@indigoai-us/hq-cli 5.345.22 → 5.345.23

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.345.23] — 2026-10-06
+- Route eight additional isolated native core commands through the fast CLI entry.
+- hqd applies the runtime kill switch to new hook and MCP operations within the existing 60-second freshness bound. A local opt-out also disables the daemon, while a local opt-in cannot override an operator-off value.
+
 ## [5.345.22] — 2026-10-06
 - Fix Claude quota holds so time-only reset messages keep accounts unavailable until the provider's stated UTC reset, and expose the hold state in host capacity output.
 

package/dist/commands/core-audit-log-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runAuditLogFast(args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-audit-log-fast.d.ts.map

package/dist/commands/core-audit-log-fast.js

@@ -0,0 +1,12 @@
+import { runAuditLog } from "./core-audit-log-native.js";
+export function runAuditLogFast(args, _stdin, _cwd, hqRoot) {
+    const result = runAuditLog(args, { root: hqRoot ?? process.cwd(), now: () => new Date() });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-audit-log-fast.js.map

package/dist/commands/core-detect-stale-core-policy-mirror-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDetectStaleCorePolicyMirrorFast(args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-detect-stale-core-policy-mirror-fast.d.ts.map

package/dist/commands/core-detect-stale-core-policy-mirror-fast.js

@@ -0,0 +1,5 @@
+import { detectStaleCorePolicyMirror } from "../lib/core-utils/detect-stale-core-policy-mirror.js";
+export function runDetectStaleCorePolicyMirrorFast(args, _stdin, _cwd, hqRoot) {
+    return detectStaleCorePolicyMirror(args, { root: hqRoot ?? process.cwd() });
+}
+//# sourceMappingURL=core-detect-stale-core-policy-mirror-fast.js.map

package/dist/commands/core-dm-bind-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDmBindFast(args: string[], stdin: string, cwd: string, hqRoot?: string): Promise<number>;
+//# sourceMappingURL=core-dm-bind-fast.d.ts.map

package/dist/commands/core-dm-bind-fast.js

@@ -0,0 +1,14 @@
+import { createDmBindDeps, runDmBind } from "./core-dm-bind-native.js";
+export async function runDmBindFast(args, stdin, cwd, hqRoot) {
+    const deps = createDmBindDeps(hqRoot ?? cwd, cwd, process.env, () => new Date());
+    deps.readStdin = async () => stdin;
+    const result = await runDmBind(args, deps);
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-dm-bind-fast.js.map

package/dist/commands/core-generate-workers-registry-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runGenerateWorkersRegistryFast(_args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-generate-workers-registry-fast.d.ts.map

package/dist/commands/core-generate-workers-registry-fast.js

@@ -0,0 +1,5 @@
+import { generateWorkersRegistry } from "../lib/workers-registry/index.js";
+export function runGenerateWorkersRegistryFast(_args, _stdin, _cwd, hqRoot) {
+    return generateWorkersRegistry(hqRoot ?? process.cwd()).status;
+}
+//# sourceMappingURL=core-generate-workers-registry-fast.js.map

package/dist/commands/core-git-pack-extension-check-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runGitPackExtensionCheckFast(args: string[], _stdin: string, cwd: string): number;
+//# sourceMappingURL=core-git-pack-extension-check-fast.d.ts.map

package/dist/commands/core-git-pack-extension-check-fast.js

@@ -0,0 +1,12 @@
+import { runGitPackExtensionCheck } from "./core-git-pack-extension-check-native.js";
+export function runGitPackExtensionCheckFast(args, _stdin, cwd) {
+    const result = runGitPackExtensionCheck(args, { cwd, env: process.env });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-git-pack-extension-check-fast.js.map

package/dist/commands/core-refresh-vault-access-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runRefreshVaultAccessFast(args: string[], _stdin: string, cwd: string): number;
+//# sourceMappingURL=core-refresh-vault-access-fast.d.ts.map

package/dist/commands/core-refresh-vault-access-fast.js

@@ -0,0 +1,12 @@
+import { createRefreshVaultAccessDependencies, runRefreshVaultAccess } from "./core-refresh-vault-access-native.js";
+export function runRefreshVaultAccessFast(args, _stdin, cwd) {
+    const result = runRefreshVaultAccess(args, createRefreshVaultAccessDependencies(cwd, process.env, () => new Date()));
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-refresh-vault-access-fast.js.map

package/dist/commands/core-refresh-vault-access-native.d.ts

@@ -15,6 +15,7 @@ export type RefreshVaultAccessDependencies = {
     hqAvailable: boolean;
     runHq?: (args: string[], cwd: string) => HqResult;
 };
+export declare function createRefreshVaultAccessDependencies(cwd: string, env: NodeJS.ProcessEnv, now: () => Date): RefreshVaultAccessDependencies;
 export declare function runRefreshVaultAccess(args: string[], deps: RefreshVaultAccessDependencies): UtilityOutput;
 export declare function registerCoreRefreshVaultAccessNative(core: Command): void;
 //# sourceMappingURL=core-refresh-vault-access-native.d.ts.map

package/dist/commands/core-refresh-vault-access-native.js

@@ -59,6 +59,15 @@ function executableOnPath(name, value) {
     }
     return false;
 }
+export function createRefreshVaultAccessDependencies(cwd, env, now) {
+    return {
+        cwd,
+        env,
+        now,
+        hqAvailable: executableOnPath("hq", env.PATH),
+        runHq: (args, directory) => defaultHq(args, directory, env),
+    };
+}
 function isHqRoot(root) {
     const candidate = root.endsWith(path.sep) ? root.slice(0, -1) : root;
     if (!candidate)
@@ -219,11 +228,7 @@ export function registerCoreRefreshVaultAccessNative(core) {
     registerNativeUtility(core, {
         name: "refresh-vault-access", asset: REFRESH_VAULT_ACCESS_ASSET, root: "cwd", summary: "Refresh the local vault access manifest",
         resolveRoot: (cwd) => cwd,
-        run: (args, context) => runRefreshVaultAccess(args, {
-            cwd: context.cwd, env: context.env, now: context.now,
-            hqAvailable: executableOnPath("hq", context.env.PATH),
-            runHq: (args, cwd) => defaultHq(args, cwd, context.env),
-        }),
+        run: (args, context) => runRefreshVaultAccess(args, createRefreshVaultAccessDependencies(context.cwd, context.env, context.now)),
     });
 }
 //# sourceMappingURL=core-refresh-vault-access-native.js.map

package/dist/commands/core-scan-packages-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runScanPackagesFast(_args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-scan-packages-fast.d.ts.map

package/dist/commands/core-scan-packages-fast.js

@@ -0,0 +1,5 @@
+import { scanPackages } from "../lib/scan-packages/index.js";
+export function runScanPackagesFast(_args, _stdin, _cwd, hqRoot) {
+    return scanPackages(hqRoot ?? process.cwd(), { quiet: process.env.HQ_SCAN_QUIET === "1" }).status;
+}
+//# sourceMappingURL=core-scan-packages-fast.js.map

package/dist/commands/core-work-mesh-bind-trusted-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runWorkMeshBindTrustedFast(args: string[], _stdin: string, cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-work-mesh-bind-trusted-fast.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-fast.js

@@ -0,0 +1,12 @@
+import { createWorkMeshBindDeps, runWorkMeshBindTrusted } from "./core-work-mesh-bind-trusted-native.js";
+export function runWorkMeshBindTrustedFast(args, _stdin, cwd, hqRoot) {
+    const result = runWorkMeshBindTrusted(args, createWorkMeshBindDeps(hqRoot ?? cwd, cwd, process.env, () => new Date()));
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-work-mesh-bind-trusted-fast.js.map

package/dist/fast-core.js

@@ -65,7 +65,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         worktreeScopeFixEnabled = await coreRrrWorktreeScopeFixFastFlagEnabled(process.env);
     }
     const shouldInjectRoot = useShell
-        ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
+        ? entry.shellHqRoot === "cwd" || entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
             !parsed.args.includes("--hq-root") && !parsed.args.includes("--help") && !parsed.args.includes("-h"))
         : entry.kind === "shell"
             ? true
@@ -76,7 +76,10 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     // its expected-user-error formatting remains authoritative.
     let hqRoot;
     const rootResolutionStartedAt = profileMark();
-    if (shouldInjectRoot) {
+    if (useShell && entry.kind === "native" && entry.shellHqRoot === "cwd") {
+        hqRoot = process.cwd();
+    }
+    else if (shouldInjectRoot) {
         const shortcutRoot = entry.name === "checkpoint-stop-gate" || entry.name === "session-journal"
             ? resolveExplicitFastLiveRoot(parsed.hqRootArg, process.env)
             : undefined;
@@ -146,7 +149,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         ? hqRoot ?? process.cwd()
         : process.cwd();
     const injectRoot = entry.kind === "shell" || entry.kind === "native" &&
-        (entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
+        (entry.shellHqRoot === "cwd" || entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
     const childEnv = {
         ...(entry.name === "hq-session" ? { HQ_HQ_SESSION_NO_CLI: "1" } : {}),
         ...(entry.name === "migrate-policy-triggers"

package/dist/fast-scaffold.d.ts

@@ -39,7 +39,7 @@ export type FastScaffoldScript = {
     /** Cwd used for a shell rollback companion. Defaults to the caller cwd. */
     shellCwd?: "caller" | "live";
     /** Root injection behavior for a shell rollback companion. */
-    shellHqRoot?: "none" | "live" | "reconcile-default";
+    shellHqRoot?: "none" | "cwd" | "live" | "reconcile-default";
     /** Whether this handler consumes stdin. Shell companions inherit stdin directly. */
     readsStdin?: boolean;
     /** Bound bytes buffered from stdin; overflow is treated as empty input. */

package/dist/fast-scaffold.js

@@ -432,6 +432,107 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         shellCwd: "caller",
         shellHqRoot: name === "source-yaml-validate" ? "none" : "live",
     })),
+    {
+        name: "audit-log",
+        kind: "native",
+        modulePath: "./commands/core-audit-log-fast.js",
+        exportName: "runAuditLogFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/audit-log.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
+    {
+        name: "refresh-vault-access",
+        kind: "native",
+        modulePath: "./commands/core-refresh-vault-access-fast.js",
+        exportName: "runRefreshVaultAccessFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/refresh-vault-access.sh",
+        root: "cwd",
+        shellCwd: "caller",
+        shellHqRoot: "cwd",
+    },
+    {
+        name: "generate-workers-registry",
+        kind: "native",
+        modulePath: "./commands/core-generate-workers-registry-fast.js",
+        exportName: "runGenerateWorkersRegistryFast",
+        flagKey: "hq-core-native-fast-route",
+        root: "live",
+        asset: "core/scripts/generate-workers-registry.sh",
+    },
+    {
+        name: "dm-bind",
+        kind: "native",
+        modulePath: "./commands/core-dm-bind-fast.js",
+        exportName: "runDmBindFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/hq-dm-bind.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+        readsStdinFor: (args) => {
+            if (args[0] !== "post")
+                return false;
+            const valueOptions = new Set(["--topic", "--under", "--to", "--title", "--state", "--line", "--next", "--ask"]);
+            for (let index = 1; index < args.length; index += 1) {
+                if (args[index] === "-")
+                    return true;
+                if (valueOptions.has(args[index] ?? ""))
+                    index += 1;
+            }
+            return false;
+        },
+        requiresNodeNetworkCompatibility: true,
+    },
+    {
+        name: "git-pack-extension-check",
+        kind: "native",
+        modulePath: "./commands/core-git-pack-extension-check-fast.js",
+        exportName: "runGitPackExtensionCheckFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/git-pack-extension-check.sh",
+        root: "cwd",
+        shellCwd: "caller",
+        shellHqRoot: "cwd",
+    },
+    {
+        name: "scan-packages",
+        kind: "native",
+        modulePath: "./commands/core-scan-packages-fast.js",
+        exportName: "runScanPackagesFast",
+        flagKey: "hq-core-native-fast-route",
+        asset: "core/scripts/scan-packages.sh",
+        root: "live",
+    },
+    {
+        name: "detect-stale-core-policy-mirror",
+        kind: "native",
+        modulePath: "./commands/core-detect-stale-core-policy-mirror-fast.js",
+        exportName: "runDetectStaleCorePolicyMirrorFast",
+        flagKey: "hq-core-native-fast-route",
+        asset: "core/scripts/detect-stale-core-policy-mirror.sh",
+        root: "live",
+    },
+    {
+        name: "work-mesh-bind-trusted",
+        kind: "native",
+        modulePath: "./commands/core-work-mesh-bind-trusted-fast.js",
+        exportName: "runWorkMeshBindTrustedFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/work-mesh-live-bind-trusted.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+        requiresNodeNetworkCompatibility: true,
+    },
 ];
 /**
  * Parse the small, non-ambiguous `hq secrets env` surface for the gated entry

package/dist/lib/daemon/flag.d.ts

@@ -17,6 +17,8 @@ export interface DaemonFlagClient {
 }
 export interface ReadDaemonFlagOptions {
     env?: NodeJS.ProcessEnv;
+    /** Controls how this read combines a local person setting with the registry value. */
+    localOverrideMode?: "respect" | "off-only" | "ignore";
     createClient?: (options: FlagClientOptions) => DaemonFlagClient;
     getToken?: () => Promise<string>;
     onError?: (error: unknown) => void;

package/dist/lib/daemon/flag.js

@@ -15,7 +15,8 @@ const READ_TIMEOUT_MS = 5_000;
 export async function readDaemonFlag(flagKey, options = {}) {
     const env = options.env ?? process.env;
     const override = readLocalOverride(flagKey, env);
-    if (override !== null)
+    const localOverrideMode = options.localOverrideMode ?? "respect";
+    if (override !== null && (localOverrideMode === "respect" || (localOverrideMode === "off-only" && !override)))
         return override;
     let failed = false;
     let reportedError;

package/dist/lib/daemon/server.d.ts

@@ -12,6 +12,7 @@ import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
 import { type StdinMachineCredentials } from "./machine-login.js";
+import { type ReadDaemonFlagOptions } from "./flag.js";
 import { type WindowsPipeAclReport, type WindowsPipeHost } from "./windows-pipe-host.js";
 export interface HqdServerOptions {
     socketPath: string;
@@ -41,7 +42,7 @@ export interface HqdServerOptions {
     /** Test seam for the hq-anywhere-runtime default-off gate. */
     mcpEnabled?: () => boolean | Promise<boolean>;
     /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
-    runtimeFlagReader?: () => Promise<boolean>;
+    runtimeFlagReader?: (options: ReadDaemonFlagOptions) => Promise<boolean>;
     /** Test seam for the hosted Streamable HTTP MCP transport. */
     mcpBridge?: HqMcpBridge;
     /** Test seam for machine login while keeping production credentials off disk. */

package/dist/lib/daemon/server.js

@@ -396,14 +396,22 @@ export async function startHqdServer(opts) {
         }
     }
     const runtimeFlagMonitor = opts.mcpEnabled ? undefined : createBoundedDaemonFlagMonitor({
-        read: opts.runtimeFlagReader ?? (() => readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, {
-            env,
-            throwOnError: true,
-        })),
+        read: () => {
+            const options = {
+                env,
+                throwOnError: true,
+                // A local opt-out is honored, while a local opt-in cannot override the operator kill switch.
+                localOverrideMode: "off-only",
+            };
+            return opts.runtimeFlagReader
+                ? opts.runtimeFlagReader(options)
+                : readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, options);
+        },
         onChange: (enabled) => {
             if (!enabled) {
                 flagRevocationGeneration += 1;
                 ephemeralMachineToken = undefined;
+                sessions.clear();
             }
         },
         onReadError: (error) => {
@@ -426,8 +434,22 @@ export async function startHqdServer(opts) {
             socket: healthSocket(socketPath, isPipe),
         };
     };
-    /** Synchronous ops answer in request order; policy.check and mcp.call may return a promise. */
+    const alwaysAvailableOps = new Set(["ping", "health", "auth.status", "shutdown"]);
+    const allowedWhileDisabled = new Set(["session.get", "session.close"]);
+    /** Gate each external hqd request once, leaving diagnostics and cleanup available while disabled. */
     const handle = (req) => {
+        const requestStartedAt = Date.now();
+        if (alwaysAvailableOps.has(req.op))
+            return dispatch(req, requestStartedAt);
+        return Promise.resolve(mcpEnabled()).then((enabled) => {
+            if (!enabled && !allowedWhileDisabled.has(req.op)) {
+                throw new OpError("anywhere_disabled", `HQ Anywhere is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+            }
+            return dispatch(req, requestStartedAt);
+        });
+    };
+    /** Internal MCP sub-operations reuse the already-gated external request. */
+    const dispatch = (req, requestStartedAt = Date.now()) => {
         const args = req.args ?? {};
         switch (req.op) {
             case "ping":
@@ -565,7 +587,6 @@ export async function startHqdServer(opts) {
                 }, { hqRoot: opts.hqRoot, workMeshRoot: opts.workMeshRoot, env, now: clock });
             }
             case "mcp.call": {
-                const requestStartedAt = Date.now();
                 const name = stringArg(args, "name");
                 const raw = args.arguments ?? {};
                 if (raw === null || typeof raw !== "object" || Array.isArray(raw))
@@ -581,7 +602,7 @@ export async function startHqdServer(opts) {
                     companyArgs.runtime = runtime;
                 if (sessionId !== undefined)
                     companyArgs.sessionId = sessionId;
-                const call = (op, a) => handle({ id: req.id, op, args: a });
+                const call = (op, a) => dispatch({ id: req.id, op, args: a });
                 const asResult = (value) => (value instanceof Promise ? value.then(jsonResult) : jsonResult(value));
                 const policyGuardedCall = (run) => {
                     const company = companyFor(companyArgs);
@@ -601,7 +622,11 @@ export async function startHqdServer(opts) {
                             const reason = Array.isArray(decision.reasons) ? decision.reasons.filter((r) => typeof r === "string").join("; ") : "policy check did not allow this tool";
                             throw new OpError("policy_blocked", reason || "policy check did not allow this tool");
                         }
-                        return run();
+                        return Promise.resolve(mcpEnabled()).then((enabled) => {
+                            if (!enabled)
+                                throw new OpError("anywhere_disabled", `HQ Anywhere is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                            return run();
+                        });
                     });
                 };
                 switch (name) {
@@ -628,10 +653,7 @@ export async function startHqdServer(opts) {
                             ? Math.max(1, Math.min(args.timeoutMs, 120_000))
                             : HQD_DEFAULT_REQUEST_TIMEOUT_MS;
                         const deadline = requestStartedAt + timeoutMs;
-                        const forward = () => Promise.resolve(mcpEnabled()).then((enabled) => {
-                            if (!enabled) {
-                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
-                            }
+                        const forward = () => {
                             const remainingMs = Math.floor(deadline - Date.now());
                             if (remainingMs <= 0) {
                                 throw new McpOpError("hq_mcp_timeout", `Hosted hq-mcp request exceeded its ${timeoutMs}ms end-to-end deadline before forwarding.`);
@@ -650,15 +672,10 @@ export async function startHqdServer(opts) {
                                 },
                             });
                             return hqMcp.callTool(name, raw, remainingMs);
-                        });
-                        return Promise.resolve(mcpEnabled()).then((enabled) => {
-                            if (!enabled) {
-                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
-                            }
-                            return !MCP_READ_ONLY_TOOL_NAMES.has(name)
-                                ? policyGuardedCall(forward)
-                                : forward();
-                        });
+                        };
+                        return !MCP_READ_ONLY_TOOL_NAMES.has(name)
+                            ? policyGuardedCall(forward)
+                            : forward();
                     }
                 }
             }

package/dist/lib/daemon/session-registry.d.ts

@@ -24,6 +24,7 @@ export declare class SessionRegistry {
     }): HqdSession;
     get(runtime: string, sessionId: string): HqdSession | null;
     close(runtime: string, sessionId: string): boolean;
+    clear(): void;
     list(): HqdSession[];
     get size(): number;
 }

package/dist/lib/daemon/session-registry.js

@@ -32,6 +32,9 @@ export class SessionRegistry {
     close(runtime, sessionId) {
         return this.sessions.delete(sessionKey(runtime, sessionId));
     }
+    clear() {
+        this.sessions.clear();
+    }
     list() {
         return [...this.sessions.values()];
     }

package/dist/lib/scan-packages/index.js

@@ -2,7 +2,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from 'js-yaml';
-import { contributionLinks } from '../../utils/pack-contributions.js';
+import { contributionLinks } from '../../utils/pack-contribution-links.js';
 import { CONTRIBUTION_TABLE } from '../../utils/contribution-table.js';
 function isDirectory(target) { try {
     return fs.statSync(target).isDirectory();

package/dist/utils/pack-contribution-links.d.ts

@@ -0,0 +1,15 @@
+import type { PackContributeKey } from '../types.js';
+/** A single symlink a pack contributes: dst (host path) -> src (inside pack). */
+export interface WiredLink {
+    key: PackContributeKey;
+    item: string;
+    src: string;
+    dst: string;
+}
+/**
+ * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
+ * keys (e.g. `mcp`) produce no symlink and are skipped here.
+ */
+export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
+//# sourceMappingURL=pack-contribution-links.d.ts.map

package/dist/utils/pack-contribution-links.js

@@ -0,0 +1,33 @@
+import * as path from 'node:path';
+import { CONTRIBUTION_TABLE, payloadFor } from './contribution-table.js';
+/**
+ * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
+ * keys (e.g. `mcp`) produce no symlink and are skipped here.
+ */
+export function contributionLinks(hqRoot, packDir, contributes) {
+    const links = [];
+    for (const [key, items] of Object.entries(contributes)) {
+        if (!(key in CONTRIBUTION_TABLE))
+            continue;
+        if (!Array.isArray(items))
+            continue;
+        if (CONTRIBUTION_TABLE[key].wire !== 'symlink')
+            continue;
+        for (const item of items) {
+            if (typeof item !== 'string' || item.length === 0)
+                continue;
+            const row = CONTRIBUTION_TABLE[key];
+            const payloadRel = payloadFor(key, item);
+            const dstRel = path.join(row.host, path.basename(payloadRel));
+            links.push({
+                key,
+                item,
+                src: path.join(packDir, payloadRel),
+                dst: path.join(hqRoot, dstRel),
+            });
+        }
+    }
+    return links;
+}
+//# sourceMappingURL=pack-contribution-links.js.map

package/dist/utils/pack-contributions.d.ts

@@ -38,6 +38,8 @@
  */
 import type { PackManifest, PackContributeKey } from '../types.js';
 import { type WireMode } from './contribution-table.js';
+import { type WiredLink } from './pack-contribution-links.js';
+export { contributionLinks, type WiredLink } from './pack-contribution-links.js';
 import { type UnregisterServerResult, type SafeWriteEnv, type AcquireLockOptions } from '../commands/mcp-registration.js';
 export { readHqVersion, readRecommendedPackages } from './hq-core-yaml.js';
 export type { WireMode };
@@ -62,21 +64,7 @@ export declare function mcpServerNameForContribution(packName: string, contribut
  * order, de-duplicated.
  */
 export declare function mergeKeys(contributes: Partial<Record<PackContributeKey, string[]>>): PackContributeKey[];
-/** A single symlink a pack contributes: dst (host path) -> src (inside pack). */
-export interface WiredLink {
-    key: PackContributeKey;
-    item: string;
-    src: string;
-    dst: string;
-}
 export type LinkStatus = 'live' | 'broken' | 'missing' | 'foreign';
-/**
- * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
- * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
- * keys (e.g. `mcp`) produce no symlink and are skipped here -- their host
- * effect (a config merge) is handled separately (US-004/US-005).
- */
-export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
 /** Classify a host path against the link that should own it. */
 export declare function linkStatus(link: WiredLink, packDir?: string): LinkStatus;
 /** A content pack's manifest plus the install-time stamped source. */

package/dist/utils/pack-contributions.js

@@ -39,7 +39,9 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
-import { CONTRIBUTION_TABLE, payloadFor } from './contribution-table.js';
+import { CONTRIBUTION_TABLE } from './contribution-table.js';
+import { contributionLinks } from './pack-contribution-links.js';
+export { contributionLinks } from './pack-contribution-links.js';
 import { unregisterMcpServers, } from '../commands/mcp-registration.js';
 export { readHqVersion, readRecommendedPackages } from './hq-core-yaml.js';
 /**
@@ -78,60 +80,6 @@ export function mergeKeys(contributes) {
     }
     return out;
 }
-/**
- * Map one SYMLINK contributes entry to its source/host paths, READING the
- * single-source `CONTRIBUTION_TABLE` (US-003). The src is the expanded pack
- * payload; the dst is `<host-dir>/<payload-basename>` so per-key suffixes
- * (`.md`, `.sh`, none) carry through.
- *
- * Returns `null` for a `wire: 'merge'` key (e.g. `mcp`): a merge contribution
- * is not a symlink and has no `WiredLink`. Callers that only handle symlinks
- * (contributionLinks/unwirePack) skip those keys.
- */
-function linkFor(hqRoot, packDir, key, item) {
-    const row = CONTRIBUTION_TABLE[key];
-    if (row.wire !== 'symlink')
-        return null;
-    const payloadRel = payloadFor(key, item); // e.g. commands/foo.md
-    // dst keeps the payload's basename (so the suffix carries through) under the
-    // host directory declared in the table.
-    const dstRel = path.join(row.host, path.basename(payloadRel));
-    return {
-        key,
-        item,
-        src: path.join(packDir, payloadRel),
-        dst: path.join(hqRoot, dstRel),
-    };
-}
-/**
- * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
- * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
- * keys (e.g. `mcp`) produce no symlink and are skipped here -- their host
- * effect (a config merge) is handled separately (US-004/US-005).
- */
-export function contributionLinks(hqRoot, packDir, contributes) {
-    const links = [];
-    for (const [key, items] of Object.entries(contributes)) {
-        if (!(key in CONTRIBUTION_TABLE))
-            continue; // unknown key -> ignore
-        if (!Array.isArray(items))
-            continue;
-        // INVARIANT (US-005): merge keys are NEVER symlinked. They route to
-        // registerMcpServers (commands/mcp-registration.ts) instead. Skip them
-        // explicitly here -- not just via linkFor returning null -- so the symlink
-        // path provably excludes them.
-        if (routeContribution(key) === 'merge')
-            continue;
-        for (const item of items) {
-            if (typeof item !== 'string' || item.length === 0)
-                continue;
-            const link = linkFor(hqRoot, packDir, key, item);
-            if (link)
-                links.push(link); // null for merge keys -- skip
-        }
-    }
-    return links;
-}
 /**
  * Canonical absolute path — resolves symlinks and platform aliases such as
  * macOS `/var` ↔ `/private/var` so equivalent paths compare equal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.22",
+  "version": "5.345.23",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {