@indigoai-us/hq-cli 5.345.198 → 5.345.200

package/dist/lib/work-context/company.d.ts

@@ -12,11 +12,10 @@
  *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
  *      remembered by repoIdentityKey; above the git-remote heuristic + device
  *      default, below the identity file so an agent box always wins)
- *   5. enabled device default
- *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
+ *   5. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
  * Prompt-text matching is never used.
- * Device default + conflicting deterministic evidence → company_conflict.
+ * Device defaults never attribute a session; explicit evidence is required.
  */
 import type { TrustedExplicitContext } from "./contract.js";
 import { type SessionStateFile } from "./state.js";

package/dist/lib/work-context/company.js

@@ -12,15 +12,14 @@
  *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
  *      remembered by repoIdentityKey; above the git-remote heuristic + device
  *      default, below the identity file so an agent box always wins)
- *   5. enabled device default
- *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
+ *   5. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
  * Prompt-text matching is never used.
- * Device default + conflicting deterministic evidence → company_conflict.
+ * Device defaults never attribute a session; explicit evidence is required.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getDefaultCompany, getRepoCompany } from "./config.js";
+import { getRepoCompany } from "./config.js";
 import { authoritativeCompanyFromState, readSessionState, } from "./state.js";
 /** Pointer to the US-017B correction client (never auto-switches). */
 const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
@@ -333,8 +332,7 @@ export function resolveCompany(input) {
             };
         }
     }
-    // 5 + 6. Device default vs deterministic evidence.
-    const deviceDefault = input.allowDeviceDefault === false ? null : getDefaultCompany({ root: input.root });
+    // Membership and device preferences are not session attribution evidence.
     const deterministic = resolveDeterministicCompany({
         cwd: input.cwd,
         hqRoot: input.hqRoot,
@@ -354,22 +352,6 @@ export function resolveCompany(input) {
             evidenceCompany: deterministicConflict.remote,
         };
     }
-    if (deviceDefault?.enabled && deviceDefault.slug) {
-        const def = {
-            slug: deviceDefault.slug,
-            uid: deviceDefault.uid,
-            source: "device_default",
-        };
-        if (deterministic &&
-            !sameCompany(def, deterministic)) {
-            return {
-                status: "company_conflict",
-                defaultCompany: def,
-                evidenceCompany: deterministic,
-            };
-        }
-        return { status: "resolved", company: def };
-    }
     if (deterministic) {
         return { status: "resolved", company: deterministic };
     }

package/dist/secrets-env-action.js

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { cognitoCachePrincipalUid } from "./utils/cognito-session.js";
+import { gatedInteractiveLogin } from "./utils/interactive-caller.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
@@ -21,10 +22,12 @@ const SECRET_LOAD_TIMEOUT_MS = 30_000;
  * stdin and stderr must be TTYs, and CI is always non-interactive.
  */
 export function secretsCredentialOptions() {
+    // The shared gate also refuses lanes, daemons, bot runtimes, launchd
+    // tasks, and HQ_NO_BROWSER_LOGIN children that happen to hold a TTY.
     return {
-        interactive: process.stdin.isTTY === true &&
+        interactive: gatedInteractiveLogin(process.stdin.isTTY === true &&
             process.stderr.isTTY === true &&
-            !process.env.CI,
+            !process.env.CI),
     };
 }
 export function scopeOpts(opts) {

package/dist/utils/cognito-callback-port.d.ts

@@ -0,0 +1,17 @@
+import type { CognitoAuthConfig } from "@indigoai-us/hq-cloud";
+/** Fallback and default loopback callback port. */
+export declare const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
+/** Ports registered as callback URLs on the HQ CLI Cognito app client. */
+export declare const REGISTERED_COGNITO_CALLBACK_PORTS: readonly number[];
+export type PortWarn = (message: string) => void;
+/** Test hook: forget that the stray-port warning was printed. */
+export declare function resetStrayPortWarningForTests(): void;
+/**
+ * Resolve a callback port value, a string from the environment or a number,
+ * to a registered port. Unset resolves to 8765 silently; an unregistered value
+ * resolves to 8765 and logs a warning.
+ */
+export declare function resolveCognitoCallbackPort(raw: string | number | undefined, warn?: PortWarn): number;
+/** Return `config` with its callback port forced into the registered set. */
+export declare function withRegisteredCallbackPort<T extends CognitoAuthConfig>(config: T, warn?: PortWarn): T;
+//# sourceMappingURL=cognito-callback-port.d.ts.map

