...anonHeaders } = headers;
+            res = await fetchImpl(HQ_CORE_LATEST_URL, {
+                headers: anonHeaders,
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
         if (!res.ok)
             return null;
         const body = (await res.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.183",
+  "version": "5.345.188",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -52,7 +52,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "6.18.106",
+    "@indigoai-us/hq-cloud": "6.18.107",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.183",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.183",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.183",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.183",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.183",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.183"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.188",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.188",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.188",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.188",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.188",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.188"
   }
 }