@indigoai-us/hq-cli 5.345.201 → 5.345.202

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.345.202] — 2026-11-04
+- The long-running `hq daemon run` and `hq mesh daemon run` processes no longer start Sentry. On some Macs, Sentry in these processes kept opening connections after network changes until the machine ran out of ports, so Claude and HQ lost internet access while other apps kept working. Short-lived CLI commands still report errors to Sentry, and the daemons keep their local logs.
+- The Executive (meeting rider, action-item lanes and source report DMs) is now off unless `executiveMeetingRider.enabled` is set to `true` in the HQ menubar settings file. In 5.345.200 it was on by default for every setup bot.
+- Native command guards on Windows now resolve tools with the same Git directories and home bin precedence as the Bash fallback, preventing a plain Windows PATH from selecting System32 timeout or missing Git tools. Added exact CLI command-argument parity coverage and portable temporary-path fixtures.
+- Port the complete policy reminder injector to Rust, including scope resolution, trigger matching, relevance ranking, output ceilings, deferred policies, cadence and seen ledgers, and receipt-backed enforcement. Shadow runs use isolated state so the Bash reference sees the original session history. Add a pinned full-injector corpus using staging regressions, release-shipped core policies and reproducibly generated synthetic policy/event payloads, with byte comparisons of output and state after each event. No rollout flags change.
+- Match Bash locale collation when indexing policy files, including Git Bash Windows collation and the macOS non-ASCII fallback order. Index format 3 rebuilds old cache files.
+
 ## [5.345.201] — 2026-11-04
 - `hq deploy domains buy` accepts a registrar price in `usd` or `USD`. Search shows that price as US dollars, and renew accepts the same code. A price in another currency is still refused, and the message shows the currency code the server sent.
 - The Executive sends source reports to its owner when a meeting ends and one final threaded report after all source lanes finish. Delivery receipts suppress normal duplicates and retain reports during the ten-minute cooldown. Recovery retries an intent without a sent receipt; a crash after sending but before recording the receipt can resend that report.

package/dist/lib/bot/executive-settings.js

@@ -1,4 +1,10 @@
-/** Shared Executive identity and the desktop's default-on rider preference. */
+/**
+ * Shared Executive identity and its opt-in switch.
+ *
+ * The Executive (meeting rider, signal-to-lane, source report DMs) is off
+ * unless ~/.hq/menubar.json sets executiveMeetingRider.enabled to true. It
+ * stays internal until the live end-to-end proof passes.
+ */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
@@ -7,15 +13,17 @@ import { tailBotEvents } from "./events.js";
 export function executiveRiderEnabled(home = os.homedir()) {
     try {
         const settings = JSON.parse(fs.readFileSync(path.join(home, ".hq/menubar.json"), "utf8"));
-        return settings?.executiveMeetingRider?.enabled !== false;
+        return settings?.executiveMeetingRider?.enabled === true;
     }
-    catch (err) {
-        return err.code === "ENOENT";
+    catch {
+        return false;
     }
 }
 export function isExecutiveBot(config, home = os.homedir()) {
     if (effectiveBotKind(config) !== "personal")
         return false;
+    if (!executiveRiderEnabled(home))
+        return false;
     let name = "setup";
     try {
         const value = JSON.parse(fs.readFileSync(path.join(home, ".hq/executive.json"), "utf8"));

package/dist/lib/bot/jobs/signal-to-lane.d.ts

@@ -7,9 +7,10 @@ export declare function ensureSignalToLaneJobs(dir: string, config: BotConfig, c
 /** Only new locally extracted signals reach here; cloud upload/garden is separate. */
 export declare function emitExecutiveSignalWritten(hqRoot: string, company: string, payload: Record<string, string>, root?: string, home?: string): boolean;
 /** Persist intent before publishing a new signal file; ordinary redo creates none. */
-export declare function prepareSignalPublication(hqRoot: string, company: string, payload: Record<string, string>): void;
+/** Records nothing while no opted-in Executive serves the company, so no backlog builds up. */
+export declare function prepareSignalPublication(hqRoot: string, company: string, payload: Record<string, string>, root?: string, home?: string): void;
 /** A pre-append crash retries; a post-append crash uses the event journal's dedupe. */
-export declare function flushSignalPublications(hqRoot: string, company: string, emit?: typeof emitExecutiveSignalWritten): void;
+export declare function flushSignalPublications(hqRoot: string, company: string, emit?: typeof emitExecutiveSignalWritten, root?: string, home?: string): void;
 type Create = (input: {
     hqRoot: string;
     company: string;

package/dist/lib/bot/jobs/signal-to-lane.js

@@ -41,10 +41,10 @@ export function ensureSignalToLaneJobs(dir, config, companies = signalLaneCompan
         return jobs.filter(job => job.context?.jobKind === SIGNAL_TO_LANE_JOB_KIND);
     });
 }
-/** Only new locally extracted signals reach here; cloud upload/garden is separate. */
-export function emitExecutiveSignalWritten(hqRoot, company, payload, root = botsRoot(), home) {
+/** The opted-in Executive bot dir serving this HQ root and company, if any. */
+function executiveFor(hqRoot, company, root = botsRoot(), home) {
     if (!fs.existsSync(root))
-        return false;
+        return null;
     for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
         if (!entry.isDirectory())
             continue;
@@ -54,10 +54,17 @@ export function emitExecutiveSignalWritten(hqRoot, company, payload, root = bots
             continue;
         if (!signalLaneCompanies(config).includes(company))
             continue;
-        emitBotEvent(dir, "signal.written", { ...payload, company }, new Date(), prior => prior.event === "signal.written" && prior.payload.company === company && prior.payload.signal_id === payload.signal_id);
-        return true;
+        return dir;
     }
-    return false;
+    return null;
+}
+/** Only new locally extracted signals reach here; cloud upload/garden is separate. */
+export function emitExecutiveSignalWritten(hqRoot, company, payload, root = botsRoot(), home) {
+    const dir = executiveFor(hqRoot, company, root, home);
+    if (!dir)
+        return false;
+    emitBotEvent(dir, "signal.written", { ...payload, company }, new Date(), prior => prior.event === "signal.written" && prior.payload.company === company && prior.payload.signal_id === payload.signal_id);
+    return true;
 }
 function publicationDir(hqRoot, company) {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(company))
@@ -65,8 +72,11 @@ function publicationDir(hqRoot, company) {
     return path.join(hqRoot, "workspace", "signal-publications", company);
 }
 /** Persist intent before publishing a new signal file; ordinary redo creates none. */
-export function prepareSignalPublication(hqRoot, company, payload) {
+/** Records nothing while no opted-in Executive serves the company, so no backlog builds up. */
+export function prepareSignalPublication(hqRoot, company, payload, root = botsRoot(), home) {
     const dir = publicationDir(hqRoot, company);
+    if (!executiveFor(hqRoot, company, root, home))
+        return;
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     const file = path.join(dir, createHash("sha256").update(payload.signal_id).digest("hex") + ".json");
     const tmp = `${file}.${randomUUID()}.tmp`;
@@ -74,12 +84,25 @@ export function prepareSignalPublication(hqRoot, company, payload) {
     fs.renameSync(tmp, file);
 }
 /** A pre-append crash retries; a post-append crash uses the event journal's dedupe. */
-export function flushSignalPublications(hqRoot, company, emit = emitExecutiveSignalWritten) {
+export function flushSignalPublications(hqRoot, company, emit = emitExecutiveSignalWritten, root = botsRoot(), home) {
     const dir = publicationDir(hqRoot, company);
     if (!fs.existsSync(dir))
         return;
+    // With the Executive off, drop stale intents so a later opt-in does not
+    // turn past action items into a burst of lanes.
+    const optedIn = executiveFor(hqRoot, company, root, home) !== null;
     for (const name of fs.readdirSync(dir).filter(name => /^[a-f0-9]{64}\.json$/.test(name))) {
         const file = path.join(dir, name);
+        if (!optedIn) {
+            try {
+                fs.unlinkSync(file);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            continue;
+        }
         let payload;
         try {
             payload = JSON.parse(fs.readFileSync(file, "utf8"));

package/dist/main.js

@@ -61,7 +61,7 @@ import { packageRoot } from "./utils/hq-roots.js";
 import { classifyModuleNotFound, installTreeTornCaptureContext, installTreeTornStderrLine, isInstallTreeTornError, } from "./utils/install-tree-torn.js";
 import { isVaultAccessDeniedError, vaultAccessDeniedMessage, } from "./utils/vault-access-denied-error.js";
 import { fallbackOperatorMessage, unexpectedCliErrorMessage } from "./utils/unexpected-cli-error.js";
-import { runGlobalNetworkLifecycle } from "./utils/cli-network-lifecycle.js";
+import { isHqDaemonRunCommand, runGlobalNetworkLifecycle, runSentryInitialization, } from "./utils/cli-network-lifecycle.js";
 import * as os from "node:os";
 import { adoptAgentIdentityEnv } from "./lib/agent-kit/adopt-identity.js";
 import { agentKitPaths } from "./lib/agent-kit/paths.js";
@@ -131,7 +131,7 @@ let activeForegroundNetworkBudget;
  */
 const RUNNING_ENTRY_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), "index.js");
 installStreamErrorBoundary();
-runGlobalNetworkLifecycle(process.argv, () => initSentry());
+runSentryInitialization(process.argv, () => initSentry());
 const program = new Command();
 program
     .name("hq")
@@ -169,7 +169,7 @@ program.hook("preAction", async () => {
 export async function runCli() {
     const xpcServiceName = process.env.XPC_SERVICE_NAME ?? "";
     const launchedByHqAgent = xpcServiceName.startsWith("ai.indigo.") || xpcServiceName.startsWith("ai.getindigo.");
-    const isDaemonEntryPoint = process.argv[2] === "daemon" && process.argv[3] === "run";
+    const isDaemonEntryPoint = isHqDaemonRunCommand(process.argv);
     const isBotHotPath = process.argv[2] === "bot" && process.argv[3] === "run";
     if (process.platform === "darwin" && typeof process.getuid === "function" &&
         !launchedByHqAgent && !isDaemonEntryPoint && !isBotHotPath) {

package/dist/utils/cli-network-lifecycle.d.ts

@@ -1,3 +1,12 @@
+export declare function isHqDaemonRunCommand(argv: readonly string[]): boolean;
+/**
+ * Resident daemons keep their own bounded local logs. Do not initialize the
+ * process-wide Sentry transport in these commands: they can live across many
+ * network changes, while the SDK is designed around one short CLI invocation.
+ */
+export declare function isLongLivedDaemonCommand(argv: readonly string[]): boolean;
+/** Suppress only Sentry startup; every other global lifecycle operation still runs. */
+export declare function runSentryInitialization<T>(argv: readonly string[], operation: () => T): T | undefined;
 export declare function isMonitorFastPathCommand(argv: readonly string[]): boolean;
 /** The commit-msg hook runs `hq fingerprint self --offline`; it must stay fast and offline. */
 export declare function isOfflineFingerprintCommand(argv: readonly string[]): boolean;

package/dist/utils/cli-network-lifecycle.js

@@ -1,4 +1,27 @@
 const MONITOR_HIDDEN_NETWORK_BYPASS = new Set(["drain", "wait", "enabled", "_run"]);
+function commandArgv(argv) {
+    return argv.slice(2).filter((arg) => arg !== "--verbose");
+}
+export function isHqDaemonRunCommand(argv) {
+    const command = commandArgv(argv);
+    return command[0] === "daemon" && command[1] === "run";
+}
+/**
+ * Resident daemons keep their own bounded local logs. Do not initialize the
+ * process-wide Sentry transport in these commands: they can live across many
+ * network changes, while the SDK is designed around one short CLI invocation.
+ */
+export function isLongLivedDaemonCommand(argv) {
+    const command = commandArgv(argv);
+    return (isHqDaemonRunCommand(argv) ||
+        (command[0] === "mesh" && command[1] === "daemon" && command[2] === "run"));
+}
+/** Suppress only Sentry startup; every other global lifecycle operation still runs. */
+export function runSentryInitialization(argv, operation) {
+    if (isLongLivedDaemonCommand(argv))
+        return undefined;
+    return operation();
+}
 export function isMonitorFastPathCommand(argv) {
     return argv[2] === "monitor" && MONITOR_HIDDEN_NETWORK_BYPASS.has(argv[3] ?? "");
 }
@@ -8,8 +31,9 @@ export function isOfflineFingerprintCommand(argv) {
 }
 /** Skip process-wide network lifecycle work for hooks and detached monitor supervisors. */
 export function runGlobalNetworkLifecycle(argv, operation) {
-    if (isMonitorFastPathCommand(argv) || isOfflineFingerprintCommand(argv))
+    if (isMonitorFastPathCommand(argv) || isOfflineFingerprintCommand(argv)) {
         return undefined;
+    }
     return operation();
 }
 //# sourceMappingURL=cli-network-lifecycle.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.201",
+  "version": "5.345.202",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,8 @@
     "prepare": "husky || true",
     "check:no-hermes": "bash scripts/check-no-hermes.sh",
     "prepack": "node scripts/hook-engine-manifest.mjs",
-    "postpublish": "node scripts/hook-engine-manifest.mjs restore"
+    "postpublish": "node scripts/hook-engine-manifest.mjs restore",
+    "build:ci": "node scripts/prepare-fixture-privacy-baseline.mjs && pnpm run build"
   },
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
@@ -116,11 +117,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.201",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.201",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.201",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.201",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.201",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.201"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.202",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.202",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.202",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.202",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.202",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.202"
   }
 }