@indigoai-us/hq-cli 5.345.203 → 5.345.204

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.345.204] — 2026-11-05
+- `hq bot create`, `hq doctor` and the Claude bot sign-in check now read the macOS Keychain item that Claude Code keeps under your login account name first. A Mac can also hold an older item for the same service under another account (often "unknown", with no Claude login in it). The check used to read that one and said Claude was not signed in right after you signed in from HQ Desktop, so Create bot failed.
+- `hq bot create --json` now includes `brainSignIn` (the same shape `hq bot list`, `status` and `start` report) when it refuses a Claude bot because Claude Code is not signed in, so HQ Desktop can offer its own sign-in instead of "Could not create".
+- `hq capacity` renews expired Claude tokens on a busy Mac again. The refresh check reads the lane list once per collect instead of once per account, runs its two reads together without blocking the mesh daemon, skips the Outpost mirror refresh it does not need, and allows each read 30 seconds instead of 15. On macOS it now reads each running `claude` process's environment, so an open session on the default home no longer blocks the refresh of every other account home. A process whose environment cannot be read still blocks every home, and if the lane read fails no token is refreshed. A session started with `HOME` set to another directory and no `CLAUDE_CONFIG_DIR` now blocks the refresh of that directory's `.claude` home.
+- `hq signals run` now runs the extract step on the Grok CLI when the main local bot runs on Grok, instead of failing every source item with "grok has no restricted tool mode". Each turn runs grok 1.0.70 or newer in `dontAsk` mode with only the file reader allowed, grok's own read-only shell list denied, the MCP bridge, web tools and subagents off, a turn cap, and a per-turn `strict` sandbox profile that can read only the item's channel folder (plus the scripts the candidate command needs) and grants no extra writes. Reads of the Grok login are denied for the literal `~/.grok` spelling, the isolated home and the real home, because Grok matches a `~` path literally before expanding it. An older grok, or a main bot on grok with no grok installed, is never run unrestricted: the step uses Claude Code, then Codex, when that tool is installed and signed in, records the fallback in the run's step detail, and otherwise fails the run naming the grok version it needs. On macOS and Windows the step does not select Grok, because Grok only blocks child-process network on Linux, and falls through the same way. Grok has no terminal tool: HQ validates its returned candidate commands, checks the pinned writer still matches the script it generated, and then invokes that writer with fixed arguments, rejecting shell chaining, substitutions and redirections. The host writes candidates after the turn. The resolved Grok executable is pinned for the probe and turn, and probe caching distinguishes changes to PATH. Its isolated temporary home carries only a private login-file copy, excludes user configuration and hooks, and is removed when the turn ends, and its environment is an allowlist.
+- `hq lanes` admission on macOS no longer holds every new lane while `kern.memorystatus_vm_pressure_level` is warn. A warn level now holds only when the free percentage (`kern.memorystatus_level`) is at or below `throttle.memory_warn_min_free_percent` (default 20, a number from 0 to 100); critical still always holds, and `throttle.min_available_mem_mb` still applies. The hold message states this rule.
+- The daemon's new-sync-engine units now plan on Windows. A Windows machine downloads the `windows-x64` or `windows-arm64` zip, installs `hq-syncd.exe` (moving a running copy aside to `hq-syncd.exe.old`), and writes an engine home with no symlinks: the config names the token file and the engine reads `menubar.json` and `work-mesh/` from the daemon's state folder. Windows vaults stay on the current sync, and no engine is downloaded, until `SYNC_CORE_WINDOWS_FULL_RELEASE` names an engine release whose Windows build runs full sync; it is unset in this release. One machine can test a build first by setting `HQ_SYNC_CORE_WINDOWS_FULL_RELEASE` to that release.
+- Show the upload-hold explanation and recovery command in sync status.
+
 ## [5.345.203] — 2026-11-05
 - Fix Codex capacity routing after plan exhaustion: available credits keep accounts usable at lowest priority, and superseded snapshots or passed resets no longer retain exhausted usage.
 - Keep company Outpost integration commands on their delegated machine session and allow sharing connections with an `out_*` principal.

package/dist/commands/bot.js

@@ -935,7 +935,11 @@ function requireClaudeCodeLoginForCreate(name) {
     const check = botCreateSeams.claudeLogin();
     if (check.signedIn)
         return;
-    throw Object.assign(new Error(`Claude Code is not signed in on this computer, so ${name} could not answer. ${describeClaudeLoginSources(check)} ${claudeLoginFix()}`.replace(/\s+/g, " ").trim()), { expected: true });
+    const reason = `Claude Code is not signed in on this computer, so ${name} could not answer.`;
+    // The same `brainSignIn` shape list, status and start report, so the
+    // desktop app offers its own sign-in instead of showing a terminal command.
+    const brainSignIn = { provider: "claude", needed: true, reason, command: "claude /login" };
+    throw Object.assign(new Error(`${reason} ${describeClaudeLoginSources(check)} ${claudeLoginFix()}`.replace(/\s+/g, " ").trim()), { expected: true, brainSignIn });
 }
 export const botStopSeams = {
     /** True when this process runs inside the bot process `botPid` (one of its turns). */
@@ -1099,7 +1103,8 @@ export async function runBotCreate(nameArg, opts) {
         // there too, not only a line on stderr.
         if (opts.json && !err?.jsonReported) {
             const message = err instanceof Error ? err.message : String(err);
-            console.log(JSON.stringify({ ok: false, name: nameArg, reason: "create-failed", message }, null, 2));
+            const brainSignIn = err?.brainSignIn ?? null;
+            console.log(JSON.stringify({ ok: false, name: nameArg, reason: "create-failed", message, ...(brainSignIn ? { brainSignIn } : {}) }, null, 2));
         }
         throw err;
     }

package/dist/commands/cloud.d.ts

@@ -210,15 +210,27 @@ export declare function scopeExcludedWarning(count: number): string | null;
  * largest count it sees instead of a sum: a repeated emit for the same hold
  * cannot inflate the total. A missing, non-numeric or negative count reads as 0.
  */
+export interface IdentityHeldNotice {
+    count: number;
+    /** Plain-language hold from hq-cloud, when that build sends one. */
+    message?: string;
+}
 export declare function createIdentityHeldTracker(): {
     observe: (event: {
         type: string;
         count?: unknown;
+        message?: unknown;
+        reason?: unknown;
     }) => void;
     count: () => number;
+    notice: () => IdentityHeldNotice;
 };
-/** Recovery lines for files held by the account-switch push fence. */
-export declare function identityHeldLines(count: number): string[];
+/**
+ * Recovery lines for files held by the account-switch push fence.
+ * A newer hq-cloud sends `message` (file names and `hq sync release-held`).
+ * Older builds send a count only, and this keeps the previous sentence.
+ */
+export declare function identityHeldLines(count: number, notice?: Pick<IdentityHeldNotice, "message">): string[];
 /** Actionable recovery for files refused because the vault baseline is stale. */
 export declare function staleUploadRefusalLines(count: number, paths?: readonly string[]): string[];
 /**

package/dist/commands/cloud.js

@@ -500,19 +500,9 @@ export function scopeExcludedWarning(count) {
         `They were skipped, not synced. Re-run with --json to list them, or ` +
         `ask an admin to grant you write on those paths.`);
 }
-/**
- * Counts the files share() held back because this sync scope is fenced after an account
- * switch on this computer (feedback_a69e12ba). share() reports the hold only as
- * an `identity-switch-push-held` event and leaves the files out of every
- * result counter, so without this the push printed "Pushed 0 file(s) (0 B,
- * 0 skipped)" as a success while the vault kept the old copy.
- *
- * Each event carries the size of one fenced hold, so the tracker keeps the
- * largest count it sees instead of a sum: a repeated emit for the same hold
- * cannot inflate the total. A missing, non-numeric or negative count reads as 0.
- */
 export function createIdentityHeldTracker() {
     let held = 0;
+    let message;
     return {
         observe(event) {
             if (event.type !== "identity-switch-push-held")
@@ -521,12 +511,24 @@ export function createIdentityHeldTracker() {
                 ? Math.max(0, Math.trunc(event.count))
                 : 0;
             held = Math.max(held, n);
+            // A company rebind uses the same event type and keeps its own warning.
+            if (event.reason === "company-rebind")
+                return;
+            if (typeof event.message === "string" && event.message.trim())
+                message = event.message.trim();
         },
         count: () => held,
+        notice: () => ({ count: held, ...(message ? { message } : {}) }),
     };
 }
-/** Recovery lines for files held by the account-switch push fence. */
-export function identityHeldLines(count) {
+/**
+ * Recovery lines for files held by the account-switch push fence.
+ * A newer hq-cloud sends `message` (file names and `hq sync release-held`).
+ * Older builds send a count only, and this keeps the previous sentence.
+ */
+export function identityHeldLines(count, notice) {
+    if (notice?.message)
+        return [`⚠ ${notice.message}`];
     if (count <= 0)
         return [];
     return [
@@ -1566,7 +1568,7 @@ export function registerCloudCommands(program) {
                 for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
                     log(chalk.yellow(line));
                 }
-                for (const line of identityHeldLines(identityHeldCount)) {
+                for (const line of identityHeldLines(identityHeldCount, identityHeld.notice())) {
                     log(chalk.yellow(line));
                 }
                 await syncHealth.succeeded();
@@ -1599,7 +1601,12 @@ export function registerCloudCommands(program) {
                 for (const line of uploadFailedLines(uploadFailed.count, uploadFailed.paths)) {
                     log(chalk.yellow(line));
                 }
-                for (const line of identityHeldLines(identityHeldCount)) {
+                for (const line of identityHeldLines(identityHeldCount, identityHeld.notice())) {
+                    log(chalk.yellow(line));
+                }
+            }
+            else if (identityHeld.notice().message) {
+                for (const line of identityHeldLines(identityHeldCount, identityHeld.notice())) {
                     log(chalk.yellow(line));
                 }
             }
@@ -2469,8 +2476,10 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         const pushRefused = planLimitTracker.summary();
         const pushUploadFailed = readUploadFailures(pushResult);
         const pushHeldCount = pushIdentityHeld.count();
+        const pushHeldNotice = pushIdentityHeld.notice();
         const pushStatus = pushResult.aborted ||
             pushHeldCount > 0 ||
+            Boolean(pushHeldNotice.message) ||
             pushResult.filesExcludedByScope > 0 ||
             (pushResult.filesRefusedStale ?? 0) > 0 ||
             pushUploadFailed.count > 0 ||
@@ -2498,7 +2507,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         for (const line of uploadFailedLines(pushUploadFailed.count, pushUploadFailed.paths)) {
             console.log(chalk.yellow(line));
         }
-        for (const line of identityHeldLines(pushHeldCount)) {
+        for (const line of identityHeldLines(pushHeldCount, pushHeldNotice)) {
             console.log(chalk.yellow(line));
         }
         if (pushResult.aborted) {

package/dist/commands/sync-core.js

@@ -59,6 +59,8 @@ export async function runSyncCoreReconcile(opts, d = defaultDeps()) {
         }),
         readRolloutFlag: (companyUid) => readCompanyRolloutFlag(companyUid, token, { env: d.env }),
         ensureBinary: (release) => ensureSyncCoreBinary({ home: d.home, platform: d.platform, arch: d.arch, release, env: d.env }),
+        platform: d.platform,
+        env: d.env,
         readPin: () => readSyncCorePin({ env: d.env }),
         log: opts.json ? () => { } : d.out,
     });

package/dist/lib/bot/claude-login.d.ts

@@ -21,7 +21,13 @@ export interface ClaudeLoginDeps {
     env?: NodeJS.ProcessEnv;
     home?: string;
     platform?: NodeJS.Platform;
-    readKeychain?: () => KeychainRead;
+    /**
+     * Reads the Keychain item; `account` scopes the read to one account name.
+     * Omitted account means "any item for the service" (the first one found).
+     */
+    readKeychain?: (account?: string) => KeychainRead;
+    /** The login user's account name; null when unknown. */
+    username?: string | null;
     now?: () => number;
 }
 export declare function checkClaudeCodeLogin(deps?: ClaudeLoginDeps): ClaudeLoginCheck;

package/dist/lib/bot/claude-login.js

@@ -17,9 +17,20 @@ import * as path from "node:path";
 import { fleetHome } from "./fleet-local.js";
 export const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
 export const CLAUDE_LOGIN_ENV_VARS = ["ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
-function readKeychainWithSecurity() {
+function safeUsername() {
     try {
-        const stdout = execFileSync("security", ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-w"], {
+        return os.userInfo().username || null;
+    }
+    catch {
+        return null;
+    }
+}
+function readKeychainWithSecurity(account) {
+    const args = account
+        ? ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-a", account, "-w"]
+        : ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-w"];
+    try {
+        const stdout = execFileSync("security", args, {
             encoding: "utf8",
             stdio: ["ignore", "pipe", "pipe"],
             timeout: 5000,
@@ -113,30 +124,59 @@ export function checkClaudeCodeLogin(deps = {}) {
         sources.push({ source: "macos_keychain", status: "skipped", reason: "not macOS" });
     }
     else {
-        const read = (deps.readKeychain ?? readKeychainWithSecurity)();
-        if (read.code !== 0) {
-            const detail = read.stderr.replace(/\s+/g, " ").trim().slice(0, 200) || `exit ${read.code}`;
-            sources.push({ source: "macos_keychain", status: "missing", reason: `no readable '${CLAUDE_KEYCHAIN_SERVICE}' item (${detail})` });
-        }
-        else {
+        // Claude Code (and the HQ desktop sign-in, which runs `claude auth login`)
+        // writes its login under the login user's account name. Another item with
+        // the same service can exist under a different account (an old one written
+        // as "unknown", or one holding only MCP OAuth), and an unscoped read
+        // returns whichever the Keychain finds first. Ask for the user's item
+        // first, then fall back to any item for the service.
+        const readKeychain = deps.readKeychain ?? readKeychainWithSecurity;
+        const username = deps.username === undefined ? safeUsername() : deps.username;
+        const recordOf = (result) => {
+            if (result.code !== 0)
+                return null;
             let payload;
             try {
-                payload = JSON.parse(read.stdout.trim());
+                payload = JSON.parse(result.stdout.trim());
             }
             catch {
                 payload = null;
             }
-            const record = payload && typeof payload === "object" ? oauthRecord(payload.claudeAiOauth) : null;
-            if (record) {
-                const described = describeRecord(record, now);
-                sources.push({ source: "macos_keychain", status: described.status, reason: described.reason });
-                if (described.usable)
-                    found("macos_keychain");
+            return payload && typeof payload === "object" ? oauthRecord(payload.claudeAiOauth) : null;
+        };
+        const scoped = username ? readKeychain(username) : null;
+        const scopedRecord = scoped ? recordOf(scoped) : null;
+        let read;
+        let record;
+        if (scoped && scopedRecord) {
+            read = scoped;
+            record = scopedRecord;
+        }
+        else {
+            const any = readKeychain();
+            const anyRecord = recordOf(any);
+            if (anyRecord || !scoped || scoped.code !== 0) {
+                read = any;
+                record = anyRecord;
             }
             else {
-                sources.push({ source: "macos_keychain", status: "missing", reason: "keychain item has no claudeAiOauth access token" });
+                read = scoped;
+                record = null;
             }
         }
+        if (read.code !== 0) {
+            const detail = read.stderr.replace(/\s+/g, " ").trim().slice(0, 200) || `exit ${read.code}`;
+            sources.push({ source: "macos_keychain", status: "missing", reason: `no readable '${CLAUDE_KEYCHAIN_SERVICE}' item (${detail})` });
+        }
+        else if (record) {
+            const described = describeRecord(record, now);
+            sources.push({ source: "macos_keychain", status: described.status, reason: described.reason });
+            if (described.usable)
+                found("macos_keychain");
+        }
+        else {
+            sources.push({ source: "macos_keychain", status: "missing", reason: "keychain item has no claudeAiOauth access token" });
+        }
     }
     return { signedIn: via !== null, via, sources };
 }

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -140,8 +140,10 @@ export type WriteClaudeCredentials = (request: WriteClaudeCredentialsRequest) =>
  *   way). The gate treats this as proof the account is already signed out and
  *   records revoked without hitting the token endpoint.
  * - `home` is the resolved per-host provider home for the account; the gate
- *   compares it to the home being refreshed with `path.resolve` so symlinks
- *   do not slip through. `null` is accepted only when the row is not live.
+ *   compares it to the home being refreshed with `canonicalHomePath` (realpath,
+ *   lower case on darwin) so symlinks and case differences do not slip through;
+ *   a home that cannot be resolved blocks. `null` is accepted only when the row
+ *   is not live.
  */
 export interface LiveLane {
     home: string | null;
@@ -164,8 +166,13 @@ export type ListLiveLanes = () => Promise<readonly LiveLane[]>;
  */
 export interface ClaudeProcess {
     pid: number;
+    /**
+     * `HOME` is set when the probe read it. Claude Code resolves its default config dir as
+     * HOME/.claude, so a process with HOME set and no CLAUDE_CONFIG_DIR holds that dir.
+     */
     env: {
         CLAUDE_CONFIG_DIR?: string;
+        HOME?: string;
     };
     probe: "env" | "command-only";
 }
@@ -245,7 +252,7 @@ export declare function mapClaudeOAuthUsage(body: unknown, options: MapOptions):
     readings: ReadingInput[];
     failures: ParserFailureEvent[];
 };
-export declare function collectClaudeOAuth(options?: CollectClaudeOAuthOptions): Promise<ClaudeOAuthCollectResult>;
+export declare function collectClaudeOAuth(inputOptions?: CollectClaudeOAuthOptions): Promise<ClaudeOAuthCollectResult>;
 /**
  * Ledger account id → hashed profile account id. Rows with no captured
  * identity are omitted. The raw uuid is never returned.
@@ -349,11 +356,16 @@ export declare function resolveHqInvocation(argv?: readonly string[], execPath?:
     command: string;
     args: string[];
 };
-/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+/**
+ * Run `hq ... --json` and parse stdout. Async on purpose: the collector runs inside the mesh
+ * daemon, and a synchronous read that takes 15-30 s on a loaded machine froze the daemon's
+ * event loop (MQTT keepalive, owner heartbeat) for the whole read.
+ * Exported for tests; `invocation` defaults to {@link resolveHqInvocation}.
+ */
 export declare function execHqJson(args: readonly string[], invocation?: {
     command: string;
     args: string[];
-}, env?: NodeJS.ProcessEnv): unknown;
+}, env?: NodeJS.ProcessEnv): Promise<unknown>;
 /**
  * Parse `hq lanes list --json` payload into typed rows.
  * Exported for tests; fail-closed semantics live in defaultListLiveLanes.
@@ -369,12 +381,48 @@ export declare function parseAccountsListPayload(payload: unknown): readonly Raw
  * Exported for tests.
  */
 export declare function buildLiveLanesFromPayloads(lanes: readonly RawLaneRow[], accounts: readonly RawAccountRow[]): readonly LiveLane[];
+/**
+ * Share one lane read across every home in a collect. Without this each expired home ran its
+ * own pair of `hq lanes ... --json` reads, so one slow machine turned into N timeouts per
+ * collect. A failure is shared too: the next home fails closed without waiting again.
+ * Exported for tests.
+ */
+export declare function memoizeListLiveLanes(list: ListLiveLanes): ListLiveLanes;
 /**
  * Parse `ps -axo pid=,command=` into rows that mention the `claude` executable.
  * Exported for tests. Returned rows carry `probe: "command-only"` so the gate
  * knows it cannot read per-process CLAUDE_CONFIG_DIR on darwin.
  */
 export declare function parsePsClaudeOutput(stdout: string): readonly ClaudeProcess[];
+/** Pid to full command line, from `ps -ww -o pid=,command= -p <pids>`. Exported for tests. */
+export declare function parsePsCommandLines(stdout: string): ReadonlyMap<number, string>;
+export interface PsEnvProbeOptions {
+    isDirectory?: (dir: string) => boolean;
+    /** False only when the pid is known to be gone (ESRCH). Unknown counts as alive. */
+    isAlive?: (pid: number) => boolean;
+}
+/**
+ * Upgrade darwin command-only rows with each process's environment. `ps -wwE` prints a
+ * same-user process's command line followed by its environment, unquoted and space separated.
+ * Only the text after the exact command line (read separately with `ps -ww`) is treated as the
+ * environment, so a prompt argument that mentions CLAUDE_CONFIG_DIR= or HOME= is never read as
+ * env. A row becomes `probe: "env"` only when:
+ *   - the `-E` line starts with the command line plus a space, and the rest starts with NAME=;
+ *   - CLAUDE_CONFIG_DIR= appears at most once in that rest, and its value is absolute and
+ *     names an existing directory (the value runs to the next ` NAME=` or the end of line).
+ * Anything else stays command-only, which blocks every home. A pid missing from the output
+ * is dropped only when it is known to have exited; otherwise it stays command-only.
+ * Exported for tests.
+ */
+export declare function parsePsEnvOutput(envStdout: string, commandLines: ReadonlyMap<number, string>, rows: readonly ClaudeProcess[], options?: PsEnvProbeOptions): readonly ClaudeProcess[];
+/** Default config dir of an env-probed process with CLAUDE_CONFIG_DIR unset. Exported for tests. */
+export declare function processDefaultConfigDir(proc: ClaudeProcess): string;
+/**
+ * Canonical form of a home directory for comparison: symlinks resolved by the OS, and lower
+ * case on darwin, where APFS is case-insensitive by default. Null when the path cannot be
+ * resolved. Exported for tests.
+ */
+export declare function canonicalHomePath(dir: string, platform?: NodeJS.Platform): string | null;
 export interface ClaudeTokenRefreshResult {
     outcome: "refreshed" | "revoked" | "error" | "skipped-race" | "skipped-live" | "skipped-live-check-failed" | "skipped-process" | "skipped-process-check-failed" | "skipped-backoff" | "skipped-revoked";
     newAccessToken?: string;