@indigoai-us/hq-cli 5.345.201 → 5.345.203

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [5.345.203] — 2026-11-05
+- Fix Codex capacity routing after plan exhaustion: available credits keep accounts usable at lowest priority, and superseded snapshots or passed resets no longer retain exhausted usage.
+- Keep company Outpost integration commands on their delegated machine session and allow sharing connections with an `out_*` principal.
+- On macOS the `hq daemon` LaunchAgent now runs node directly and is no longer attributed to the HQ app, so launchd loads it at login whether or not the app is installed or allowed. `hq daemon status` now asks launchd or systemd and says whether the daemon runs under the service manager, runs outside it, or is not loaded. New `hq daemon start` loads the unit when it is missing and starts it. A Mac that still has the older plist, which runs through the app, gets it rewritten and reloaded when the daemon next starts or when `hq daemon start` runs, with no `hq daemon install` needed; `hq daemon status` warns while the plist, or the job launchd has loaded, still runs through the app, and `hq daemon start` reloads a job left on the old definition. `hq daemon start` leaves a daemon the desktop app hosts alone, and no longer mistakes state left by an earlier app-hosted daemon for that. `hq daemon install` treats a failed bootstrap as an error and retries it, and `hq daemon migrate --apply` loads the daemon's agent first and loads an older agent again if taking it over fails.
+- The daemon no longer holds a sync engine for 30 minutes when its heartbeat timeouts come from a slow transfer the engine reports progress on (up to six such restarts per episode; after that they count again), and a sync engine held because another process had its lock (exit 17) starts again as soon as that process exits.
+- The sync engine release can now be pinned on the server (`pin.json` on the engine download base); the CLI's built-in release is the fallback, and an installed engine is never downgraded.
+- A self-check in the daemon sends the person signed in on the machine a DM when a sync engine unit has been held or failing for over 30 minutes, at most once a day per machine, naming every affected vault. It reports only units the daemon runs, and sends nothing when the machine is signed in as an agent.
+- The Executive opt-in key is now `executive.enabled` in the HQ menubar settings file. The old `executiveMeetingRider.enabled` key is ignored, so values saved under it earlier now read as off.
+
+## [5.345.202] — 2026-11-04
+- The long-running `hq daemon run` and `hq mesh daemon run` processes no longer start Sentry. On some Macs, Sentry in these processes kept opening connections after network changes until the machine ran out of ports, so Claude and HQ lost internet access while other apps kept working. Short-lived CLI commands still report errors to Sentry, and the daemons keep their local logs.
+- The Executive (meeting rider, action-item lanes and source report DMs) is now off unless `executiveMeetingRider.enabled` is set to `true` in the HQ menubar settings file. In 5.345.200 it was on by default for every setup bot.
+- Native command guards on Windows now resolve tools with the same Git directories and home bin precedence as the Bash fallback, preventing a plain Windows PATH from selecting System32 timeout or missing Git tools. Added exact CLI command-argument parity coverage and portable temporary-path fixtures.
+- Port the complete policy reminder injector to Rust, including scope resolution, trigger matching, relevance ranking, output ceilings, deferred policies, cadence and seen ledgers, and receipt-backed enforcement. Shadow runs use isolated state so the Bash reference sees the original session history. Add a pinned full-injector corpus using staging regressions, release-shipped core policies and reproducibly generated synthetic policy/event payloads, with byte comparisons of output and state after each event. No rollout flags change.
+- Match Bash locale collation when indexing policy files, including Git Bash Windows collation and the macOS non-ASCII fallback order. Index format 3 rebuilds old cache files.
+
 ## [5.345.201] — 2026-11-04
 - `hq deploy domains buy` accepts a registrar price in `usd` or `USD`. Search shows that price as US dollars, and renew accepts the same code. A price in another currency is still refused, and the message shows the currency code the server sent.
 - The Executive sends source reports to its owner when a meeting ends and one final threaded report after all source lanes finish. Delivery receipts suppress normal duplicates and retain reports during the ten-minute cooldown. Recovery retries an intent without a sent receipt; a crash after sending but before recording the receipt can resend that report.

package/dist/command-catalog.generated.d.ts

@@ -18236,6 +18236,18 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "start";
+        readonly description: "Load the daemon's OS unit if the service manager does not have it, and start it";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "uninstall";
         readonly description: "Stop the daemon and remove its OS unit";
@@ -18816,6 +18828,18 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "sync-core-selfcheck";
+            readonly description: "DM the person signed in here when a sync engine unit has been held or failing for over 30 minutes (at most daily per unit set)";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "sync-core-manifest";
             readonly description: "Upload the sync-audit manifest for every vault the new sync engine owns on this machine";

package/dist/command-catalog.generated.js

@@ -22248,6 +22248,19 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "start",
+                "description": "Load the daemon's OS unit if the service manager does not have it, and start it",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "uninstall",
                 "description": "Stop the daemon and remove its OS unit",
@@ -22941,6 +22954,19 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "sync-core-selfcheck",
+                        "description": "DM the person signed in here when a sync engine unit has been held or failing for over 30 minutes (at most daily per unit set)",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [],
+                        "subcommands": []
+                    },
                     {
                         "name": "sync-core-manifest",
                         "description": "Upload the sync-audit manifest for every vault the new sync engine owns on this machine",

package/dist/commands/capacity.js

@@ -1,3 +1,4 @@
+import { hasCodexCreditRoom } from "../lib/capacity/codex-availability.js";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -98,7 +99,10 @@ export function formatCapacityTable(view, nowMs, accounts = []) {
     return view.providers.map((provider) => {
         const head = `${provider.provider}  ${provider.state}`;
         if (!provider.accounts || provider.accounts.length === 0) {
-            return `${head}\n${formatLimitTable(provider.limits, nowMs)}`;
+            const creditNote = provider.provider === "codex" && provider.state === "ok"
+                && provider.limits.some((limit) => limit.state === "exhausted")
+                ? " — usable on Codex credits" : "";
+            return `${head}${creditNote}\n${formatLimitTable(provider.limits, nowMs)}`;
         }
         const blocks = provider.accounts.map((account) => {
             const labels = account.labels.map((label) => {
@@ -112,7 +116,11 @@ export function formatCapacityTable(view, nowMs, accounts = []) {
                 const fix = presented.command ? formatRefreshLine(provider.provider, presented.command) : "";
                 return fix ? `${title}\n${reason}\n${fix}` : `${title}\n${reason}`;
             }
-            return `${title}\n${formatLimitTable(account.limits, nowMs)}`;
+            const creditNote = provider.provider === "codex"
+                && account.limits.some((limit) => limit.state === "exhausted")
+                && hasCodexCreditRoom(account.limits, nowMs)
+                ? " — usable on Codex credits (ranked last)" : "";
+            return `${title}${creditNote}\n${formatLimitTable(account.limits, nowMs)}`;
         });
         return [head, ...blocks].join("\n");
     }).join("\n\n");

package/dist/commands/daemon.d.ts

@@ -4,7 +4,8 @@
  *   hq daemon                     status (same as `hq daemon status`)
  *   hq daemon install             detect the machine type, install the one OS unit
  *   hq daemon run                 what the OS unit runs; starts the default services
- *   hq daemon status [--json]
+ *   hq daemon start               load the OS unit if needed and start it
+ *   hq daemon status [--json]     includes whether the service manager runs it
  *   hq daemon logs [unit] [--follow] [--lines N]
  *   hq daemon restart [unit] | trigger <unit>
  *   hq daemon enable|disable <service...>   per-machine overrides

package/dist/commands/daemon.js

@@ -4,7 +4,8 @@
  *   hq daemon                     status (same as `hq daemon status`)
  *   hq daemon install             detect the machine type, install the one OS unit
  *   hq daemon run                 what the OS unit runs; starts the default services
- *   hq daemon status [--json]
+ *   hq daemon start               load the OS unit if needed and start it
+ *   hq daemon status [--json]     includes whether the service manager runs it
  *   hq daemon logs [unit] [--follow] [--lines N]
  *   hq daemon restart [unit] | trigger <unit>
  *   hq daemon enable|disable <service...>   per-machine overrides
@@ -24,7 +25,8 @@ import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices, hqCloudUnits }
 import { applyServiceToggle, effectiveSyncOwner, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
 import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
 import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/daemon/migrate.js";
-import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, WINDOWS_START_WAIT_MS, daemonRootRefusal, installDaemonUnit, installScopeFor, classifyWindowsTask, legacyWindowsTask, readWindowsSid, uninstallDaemonUnit, windowsInteractiveSession, windowsTaskName, } from "../lib/daemon/install.js";
+import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, WINDOWS_START_WAIT_MS, daemonRootRefusal, installDaemonUnit, installScopeFor, classifyWindowsTask, daemonServiceStatus, describeSupervision, legacyWindowsTask, startDaemonUnit, readWindowsSid, uninstallDaemonUnit, windowsInteractiveSession, windowsTaskName, } from "../lib/daemon/install.js";
+import { PLIST_REFRESH_MARKER } from "../lib/daemon/plist-refresh.js";
 import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
 import { isDaemonProcess, liveDaemonLock, runningDaemonPid } from "../lib/daemon/lock.js";
 import { bundledHqCloud, managedHqCloud, managedHqCloudRoot, readHqCloudCopy, readHqCloudUpdateState } from "../lib/daemon/hq-cloud.js";
@@ -438,28 +440,126 @@ function formatUnit(u) {
     const restarts = u.restarts > 0 ? ` (restarted ${u.restarts}x)` : "";
     return `  ${u.id.padEnd(40)} ${u.status.padEnd(12)} ${detail}${restarts}`;
 }
+/**
+ * True when the daemon holding the lock is the one the desktop app hosts.
+ * state.json outlives the daemon that wrote it, and a new daemon writes its own
+ * only after starting up, so a `host: "desktop"` left by an earlier app-hosted
+ * daemon counts only when its pid is the lock holder's.
+ */
+function hostedByDesktop(state, lockPid) {
+    return lockPid !== null && state?.host === "desktop" && state.pid === lockPid;
+}
+/**
+ * The service manager's warnings, plus where the automatic plist rewrite
+ * logged when it was tried and the plist still needs it.
+ */
+function statusWarnings(service, paths) {
+    const warnings = [...(service.warnings ?? [])];
+    if (warnings.length > 0 && fs.existsSync(path.join(paths.root, PLIST_REFRESH_MARKER))) {
+        warnings.push(`The daemon tried to rewrite it automatically and did not finish. See: ${path.join(paths.root, "logs", "plist-refresh.log")}`);
+    }
+    return warnings;
+}
 async function runStatus(d, opts) {
     const host = currentHost(d);
     const { paths } = host;
     const pid = runningDaemonPid(paths.lockPath, d.daemonAlive);
     const state = pid ? readState(paths) : null;
     const config = readDaemonConfig(paths.configPath);
+    // The pid lock alone says nothing about whether the daemon comes back after
+    // a crash or a login: ask the service manager too.
+    const service = daemonServiceStatus(hostFor(d, paths, false), d.run, pid);
+    // A daemon hosted by the desktop app is supervised by the app, not the OS.
+    const hosted = hostedByDesktop(state, pid);
     if (opts.json) {
-        d.out(JSON.stringify({ running: pid !== null, pid, machineType: state?.machineType ?? config.machineType ?? null, units: state?.units ?? [] }, null, 2));
+        d.out(JSON.stringify({
+            running: pid !== null,
+            pid,
+            supervision: hosted && service.supervision === "unmanaged" ? "desktop-app" : service.supervision,
+            serviceManager: {
+                manager: service.manager,
+                unitInstalled: service.unitInstalled,
+                loaded: service.loaded,
+                active: service.active,
+                pid: service.managerPid ?? null,
+                detail: service.detail,
+            },
+            warnings: statusWarnings(service, paths),
+            machineType: state?.machineType ?? config.machineType ?? null,
+            units: state?.units ?? [],
+        }, null, 2));
         return;
     }
+    const managerLine = hosted && service.supervision === "unmanaged"
+        ? `Service manager: running as the HQ desktop app's child (${service.detail}).`
+        : `Service manager: ${describeSupervision(service)}.`;
+    const warnings = statusWarnings(service, paths).map((w) => `Warning: ${w}`);
     if (!pid || !state) {
         const { detected } = host;
         d.out(`hq daemon is not running. Machine type: ${detected.type} (${detected.detail}).`);
+        d.out(managerLine);
+        for (const line of warnings)
+            d.out(line);
         d.out("Default services for this machine:");
         for (const line of describeServices(detected.type, config))
             d.out(line);
         return;
     }
     d.out(`hq daemon is running (pid ${pid}) on a ${state.machineType} machine.`);
+    d.out(managerLine);
+    for (const line of warnings)
+        d.out(line);
     for (const u of state.units)
         d.out(formatUnit(u));
 }
+async function runStart(d) {
+    const host = currentHost(d);
+    const { paths } = host;
+    const pid = runningDaemonPid(paths.lockPath, d.daemonAlive);
+    // The desktop app hosts this daemon and restarts it itself. Loading the OS
+    // unit now would start a second daemon that exits on the lock and is
+    // respawned until the app quits.
+    if (hostedByDesktop(readState(paths), pid)) {
+        d.out(`hq daemon is running (pid ${pid}) inside the desktop app, which restarts it. ` +
+            "Nothing to start. To run it under the service manager instead, quit the app, then run: hq daemon start");
+        return;
+    }
+    const before = daemonServiceStatus(hostFor(d, paths, false), d.run, pid);
+    if (!before.unitInstalled && before.manager !== "none") {
+        // Nothing to load: install writes the unit, loads it and starts it.
+        d.out("hq daemon is not installed here yet; installing it.");
+        await runInstall(d, {});
+        return;
+    }
+    const result = startDaemonUnit(hostFor(d, paths, false), {
+        run: d.run,
+        sleep: d.sleep,
+        daemonPid: () => runningDaemonPid(paths.lockPath, d.daemonAlive),
+    });
+    handOver(d, host);
+    const refresh = result.refresh;
+    if (refresh?.action === "rewritten" || refresh?.action === "reloaded") {
+        d.out(`Rewrote ${refresh.plistPath} so launchd loads the daemon at login without HQ.app.`);
+    }
+    if (refresh?.error)
+        d.err(`warning: ${refresh.error}`);
+    if (result.action === "already-running") {
+        d.out(`hq daemon is already running (pid ${result.status.daemonPid}) under the service manager.`);
+        return;
+    }
+    if (result.status.supervision !== "managed" || result.status.daemonPid === null) {
+        const what = result.action === "loaded"
+            ? "Loaded the daemon's unit"
+            : result.action === "reloaded"
+                ? "Reloaded the daemon's unit"
+                : "Asked the service manager to start the daemon";
+        const why = result.status.supervision === "managed"
+            ? `no daemon took the lock within 15 seconds (${result.status.detail})`
+            : `it is ${describeSupervision(result.status)}`;
+        throw new DaemonCommandError(`${what}, but ${why}. See: hq daemon logs`);
+    }
+    d.out(`${result.action === "loaded" ? "Loaded and started" : result.action === "reloaded" ? "Reloaded and started" : "Started"} hq daemon (pid ${result.status.daemonPid}) under the service manager.`);
+}
 function tailLines(file, lines) {
     const text = fs.readFileSync(file, "utf8");
     return text.split("\n").filter((l, i, all) => i < all.length - 1 || l !== "").slice(-lines);
@@ -886,7 +986,26 @@ async function runMigrate(d, opts) {
         if (!installed) {
             throw new DaemonCommandError("hq daemon is not installed here yet. Run `hq daemon install` first, then `hq daemon migrate --apply`.");
         }
-        const result = adoptLegacyUnits(units, migrateDeps(d, host.paths, host.runAsUser));
+        // The daemon starts the adopted services, so its own unit must be loaded
+        // before the older units are booted out (an installed but unloaded plist
+        // would leave every adopted service off until the next manual start).
+        const ensureDaemonLoaded = (when) => {
+            const daemonPid = () => runningDaemonPid(host.paths.lockPath, d.daemonAlive);
+            const status = daemonServiceStatus(hostFor(d, host.paths, false), d.run, daemonPid());
+            if (status.loaded || status.manager === "none")
+                return;
+            try {
+                startDaemonUnit(hostFor(d, host.paths, false), { run: d.run, sleep: d.sleep, daemonPid, waitMs: 0 });
+                d.out(`Loaded the daemon's unit ${when}.`);
+            }
+            catch (err) {
+                throw new DaemonCommandError(`The daemon's unit is not loaded and could not be loaded ${when}: ${err.message}`);
+            }
+        };
+        ensureDaemonLoaded("before taking over the older units");
+        const result = adoptLegacyUnits(units, { ...migrateDeps(d, host.paths, host.runAsUser), sleep: d.sleep });
+        if (result.adopted.length > 0)
+            ensureDaemonLoaded("after taking over the older units");
         handOver(d, host);
         for (const a of result.adopted)
             d.out(`Took over ${a.unitId} from ${describeLegacyUnit(a)}`);
@@ -1306,6 +1425,68 @@ async function runServiceCodexRemoteControl(d, opts) {
         watch: codex,
     });
 }
+/**
+ * DM the person signed in on this machine (the machine owner) through the
+ * same route as `hq dm`. A machine identity (agent box) has no person to tell.
+ */
+/**
+ * Which engine vaults the self-check reports, and their names: a vault skipped
+ * in ~/.hq/sync-core/skip.json or not on the rollout recorded in rollout.json
+ * is kept on the old sync on purpose, so a hold left over for it is not an outage.
+ */
+async function selfCheckVaults(home) {
+    const [{ readSyncCoreSkips }, { readSyncCoreRolloutState }] = await Promise.all([
+        import("../lib/sync-core/skip.js"),
+        import("../lib/sync-core/rollout-state.js"),
+    ]);
+    let skipped = new Set();
+    try {
+        skipped = new Set(readSyncCoreSkips(home).map((s) => s.uid));
+    }
+    catch {
+        // An unreadable skip list skips nothing here; the reconcile reports it.
+    }
+    let rollout = null;
+    try {
+        rollout = readSyncCoreRolloutState(home);
+    }
+    catch {
+        // No rollout file: every vault counts.
+    }
+    const onRollout = rollout ? new Map(rollout.vaults.map((v) => [v.uid, v])) : null;
+    return {
+        wanted: (uid) => !skipped.has(uid) && (onRollout === null || onRollout.has(uid)),
+        vaultName: (uid) => {
+            const v = onRollout?.get(uid);
+            if (!v)
+                return undefined;
+            return v.kind === "personal" ? "your personal vault" : v.slug;
+        },
+    };
+}
+async function sendDmToMachineOwner(message) {
+    const [{ ensureCognitoToken }, { agentUidFromToken, resolveCallerPersonUid, vaultApiFetch }] = await Promise.all([
+        import("../utils/cognito-session.js"),
+        import("../utils/vault-api.js"),
+    ]);
+    const token = await ensureCognitoToken();
+    // An agent box has no person signed in, and the server does not deliver a
+    // DM an agent sends itself: there is no owner to reach from here.
+    if (agentUidFromToken(token))
+        return null;
+    const personUid = await resolveCallerPersonUid(token, undefined, { command: "hq daemon service sync-core-selfcheck" });
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/notify/dm",
+        method: "POST",
+        body: { toPersonUid: personUid, body: message.body, details: message.details },
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new DaemonCommandError(`could not send the self-check DM: HTTP ${res.status} ${err.code ?? ""} ${err.error ?? err.message ?? ""}`.trim());
+    }
+    return personUid;
+}
 export function registerDaemonCommand(program, over = {}) {
     let resolved = null;
     const deps = () => (resolved ??= loadDefaults(over));
@@ -1330,6 +1511,10 @@ export function registerDaemonCommand(program, over = {}) {
         .option("--hq-root <path>", "HQ folder the services work against")
         .option("--user <login>", "on a box: the login user the daemon runs as (never root)")
         .action(wrap((d, opts) => runInstall(d, opts)));
+    daemon
+        .command("start")
+        .description("Load the daemon's OS unit if the service manager does not have it, and start it")
+        .action(wrap((d) => runStart(d)));
     daemon
         .command("uninstall")
         .description("Stop the daemon and remove its OS unit")
@@ -1601,6 +1786,42 @@ export function registerDaemonCommand(program, over = {}) {
             err: d.err,
         });
     }));
+    service
+        .command("sync-core-selfcheck")
+        .description("DM the person signed in here when a sync engine unit has been held or failing for over 30 minutes (at most daily per unit set)")
+        .action(wrap(async (d) => {
+        const [{ runSelfCheck }, { readUnitHolds }] = await Promise.all([
+            import("../lib/daemon/selfcheck.js"),
+            import("../lib/daemon/unit-holds.js"),
+        ]);
+        const { paths } = currentHost(d);
+        await runSelfCheck({
+            statePath: paths.statePath,
+            holdsPath: paths.holdsPath,
+            recordPath: path.join(paths.root, "selfcheck.json"),
+            now: Date.now,
+            machine: os.hostname(),
+            readState: () => {
+                try {
+                    return readState(paths);
+                }
+                catch {
+                    return null;
+                }
+            },
+            readHolds: () => {
+                try {
+                    return readUnitHolds(paths.holdsPath);
+                }
+                catch {
+                    return {};
+                }
+            },
+            sendToOwner: (message) => sendDmToMachineOwner(message),
+            ...(await selfCheckVaults(d.home)),
+            log: (line) => d.out(line),
+        });
+    }));
     service
         .command("sync-core-manifest")
         .description("Upload the sync-audit manifest for every vault the new sync engine owns on this machine")

package/dist/commands/integrations-core.d.ts

@@ -8,6 +8,7 @@
  * Sentry live in exactly one place. `integrations.ts` re-exports this module's
  * public surface, so existing importers keep working unchanged.
  */
+import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 export { bareProvider } from "../lib/integrations/provider-slug.js";
 /** Write policy on a connection — mirrors hq-pro's `WritePolicy`. */
 export type WritePolicy = "auto-allow" | "confirm" | "deny";
@@ -415,4 +416,6 @@ export declare function selectAccountConnections(connections: readonly AdminConn
     account: string;
     provider?: string;
 }): AdminConnection[];
+/** A runner-selected session must never fall back to a cached human identity. */
+export declare function ensureIntegrationIdToken(options?: Parameters<typeof ensureCognitoIdToken>[0]): Promise<string>;
 //# sourceMappingURL=integrations-core.d.ts.map

package/dist/commands/integrations-core.js

@@ -9,6 +9,8 @@
  * public surface, so existing importers keep working unchanged.
  */
 import { randomUUID } from "node:crypto";
+import { delegatedMachineSessionFilePath, loadDelegatedMachineSession, getValidMachineTokens } from "@indigoai-us/hq-cloud";
+import { DEFAULT_COGNITO, ensureCognitoIdToken } from "../utils/cognito-session.js";
 import chalk from "chalk";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
@@ -991,4 +993,13 @@ export function selectAccountConnections(connections, opts) {
     }
     return matches;
 }
+/** A runner-selected session must never fall back to a cached human identity. */
+export async function ensureIntegrationIdToken(options) {
+    if (delegatedMachineSessionFilePath() !== null) {
+        if (!loadDelegatedMachineSession())
+            throw new Error("HQ_MACHINE_SESSION_FILE is not a usable delegated session; the job runner must rewrite it.");
+        return (await getValidMachineTokens(DEFAULT_COGNITO)).idToken;
+    }
+    return options === undefined ? ensureCognitoIdToken() : ensureCognitoIdToken(options);
+}
 //# sourceMappingURL=integrations-core.js.map

package/dist/commands/integrations-manage.js

@@ -71,10 +71,10 @@ export function parsePrincipal(raw) {
         return { granteeType: "group", granteeId: value };
     // Agents are people to the ACL: they hold an identity and a membership, so a
     // grant to `agt_…` is a person grant, not a separate grantee kind.
-    if (/^(prs|psn|agt)_[A-Za-z0-9_-]+$/i.test(value)) {
+    if (/^(prs|psn|agt|out)_[A-Za-z0-9_-]+$/i.test(value)) {
         return { granteeType: "person", granteeId: value };
     }
-    throw new IntegrationsCliError(`Could not tell what '${raw}' refers to. Use an email address, a uid (prs_… / agt_… / grp_…), \`everyone\`, or an explicit \`person:<id>\` / \`group:<id>\` form.`, { expected: true });
+    throw new IntegrationsCliError(`Could not tell what '${raw}' refers to. Use an email address, a uid (prs_… / agt_… / out_… / grp_…), \`everyone\`, or an explicit \`person:<id>\` / \`group:<id>\` form.`, { expected: true });
 }
 /** `--with` / `--to` / `--from` help. Groups resolve membership at call time. */
 export const PRINCIPAL_HELP = "Email, uid, vault group (grp_…), or `everyone`";

package/dist/commands/integrations.js

@@ -53,7 +53,7 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import chalk from "chalk";
-import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { ensureIntegrationIdToken } from "./integrations-core.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, callGateway, parseCallTimeoutMs, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, connectionAccountLabel, connectionOwnerLabel, selectAccountConnections, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, accountCandidateFor, accountSelectionMessage, ACCOUNT_REQUIRED_CODE, } from "./integrations-core.js";
@@ -361,7 +361,7 @@ export function registerIntegrationsCommand(program) {
         .option("--usable", "Only apps you can use right now (connected and shared with you), with the --provider value to call them")
         .option("--no-login", "Fail instead of opening a browser sign-in when there is no HQ session")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken(opts.login === false ? { interactive: false } : {});
+        const token = await ensureIntegrationIdToken(opts.login === false ? { interactive: false } : {});
         const companyUid = await getCompanyUid(token, opts.company);
         if (opts.usable) {
             const result = await fetchUsableApps(token, companyUid);
@@ -424,7 +424,7 @@ export function registerIntegrationsCommand(program) {
         .option("--describe <tool>", "Print the full input schema for one tool")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken();
+        const token = await ensureIntegrationIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connections = await fetchConnections(token, companyUid);
         const { connection, accountMatches } = selectToolConnection(connections, opts);
@@ -516,7 +516,7 @@ export function registerIntegrationsCommand(program) {
         .action(async (tool, opts) => {
         const waitMs = parseCallTimeoutMs(opts.timeout);
         const parsedArgs = await resolveCallArgs(opts);
-        const token = await ensureCognitoIdToken();
+        const token = await ensureIntegrationIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const { connection, accountMatches } = selectToolConnection(await fetchConnections(token, companyUid), opts);
         if (reportRevokedConnection(connection, { ...opts, fail: true }))
@@ -605,7 +605,7 @@ export function registerIntegrationsCommand(program) {
             .option("--company <slug>", "Company slug, e.g. indigo")
             .option("--json", "Machine-readable output")
             .action(async (queueId, opts) => {
-            const token = await ensureCognitoIdToken();
+            const token = await ensureIntegrationIdToken();
             const companyUid = await getCompanyUid(token, opts.company);
             const connection = selectConnection(await fetchConnections(token, companyUid), opts);
             const res = await vaultApiFetch({

package/dist/commands/sync-core.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { ensureSyncCoreBinary } from "../lib/sync-core/release.js";
+import { ensureSyncCoreBinary, readSyncCorePin } from "../lib/sync-core/release.js";
 import { readCompanyRolloutFlag } from "../lib/sync-core/flag.js";
 import { reconcileSyncCore } from "../lib/sync-core/reconcile.js";
 import { engineOwnedManifestScopes, manifestScopeArg } from "../lib/sync-core/manifest-scopes.js";
@@ -59,6 +59,7 @@ export async function runSyncCoreReconcile(opts, d = defaultDeps()) {
         }),
         readRolloutFlag: (companyUid) => readCompanyRolloutFlag(companyUid, token, { env: d.env }),
         ensureBinary: (release) => ensureSyncCoreBinary({ home: d.home, platform: d.platform, arch: d.arch, release, env: d.env }),
+        readPin: () => readSyncCorePin({ env: d.env }),
         log: opts.json ? () => { } : d.out,
     });
     if (opts.json)

package/dist/lib/bot/executive-settings.d.ts

@@ -1,5 +1,5 @@
 import { type BotConfig } from "./config.js";
-export declare function executiveRiderEnabled(home?: string): boolean;
+export declare function executiveEnabled(home?: string): boolean;
 export declare function isExecutiveBot(config: Pick<BotConfig, "name" | "kind" | "workerId">, home?: string): boolean;
 export declare function executiveStatus(config: Pick<BotConfig, "name" | "kind" | "workerId">, dir: string, home?: string): {
     is_executive: boolean;

package/dist/lib/bot/executive-settings.js

@@ -1,21 +1,31 @@
-/** Shared Executive identity and the desktop's default-on rider preference. */
+/**
+ * Shared Executive identity and its opt-in switch.
+ *
+ * The Executive (meeting rider, signal-to-lane, source report DMs) is off
+ * unless ~/.hq/menubar.json sets executive.enabled to true. It
+ * stays internal until the live end-to-end proof passes. The older
+ * executiveMeetingRider key is ignored whatever its value: the desktop beta
+ * saved executiveMeetingRider.enabled: true for users who never chose it.
+ */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 import { effectiveBotKind } from "./config.js";
 import { tailBotEvents } from "./events.js";
-export function executiveRiderEnabled(home = os.homedir()) {
+export function executiveEnabled(home = os.homedir()) {
     try {
         const settings = JSON.parse(fs.readFileSync(path.join(home, ".hq/menubar.json"), "utf8"));
-        return settings?.executiveMeetingRider?.enabled !== false;
+        return settings?.executive?.enabled === true;
     }
-    catch (err) {
-        return err.code === "ENOENT";
+    catch {
+        return false;
     }
 }
 export function isExecutiveBot(config, home = os.homedir()) {
     if (effectiveBotKind(config) !== "personal")
         return false;
+    if (!executiveEnabled(home))
+        return false;
     let name = "setup";
     try {
         const value = JSON.parse(fs.readFileSync(path.join(home, ".hq/executive.json"), "utf8"));
@@ -34,7 +44,7 @@ export function isExecutiveBot(config, home = os.homedir()) {
 export function executiveStatus(config, dir, home = os.homedir()) {
     const last = tailBotEvents(dir, (event) => event.event === "meeting.detected").at(-1);
     return {
-        is_executive: isExecutiveBot(config, home), rider_enabled: executiveRiderEnabled(home),
+        is_executive: isExecutiveBot(config, home), rider_enabled: executiveEnabled(home),
         // The first desktop producer did not set source.
         detect_source_last: last ? (last.payload.source === "poll" ? "poll" : "desktop") : null,
         last_detected_at: last?.at ?? null,

package/dist/lib/bot/jobs/meeting-detect.js

@@ -9,7 +9,7 @@ import { getCompanyUid } from "../../../utils/vault-api.js";
 import { assertSafeSegment } from "../../hot-channels/landing.js";
 import { readManifestCompanies } from "../company-bind.js";
 import { emitBotEvent } from "../events.js";
-import { executiveRiderEnabled, isExecutiveBot } from "../executive-settings.js";
+import { executiveEnabled, isExecutiveBot } from "../executive-settings.js";
 const RETENTION_MS = 24 * 60 * 60 * 1000;
 const ACTIVE = new Set(["joining", "recording", "in_call"]);
 export function detectIntervalSeconds(hqRoot) {
@@ -161,7 +161,7 @@ async function untilAborted(signal, work) {
 export function defaultMeetingDetectDeps(config, dir, log) {
     return {
         hqRoot: config.hqRoot, dir, log,
-        enabled: () => isExecutiveBot(config) && executiveRiderEnabled(),
+        enabled: () => isExecutiveBot(config) && executiveEnabled(),
         companies: () => config.companySlug ? [config.companySlug] : readManifestCompanies(config.hqRoot),
         intervalSeconds: () => detectIntervalSeconds(config.hqRoot),
         list: async (company, signal) => {