@indigoai-us/hq-cli 5.345.21 → 5.345.23

package/CHANGELOG.md

@@ -2,7 +2,16 @@
 
 ## [Unreleased]
 
+## [5.345.23] — 2026-10-06
+- Route eight additional isolated native core commands through the fast CLI entry.
+- hqd applies the runtime kill switch to new hook and MCP operations within the existing 60-second freshness bound. A local opt-out also disables the daemon, while a local opt-in cannot override an operator-off value.
+
+## [5.345.22] — 2026-10-06
+- Fix Claude quota holds so time-only reset messages keep accounts unavailable until the provider's stated UTC reset, and expose the hold state in host capacity output.
+
 ## [5.345.21] — 2026-10-06
+- `hq sync push --personal <path>` now waits up to 500 ms for the startup flag registry snapshot before evaluating `cli.personal-targeted-push-paths`, while preserving the legacy refusal when the registry is unavailable.
+
 - Hook timeout reports now show elapsed time against the configured budget and include available phase and hook attribution.
 - Reconcile hire-grant carve accounting across resume, reparent and grant updates; decreases no longer fail because sibling grants exceed the senior allocation.
 - Route eligible Linux pull-request checks and local release guards through the registered ARM64 self-hosted runner. Keep the shared npm/OIDC publish job on its existing runner.

package/dist/commands/cloud.js

@@ -840,7 +840,7 @@ export function registerCloudCommands(program) {
                     "to have already resolved entity + credentials. Pick one.");
             }
             // Closes hq-cli#25 — see `assertNoPersonalPositionalPaths` doc-block.
-            const targetedPersonalPathsEnabled = Boolean(options.personal && paths && paths.length > 0 && personalTargetedPushPathsEnabled());
+            const targetedPersonalPathsEnabled = Boolean(options.personal && paths && paths.length > 0 && await personalTargetedPushPathsEnabled());
             assertNoPersonalPositionalPaths(options, paths, targetedPersonalPathsEnabled);
             if (targetedPersonalPathsEnabled) {
                 explicitPersonalPaths = resolveExplicitPersonalPushPaths(options.hqRoot, paths);

package/dist/commands/core-audit-log-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runAuditLogFast(args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-audit-log-fast.d.ts.map

package/dist/commands/core-audit-log-fast.js

@@ -0,0 +1,12 @@
+import { runAuditLog } from "./core-audit-log-native.js";
+export function runAuditLogFast(args, _stdin, _cwd, hqRoot) {
+    const result = runAuditLog(args, { root: hqRoot ?? process.cwd(), now: () => new Date() });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-audit-log-fast.js.map

package/dist/commands/core-detect-stale-core-policy-mirror-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDetectStaleCorePolicyMirrorFast(args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-detect-stale-core-policy-mirror-fast.d.ts.map

package/dist/commands/core-detect-stale-core-policy-mirror-fast.js

@@ -0,0 +1,5 @@
+import { detectStaleCorePolicyMirror } from "../lib/core-utils/detect-stale-core-policy-mirror.js";
+export function runDetectStaleCorePolicyMirrorFast(args, _stdin, _cwd, hqRoot) {
+    return detectStaleCorePolicyMirror(args, { root: hqRoot ?? process.cwd() });
+}
+//# sourceMappingURL=core-detect-stale-core-policy-mirror-fast.js.map

package/dist/commands/core-dm-bind-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDmBindFast(args: string[], stdin: string, cwd: string, hqRoot?: string): Promise<number>;
+//# sourceMappingURL=core-dm-bind-fast.d.ts.map

package/dist/commands/core-dm-bind-fast.js

@@ -0,0 +1,14 @@
+import { createDmBindDeps, runDmBind } from "./core-dm-bind-native.js";
+export async function runDmBindFast(args, stdin, cwd, hqRoot) {
+    const deps = createDmBindDeps(hqRoot ?? cwd, cwd, process.env, () => new Date());
+    deps.readStdin = async () => stdin;
+    const result = await runDmBind(args, deps);
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-dm-bind-fast.js.map

package/dist/commands/core-generate-workers-registry-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runGenerateWorkersRegistryFast(_args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-generate-workers-registry-fast.d.ts.map

package/dist/commands/core-generate-workers-registry-fast.js

@@ -0,0 +1,5 @@
+import { generateWorkersRegistry } from "../lib/workers-registry/index.js";
+export function runGenerateWorkersRegistryFast(_args, _stdin, _cwd, hqRoot) {
+    return generateWorkersRegistry(hqRoot ?? process.cwd()).status;
+}
+//# sourceMappingURL=core-generate-workers-registry-fast.js.map

package/dist/commands/core-git-pack-extension-check-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runGitPackExtensionCheckFast(args: string[], _stdin: string, cwd: string): number;
+//# sourceMappingURL=core-git-pack-extension-check-fast.d.ts.map

package/dist/commands/core-git-pack-extension-check-fast.js

@@ -0,0 +1,12 @@
+import { runGitPackExtensionCheck } from "./core-git-pack-extension-check-native.js";
+export function runGitPackExtensionCheckFast(args, _stdin, cwd) {
+    const result = runGitPackExtensionCheck(args, { cwd, env: process.env });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-git-pack-extension-check-fast.js.map

package/dist/commands/core-refresh-vault-access-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runRefreshVaultAccessFast(args: string[], _stdin: string, cwd: string): number;
+//# sourceMappingURL=core-refresh-vault-access-fast.d.ts.map

package/dist/commands/core-refresh-vault-access-fast.js

@@ -0,0 +1,12 @@
+import { createRefreshVaultAccessDependencies, runRefreshVaultAccess } from "./core-refresh-vault-access-native.js";
+export function runRefreshVaultAccessFast(args, _stdin, cwd) {
+    const result = runRefreshVaultAccess(args, createRefreshVaultAccessDependencies(cwd, process.env, () => new Date()));
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-refresh-vault-access-fast.js.map

