@indigoai-us/hq-cli 5.345.197 → 5.345.199

package/dist/secrets-env-action.js

@@ -2,11 +2,14 @@ import chalk from "chalk";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { cognitoCachePrincipalUid } from "./utils/cognito-session.js";
-import { isAuthError } from "./utils/auth-error.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
 import { finishEnvExportsAndExit } from "./commands/secrets-env-exit.js";
+import { DELEGATED_MACHINE_SESSION_ENV, delegatedMachineSessionFilePath, loadDelegatedMachineSession, loadMachineCreds, } from "@indigoai-us/hq-cloud";
+import { AuthError, isAuthError } from "./utils/auth-error.js";
+import { peekIdToken } from "./utils/id-token.js";
+import { wantsMachineCognitoTokens } from "./utils/machine-principal-state.js";
 import { getEntityUid, looksLikeCompanyUid, vaultApiFetch } from "./utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, resolveVaultCredentialForCapability, } from "./utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "./utils/secret-load-availability.js";
@@ -221,10 +224,224 @@ export async function assertApiKeyCompany(token, requested, commandLabel) {
     throw new Error(`Could not verify that HQ_API_KEY belongs to ${requested} (HTTP ${response.status}` +
         `${message ? `: ${message}` : ""}).`);
 }
+const COMPANY_OUTPOST_UID_PATTERN = /^out_[0-9A-HJKMNP-TV-Z]{26}$/;
+const COMPANY_UID_PATTERN = /^cmp_[A-Za-z0-9]+$/;
+/**
+ * The company Outpost identity named by the token this command will send, or
+ * null for any other token (person, agent, owner-delegated outpost, API key).
+ *
+ * hq-cloud says whether this process is a machine identity but exposes no
+ * accessor for the bound company, and hq-pro routes on the claims of the
+ * token it receives, so the route choice reads them from that token. The
+ * claims are not verified here; hq-pro verifies the token and re-checks the
+ * live Outpost binding on every request. A token with any company Outpost
+ * marker but no usable company or out_* uid fails closed rather than falling
+ * through to the person routes.
+ */
+export function companyOutpostIdentityFromToken(token) {
+    if (token.startsWith(HQ_API_KEY_PREFIX))
+        return null;
+    const claims = peekIdToken(token);
+    const has = (key) => Object.prototype.hasOwnProperty.call(claims, key);
+    if (claims["custom:entityType"] !== "company-outpost" &&
+        !has("custom:ownerCompanyUid") &&
+        !has("custom:companyOutpostId")) {
+        return null;
+    }
+    const outpostUid = claims["custom:entityUid"];
+    const companyUid = claims["custom:ownerCompanyUid"];
+    if (claims["custom:entityType"] !== "company-outpost" ||
+        typeof outpostUid !== "string" ||
+        !COMPANY_OUTPOST_UID_PATTERN.test(outpostUid) ||
+        typeof companyUid !== "string" ||
+        !COMPANY_UID_PATTERN.test(companyUid)) {
+        throw new Error("This HQ session carries company Outpost markers but does not name its Outpost (out_…) " +
+            "and company (cmp_…). Refusing to read secrets with it.");
+    }
+    return { outpostUid, companyUid };
+}
+/**
+ * True when this process will authenticate as a company Outpost: hq-cli picks
+ * machine tokens and hq-cloud's machine identity (a delegated session file or
+ * a credentials file) is a company Outpost. Local state only, no network.
+ * Used before a credential is resolved, where there is no token to read yet.
+ */
+export function callerIsCompanyOutpost(env = process.env) {
+    try {
+        return wantsMachineCognitoTokens({}, env) && loadMachineCreds()?.entityType === "company-outpost";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The company uid a company Outpost reads secrets from. The token names its
+ * bound company, so an omitted `--company` uses it with no lookup. An explicit
+ * `--company` must name that same company: a uid is compared locally, and a
+ * slug is checked with GET /entity/check-slug/me, the one slug lookup hq-pro
+ * answers for a company Outpost (it reports a conflict only for the bound
+ * company). Any other company, and `--personal`, is refused.
+ */
+export async function resolveCompanyOutpostSecretsCompany(token, outpost, scope) {
+    if (scope.personal) {
+        throw new Error("A company Outpost session has no personal vault. Drop --personal; it reads its company's secrets.");
+    }
+    const ref = scope.companySlug?.trim();
+    if (!ref || ref === outpost.companyUid)
+        return outpost.companyUid;
+    const notBound = () => new Error(`Company '${ref}' is not the company this Outpost (${outpost.outpostUid}) is bound to ` +
+        `(${outpost.companyUid}). A company Outpost can read only its own company's secrets.`);
+    if (looksLikeCompanyUid(ref) || /^(prs|agt|out)_/.test(ref))
+        throw notBound();
+    const res = await vaultApiFetch({
+        token,
+        path: "/entity/check-slug/me",
+        query: { type: "company", slug: ref },
+        signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        if (res.status === 401)
+            throw companyOutpostSessionRejected();
+        const message = `Failed to resolve company '${ref}' for this Outpost: ${extractApiMessage(body, `HTTP ${res.status}`)}`;
+        if (isUnavailableSecretLoadHttpStatus(res.status))
+            throw new SecretLoadUnavailableError(message);
+        throw new Error(message);
+    }
+    if (body.available === false && body.conflictingCompanyUid === outpost.companyUid) {
+        return outpost.companyUid;
+    }
+    throw notBound();
+}
+function companyOutpostSessionRejected() {
+    return new AuthError("HQ rejected this company Outpost session (HTTP 401). The job runner refreshes " +
+        "HQ_MACHINE_SESSION_FILE; re-run the job, and if it persists check the Outpost's binding.");
+}
+/**
+ * The company uid a `secrets exec` / `env` / `get` call reads from. A company
+ * Outpost token takes its company from the token (see
+ * {@link resolveCompanyOutpostSecretsCompany}); every other Cognito token keeps
+ * the existing {@link getEntityUid} resolution unchanged.
+ */
+export async function resolveSecretsReadCompanyUid(token, scope, options = {}) {
+    const outpost = companyOutpostIdentityFromToken(token);
+    if (outpost)
+        return resolveCompanyOutpostSecretsCompany(token, outpost, scope);
+    return getEntityUid(token, scope, options);
+}
+/**
+ * The message for a 403 a company Outpost gets on the single-secret GET, or
+ * null when the status/body is not one of these denials.
+ *
+ * - No code: hq-pro answers a plain "read permission required" both when the
+ *   secret is not shared with this Outpost and when the Outpost's live binding
+ *   to its company is not active, and the response does not say which.
+ * - `reveal_disabled` / `env_disabled`: the secret is script-locked. The
+ *   Outpost route evaluates the read with no script attestation, so a
+ *   script-locked secret can never be read by an Outpost job.
+ */
+export function companyOutpostReadDenialMessage(name, status, body, companyUid, outpost) {
+    if (status !== 403)
+        return null;
+    if (body.code === undefined) {
+        return (`Failed to fetch secret '${name}': ${extractApiMessage(body, "No read permission")}. ` +
+            `Either the secret is not shared with this Outpost (${outpost.outpostUid}), or the Outpost's ` +
+            `binding to ${companyUid} is not active. To share it: ` +
+            `hq secrets --company ${companyUid} share ${name} --with ${outpost.outpostUid}`);
+    }
+    if (body.code === "reveal_disabled" || body.code === "env_disabled") {
+        return (`Failed to fetch secret '${name}': it is script-locked, and company Outpost jobs cannot ` +
+            `read script-locked secrets (the Outpost secret route carries no script attestation).`);
+    }
+    return null;
+}
+/**
+ * Fail closed when HQ_MACHINE_SESSION_FILE is set but hq-cloud cannot use the
+ * file. The parent that set it chose that identity for this process, so an
+ * unreadable or malformed file must stop the read with a message naming the
+ * file, never fall through to another identity or a generic scope error.
+ * An expired but well-formed session passes here; the token request reports
+ * the expiry.
+ */
+export function assertDelegatedMachineSessionUsable() {
+    const file = delegatedMachineSessionFilePath();
+    if (file === null)
+        return;
+    if (loadDelegatedMachineSession() !== null)
+        return;
+    throw new Error(`${DELEGATED_MACHINE_SESSION_ENV} names ${file}, but that file is not a usable delegated machine ` +
+        `session (missing, unreadable, malformed, or its tokens do not describe the identity it claims). ` +
+        `Refusing to read secrets; the job runner must rewrite the session file.`);
+}
+function encodeSecretNamePath(name) {
+    // Encode each segment so structural `/` separators stay route separators
+    // for GET /secrets/{companyUid}/name/{proxy+} (same as `hq secrets get`).
+    return name.split("/").map(encodeURIComponent).join("/");
+}
+/**
+ * Read each key with GET /secrets/{companyUid}/name/{name}?reveal=true, the
+ * only secrets route hq-pro serves to a company Outpost. Throws on the first
+ * key that does not resolve, with the same `Failed to fetch secret '<k>':
+ * <reason>` shape as the batch path. Values are never written to the local
+ * secrets cache and there is no offline fallback: the Outpost reads only what
+ * the server authorizes on each run.
+ *
+ * The route evaluates the read as a plain reveal with no script usage, so a
+ * script-locked or high-security secret is refused by the server; the denial
+ * is surfaced as is (high-security gets the sandbox guidance).
+ */
+async function loadRevealedSecretsForCompanyOutpost(token, outpost, companyUid, keys, lockModes) {
+    if (companyUid !== outpost.companyUid) {
+        throw new Error(`This company Outpost (${outpost.outpostUid}) is bound to ${outpost.companyUid} ` +
+            `and cannot read secrets from ${companyUid}.`);
+    }
+    const resolved = new Map();
+    for (const name of [...new Set(keys)]) {
+        const res = await vaultApiFetch({
+            token,
+            path: `/secrets/${encodeURIComponent(companyUid)}/name/${encodeSecretNamePath(name)}`,
+            query: { reveal: "true" },
+            signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            if (body.highSecurity === true ||
+                body.code === "high_security_denied" ||
+                body.code === "high_security_sandbox_only") {
+                throw new Error(highSecuritySandboxOnlyMessage(name));
+            }
+            if (res.status === 401)
+                throw companyOutpostSessionRejected();
+            if (res.status === 404) {
+                throw new Error(`Failed to fetch secret '${name}': Secret not found`);
+            }
+            const message = extractApiMessage(body, res.statusText || `HTTP ${res.status}`);
+            if (isUnavailableSecretLoadHttpStatus(res.status)) {
+                throw new SecretLoadUnavailableError(`Failed to fetch secret '${name}': ${message}`);
+            }
+            throw new Error(companyOutpostReadDenialMessage(name, res.status, body, companyUid, outpost) ??
+                `Failed to fetch secret '${name}': ${message}`);
+        }
+        const secret = typeof body.secret === "object" && body.secret !== null
+            ? body.secret
+            : null;
+        if (!secret || secret.name !== name || typeof secret.value !== "string") {
+            throw new Error(`Failed to fetch secret '${name}': malformed fetch response`);
+        }
+        const mode = secret.scriptLock?.mode;
+        lockModes?.set(name, typeof mode === "string" ? mode : undefined);
+        resolved.set(name, secret.value);
+    }
+    return resolved;
+}
 export async function loadRevealedSecrets(token, companyUid, keys, usage, options = {}) {
     if (token.startsWith(HQ_API_KEY_PREFIX)) {
         return loadRevealedSecretsViaApiKey(token, keys, companyUid, options.lockModes);
     }
+    const outpost = companyOutpostIdentityFromToken(token);
+    if (outpost) {
+        return loadRevealedSecretsForCompanyOutpost(token, outpost, companyUid, keys, options.lockModes);
+    }
     const resolved = new Map();
     const requested = [...new Set(keys)];
     const principalUid = cognitoCachePrincipalUid(token);
@@ -469,6 +686,7 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
             console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
         }
         const keys = parseSecretNameList(opts.only);
+        assertDelegatedMachineSessionUsable();
         const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
         const apiKeyCompanyRef = cred.kind === "api-key"
             ? requestedApiKeyCompany(parentScope.company)
@@ -477,7 +695,7 @@ export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
             ? (apiKeyCompanyRef
                 ? await assertApiKeyCompany(cred.token, apiKeyCompanyRef, "secrets env")
                 : "__api_key__")
-            : await getEntityUid(cred.token, scopeOpts(parentScope), {
+            : await resolveSecretsReadCompanyUid(cred.token, scopeOpts(parentScope), {
                 allowOfflineScopeFallback: true,
             });
         const usage = cred.kind === "cognito"

package/dist/utils/cognito-callback-port.d.ts

@@ -0,0 +1,15 @@
+import type { CognitoAuthConfig } from "@indigoai-us/hq-cloud";
+/** Fallback and default loopback callback port. */
+export declare const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
+/** Ports registered as callback URLs on the HQ CLI Cognito app client. */
+export declare const REGISTERED_COGNITO_CALLBACK_PORTS: readonly number[];
+export type PortWarn = (message: string) => void;
+/**
+ * Resolve a callback port value, a string from the environment or a number,
+ * to a registered port. Unset resolves to 8765 silently; an unregistered value
+ * resolves to 8765 and logs a warning.
+ */
+export declare function resolveCognitoCallbackPort(raw: string | number | undefined, warn?: PortWarn): number;
+/** Return `config` with its callback port forced into the registered set. */
+export declare function withRegisteredCallbackPort<T extends CognitoAuthConfig>(config: T, warn?: PortWarn): T;
+//# sourceMappingURL=cognito-callback-port.d.ts.map

package/dist/utils/cognito-callback-port.js

@@ -0,0 +1,51 @@
+// src/utils/cognito-callback-port.ts
+//
+// The HQ CLI Cognito app client accepts exactly three loopback redirect URIs:
+// http://localhost:{8765,3000,53682}/callback (hq-pro infra/cognito.ts,
+// callbackUrls). browserLogin builds its redirect_uri from config.port, so any
+// other port opens a sign-in tab that Cognito rejects with redirect_mismatch.
+// A stray HQ_COGNITO_CALLBACK_PORT (seen with random ports such as 57726 and
+// 61604) produced exactly that tab. Every browser sign-in now goes through
+// this guard: an unregistered port falls back to 8765 with a stderr warning.
+/** Fallback and default loopback callback port. */
+export const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
+/** Ports registered as callback URLs on the HQ CLI Cognito app client. */
+export const REGISTERED_COGNITO_CALLBACK_PORTS = [8765, 3000, 53682];
+const warned = new Set();
+function defaultWarn(message) {
+    console.error(message);
+}
+function warnOnce(key, message, warn) {
+    if (warn === defaultWarn) {
+        if (warned.has(key))
+            return;
+        warned.add(key);
+    }
+    warn(message);
+}
+/**
+ * Resolve a callback port value, a string from the environment or a number,
+ * to a registered port. Unset resolves to 8765 silently; an unregistered value
+ * resolves to 8765 and logs a warning.
+ */
+export function resolveCognitoCallbackPort(raw, warn = defaultWarn) {
+    if (raw === undefined || (typeof raw === "string" && !raw.trim())) {
+        return DEFAULT_COGNITO_CALLBACK_PORT;
+    }
+    const port = typeof raw === "number" ? raw : Number(raw.trim());
+    if (REGISTERED_COGNITO_CALLBACK_PORTS.includes(port))
+        return port;
+    warnOnce(String(raw), `hq: ignoring callback port ${String(raw)}: it is not a registered Cognito callback ` +
+        `(${REGISTERED_COGNITO_CALLBACK_PORTS.join(", ")}). Using ${DEFAULT_COGNITO_CALLBACK_PORT}. ` +
+        "Unset HQ_COGNITO_CALLBACK_PORT or set it to a registered port.", warn);
+    return DEFAULT_COGNITO_CALLBACK_PORT;
+}
+/** Return `config` with its callback port forced into the registered set. */
+export function withRegisteredCallbackPort(config, warn = defaultWarn) {
+    // Unset keeps hq-cloud's own default (3000), which is registered.
+    if (config.port === undefined)
+        return config;
+    const port = resolveCognitoCallbackPort(config.port, warn);
+    return port === config.port ? config : { ...config, port };
+}
+//# sourceMappingURL=cognito-callback-port.js.map

package/dist/utils/cognito-config.js

@@ -1,11 +1,10 @@
+import { resolveCognitoCallbackPort } from "./cognito-callback-port.js";
 /** Lightweight Cognito and Vault defaults shared by startup-safe modules. */
 export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: process.env.HQ_COGNITO_CALLBACK_PORT
-        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
-        : 8765,
+    port: resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT),
     identityProvider: process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
         ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
         : "Google",

package/dist/utils/cognito-session.d.ts

@@ -20,6 +20,7 @@
  */
 import { isExpiring, isMachineIdentity, type CognitoAuthConfig, type CognitoTokens, type ClientInfo, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
 import { hasPersonCachedSession, isMachineCredsFileEnvSet, wantsMachineCognitoTokens, type CognitoTokenSource } from "./machine-principal-state.js";
+import { HQ_NO_BROWSER_LOGIN_ENV, type InteractiveCallerInput } from "./interactive-caller.js";
 import { loadCachedTokens, personTokenCacheFile, readPersonTokenFile } from "./person-token-cache.js";
 export { loadCachedTokens, personTokenCacheFile, readPersonTokenFile };
 export { isExpiring, isMachineIdentity };
@@ -115,14 +116,14 @@ export type EnsureCognitoTokenOptions = {
     /** Cancels bounded, non-interactive person-session refreshes. */
     signal?: AbortSignal;
 };
+export { HQ_NO_BROWSER_LOGIN_ENV };
 /**
- * Env switch a parent process sets so a child `hq` never opens a browser
- * sign-in. A hook-driven helper (SessionStart's refresh-vault-access) cannot
- * complete a browser login, and a child waiting on one outlives its caller.
+ * An explicit `interactive` option wins. Otherwise the implicit browser sign-in
+ * is allowed only for an interactive caller (see isInteractiveCaller): a TTY on
+ * stdin and stdout, and not a daemon, lane, monitor, bot, `mcp serve`, sync
+ * runner, launchd task, or HQ_NO_BROWSER_LOGIN=1 child.
  */
-export declare const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
-/** An explicit `interactive` option wins; otherwise interactive unless the env switch is "1". */
-export declare function resolveInteractiveLogin(options: Pick<EnsureCognitoTokenOptions, "interactive">, env?: NodeJS.ProcessEnv): boolean;
+export declare function resolveInteractiveLogin(options: Pick<EnsureCognitoTokenOptions, "interactive">, env?: NodeJS.ProcessEnv, caller?: Omit<InteractiveCallerInput, "env">): boolean;
 /**
  * Fresh-box / Outpost bootstrap: env unset, not forced to person, no person
  * cache, and the default machine-creds file is readable. Distinct from

package/dist/utils/cognito-session.js

@@ -32,6 +32,8 @@ import { daemonDir } from "../lib/mesh/live/daemon/paths.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
 import { defaultHqRootFallback, hqDiscoveryCandidates, pathForPlatform, } from "./hq-root-resolver.js";
 import { acquireLockFileExclusively } from "./exclusive-lock.js";
+import { resolveCognitoCallbackPort, withRegisteredCallbackPort } from "./cognito-callback-port.js";
+import { HQ_NO_BROWSER_LOGIN_ENV, NON_INTERACTIVE_LOGIN_MESSAGE, isInteractiveCaller, } from "./interactive-caller.js";
 import { reportNoninteractivePersonRefreshRejection } from "./cognito-refresh-sentry.js";
 import { decodeJwtPayload, loadCachedTokens, personTokenCacheFile, readPersonTokenFile, readTokenFile, } from "./person-token-cache.js";
 export { loadCachedTokens, personTokenCacheFile, readPersonTokenFile };
@@ -49,9 +51,7 @@ export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: process.env.HQ_COGNITO_CALLBACK_PORT
-        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
-        : 8765,
+    port: resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT),
     // Skip Cognito's Hosted UI — go straight to Google OAuth. The Cognito
     // /oauth2/authorize endpoint honors `identity_provider` and performs an
     // internal redirect, so the user never sees the (un-styleable) Hosted UI.
@@ -244,17 +244,17 @@ export function machineTokenCacheFile(home = os.homedir(), env = process.env) {
 export function defaultMachineCredsFile(home = os.homedir()) {
     return path.join(home, ".hq-agent", "machine-creds.json");
 }
+export { HQ_NO_BROWSER_LOGIN_ENV };
 /**
- * Env switch a parent process sets so a child `hq` never opens a browser
- * sign-in. A hook-driven helper (SessionStart's refresh-vault-access) cannot
- * complete a browser login, and a child waiting on one outlives its caller.
+ * An explicit `interactive` option wins. Otherwise the implicit browser sign-in
+ * is allowed only for an interactive caller (see isInteractiveCaller): a TTY on
+ * stdin and stdout, and not a daemon, lane, monitor, bot, `mcp serve`, sync
+ * runner, launchd task, or HQ_NO_BROWSER_LOGIN=1 child.
  */
-export const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
-/** An explicit `interactive` option wins; otherwise interactive unless the env switch is "1". */
-export function resolveInteractiveLogin(options, env = process.env) {
+export function resolveInteractiveLogin(options, env = process.env, caller = {}) {
     if (options.interactive !== undefined)
         return options.interactive;
-    return env[HQ_NO_BROWSER_LOGIN_ENV]?.trim() !== "1";
+    return isInteractiveCaller({ ...caller, env });
 }
 /**
  * Fresh-box / Outpost bootstrap: env unset, not forced to person, no person
@@ -939,7 +939,7 @@ async function ensureCognitoTokenUnserialized(options) {
             return fallback.idToken;
     }
     if (!interactive) {
-        throw new Error("No valid HQ session and interactive login is disabled. Run `hq login` first.");
+        throw new Error(NON_INTERACTIVE_LOGIN_MESSAGE);
     }
     if (isHeadlessHost() && hostRunsAnAgent()) {
         // An agent host with no display has no one to complete a browser sign-in,
@@ -951,7 +951,7 @@ async function ensureCognitoTokenUnserialized(options) {
             "(or HQ_MACHINE_CREDS_FILE to its machine-creds.json). Otherwise run `hq login` on a computer with a browser.");
     }
     console.error(chalk.cyan("  No cached HQ session — launching browser sign-in..."));
-    const tokens = await browserLogin(DEFAULT_COGNITO);
+    const tokens = await browserLogin(withRegisteredCallbackPort(DEFAULT_COGNITO));
     return tokens.accessToken;
 }
 /**
@@ -1022,7 +1022,7 @@ async function ensureCognitoIdTokenUnserialized(options) {
             return fallback.idToken;
     }
     if (!interactive) {
-        throw new Error("No valid HQ session and interactive login is disabled. Run `hq login` first.");
+        throw new Error(NON_INTERACTIVE_LOGIN_MESSAGE);
     }
     if (isHeadlessHost() && hostRunsAnAgent()) {
         // A browser sign-in on a server has no one to complete it and blocks
@@ -1032,7 +1032,7 @@ async function ensureCognitoIdTokenUnserialized(options) {
             "(or HQ_MACHINE_CREDS_FILE to its machine-creds.json). Otherwise run `hq login` on a computer with a browser.");
     }
     console.error(chalk.cyan("  No cached HQ session — launching browser sign-in..."));
-    const tokens = await browserLogin(DEFAULT_COGNITO);
+    const tokens = await browserLogin(withRegisteredCallbackPort(DEFAULT_COGNITO));
     return tokens.idToken;
 }
 /**

package/dist/utils/interactive-caller.d.ts

@@ -0,0 +1,15 @@
+/** Parent-set switch: a child `hq` must never open a browser sign-in. */
+export declare const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
+/** Remedy printed when an implicit sign-in is refused. */
+export declare const NON_INTERACTIVE_LOGIN_MESSAGE: string;
+export type InteractiveCallerInput = {
+    env?: NodeJS.ProcessEnv;
+    argv?: readonly string[];
+    stdinIsTTY?: boolean;
+    stdoutIsTTY?: boolean;
+};
+/** The reason a caller is not interactive, or null when it is. */
+export declare function nonInteractiveReason(input?: InteractiveCallerInput): string | null;
+/** True only when a person is at a terminal and may complete a browser sign-in. */
+export declare function isInteractiveCaller(input?: InteractiveCallerInput): boolean;
+//# sourceMappingURL=interactive-caller.d.ts.map

package/dist/utils/interactive-caller.js

@@ -0,0 +1,70 @@
+// src/utils/interactive-caller.ts
+//
+// One predicate for "may this process open an implicit browser sign-in?".
+//
+// HQ-CLI-15 follow-up: ~100 ensureCognitoToken/ensureCognitoIdToken call sites
+// fall back to browserLogin when a token refresh fails. Before this predicate
+// the fallback ran for every caller unless HQ_NO_BROWSER_LOGIN=1 was set, so a
+// daemon, lane, monitor, bot, `hq mcp serve`, sync runner, or launchd task
+// opened a sign-in tab on its own that nobody had asked for. The implicit
+// sign-in is now allowed only when a person is at a terminal: stdin AND stdout
+// are TTYs and none of the background markers below is present. Explicit
+// `hq login` calls browserLogin directly and is not gated here.
+/** Parent-set switch: a child `hq` must never open a browser sign-in. */
+export const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
+/** Remedy printed when an implicit sign-in is refused. */
+export const NON_INTERACTIVE_LOGIN_MESSAGE = "No valid HQ session and interactive login is disabled. Run `hq login` first. " +
+    "This process is not interactive (no terminal, or a background HQ runtime), so it did not open a browser sign-in.";
+/** launchd job labels the HQ service manager installs (see main.ts runCli). */
+const HQ_LAUNCHD_LABEL_PREFIXES = ["ai.indigo.", "ai.getindigo."];
+/** Env markers set for background HQ runtimes. Any non-empty value counts. */
+const BACKGROUND_ENV_MARKERS = [
+    "HQ_LANE_ID", // hq lanes worker sessions
+    "HQ_BOT_AGENT_UID", // hq bot runtimes
+    "HQ_DAEMON_UNIT", // daemon service units
+];
+/**
+ * argv prefixes (after `hq`) for long-running background entry points. The
+ * daemon's sync runner child has no TTY on stdio, so the TTY check covers it.
+ */
+const BACKGROUND_COMMANDS = [
+    ["daemon"],
+    ["mesh", "daemon"],
+    ["bot", "run"],
+    ["mcp", "serve"],
+    ["monitor"],
+];
+function nonEmpty(value) {
+    return Boolean(value && value.trim());
+}
+/** The reason a caller is not interactive, or null when it is. */
+export function nonInteractiveReason(input = {}) {
+    const env = input.env ?? process.env;
+    const argv = input.argv ?? process.argv.slice(2);
+    const stdinIsTTY = input.stdinIsTTY ?? process.stdin.isTTY === true;
+    const stdoutIsTTY = input.stdoutIsTTY ?? process.stdout.isTTY === true;
+    if (env[HQ_NO_BROWSER_LOGIN_ENV]?.trim() === "1")
+        return `${HQ_NO_BROWSER_LOGIN_ENV}=1`;
+    if (!stdinIsTTY)
+        return "stdin is not a terminal";
+    if (!stdoutIsTTY)
+        return "stdout is not a terminal";
+    for (const marker of BACKGROUND_ENV_MARKERS) {
+        if (nonEmpty(env[marker]))
+            return `${marker} is set`;
+    }
+    const xpc = env.XPC_SERVICE_NAME ?? "";
+    if (HQ_LAUNCHD_LABEL_PREFIXES.some((p) => xpc.startsWith(p)))
+        return "launchd task";
+    const args = argv.filter((a) => !a.startsWith("-"));
+    for (const cmd of BACKGROUND_COMMANDS) {
+        if (cmd.every((part, i) => args[i] === part))
+            return `\`hq ${cmd.join(" ")}\``;
+    }
+    return null;
+}
+/** True only when a person is at a terminal and may complete a browser sign-in. */
+export function isInteractiveCaller(input = {}) {
+    return nonInteractiveReason(input) === null;
+}
+//# sourceMappingURL=interactive-caller.js.map

package/dist/utils/login-browser.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { browserLogin, saveCachedTokens, CognitoAuthError } from "@indigoai-us/hq-cloud";
 import { isHeadless } from "./headless.js";
+import { withRegisteredCallbackPort } from "./cognito-callback-port.js";
 function assertHumanLoginAllowed() {
     // Preserve hq-cloud's company-machine boundary on the manual URL path.
     if (["1", "true", "yes"].includes(process.env.HQ_MACHINE_AUTH_REQUIRED?.trim().toLowerCase() ?? "")) {
@@ -10,8 +11,9 @@ function assertHumanLoginAllowed() {
 }
 /** Keep desktop login unchanged; manual login uses the same PKCE loopback flow. */
 export async function loginWithBrowserPreference(config, browser = true) {
+    // A callback port outside the registered set opens a redirect_mismatch tab.
     if (browser && !isHeadless())
-        return browserLogin(config);
+        return browserLogin(withRegisteredCallbackPort(config));
     assertHumanLoginAllowed();
     const port = config.port ?? 3000;
     const redirectUri = `http://localhost:${port}/callback`;

package/dist/utils/resident-package-preload.js

@@ -28,6 +28,8 @@ export const RESIDENT_PACKAGE_MODULES = {
     ],
     "agents-terminal": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     bot: [
+        "../commands/lanes.js",
+        "../lib/lanes/reconcile.js",
         "../lib/flag-registry.js",
         "../commands/access.js",
         "../commands/sources.js",
@@ -176,6 +178,8 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
     ],
     bot: [
+        () => import("../commands/lanes.js"),
+        () => import("../lib/lanes/reconcile.js"),
         () => import("../lib/flag-registry.js"),
         () => import("../commands/access.js"),
         // The signals engine's adapters step (lib/signals/steps/adapters.ts)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.197",
+  "version": "5.345.199",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -27,6 +27,8 @@
   ],
   "scripts": {
     "build": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs && node scripts/bundle-sync-runner.mjs",
+    "release:preflight": "node scripts/check-fleet-local-pin-published.mjs",
+    "release:tag": "node scripts/check-fleet-local-pin-published.mjs --release-tag",
     "prepublishOnly": "npm run build",
     "pretypecheck": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.typetest.json",
@@ -114,11 +116,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.197",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.197",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.197",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.197",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.197",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.197"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.199",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.199",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.199",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.199",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.199",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.199"
   }
 }