package/dist/utils/cognito-callback-port.js

@@ -0,0 +1,56 @@
+// src/utils/cognito-callback-port.ts
+//
+// The HQ CLI Cognito app client accepts exactly three loopback redirect URIs:
+// http://localhost:{8765,3000,53682}/callback (hq-pro infra/cognito.ts,
+// callbackUrls). browserLogin builds its redirect_uri from config.port, so any
+// other port opens a sign-in tab that Cognito rejects with redirect_mismatch.
+// A stray HQ_COGNITO_CALLBACK_PORT (seen with random ports such as 57726 and
+// 61604) produced exactly that tab. Every browser sign-in now goes through
+// this guard: an unregistered port falls back to 8765 with a stderr warning.
+/** Fallback and default loopback callback port. */
+export const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
+/** Ports registered as callback URLs on the HQ CLI Cognito app client. */
+export const REGISTERED_COGNITO_CALLBACK_PORTS = [8765, 3000, 53682];
+/** One stray-port warning per process: config and session both resolve the env value. */
+let warnedStrayPort = false;
+function defaultWarn(message) {
+    console.error(message);
+}
+function warnOnce(message, warn) {
+    if (warn === defaultWarn) {
+        if (warnedStrayPort)
+            return;
+        warnedStrayPort = true;
+    }
+    warn(message);
+}
+/** Test hook: forget that the stray-port warning was printed. */
+export function resetStrayPortWarningForTests() {
+    warnedStrayPort = false;
+}
+/**
+ * Resolve a callback port value, a string from the environment or a number,
+ * to a registered port. Unset resolves to 8765 silently; an unregistered value
+ * resolves to 8765 and logs a warning.
+ */
+export function resolveCognitoCallbackPort(raw, warn = defaultWarn) {
+    if (raw === undefined || (typeof raw === "string" && !raw.trim())) {
+        return DEFAULT_COGNITO_CALLBACK_PORT;
+    }
+    const port = typeof raw === "number" ? raw : Number(raw.trim());
+    if (REGISTERED_COGNITO_CALLBACK_PORTS.includes(port))
+        return port;
+    warnOnce(`hq: ignoring callback port ${String(raw)}: it is not a registered Cognito callback ` +
+        `(${REGISTERED_COGNITO_CALLBACK_PORTS.join(", ")}). Using ${DEFAULT_COGNITO_CALLBACK_PORT}. ` +
+        "Unset HQ_COGNITO_CALLBACK_PORT or set it to a registered port.", warn);
+    return DEFAULT_COGNITO_CALLBACK_PORT;
+}
+/** Return `config` with its callback port forced into the registered set. */
+export function withRegisteredCallbackPort(config, warn = defaultWarn) {
+    // Unset keeps hq-cloud's own default (3000), which is registered.
+    if (config.port === undefined)
+        return config;
+    const port = resolveCognitoCallbackPort(config.port, warn);
+    return port === config.port ? config : { ...config, port };
+}
+//# sourceMappingURL=cognito-callback-port.js.map

package/dist/utils/cognito-config.js

@@ -1,11 +1,15 @@
+import { resolveCognitoCallbackPort } from "./cognito-callback-port.js";
 /** Lightweight Cognito and Vault defaults shared by startup-safe modules. */
 export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: process.env.HQ_COGNITO_CALLBACK_PORT
-        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
-        : 8765,
+    // Resolved on read, not at module load: main.ts imports this for every
+    // command, and a stray HQ_COGNITO_CALLBACK_PORT should warn only when a
+    // sign-in actually reads the port.
+    get port() {
+        return resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT);
+    },
     identityProvider: process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
         ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
         : "Google",

package/dist/utils/cognito-session.d.ts

@@ -20,6 +20,7 @@
  */
 import { isExpiring, isMachineIdentity, type CognitoAuthConfig, type CognitoTokens, type ClientInfo, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
 import { hasPersonCachedSession, isMachineCredsFileEnvSet, wantsMachineCognitoTokens, type CognitoTokenSource } from "./machine-principal-state.js";
+import { HQ_NO_BROWSER_LOGIN_ENV, type InteractiveCallerInput } from "./interactive-caller.js";
 import { loadCachedTokens, personTokenCacheFile, readPersonTokenFile } from "./person-token-cache.js";
 export { loadCachedTokens, personTokenCacheFile, readPersonTokenFile };
 export { isExpiring, isMachineIdentity };
@@ -115,14 +116,14 @@ export type EnsureCognitoTokenOptions = {
     /** Cancels bounded, non-interactive person-session refreshes. */
     signal?: AbortSignal;
 };
+export { HQ_NO_BROWSER_LOGIN_ENV };
 /**
- * Env switch a parent process sets so a child `hq` never opens a browser
- * sign-in. A hook-driven helper (SessionStart's refresh-vault-access) cannot
- * complete a browser login, and a child waiting on one outlives its caller.
+ * An explicit `interactive` option wins. Otherwise the implicit browser sign-in
+ * is allowed only for an interactive caller (see isInteractiveCaller): a TTY on
+ * stdin and stdout, and not a daemon, lane, monitor, bot, `mcp serve`, sync
+ * runner, launchd task, or HQ_NO_BROWSER_LOGIN=1 child.
  */
-export declare const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
-/** An explicit `interactive` option wins; otherwise interactive unless the env switch is "1". */
-export declare function resolveInteractiveLogin(options: Pick<EnsureCognitoTokenOptions, "interactive">, env?: NodeJS.ProcessEnv): boolean;
+export declare function resolveInteractiveLogin(options: Pick<EnsureCognitoTokenOptions, "interactive">, env?: NodeJS.ProcessEnv, caller?: Omit<InteractiveCallerInput, "env">): boolean;
 /**
  * Fresh-box / Outpost bootstrap: env unset, not forced to person, no person
  * cache, and the default machine-creds file is readable. Distinct from

package/dist/utils/cognito-session.js

@@ -32,6 +32,8 @@ import { daemonDir } from "../lib/mesh/live/daemon/paths.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
 import { defaultHqRootFallback, hqDiscoveryCandidates, pathForPlatform, } from "./hq-root-resolver.js";
 import { acquireLockFileExclusively } from "./exclusive-lock.js";
+import { resolveCognitoCallbackPort, withRegisteredCallbackPort } from "./cognito-callback-port.js";
+import { HQ_NO_BROWSER_LOGIN_ENV, NON_INTERACTIVE_LOGIN_MESSAGE, isInteractiveCaller, } from "./interactive-caller.js";
 import { reportNoninteractivePersonRefreshRejection } from "./cognito-refresh-sentry.js";
 import { decodeJwtPayload, loadCachedTokens, personTokenCacheFile, readPersonTokenFile, readTokenFile, } from "./person-token-cache.js";
 export { loadCachedTokens, personTokenCacheFile, readPersonTokenFile };
@@ -49,9 +51,12 @@ export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: process.env.HQ_COGNITO_CALLBACK_PORT
-        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
-        : 8765,
+    // Resolved on read, not at module load: main.ts imports this for every
+    // command, and a stray HQ_COGNITO_CALLBACK_PORT should warn only when a
+    // sign-in actually reads the port.
+    get port() {
+        return resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT);
+    },
     // Skip Cognito's Hosted UI — go straight to Google OAuth. The Cognito
     // /oauth2/authorize endpoint honors `identity_provider` and performs an
     // internal redirect, so the user never sees the (un-styleable) Hosted UI.
@@ -244,17 +249,17 @@ export function machineTokenCacheFile(home = os.homedir(), env = process.env) {
 export function defaultMachineCredsFile(home = os.homedir()) {
     return path.join(home, ".hq-agent", "machine-creds.json");
 }
+export { HQ_NO_BROWSER_LOGIN_ENV };
 /**
- * Env switch a parent process sets so a child `hq` never opens a browser
- * sign-in. A hook-driven helper (SessionStart's refresh-vault-access) cannot
- * complete a browser login, and a child waiting on one outlives its caller.
+ * An explicit `interactive` option wins. Otherwise the implicit browser sign-in
+ * is allowed only for an interactive caller (see isInteractiveCaller): a TTY on
+ * stdin and stdout, and not a daemon, lane, monitor, bot, `mcp serve`, sync
+ * runner, launchd task, or HQ_NO_BROWSER_LOGIN=1 child.
  */
-export const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
-/** An explicit `interactive` option wins; otherwise interactive unless the env switch is "1". */
-export function resolveInteractiveLogin(options, env = process.env) {
+export function resolveInteractiveLogin(options, env = process.env, caller = {}) {
     if (options.interactive !== undefined)
         return options.interactive;
-    return env[HQ_NO_BROWSER_LOGIN_ENV]?.trim() !== "1";
+    return isInteractiveCaller({ ...caller, env });
 }
 /**
  * Fresh-box / Outpost bootstrap: env unset, not forced to person, no person
@@ -939,7 +944,7 @@ async function ensureCognitoTokenUnserialized(options) {
             return fallback.idToken;
     }
     if (!interactive) {
-        throw new Error("No valid HQ session and interactive login is disabled. Run `hq login` first.");
+        throw new Error(NON_INTERACTIVE_LOGIN_MESSAGE);
     }
     if (isHeadlessHost() && hostRunsAnAgent()) {
         // An agent host with no display has no one to complete a browser sign-in,
@@ -951,7 +956,7 @@ async function ensureCognitoTokenUnserialized(options) {
             "(or HQ_MACHINE_CREDS_FILE to its machine-creds.json). Otherwise run `hq login` on a computer with a browser.");
     }
     console.error(chalk.cyan("  No cached HQ session — launching browser sign-in..."));
-    const tokens = await browserLogin(DEFAULT_COGNITO);
+    const tokens = await browserLogin(withRegisteredCallbackPort(DEFAULT_COGNITO));
     return tokens.accessToken;
 }
 /**
@@ -1022,7 +1027,7 @@ async function ensureCognitoIdTokenUnserialized(options) {
             return fallback.idToken;
     }
     if (!interactive) {
-        throw new Error("No valid HQ session and interactive login is disabled. Run `hq login` first.");
+        throw new Error(NON_INTERACTIVE_LOGIN_MESSAGE);
     }
     if (isHeadlessHost() && hostRunsAnAgent()) {
         // A browser sign-in on a server has no one to complete it and blocks
@@ -1032,7 +1037,7 @@ async function ensureCognitoIdTokenUnserialized(options) {
             "(or HQ_MACHINE_CREDS_FILE to its machine-creds.json). Otherwise run `hq login` on a computer with a browser.");
     }
     console.error(chalk.cyan("  No cached HQ session — launching browser sign-in..."));
-    const tokens = await browserLogin(DEFAULT_COGNITO);
+    const tokens = await browserLogin(withRegisteredCallbackPort(DEFAULT_COGNITO));
     return tokens.idToken;
 }
 /**

package/dist/utils/interactive-caller.d.ts

@@ -0,0 +1,23 @@
+/** Parent-set switch: a child `hq` must never open a browser sign-in. */
+export declare const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
+/** Remedy printed when an implicit sign-in is refused. */
+export declare const NON_INTERACTIVE_LOGIN_MESSAGE: string;
+export type InteractiveCallerInput = {
+    env?: NodeJS.ProcessEnv;
+    argv?: readonly string[];
+    stdinIsTTY?: boolean;
+    stdoutIsTTY?: boolean;
+};
+/** The reason a caller is not interactive, or null when it is. */
+export declare function nonInteractiveReason(input?: InteractiveCallerInput): string | null;
+/** True only when a person is at a terminal and may complete a browser sign-in. */
+export declare function isInteractiveCaller(input?: InteractiveCallerInput): boolean;
+/**
+ * Gate a call site's request for an implicit browser sign-in. A command that
+ * asks for `interactive: true` gets it only when a person is at a terminal, so
+ * the same command run from a lane, daemon, bot, launchd task, or piped child
+ * fails with the `hq login` remedy instead of opening a sign-in tab. Explicit
+ * `false` stays false. `hq login` calls browserLogin directly and is not gated.
+ */
+export declare function gatedInteractiveLogin(requested?: boolean, input?: InteractiveCallerInput): boolean;
+//# sourceMappingURL=interactive-caller.d.ts.map

package/dist/utils/interactive-caller.js

@@ -0,0 +1,80 @@
+// src/utils/interactive-caller.ts
+//
+// One predicate for "may this process open an implicit browser sign-in?".
+//
+// HQ-CLI-15 follow-up: ~100 ensureCognitoToken/ensureCognitoIdToken call sites
+// fall back to browserLogin when a token refresh fails. Before this predicate
+// the fallback ran for every caller unless HQ_NO_BROWSER_LOGIN=1 was set, so a
+// daemon, lane, monitor, bot, `hq mcp serve`, sync runner, or launchd task
+// opened a sign-in tab on its own that nobody had asked for. The implicit
+// sign-in is now allowed only when a person is at a terminal: stdin AND stdout
+// are TTYs and none of the background markers below is present. Explicit
+// `hq login` calls browserLogin directly and is not gated here.
+/** Parent-set switch: a child `hq` must never open a browser sign-in. */
+export const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
+/** Remedy printed when an implicit sign-in is refused. */
+export const NON_INTERACTIVE_LOGIN_MESSAGE = "No valid HQ session and interactive login is disabled. Run `hq login` first. " +
+    "This process is not interactive (no terminal, or a background HQ runtime), so it did not open a browser sign-in.";
+/** launchd job labels the HQ service manager installs (see main.ts runCli). */
+const HQ_LAUNCHD_LABEL_PREFIXES = ["ai.indigo.", "ai.getindigo."];
+/** Env markers set for background HQ runtimes. Any non-empty value counts. */
+const BACKGROUND_ENV_MARKERS = [
+    "HQ_LANE_ID", // hq lanes worker sessions
+    "HQ_BOT_AGENT_UID", // hq bot runtimes
+    "HQ_DAEMON_UNIT", // daemon service units
+];
+/**
+ * argv prefixes (after `hq`) for long-running background entry points. The
+ * daemon's sync runner child has no TTY on stdio, so the TTY check covers it.
+ */
+const BACKGROUND_COMMANDS = [
+    ["daemon"],
+    ["mesh", "daemon"],
+    ["bot", "run"],
+    ["mcp", "serve"],
+    ["monitor"],
+];
+function nonEmpty(value) {
+    return Boolean(value && value.trim());
+}
+/** The reason a caller is not interactive, or null when it is. */
+export function nonInteractiveReason(input = {}) {
+    const env = input.env ?? process.env;
+    const argv = input.argv ?? process.argv.slice(2);
+    const stdinIsTTY = input.stdinIsTTY ?? process.stdin.isTTY === true;
+    const stdoutIsTTY = input.stdoutIsTTY ?? process.stdout.isTTY === true;
+    if (env[HQ_NO_BROWSER_LOGIN_ENV]?.trim() === "1")
+        return `${HQ_NO_BROWSER_LOGIN_ENV}=1`;
+    if (!stdinIsTTY)
+        return "stdin is not a terminal";
+    if (!stdoutIsTTY)
+        return "stdout is not a terminal";
+    for (const marker of BACKGROUND_ENV_MARKERS) {
+        if (nonEmpty(env[marker]))
+            return `${marker} is set`;
+    }
+    const xpc = env.XPC_SERVICE_NAME ?? "";
+    if (HQ_LAUNCHD_LABEL_PREFIXES.some((p) => xpc.startsWith(p)))
+        return "launchd task";
+    const args = argv.filter((a) => !a.startsWith("-"));
+    for (const cmd of BACKGROUND_COMMANDS) {
+        if (cmd.every((part, i) => args[i] === part))
+            return `\`hq ${cmd.join(" ")}\``;
+    }
+    return null;
+}
+/** True only when a person is at a terminal and may complete a browser sign-in. */
+export function isInteractiveCaller(input = {}) {
+    return nonInteractiveReason(input) === null;
+}
+/**
+ * Gate a call site's request for an implicit browser sign-in. A command that
+ * asks for `interactive: true` gets it only when a person is at a terminal, so
+ * the same command run from a lane, daemon, bot, launchd task, or piped child
+ * fails with the `hq login` remedy instead of opening a sign-in tab. Explicit
+ * `false` stays false. `hq login` calls browserLogin directly and is not gated.
+ */
+export function gatedInteractiveLogin(requested = true, input = {}) {
+    return requested && isInteractiveCaller(input);
+}
+//# sourceMappingURL=interactive-caller.js.map

package/dist/utils/login-browser.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { browserLogin, saveCachedTokens, CognitoAuthError } from "@indigoai-us/hq-cloud";
 import { isHeadless } from "./headless.js";
+import { withRegisteredCallbackPort } from "./cognito-callback-port.js";
 function assertHumanLoginAllowed() {
     // Preserve hq-cloud's company-machine boundary on the manual URL path.
     if (["1", "true", "yes"].includes(process.env.HQ_MACHINE_AUTH_REQUIRED?.trim().toLowerCase() ?? "")) {
@@ -10,10 +11,12 @@ function assertHumanLoginAllowed() {
 }
 /** Keep desktop login unchanged; manual login uses the same PKCE loopback flow. */
 export async function loginWithBrowserPreference(config, browser = true) {
+    // A callback port outside the registered set opens a redirect_mismatch tab.
     if (browser && !isHeadless())
-        return browserLogin(config);
+        return browserLogin(withRegisteredCallbackPort(config));
     assertHumanLoginAllowed();
-    const port = config.port ?? 3000;
+    // The manual URL path builds the same redirect_uri, so it needs the same guard.
+    const port = withRegisteredCallbackPort(config).port ?? 3000;
     const redirectUri = `http://localhost:${port}/callback`;
     const base = `https://${config.userPoolDomain}.auth.${config.region}.amazoncognito.com`;
     const verifier = randomBytes(32).toString("base64url");

package/dist/utils/resident-package-preload.js

@@ -28,6 +28,8 @@ export const RESIDENT_PACKAGE_MODULES = {
     ],
     "agents-terminal": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     bot: [
+        "../commands/lanes.js",
+        "../lib/lanes/reconcile.js",
         "../lib/flag-registry.js",
         "../commands/access.js",
         "../commands/sources.js",
@@ -176,6 +178,8 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
     ],
     bot: [
+        () => import("../commands/lanes.js"),
+        () => import("../lib/lanes/reconcile.js"),
         () => import("../lib/flag-registry.js"),
         () => import("../commands/access.js"),
         // The signals engine's adapters step (lib/signals/steps/adapters.ts)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.198",
+  "version": "5.345.200",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -116,11 +116,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.198",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.198",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.198",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.198",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.198",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.198"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.200",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.200",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.200",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.200",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.200",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.200"
   }
 }