package/dist/commands/core-refresh-vault-access-native.d.ts

@@ -15,6 +15,7 @@ export type RefreshVaultAccessDependencies = {
     hqAvailable: boolean;
     runHq?: (args: string[], cwd: string) => HqResult;
 };
+export declare function createRefreshVaultAccessDependencies(cwd: string, env: NodeJS.ProcessEnv, now: () => Date): RefreshVaultAccessDependencies;
 export declare function runRefreshVaultAccess(args: string[], deps: RefreshVaultAccessDependencies): UtilityOutput;
 export declare function registerCoreRefreshVaultAccessNative(core: Command): void;
 //# sourceMappingURL=core-refresh-vault-access-native.d.ts.map

package/dist/commands/core-refresh-vault-access-native.js

@@ -59,6 +59,15 @@ function executableOnPath(name, value) {
     }
     return false;
 }
+export function createRefreshVaultAccessDependencies(cwd, env, now) {
+    return {
+        cwd,
+        env,
+        now,
+        hqAvailable: executableOnPath("hq", env.PATH),
+        runHq: (args, directory) => defaultHq(args, directory, env),
+    };
+}
 function isHqRoot(root) {
     const candidate = root.endsWith(path.sep) ? root.slice(0, -1) : root;
     if (!candidate)
@@ -219,11 +228,7 @@ export function registerCoreRefreshVaultAccessNative(core) {
     registerNativeUtility(core, {
         name: "refresh-vault-access", asset: REFRESH_VAULT_ACCESS_ASSET, root: "cwd", summary: "Refresh the local vault access manifest",
         resolveRoot: (cwd) => cwd,
-        run: (args, context) => runRefreshVaultAccess(args, {
-            cwd: context.cwd, env: context.env, now: context.now,
-            hqAvailable: executableOnPath("hq", context.env.PATH),
-            runHq: (args, cwd) => defaultHq(args, cwd, context.env),
-        }),
+        run: (args, context) => runRefreshVaultAccess(args, createRefreshVaultAccessDependencies(context.cwd, context.env, context.now)),
     });
 }
 //# sourceMappingURL=core-refresh-vault-access-native.js.map

package/dist/commands/core-scan-packages-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runScanPackagesFast(_args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-scan-packages-fast.d.ts.map

package/dist/commands/core-scan-packages-fast.js

@@ -0,0 +1,5 @@
+import { scanPackages } from "../lib/scan-packages/index.js";
+export function runScanPackagesFast(_args, _stdin, _cwd, hqRoot) {
+    return scanPackages(hqRoot ?? process.cwd(), { quiet: process.env.HQ_SCAN_QUIET === "1" }).status;
+}
+//# sourceMappingURL=core-scan-packages-fast.js.map

package/dist/commands/core-work-mesh-bind-trusted-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runWorkMeshBindTrustedFast(args: string[], _stdin: string, cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-work-mesh-bind-trusted-fast.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-fast.js

@@ -0,0 +1,12 @@
+import { createWorkMeshBindDeps, runWorkMeshBindTrusted } from "./core-work-mesh-bind-trusted-native.js";
+export function runWorkMeshBindTrustedFast(args, _stdin, cwd, hqRoot) {
+    const result = runWorkMeshBindTrusted(args, createWorkMeshBindDeps(hqRoot ?? cwd, cwd, process.env, () => new Date()));
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-work-mesh-bind-trusted-fast.js.map

package/dist/commands/lanes.js

@@ -5306,6 +5306,7 @@ async function runCapacity(ctx) {
         env: ctx.env,
         hostname: ctx.hostname(),
         now: ctx.now(),
+        quotaState: loadQuotaState(hqRoot),
     });
     printJson({
         ...snapshot,

package/dist/commands/personal-targeted-push-flag.d.ts

@@ -1,4 +1,4 @@
 export declare const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
 /** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
-export declare function personalTargetedPushPathsEnabled(): boolean;
+export declare function personalTargetedPushPathsEnabled(): Promise<boolean>;
 //# sourceMappingURL=personal-targeted-push-flag.d.ts.map

package/dist/commands/personal-targeted-push-flag.js

@@ -1,7 +1,11 @@
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+import { resolveProcessFlagGate, waitForFlagRegistryRefresh, } from "../lib/flag-registry.js";
 export const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
 /** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
-export function personalTargetedPushPathsEnabled() {
+export async function personalTargetedPushPathsEnabled() {
+    // This command reads the gate immediately after startup. Give the existing
+    // unref'd registry worker one bounded window to publish its company snapshot.
+    // An unavailable registry leaves resolveProcessFlagGate on the legacy false.
+    await waitForFlagRegistryRefresh(500);
     return resolveProcessFlagGate(CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG, { fallback: false }, () => false);
 }
 //# sourceMappingURL=personal-targeted-push-flag.js.map

package/dist/fast-core.js

@@ -65,7 +65,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         worktreeScopeFixEnabled = await coreRrrWorktreeScopeFixFastFlagEnabled(process.env);
     }
     const shouldInjectRoot = useShell
-        ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
+        ? entry.shellHqRoot === "cwd" || entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
             !parsed.args.includes("--hq-root") && !parsed.args.includes("--help") && !parsed.args.includes("-h"))
         : entry.kind === "shell"
             ? true
@@ -76,7 +76,10 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     // its expected-user-error formatting remains authoritative.
     let hqRoot;
     const rootResolutionStartedAt = profileMark();
-    if (shouldInjectRoot) {
+    if (useShell && entry.kind === "native" && entry.shellHqRoot === "cwd") {
+        hqRoot = process.cwd();
+    }
+    else if (shouldInjectRoot) {
         const shortcutRoot = entry.name === "checkpoint-stop-gate" || entry.name === "session-journal"
             ? resolveExplicitFastLiveRoot(parsed.hqRootArg, process.env)
             : undefined;
@@ -146,7 +149,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         ? hqRoot ?? process.cwd()
         : process.cwd();
     const injectRoot = entry.kind === "shell" || entry.kind === "native" &&
-        (entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
+        (entry.shellHqRoot === "cwd" || entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
     const childEnv = {
         ...(entry.name === "hq-session" ? { HQ_HQ_SESSION_NO_CLI: "1" } : {}),
         ...(entry.name === "migrate-policy-triggers"

package/dist/fast-scaffold.d.ts

@@ -39,7 +39,7 @@ export type FastScaffoldScript = {
     /** Cwd used for a shell rollback companion. Defaults to the caller cwd. */
     shellCwd?: "caller" | "live";
     /** Root injection behavior for a shell rollback companion. */
-    shellHqRoot?: "none" | "live" | "reconcile-default";
+    shellHqRoot?: "none" | "cwd" | "live" | "reconcile-default";
     /** Whether this handler consumes stdin. Shell companions inherit stdin directly. */
     readsStdin?: boolean;
     /** Bound bytes buffered from stdin; overflow is treated as empty input. */

package/dist/fast-scaffold.js

@@ -432,6 +432,107 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         shellCwd: "caller",
         shellHqRoot: name === "source-yaml-validate" ? "none" : "live",
     })),
+    {
+        name: "audit-log",
+        kind: "native",
+        modulePath: "./commands/core-audit-log-fast.js",
+        exportName: "runAuditLogFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/audit-log.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
+    {
+        name: "refresh-vault-access",
+        kind: "native",
+        modulePath: "./commands/core-refresh-vault-access-fast.js",
+        exportName: "runRefreshVaultAccessFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/refresh-vault-access.sh",
+        root: "cwd",
+        shellCwd: "caller",
+        shellHqRoot: "cwd",
+    },
+    {
+        name: "generate-workers-registry",
+        kind: "native",
+        modulePath: "./commands/core-generate-workers-registry-fast.js",
+        exportName: "runGenerateWorkersRegistryFast",
+        flagKey: "hq-core-native-fast-route",
+        root: "live",
+        asset: "core/scripts/generate-workers-registry.sh",
+    },
+    {
+        name: "dm-bind",
+        kind: "native",
+        modulePath: "./commands/core-dm-bind-fast.js",
+        exportName: "runDmBindFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/hq-dm-bind.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+        readsStdinFor: (args) => {
+            if (args[0] !== "post")
+                return false;
+            const valueOptions = new Set(["--topic", "--under", "--to", "--title", "--state", "--line", "--next", "--ask"]);
+            for (let index = 1; index < args.length; index += 1) {
+                if (args[index] === "-")
+                    return true;
+                if (valueOptions.has(args[index] ?? ""))
+                    index += 1;
+            }
+            return false;
+        },
+        requiresNodeNetworkCompatibility: true,
+    },
+    {
+        name: "git-pack-extension-check",
+        kind: "native",
+        modulePath: "./commands/core-git-pack-extension-check-fast.js",
+        exportName: "runGitPackExtensionCheckFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/git-pack-extension-check.sh",
+        root: "cwd",
+        shellCwd: "caller",
+        shellHqRoot: "cwd",
+    },
+    {
+        name: "scan-packages",
+        kind: "native",
+        modulePath: "./commands/core-scan-packages-fast.js",
+        exportName: "runScanPackagesFast",
+        flagKey: "hq-core-native-fast-route",
+        asset: "core/scripts/scan-packages.sh",
+        root: "live",
+    },
+    {
+        name: "detect-stale-core-policy-mirror",
+        kind: "native",
+        modulePath: "./commands/core-detect-stale-core-policy-mirror-fast.js",
+        exportName: "runDetectStaleCorePolicyMirrorFast",
+        flagKey: "hq-core-native-fast-route",
+        asset: "core/scripts/detect-stale-core-policy-mirror.sh",
+        root: "live",
+    },
+    {
+        name: "work-mesh-bind-trusted",
+        kind: "native",
+        modulePath: "./commands/core-work-mesh-bind-trusted-fast.js",
+        exportName: "runWorkMeshBindTrustedFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/work-mesh-live-bind-trusted.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+        requiresNodeNetworkCompatibility: true,
+    },
 ];
 /**
  * Parse the small, non-ambiguous `hq secrets env` surface for the gated entry

package/dist/lib/daemon/flag.d.ts

@@ -17,6 +17,8 @@ export interface DaemonFlagClient {
 }
 export interface ReadDaemonFlagOptions {
     env?: NodeJS.ProcessEnv;
+    /** Controls how this read combines a local person setting with the registry value. */
+    localOverrideMode?: "respect" | "off-only" | "ignore";
     createClient?: (options: FlagClientOptions) => DaemonFlagClient;
     getToken?: () => Promise<string>;
     onError?: (error: unknown) => void;

package/dist/lib/daemon/flag.js

@@ -15,7 +15,8 @@ const READ_TIMEOUT_MS = 5_000;
 export async function readDaemonFlag(flagKey, options = {}) {
     const env = options.env ?? process.env;
     const override = readLocalOverride(flagKey, env);
-    if (override !== null)
+    const localOverrideMode = options.localOverrideMode ?? "respect";
+    if (override !== null && (localOverrideMode === "respect" || (localOverrideMode === "off-only" && !override)))
         return override;
     let failed = false;
     let reportedError;

package/dist/lib/daemon/server.d.ts

@@ -12,6 +12,7 @@ import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
 import { type StdinMachineCredentials } from "./machine-login.js";
+import { type ReadDaemonFlagOptions } from "./flag.js";
 import { type WindowsPipeAclReport, type WindowsPipeHost } from "./windows-pipe-host.js";
 export interface HqdServerOptions {
     socketPath: string;
@@ -41,7 +42,7 @@ export interface HqdServerOptions {
     /** Test seam for the hq-anywhere-runtime default-off gate. */
     mcpEnabled?: () => boolean | Promise<boolean>;
     /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
-    runtimeFlagReader?: () => Promise<boolean>;
+    runtimeFlagReader?: (options: ReadDaemonFlagOptions) => Promise<boolean>;
     /** Test seam for the hosted Streamable HTTP MCP transport. */
     mcpBridge?: HqMcpBridge;
     /** Test seam for machine login while keeping production credentials off disk. */

package/dist/lib/daemon/server.js

@@ -396,14 +396,22 @@ export async function startHqdServer(opts) {
         }
     }
     const runtimeFlagMonitor = opts.mcpEnabled ? undefined : createBoundedDaemonFlagMonitor({
-        read: opts.runtimeFlagReader ?? (() => readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, {
-            env,
-            throwOnError: true,
-        })),
+        read: () => {
+            const options = {
+                env,
+                throwOnError: true,
+                // A local opt-out is honored, while a local opt-in cannot override the operator kill switch.
+                localOverrideMode: "off-only",
+            };
+            return opts.runtimeFlagReader
+                ? opts.runtimeFlagReader(options)
+                : readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, options);
+        },
         onChange: (enabled) => {
             if (!enabled) {
                 flagRevocationGeneration += 1;
                 ephemeralMachineToken = undefined;
+                sessions.clear();
             }
         },
         onReadError: (error) => {
@@ -426,8 +434,22 @@ export async function startHqdServer(opts) {
             socket: healthSocket(socketPath, isPipe),
         };
     };
-    /** Synchronous ops answer in request order; policy.check and mcp.call may return a promise. */
+    const alwaysAvailableOps = new Set(["ping", "health", "auth.status", "shutdown"]);
+    const allowedWhileDisabled = new Set(["session.get", "session.close"]);
+    /** Gate each external hqd request once, leaving diagnostics and cleanup available while disabled. */
     const handle = (req) => {
+        const requestStartedAt = Date.now();
+        if (alwaysAvailableOps.has(req.op))
+            return dispatch(req, requestStartedAt);
+        return Promise.resolve(mcpEnabled()).then((enabled) => {
+            if (!enabled && !allowedWhileDisabled.has(req.op)) {
+                throw new OpError("anywhere_disabled", `HQ Anywhere is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+            }
+            return dispatch(req, requestStartedAt);
+        });
+    };
+    /** Internal MCP sub-operations reuse the already-gated external request. */
+    const dispatch = (req, requestStartedAt = Date.now()) => {
         const args = req.args ?? {};
         switch (req.op) {
             case "ping":
@@ -565,7 +587,6 @@ export async function startHqdServer(opts) {
                 }, { hqRoot: opts.hqRoot, workMeshRoot: opts.workMeshRoot, env, now: clock });
             }
             case "mcp.call": {
-                const requestStartedAt = Date.now();
                 const name = stringArg(args, "name");
                 const raw = args.arguments ?? {};
                 if (raw === null || typeof raw !== "object" || Array.isArray(raw))
@@ -581,7 +602,7 @@ export async function startHqdServer(opts) {
                     companyArgs.runtime = runtime;
                 if (sessionId !== undefined)
                     companyArgs.sessionId = sessionId;
-                const call = (op, a) => handle({ id: req.id, op, args: a });
+                const call = (op, a) => dispatch({ id: req.id, op, args: a });
                 const asResult = (value) => (value instanceof Promise ? value.then(jsonResult) : jsonResult(value));
                 const policyGuardedCall = (run) => {
                     const company = companyFor(companyArgs);
@@ -601,7 +622,11 @@ export async function startHqdServer(opts) {
                             const reason = Array.isArray(decision.reasons) ? decision.reasons.filter((r) => typeof r === "string").join("; ") : "policy check did not allow this tool";
                             throw new OpError("policy_blocked", reason || "policy check did not allow this tool");
                         }
-                        return run();
+                        return Promise.resolve(mcpEnabled()).then((enabled) => {
+                            if (!enabled)
+                                throw new OpError("anywhere_disabled", `HQ Anywhere is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                            return run();
+                        });
                     });
                 };
                 switch (name) {
@@ -628,10 +653,7 @@ export async function startHqdServer(opts) {
                             ? Math.max(1, Math.min(args.timeoutMs, 120_000))
                             : HQD_DEFAULT_REQUEST_TIMEOUT_MS;
                         const deadline = requestStartedAt + timeoutMs;
-                        const forward = () => Promise.resolve(mcpEnabled()).then((enabled) => {
-                            if (!enabled) {
-                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
-                            }
+                        const forward = () => {
                             const remainingMs = Math.floor(deadline - Date.now());
                             if (remainingMs <= 0) {
                                 throw new McpOpError("hq_mcp_timeout", `Hosted hq-mcp request exceeded its ${timeoutMs}ms end-to-end deadline before forwarding.`);
@@ -650,15 +672,10 @@ export async function startHqdServer(opts) {
                                 },
                             });
                             return hqMcp.callTool(name, raw, remainingMs);
-                        });
-                        return Promise.resolve(mcpEnabled()).then((enabled) => {
-                            if (!enabled) {
-                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
-                            }
-                            return !MCP_READ_ONLY_TOOL_NAMES.has(name)
-                                ? policyGuardedCall(forward)
-                                : forward();
-                        });
+                        };
+                        return !MCP_READ_ONLY_TOOL_NAMES.has(name)
+                            ? policyGuardedCall(forward)
+                            : forward();
                     }
                 }
             }

package/dist/lib/daemon/session-registry.d.ts

@@ -24,6 +24,7 @@ export declare class SessionRegistry {
     }): HqdSession;
     get(runtime: string, sessionId: string): HqdSession | null;
     close(runtime: string, sessionId: string): boolean;
+    clear(): void;
     list(): HqdSession[];
     get size(): number;
 }

package/dist/lib/daemon/session-registry.js

@@ -32,6 +32,9 @@ export class SessionRegistry {
     close(runtime, sessionId) {
         return this.sessions.delete(sessionKey(runtime, sessionId));
     }
+    clear() {
+        this.sessions.clear();
+    }
     list() {
         return [...this.sessions.values()];
     }

package/dist/lib/lanes/host-capacity.d.ts

@@ -1,4 +1,5 @@
 import { type AuthState } from "./accounts.js";
+import { type QuotaState } from "./quota.js";
 import type { LaneHost, LaneProvider, LaneRecord, LanesConfig } from "./types.js";
 export interface HostCapacityAccount {
     enabled: boolean;
@@ -8,6 +9,9 @@ export interface HostCapacityAccount {
     max_running: number;
     running: number;
     queued: number;
+    /** Account-wide quota status when this snapshot is produced on its host. */
+    quota_held?: boolean;
+    quota_reset_at?: string;
     /** Exact lane states used for Claude account balancing; absent on older Outposts. */
     lane_counts?: {
         running: number;
@@ -54,6 +58,7 @@ export declare function buildHostCapacitySnapshot(input: {
     env?: NodeJS.ProcessEnv;
     hostname?: string;
     now: Date;
+    quotaState?: QuotaState;
 }): HostCapacitySnapshot;
 /** Reject malformed remote snapshots before they can influence host selection. */
 export declare function parseHostCapacitySnapshot(raw: unknown): HostCapacitySnapshot;

package/dist/lib/lanes/host-capacity.js

@@ -2,6 +2,7 @@ import { accountStatus } from "./accounts.js";
 import { accountMaxRunning } from "./config.js";
 import { laneOccupiesRunningSlot, laneRunsOnHost, } from "./admission.js";
 import { LanesError } from "./errors.js";
+import { quotaBlockFor } from "./quota.js";
 function admissionHost(host) {
     return host.kind === "outpost"
         ? { hostname: "", outpostId: host.id }
@@ -33,6 +34,10 @@ export function buildHostCapacitySnapshot(input) {
             });
             const accountLanes = providerLanes.filter((lane) => lane.account === id);
             const liveLanes = accountLanes.filter((lane) => lane.state === "running" || lane.state === "queued" || lane.state === "awaiting_input");
+            const quotaBlock = input.quotaState
+                ? quotaBlockFor(input.quotaState, provider, id, undefined, input.now)
+                : undefined;
+            const quotaResetAt = input.quotaState?.providers[provider]?.[id]?.all_models_quota_reset_at;
             accounts[id] = {
                 enabled: account.enabled,
                 logged_in: status.logged_in,
@@ -40,6 +45,12 @@ export function buildHostCapacitySnapshot(input) {
                 max_running: accountMaxRunning(providerConfig, id),
                 running: running.filter((lane) => lane.account === id).length,
                 queued: queued.filter((lane) => lane.account === id).length,
+                ...(quotaBlock !== undefined
+                    ? {
+                        quota_held: quotaBlock.blocked,
+                        ...(quotaResetAt ? { quota_reset_at: quotaResetAt } : {}),
+                    }
+                    : {}),
                 lane_counts: {
                     running: liveLanes.filter((lane) => lane.state === "running").length,
                     queued: liveLanes.filter((lane) => lane.state === "queued").length,
@@ -108,6 +119,9 @@ export function parseHostCapacitySnapshot(raw) {
             if (id.trim() === "" || account === undefined ||
                 typeof account.enabled !== "boolean" ||
                 !(account.logged_in === null || typeof account.logged_in === "boolean") ||
+                (account.quota_held !== undefined && typeof account.quota_held !== "boolean") ||
+                (account.quota_reset_at !== undefined &&
+                    (typeof account.quota_reset_at !== "string" || !Number.isFinite(Date.parse(account.quota_reset_at)))) ||
                 (account.auth_state !== undefined &&
                     !["file", "status", "absent", "unknown", "home_missing"].includes(account.auth_state))) {
                 throw new LanesError("host_capacity_invalid", `Malformed ${provider} account capacity`, {
@@ -124,6 +138,10 @@ export function parseHostCapacitySnapshot(raw) {
                 max_running: requireCount(account.max_running, `${provider}.${id}.max_running`, true),
                 running: requireCount(account.running, `${provider}.${id}.running`),
                 queued: requireCount(account.queued, `${provider}.${id}.queued`),
+                ...(account.quota_held !== undefined ? { quota_held: account.quota_held } : {}),
+                ...(account.quota_reset_at !== undefined
+                    ? { quota_reset_at: account.quota_reset_at }
+                    : {}),
                 ...(account.lane_counts !== undefined
                     ? { lane_counts: parseLaneCounts(account.lane_counts, `${provider}.${id}.lane_counts`) }
                     : {}),

package/dist/lib/lanes/provider-rejection.d.ts

@@ -36,6 +36,8 @@ export interface ProviderRejection {
     retryable: boolean;
     /** Which event on the stream carried the failure. */
     event: "codex.turn.failed" | "claude.result.is_error" | "claude.result.login_failure" | "grok.error";
+    /** Filesystem time when the provider output was appended, when read from worker.out. */
+    output_at?: string;
 }
 export declare function isProviderLoginFailure(failure: ProviderRejection | null): boolean;
 /**

package/dist/lib/lanes/provider-rejection.js

@@ -271,9 +271,21 @@ export function parseProviderRejection(provider, text) {
 export function readProviderRejection(runDir, provider, workerOutOffset = 0) {
     const outPath = path.join(runDir, "logs", "worker.out");
     let text;
+    let outputAt;
     try {
         const bytes = fs.readFileSync(outPath);
         text = bytes.subarray(Math.min(workerOutOffset, bytes.length)).toString("utf8");
+        const outputMtime = fs.statSync(outPath).mtime;
+        let spawnMtime;
+        try {
+            spawnMtime = fs.statSync(path.join(runDir, "spawn.json")).mtime;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (!spawnMtime || outputMtime >= spawnMtime)
+            outputAt = outputMtime.toISOString();
     }
     catch (err) {
         const code = err.code;
@@ -281,6 +293,9 @@ export function readProviderRejection(runDir, provider, workerOutOffset = 0) {
             return null;
         throw err;
     }
-    return parseProviderRejection(provider, text);
+    const failure = parseProviderRejection(provider, text);
+    return failure
+        ? { ...failure, ...(outputAt ? { output_at: outputAt } : {}) }
+        : null;
 }
 //# sourceMappingURL=provider-rejection.js.map

package/dist/lib/lanes/quota.d.ts

@@ -26,13 +26,13 @@ export interface ModelQuota {
     /** Operator-facing marker, e.g. "needs credits for claude-fable-5-1". */
     marker?: string;
 }
-export type QuotaResetSource = "provider" | "default_hold";
+export type QuotaResetSource = "parsed" | "derived";
 export interface AccountQuota {
     /** Set when the 429 is an account-wide usage limit with a reset time. */
     all_models_quota_reset_at?: string;
     /**
-     * Where `all_models_quota_reset_at` came from: the provider's own message,
-     * or the configured default hold applied to a 429 that named no reset.
+     * Whether `all_models_quota_reset_at` came from a parsed provider reset or
+     * the configured default hold applied to a 429 with no parseable reset.
      */
     reset_source?: QuotaResetSource;
     models: Record<string, ModelQuota>;
@@ -57,8 +57,8 @@ export interface QuotaSignal {
  * otherwise record no hold at all, and the next lane on the account would
  * hit the same 429. Give such a signal the provider's configured default
  * hold (`quota_default_hold_ms`, fifteen minutes unless set) as its reset,
- * marked `default_hold`; a signal that already carries a reset keeps it,
- * marked `provider`. A per-model credits refusal is untouched.
+ * marked `derived`; a signal that already carries a reset keeps it, marked
+ * `parsed`. A per-model credits refusal is untouched.
  */
 export declare function applyDefaultQuotaHold(signal: QuotaSignal, defaultHoldMs: number, now: Date): QuotaSignal;
 export declare function quotaStatePath(hqRoot: string): string;

package/dist/lib/lanes/quota.js

@@ -27,19 +27,19 @@ export const QUOTA_SCHEMA_VERSION = "hq-lanes-quota.v1";
  * otherwise record no hold at all, and the next lane on the account would
  * hit the same 429. Give such a signal the provider's configured default
  * hold (`quota_default_hold_ms`, fifteen minutes unless set) as its reset,
- * marked `default_hold`; a signal that already carries a reset keeps it,
- * marked `provider`. A per-model credits refusal is untouched.
+ * marked `derived`; a signal that already carries a reset keeps it, marked
+ * `parsed`. A per-model credits refusal is untouched.
  */
 export function applyDefaultQuotaHold(signal, defaultHoldMs, now) {
     if (signal.reason !== "account_quota_exhausted" || signal.needs_credits)
         return signal;
     if (signal.quota_reset_at)
-        return { ...signal, reset_source: "provider" };
+        return { ...signal, reset_source: "parsed" };
     return {
         ...signal,
         quota_reset_at: new Date(now.getTime() + defaultHoldMs).toISOString(),
         account_wide: true,
-        reset_source: "default_hold",
+        reset_source: "derived",
     };
 }
 const MONTHS = {
@@ -119,8 +119,13 @@ export function loadQuotaState(hqRoot) {
             if (typeof raw.all_models_quota_reset_at === "string" &&
                 raw.all_models_quota_reset_at.length > 0) {
                 account.all_models_quota_reset_at = raw.all_models_quota_reset_at;
-                if (raw.reset_source === "provider" || raw.reset_source === "default_hold") {
-                    account.reset_source = raw.reset_source;
+                // Normalize values written by older CLI versions while preserving the
+                // distinction between provider-parsed and configured fallback times.
+                if (raw.reset_source === "provider" || raw.reset_source === "parsed") {
+                    account.reset_source = "parsed";
+                }
+                else if (raw.reset_source === "default_hold" || raw.reset_source === "derived") {
+                    account.reset_source = "derived";
                 }
             }
             accounts[id] = account;
@@ -145,6 +150,22 @@ function writeQuotaState(hqRoot, state) {
  * An explicit provider year is kept as stated.
  */
 export function parseProviderResetTime(text, now) {
+    const timeOnlyMatch = /\bresets\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(UTC\)/i.exec(text);
+    if (timeOnlyMatch) {
+        let hour = Number(timeOnlyMatch[1]);
+        const minute = Number(timeOnlyMatch[2] ?? 0);
+        const meridiem = (timeOnlyMatch[3] ?? "").toLowerCase();
+        if (!Number.isInteger(hour) || hour < 1 || hour > 12 || minute < 0 || minute > 59)
+            return null;
+        if (meridiem === "pm" && hour < 12)
+            hour += 12;
+        if (meridiem === "am" && hour === 12)
+            hour = 0;
+        const candidate = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), hour, minute, 0, 0));
+        if (candidate.getTime() <= now.getTime())
+            candidate.setUTCDate(candidate.getUTCDate() + 1);
+        return candidate.toISOString();
+    }
     const resetMatch = /\bresets\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?(?:,\s*(?:(\d{4})\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm))?(?:\s*\((UTC)\))?/i.exec(text);
     const codexMatch = /\btry\s+again\s+at\s+([A-Za-z]+)\s+(\d{1,2})(?:st|nd|rd|th)?,\s*(\d{4})\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\((UTC)\))?/i.exec(text);
     const match = resetMatch ?? codexMatch;
@@ -263,9 +284,23 @@ export function quotaSignalFromFields(fields, model, now) {
 export function readQuotaSignal(runDir, model, now, workerOutOffset = 0) {
     const outPath = path.join(runDir, "logs", "worker.out");
     let text;
+    let outputAt;
     try {
         const bytes = fs.readFileSync(outPath);
         text = bytes.subarray(Math.min(workerOutOffset, bytes.length)).toString("utf8");
+        // worker.out is appended as provider output arrives. Its mtime anchors a
+        // time-only reset to the output event, not to a later reconcile pass.
+        outputAt = fs.statSync(outPath).mtime;
+        let spawnAt;
+        try {
+            spawnAt = fs.statSync(path.join(runDir, "spawn.json")).mtime;
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        if (outputAt > now || (spawnAt && outputAt < spawnAt))
+            outputAt = now;
     }
     catch (err) {
         const code = err.code;
@@ -276,7 +311,8 @@ export function readQuotaSignal(runDir, model, now, workerOutOffset = 0) {
     const fields = quotaFieldsFromOutput(text);
     if (!fields)
         return null;
-    return quotaSignalFromFields(fields, model, now);
+    const observedAt = Number.isFinite(outputAt.getTime()) ? outputAt : now;
+    return quotaSignalFromFields(fields, model, observedAt);
 }
 export function recordAccountQuota(hqRoot, provider, accountId, signal) {
     return withLaneRecordFileLock(quotaStatePath(hqRoot), () => {
@@ -303,11 +339,11 @@ export function recordAccountQuota(hqRoot, provider, accountId, signal) {
         if (signal.account_wide && signal.quota_reset_at) {
             if (shouldReplaceReset(current.all_models_quota_reset_at, signal.quota_reset_at)) {
                 account.all_models_quota_reset_at = signal.quota_reset_at;
-                account.reset_source = signal.reset_source ?? "provider";
+                account.reset_source = signal.reset_source ?? "parsed";
             }
             else if (current.all_models_quota_reset_at) {
                 account.all_models_quota_reset_at = current.all_models_quota_reset_at;
-                account.reset_source = current.reset_source ?? "provider";
+                account.reset_source = current.reset_source ?? "parsed";
             }
         }
         accounts[accountId] = account;

package/dist/lib/lanes/spawn.d.ts

@@ -19,7 +19,7 @@ import { type LaneCompanyRef, type LaneProvider, type LaneRecord, type AccountHi
 export declare const LANES_RUNS_REL: string;
 /** Written by reconcile before a resume spawn; the worker prompt names this path. */
 export declare const ANSWERED_QUESTIONS_FILE = "answered-questions.json";
-export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed", "model_unsupported"];
+export declare const SPAWN_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "no_enabled_account", "spawn_failed", "not_detached", "watcher_not_armed", "model_unsupported", "account_quota_exhausted"];
 export type SpawnTerminalReason = (typeof SPAWN_TERMINAL_REASONS)[number];
 declare const PROVIDER_COMMAND: Record<LaneProvider, string>;
 export declare function providerCommandOnPath(command: string, pathEnv: string | undefined): boolean;

package/dist/lib/lanes/spawn.js

@@ -50,6 +50,7 @@ export const SPAWN_TERMINAL_REASONS = [
     "not_detached",
     "watcher_not_armed",
     "model_unsupported",
+    "account_quota_exhausted",
 ];
 const PROVIDER_COMMAND = {
     claude: "claude",

package/dist/lib/lanes/watcher.d.ts

@@ -108,18 +108,6 @@ export declare function classifyLaneExit(input: {
      */
     providerRejection?: ProviderRejection | null;
 }): TerminalClassification;
-/**
- * One decision for an exited worker's output. An explicit provider status
- * wins over the quota text heuristics: a 429 from any provider (including
- * codex `turn.failed` and grok error objects, which the claude-shaped quota
- * reader never sees) becomes a quota signal; any other explicit status is a
- * rejection even when its text sounds like a quota message (a 402 "requires
- * usage credits" is a rejection, not a hold). A failure with no status at
- * all is matched against the quota text heuristics first: a status-less
- * "usage limit" / "rate limit" turn.failed still creates the account hold;
- * any other status-less message is a rejection. Only when the stream
- * carries no failure object does the quota reader's own read apply.
- */
 export declare function routeProviderFailure(failure: ProviderRejection | null, readQuota: () => QuotaSignal | null, model: string | undefined, now: Date): {
     quota: QuotaSignal | null;
     rejection: ProviderRejection | null;

package/dist/lib/lanes/watcher.js

@@ -139,15 +139,21 @@ export function classifyLaneExit(input) {
  * any other status-less message is a rejection. Only when the stream
  * carries no failure object does the quota reader's own read apply.
  */
+function validFailureOutputTime(value, fallback) {
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) && parsed.getTime() <= fallback.getTime()
+        ? parsed
+        : fallback;
+}
 export function routeProviderFailure(failure, readQuota, model, now) {
     if (failure && failure.status === QUOTA_STATUS) {
         return {
-            quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, now),
+            quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now),
             rejection: null,
         };
     }
     if (failure && failure.status === null) {
-        const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, now);
+        const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now);
         if (quota)
             return { quota, rejection: null };
     }

package/dist/lib/scan-packages/index.js

@@ -2,7 +2,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from 'js-yaml';
-import { contributionLinks } from '../../utils/pack-contributions.js';
+import { contributionLinks } from '../../utils/pack-contribution-links.js';
 import { CONTRIBUTION_TABLE } from '../../utils/contribution-table.js';
 function isDirectory(target) { try {
     return fs.statSync(target).isDirectory();

package/dist/utils/pack-contribution-links.d.ts

@@ -0,0 +1,15 @@
+import type { PackContributeKey } from '../types.js';
+/** A single symlink a pack contributes: dst (host path) -> src (inside pack). */
+export interface WiredLink {
+    key: PackContributeKey;
+    item: string;
+    src: string;
+    dst: string;
+}
+/**
+ * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
+ * keys (e.g. `mcp`) produce no symlink and are skipped here.
+ */
+export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
+//# sourceMappingURL=pack-contribution-links.d.ts.map

package/dist/utils/pack-contribution-links.js

@@ -0,0 +1,33 @@
+import * as path from 'node:path';
+import { CONTRIBUTION_TABLE, payloadFor } from './contribution-table.js';
+/**
+ * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
+ * keys (e.g. `mcp`) produce no symlink and are skipped here.
+ */
+export function contributionLinks(hqRoot, packDir, contributes) {
+    const links = [];
+    for (const [key, items] of Object.entries(contributes)) {
+        if (!(key in CONTRIBUTION_TABLE))
+            continue;
+        if (!Array.isArray(items))
+            continue;
+        if (CONTRIBUTION_TABLE[key].wire !== 'symlink')
+            continue;
+        for (const item of items) {
+            if (typeof item !== 'string' || item.length === 0)
+                continue;
+            const row = CONTRIBUTION_TABLE[key];
+            const payloadRel = payloadFor(key, item);
+            const dstRel = path.join(row.host, path.basename(payloadRel));
+            links.push({
+                key,
+                item,
+                src: path.join(packDir, payloadRel),
+                dst: path.join(hqRoot, dstRel),
+            });
+        }
+    }
+    return links;
+}
+//# sourceMappingURL=pack-contribution-links.js.map

package/dist/utils/pack-contributions.d.ts

@@ -38,6 +38,8 @@
  */
 import type { PackManifest, PackContributeKey } from '../types.js';
 import { type WireMode } from './contribution-table.js';
+import { type WiredLink } from './pack-contribution-links.js';
+export { contributionLinks, type WiredLink } from './pack-contribution-links.js';
 import { type UnregisterServerResult, type SafeWriteEnv, type AcquireLockOptions } from '../commands/mcp-registration.js';
 export { readHqVersion, readRecommendedPackages } from './hq-core-yaml.js';
 export type { WireMode };
@@ -62,21 +64,7 @@ export declare function mcpServerNameForContribution(packName: string, contribut
  * order, de-duplicated.
  */
 export declare function mergeKeys(contributes: Partial<Record<PackContributeKey, string[]>>): PackContributeKey[];
-/** A single symlink a pack contributes: dst (host path) -> src (inside pack). */
-export interface WiredLink {
-    key: PackContributeKey;
-    item: string;
-    src: string;
-    dst: string;
-}
 export type LinkStatus = 'live' | 'broken' | 'missing' | 'foreign';
-/**
- * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
- * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
- * keys (e.g. `mcp`) produce no symlink and are skipped here -- their host
- * effect (a config merge) is handled separately (US-004/US-005).
- */
-export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
 /** Classify a host path against the link that should own it. */
 export declare function linkStatus(link: WiredLink, packDir?: string): LinkStatus;
 /** A content pack's manifest plus the install-time stamped source. */

package/dist/utils/pack-contributions.js

@@ -39,7 +39,9 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
-import { CONTRIBUTION_TABLE, payloadFor } from './contribution-table.js';
+import { CONTRIBUTION_TABLE } from './contribution-table.js';
+import { contributionLinks } from './pack-contribution-links.js';
+export { contributionLinks } from './pack-contribution-links.js';
 import { unregisterMcpServers, } from '../commands/mcp-registration.js';
 export { readHqVersion, readRecommendedPackages } from './hq-core-yaml.js';
 /**
@@ -78,60 +80,6 @@ export function mergeKeys(contributes) {
     }
     return out;
 }
-/**
- * Map one SYMLINK contributes entry to its source/host paths, READING the
- * single-source `CONTRIBUTION_TABLE` (US-003). The src is the expanded pack
- * payload; the dst is `<host-dir>/<payload-basename>` so per-key suffixes
- * (`.md`, `.sh`, none) carry through.
- *
- * Returns `null` for a `wire: 'merge'` key (e.g. `mcp`): a merge contribution
- * is not a symlink and has no `WiredLink`. Callers that only handle symlinks
- * (contributionLinks/unwirePack) skip those keys.
- */
-function linkFor(hqRoot, packDir, key, item) {
-    const row = CONTRIBUTION_TABLE[key];
-    if (row.wire !== 'symlink')
-        return null;
-    const payloadRel = payloadFor(key, item); // e.g. commands/foo.md
-    // dst keeps the payload's basename (so the suffix carries through) under the
-    // host directory declared in the table.
-    const dstRel = path.join(row.host, path.basename(payloadRel));
-    return {
-        key,
-        item,
-        src: path.join(packDir, payloadRel),
-        dst: path.join(hqRoot, dstRel),
-    };
-}
-/**
- * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
- * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
- * keys (e.g. `mcp`) produce no symlink and are skipped here -- their host
- * effect (a config merge) is handled separately (US-004/US-005).
- */
-export function contributionLinks(hqRoot, packDir, contributes) {
-    const links = [];
-    for (const [key, items] of Object.entries(contributes)) {
-        if (!(key in CONTRIBUTION_TABLE))
-            continue; // unknown key -> ignore
-        if (!Array.isArray(items))
-            continue;
-        // INVARIANT (US-005): merge keys are NEVER symlinked. They route to
-        // registerMcpServers (commands/mcp-registration.ts) instead. Skip them
-        // explicitly here -- not just via linkFor returning null -- so the symlink
-        // path provably excludes them.
-        if (routeContribution(key) === 'merge')
-            continue;
-        for (const item of items) {
-            if (typeof item !== 'string' || item.length === 0)
-                continue;
-            const link = linkFor(hqRoot, packDir, key, item);
-            if (link)
-                links.push(link); // null for merge keys -- skip
-        }
-    }
-    return links;
-}
 /**
  * Canonical absolute path — resolves symlinks and platform aliases such as
  * macOS `/var` ↔ `/private/var` so equivalent paths compare equal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.21",
+  "version": "5.345.23",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {