@indigoai-us/hq-cli 5.345.30 → 5.345.32

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.345.32] — 2026-10-06
+- `hq integrations list --usable` lists only the apps you can use right now: connected, shared with you under the same access rule the HQ gateway applies, and backed by a provider the gateway has registered. Each row shows the app name, its website domain, and the flag that selects exactly that connection in `hq integrations tools` and `call` (`--provider <slug>`, or `--connection <id>` when two connections share a provider). `--json` returns `{companyUid, viewerAccessKnown, apps}`. `--no-login` makes `list` fail instead of opening a browser sign-in, for hooks and scripts.
+
+## [5.345.31] — 2026-10-06
+- HQ Anywhere commands now require both the operator runtime switch and the signed-in person's `hq-anywhere` setting. `hq doctor` reports the setting state and access stays off when it cannot be read.
+
 ## [5.345.30] — 2026-10-06
 - Sanitize malformed journal scope identifiers before composing per-scope check IDs.
 

package/dist/command-catalog.generated.d.ts

@@ -4054,6 +4054,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--json";
             readonly description: "Machine-readable output";
             readonly hidden: false;
+        }, {
+            readonly flags: "--usable";
+            readonly description: "Only apps you can use right now (connected and shared with you), with the --provider value to call them";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--no-login";
+            readonly description: "Fail instead of opening a browser sign-in when there is no HQ session";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {

package/dist/command-catalog.generated.js

@@ -4897,6 +4897,16 @@ export const COMMAND_CATALOG = [
                         "flags": "--json",
                         "description": "Machine-readable output",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--usable",
+                        "description": "Only apps you can use right now (connected and shared with you), with the --provider value to call them",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--no-login",
+                        "description": "Fail instead of opening a browser sign-in when there is no HQ session",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []

package/dist/commands/anywhere-runtime-flag.js

@@ -4,7 +4,7 @@ export { HQ_ANYWHERE_RUNTIME_FLAG };
 export class AnywhereRuntimeDisabledError extends Error {
     expected = true;
     constructor() {
-        super("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use this command.");
+        super("HQ Anywhere is not enabled. The hq-anywhere-runtime flag and your HQ Anywhere person setting must both be on.");
         this.name = "AnywhereRuntimeDisabledError";
     }
 }

package/dist/commands/daemon.d.ts

@@ -43,6 +43,8 @@ export interface DaemonCommandDeps {
     userHome: (user: string) => string;
     /** The pid is a live `hq daemon run`. */
     daemonAlive: (pid: number) => boolean;
+    /** Test seam for the combined hq-flags and person-setting gate. */
+    runtimeAllowed?: () => boolean | Promise<boolean>;
     /** Test seam for the company sync-mode commands. */
     syncModeClient?: () => Promise<SyncModeVaultClient>;
     /** Reads stdin for the one-shot daemon machine login; never reads env or argv credentials. */

package/dist/commands/daemon.js

@@ -33,7 +33,7 @@ import { runDaemonCall } from "../lib/daemon/command-call.js";
 import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, syncRunnerPathFromCommandLine, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
 import { stagedSyncRunnerVersion, syncRunnerBundleStageRoot } from "../lib/daemon/sync-runner-bundle.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
-import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
+import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
 import { parseStdinMachineCredentials } from "../lib/daemon/machine-login.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
@@ -130,6 +130,7 @@ async function loadDefaults(over) {
         windowsHeadlessLauncher: over.windowsHeadlessLauncher ?? (platform === "win32" ? mesh.resolveWindowsHeadlessLauncher(env) : undefined),
         systemUnitDir: over.systemUnitDir ?? SYSTEM_UNIT_DIR,
         syncModeClient: over.syncModeClient,
+        runtimeAllowed: over.runtimeAllowed,
         systemRecordPath: over.systemRecordPath ?? path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
     };
 }
@@ -892,7 +893,8 @@ export function registerDaemonCommand(program, over = {}) {
         .option("--status", "Show whether hqd has an in-memory machine sign-in")
         .allowUnknownOption(true)
         .action(wrap(async (d, extra, opts) => {
-        requireAnywhereRuntime();
+        if (!(await (d.runtimeAllowed ?? (() => anywhereRuntimeAllowed(d.env)))()))
+            throw new DaemonCommandError("HQ Anywhere is not enabled for this person or the hq-anywhere-runtime switch is off.");
         if (extra?.length)
             throw new DaemonCommandError("Machine credentials are accepted from stdin only; do not pass credentials as arguments.");
         const socketPath = hqdSocketPath(d.home, d.env, d.platform);
@@ -930,7 +932,8 @@ export function registerDaemonCommand(program, over = {}) {
         .option("--json <args>", "Request args as a JSON object", "{}")
         .option("--timeout <ms>", "Give up after this many milliseconds")
         .action(wrap(async (d, op, opts) => {
-        requireAnywhereRuntime();
+        if (!(await (d.runtimeAllowed ?? (() => anywhereRuntimeAllowed(d.env)))()))
+            throw new DaemonCommandError("HQ Anywhere is not enabled for this person or the hq-anywhere-runtime switch is off.");
         if (op === "auth.login") {
             throw new Error("Use `hq daemon login --stdin`; credentials are accepted from stdin only.");
         }

package/dist/commands/install-global.d.ts

@@ -73,9 +73,11 @@ export interface GlobalCommandOpts {
     /** Dependency injection for tests. */
     env?: NodeJS.ProcessEnv;
     log?: (line: string) => void;
+    /** Test seam for the hq-pro person preference read. */
+    personSettingReader?: () => Promise<boolean | null>;
 }
 export declare function resolveInstallRoot(explicit: string | undefined): string;
 /** Entry used by `hq install --global` (wired from pkg-install.ts). */
-export declare function runInstallGlobal(opts: GlobalCommandOpts): void;
+export declare function runInstallGlobal(opts: GlobalCommandOpts): Promise<void>;
 export declare function registerUninstallCommand(program: Command): void;
 //# sourceMappingURL=install-global.d.ts.map

package/dist/commands/install-global.js

@@ -17,6 +17,7 @@ import { resolveHqRoot } from './doctor.js';
 import { anywhereRuntimeEnabled, AnywhereRuntimeDisabledError } from './anywhere-runtime-flag.js';
 import { resolveHqMcpEndpoint } from '../lib/daemon/mcp-endpoint.js';
 import { chatgptConnectorInstructions } from '../lib/install/chatgpt-targets.js';
+import { anywhereRuntimeAllowed } from '../lib/anywhere-person-setting.js';
 import { grokConnectorInstructions } from '../lib/install/grok-targets.js';
 import { readRegistry, registryDir, registryFile, writeRegistry } from '../lib/registry/registry.js';
 import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from '../lib/daemon/install.js';
@@ -294,8 +295,6 @@ export function installGlobalClaude(opts) {
     const log = opts.log ?? ((l) => console.log(l));
     const hqRoot = opts.hqRoot;
     assertHqRoot(hqRoot);
-    if (!isAnywhereEnabled(home, env))
-        throw new AnywhereRuntimeDisabledError();
     const t = claudeTargets(home);
     const prior = readState(t);
     const pluginSource = opts.via === 'plugin' ? resolveClaudePluginSource(opts.marketplaceDir, env, opts.marketplaceRepository) : undefined;
@@ -680,8 +679,6 @@ export function installGlobalCodex(opts) {
             expected: true,
         });
     }
-    if (!isAnywhereEnabled(home, env))
-        throw new AnywhereRuntimeDisabledError();
     const t = codexTargets(home);
     const hqPointer = claudeTargets(home).hqPointer;
     const prior = readCodexState(t);
@@ -957,10 +954,15 @@ export function resolveInstallRoot(explicit) {
     return root;
 }
 /** Entry used by `hq install --global` (wired from pkg-install.ts). */
-export function runInstallGlobal(opts) {
+export async function runInstallGlobal(opts) {
     const runtime = assertRuntime(opts.runtime);
+    const env = opts.env ?? process.env;
     if (runtime === 'chatgpt' || runtime === 'grok') {
-        if (!anywhereRuntimeEnabled(opts.env ?? process.env))
+        const enabled = await anywhereRuntimeAllowed(env, {
+            ...(opts.personSettingReader ? { readSetting: opts.personSettingReader } : {}),
+            onError: (name) => (opts.log ?? console.log)(`HQ Anywhere person setting unavailable (${name}); access remains off.`),
+        });
+        if (!enabled)
             throw new AnywhereRuntimeDisabledError();
         const endpoint = resolveHqMcpEndpoint(opts.env ?? process.env).toString();
         const lines = runtime === 'chatgpt' ? chatgptConnectorInstructions(endpoint) : grokConnectorInstructions(endpoint);
@@ -969,7 +971,15 @@ export function runInstallGlobal(opts) {
         return;
     }
     const install = runtime === 'codex' ? installGlobalCodex : installGlobalClaude;
-    install({ hqRoot: resolveInstallRoot(opts.hqRoot), dryRun: opts.dryRun, via: opts.via, marketplaceDir: opts.marketplaceDir, marketplaceRepository: opts.marketplaceRepository });
+    install({
+        hqRoot: resolveInstallRoot(opts.hqRoot),
+        dryRun: opts.dryRun,
+        via: opts.via,
+        marketplaceDir: opts.marketplaceDir,
+        marketplaceRepository: opts.marketplaceRepository,
+        env,
+        log: opts.log,
+    });
 }
 export function registerUninstallCommand(program) {
     program

package/dist/commands/integrations-core.d.ts

@@ -225,6 +225,46 @@ export declare function toolPrefixForProvider(provider: string): string;
  */
 export declare function fetchAdminSurface(token: string, companyUid: string): Promise<AdminSurface>;
 export declare function fetchConnections(token: string, companyUid: string): Promise<AdminConnection[]>;
+/**
+ * One app the caller can use right now through the HQ gateway. Field names
+ * follow the bot `company_apps` projection (name, provider, domain, status),
+ * so session context and bot context describe an app the same way. No
+ * endpoint URLs, credentials, scopes, or creator identities.
+ */
+export interface UsableApp {
+    connectionId: string;
+    /** Display name, stripped of control characters and capped in length. */
+    name: string;
+    provider: string;
+    domain: string | null;
+    status: string;
+    /** Bare provider slug, e.g. `notion`. */
+    providerArg: string;
+    /**
+     * The flag that resolves to exactly this connection in `hq integrations
+     * tools|call`: `--provider <slug>` when no other active row shares the
+     * provider, else `--connection <id>`.
+     */
+    selector: string;
+}
+export interface UsableAppsResult {
+    companyUid: string;
+    /**
+     * False when the server ignored `view=summary` (an older deploy). Its rows
+     * carry no `viewerAccess`, so nothing can be confirmed usable and `apps` is
+     * empty rather than guessed.
+     */
+    viewerAccessKnown: boolean;
+    apps: UsableApp[];
+}
+/**
+ * The apps the caller may use, from `GET /v1/integrations/admin?view=summary`.
+ * A row counts only when all of these hold, mirroring the gateway's checks:
+ * the server's per-caller ACL decision (`viewerAccess.usable`) is true, the
+ * status is one the gateway serves, and the gateway has a provider registered
+ * for it. Fails closed: a row without `viewerAccess` is not listed.
+ */
+export declare function fetchUsableApps(token: string, companyUid: string): Promise<UsableAppsResult>;
 /**
  * Resolve one connection by `--connection acct_…` or `--provider linear`
  * (matches `factory:<slug>`, bare provider ids, and an installation's human

package/dist/commands/integrations-core.js

@@ -355,6 +355,96 @@ export async function fetchAdminSurface(token, companyUid) {
 export async function fetchConnections(token, companyUid) {
     return (await fetchAdminSurface(token, companyUid)).connections;
 }
+/**
+ * Statuses the gateway serves. `needs-attention` is derived by the summary
+ * view from a stored `connected` row whose token renewal is failing, so the
+ * gateway still dispatches to it.
+ */
+const GATEWAY_SERVED_STATUSES = new Set(["connected", "needs-attention"]);
+/**
+ * Providers hq-pro registers statically (`createIntegrationProviderRegistry`).
+ * Every other provider is registered per company from a factory installation
+ * keyed by its `runtimeProviderId`; a connection with neither is refused by the
+ * gateway as `ProviderUnsupported`.
+ */
+const STATIC_GATEWAY_PROVIDERS = new Set(["google-workspace", "linear", "slack"]);
+const MAX_APP_NAME_LENGTH = 60;
+/**
+ * Display names are set by whoever installed the app and end up in agent
+ * context, so keep them to one short line of printable text.
+ */
+function safeAppName(raw, fallback) {
+    const cleaned = (raw ?? "")
+        .replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!cleaned)
+        return fallback;
+    const chars = Array.from(cleaned);
+    return chars.length > MAX_APP_NAME_LENGTH
+        ? `${chars.slice(0, MAX_APP_NAME_LENGTH - 1).join("").trimEnd()}…`
+        : cleaned;
+}
+/** Case-insensitive code-point order, so the list reads the same in every locale. */
+function compareNames(a, b) {
+    const x = a.toLowerCase();
+    const y = b.toLowerCase();
+    return x < y ? -1 : x > y ? 1 : 0;
+}
+function gatewayHasProvider(row) {
+    if (STATIC_GATEWAY_PROVIDERS.has(row.provider))
+        return true;
+    return row.installation?.runtimeProviderId === row.provider;
+}
+/**
+ * The apps the caller may use, from `GET /v1/integrations/admin?view=summary`.
+ * A row counts only when all of these hold, mirroring the gateway's checks:
+ * the server's per-caller ACL decision (`viewerAccess.usable`) is true, the
+ * status is one the gateway serves, and the gateway has a provider registered
+ * for it. Fails closed: a row without `viewerAccess` is not listed.
+ */
+export async function fetchUsableApps(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/admin",
+        query: { companyUid, view: "summary" },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to list integrations");
+    const data = (await res.json());
+    const viewerAccessKnown = data.view === "summary";
+    const rows = Array.isArray(data.connections) ? data.connections : [];
+    // `--provider` picks the first non-revoked row with that provider, whoever
+    // may use it, so a shared provider needs `--connection` to be exact.
+    const activeByProvider = new Map();
+    for (const row of rows) {
+        if (row.status === "revoked")
+            continue;
+        const key = bareProvider(row.provider).toLowerCase();
+        activeByProvider.set(key, (activeByProvider.get(key) ?? 0) + 1);
+    }
+    const apps = viewerAccessKnown
+        ? rows
+            .filter((row) => row.viewerAccess?.usable === true &&
+            GATEWAY_SERVED_STATUSES.has(row.status) &&
+            gatewayHasProvider(row))
+            .map((row) => {
+            const providerArg = bareProvider(row.provider);
+            const shared = (activeByProvider.get(providerArg.toLowerCase()) ?? 0) > 1;
+            return {
+                connectionId: row.id,
+                name: safeAppName(row.installation?.displayName, providerArg),
+                provider: row.provider,
+                domain: typeof row.domain === "string" && row.domain ? row.domain : null,
+                status: row.status,
+                providerArg,
+                selector: shared ? `--connection ${row.id}` : `--provider ${providerArg}`,
+            };
+        })
+            .sort((a, b) => compareNames(a.name, b.name))
+        : [];
+    return { companyUid: data.companyUid ?? companyUid, viewerAccessKnown, apps };
+}
 /**
  * Resolve one connection by `--connection acct_…` or `--provider linear`
  * (matches `factory:<slug>`, bare provider ids, and an installation's human

package/dist/commands/integrations.d.ts

@@ -51,8 +51,8 @@
  */
 import { Command } from "commander";
 import { type PendingApproval } from "./integrations-api.js";
-export { IntegrationsCliError, callGateway, fetchConnections, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
-export type { AdminConnection } from "./integrations-core.js";
+export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
+export type { AdminConnection, UsableApp, UsableAppsResult } from "./integrations-core.js";
 /** Wait for a decided queue item without resending the approve request. */
 export declare function waitForApprovalTerminal(token: string, companyUid: string, queueId: string, options?: {
     timeoutMs?: number;

package/dist/commands/integrations.js

@@ -54,12 +54,12 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { fetchPendingApprovals } from "./integrations-api.js";
-export { IntegrationsCliError, callGateway, fetchConnections, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
+export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 /**
  * Gateway metadata is additive and may be absent when talking to an older
  * gateway. Parse it defensively so an unknown or malformed value never breaks
@@ -220,9 +220,33 @@ export function registerIntegrationsCommand(program) {
         .description("List the company's connected apps")
         .option("--company <slug>", "Company slug, e.g. indigo (defaults to your single active company)")
         .option("--json", "Machine-readable output")
+        .option("--usable", "Only apps you can use right now (connected and shared with you), with the --provider value to call them")
+        .option("--no-login", "Fail instead of opening a browser sign-in when there is no HQ session")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken();
+        const token = await ensureCognitoIdToken(opts.login === false ? { interactive: false } : {});
         const companyUid = await getCompanyUid(token, opts.company);
+        if (opts.usable) {
+            const result = await fetchUsableApps(token, companyUid);
+            if (opts.json) {
+                printJson(result);
+                return;
+            }
+            if (!result.viewerAccessKnown) {
+                console.log("This HQ server cannot report which apps are shared with you yet. Run `hq integrations list` to see every connected app.");
+                return;
+            }
+            if (result.apps.length === 0) {
+                console.log("No connected apps are available to you in this company. Run `hq integrations list` to see what is connected, or ask an admin to share one.");
+                return;
+            }
+            for (const app of result.apps) {
+                const where = app.domain ? ` (${app.domain})` : "";
+                const flag = app.status === "needs-attention" ? chalk.yellow("  needs attention") : "";
+                console.log(`${chalk.bold(app.name)}${chalk.dim(where)}${flag}`);
+                console.log(chalk.dim(`  hq integrations tools ${app.selector}`));
+            }
+            return;
+        }
         const connections = await fetchConnections(token, companyUid);
         if (opts.json) {
             printJson(connections);

package/dist/commands/link.d.ts

@@ -15,6 +15,10 @@ export interface LinkDeps {
     listMemberships?: () => Promise<MembershipCompany[]>;
     now?: () => Date;
 }
+export interface LinkCommandDeps {
+    /** Test seam for the combined hq-flags and person-setting gate. */
+    runtimeAllowed?: () => boolean | Promise<boolean>;
+}
 /** Link `dir` to `company` after confirming the caller is an active member. */
 export declare function linkFolder(company: string, dir: string | undefined, deps?: LinkDeps): Promise<{
     key: string;
@@ -24,7 +28,7 @@ export declare function unlinkFolder(dir: string | undefined, deps?: LinkDeps):
 export declare function resolveCompany(dir: string | undefined, deps?: LinkDeps): import("../lib/registry/registry.js").ResolveResult;
 /** Seed manifest-sourced entries; called by `hq install --global` (US-005). */
 export declare function seedRegistryFromHqRoot(hqRoot: string, deps?: LinkDeps): import("../lib/registry/registry.js").SeedResult;
-export declare function registerLinkCommand(program: Command): void;
-export declare function registerUnlinkCommand(program: Command): void;
-export declare function registerResolveCompanyCommand(program: Command): void;
+export declare function registerLinkCommand(program: Command, deps?: LinkCommandDeps): void;
+export declare function registerUnlinkCommand(program: Command, deps?: LinkCommandDeps): void;
+export declare function registerResolveCompanyCommand(program: Command, deps?: LinkCommandDeps): void;
 //# sourceMappingURL=link.d.ts.map

package/dist/commands/link.js

@@ -9,9 +9,14 @@ import { Option } from "commander";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { listActiveMembershipCompanies } from "../lib/mesh/api.js";
-import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
+import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
 import { canonicalDir, keyForDir, readRegistry, registryDir, registryFile, removeEntriesForDir, resolveCompanyForDir, seedFromManifest, setEntry, writeRegistry, } from "../lib/registry/registry.js";
+async function requireAnywhereRuntime(deps) {
+    if (!(await (deps.runtimeAllowed ?? (() => anywhereRuntimeAllowed()))())) {
+        throw new Error("HQ Anywhere is disabled until both the runtime flag and your person setting are on.");
+    }
+}
 async function defaultListMemberships() {
     const token = await ensureCognitoToken({ interactive: false });
     return listActiveMembershipCompanies(token);
@@ -90,7 +95,7 @@ function fail(err) {
     console.error(chalk.red(err instanceof Error ? err.message : String(err)));
     process.exitCode = 1;
 }
-export function registerLinkCommand(program) {
+export function registerLinkCommand(program, deps = {}) {
     program
         .command("link [company]")
         .description("Link this folder (or its git remote) to an HQ company")
@@ -100,7 +105,7 @@ export function registerLinkCommand(program) {
         .addOption(new Option("--seed-manifest <hqRoot>", "Seed entries from an HQ companies/manifest.yaml").hideHelp())
         .action(async (company, opts) => {
         try {
-            requireAnywhereRuntime();
+            await requireAnywhereRuntime(deps);
             if (opts.list) {
                 const registry = readRegistry();
                 if (opts.json)
@@ -132,14 +137,14 @@ export function registerLinkCommand(program) {
         }
     });
 }
-export function registerUnlinkCommand(program) {
+export function registerUnlinkCommand(program, deps = {}) {
     program
         .command("unlink")
         .description("Remove the HQ company link for this folder")
         .option("--path <dir>", "Folder to unlink (default: current directory)")
-        .action((opts) => {
+        .action(async (opts) => {
         try {
-            requireAnywhereRuntime();
+            await requireAnywhereRuntime(deps);
             const removed = unlinkFolder(opts.path);
             if (removed.length === 0)
                 console.log(chalk.dim("Nothing linked here."));
@@ -152,15 +157,15 @@ export function registerUnlinkCommand(program) {
         }
     });
 }
-export function registerResolveCompanyCommand(program) {
+export function registerResolveCompanyCommand(program, deps = {}) {
     program
         .command("resolve-company")
         .description("Print the HQ company linked to this folder (never guesses)")
         .option("--path <dir>", "Folder to resolve (default: current directory)")
         .option("--json", "Print JSON output")
-        .action((opts) => {
+        .action(async (opts) => {
         try {
-            requireAnywhereRuntime();
+            await requireAnywhereRuntime(deps);
         }
         catch (err) {
             fail(err);

package/dist/commands/mcp-serve.d.ts

@@ -24,6 +24,8 @@ export interface McpServeOptions {
     preloadResidentModules?: (residentPath: "mcp", modules: readonly string[]) => Promise<void>;
     /** Test seam for releasing the process package lease after resident preload. */
     releasePackageUseLease?: () => void;
+    /** Test seam for combined hq-flags and person-setting authorization. */
+    runtimeAllowed?: () => boolean | Promise<boolean>;
 }
 /** HQ root for prompts: HQ_ROOT, else the ~/.hq/root pointer written by `hq install --global`. */
 export declare function readHqRoot(env: NodeJS.ProcessEnv, home: string): string | null;

package/dist/commands/mcp-serve.js

@@ -16,7 +16,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
 import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
-import { anywhereRuntimeEnabledFromSnapshot } from "../lib/anywhere-runtime-fast-flag.js";
+import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 import { createLineSplitter, HqdClientError, hqdRequest, hqdSocketPath } from "../lib/daemon/protocol.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, RESIDENT_PACKAGE_MODULES } from "../utils/resident-package-preload.js";
@@ -54,8 +54,10 @@ export async function runMcpServe(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const socketPath = hqdSocketPath(home, env);
     const timeoutMs = opts.timeoutMs ?? 120_000;
-    if (!anywhereRuntimeEnabledFromSnapshot(env)) {
-        process.stderr.write(`HQ Anywhere is not enabled. Enable the ${HQ_ANYWHERE_RUNTIME_FLAG} flag to use hq mcp serve.\n`);
+    if (!(await (opts.runtimeAllowed ?? (() => anywhereRuntimeAllowed(env, {
+        onError: (name) => process.stderr.write(`HQ Anywhere person setting unavailable (${name}); access remains off.\n`),
+    })))())) {
+        process.stderr.write(`HQ Anywhere is not enabled. The ${HQ_ANYWHERE_RUNTIME_FLAG} flag and your HQ Anywhere person setting must both be on.\n`);
         process.exitCode = 1;
         return;
     }

package/dist/commands/packs.d.ts

@@ -20,6 +20,10 @@ import { Command } from 'commander';
 import { type LatestResult } from './pack-install.js';
 import { type InstalledPack, type LinkStatus } from '../utils/pack-contributions.js';
 import type { PackContributeKey } from '../types.js';
+interface CommonOpts {
+    json?: boolean;
+    hqRoot?: string;
+}
 interface InstalledPackView {
     name: string;
     version?: string;
@@ -49,6 +53,28 @@ interface InstalledPackView {
     error?: string;
 }
 export declare function buildInstalledView(hqRoot: string, hqVersion: string | null, pack: InstalledPack, installedSources: Set<string>, checkUpdates: boolean, latestProbe?: LatestResult): InstalledPackView;
+interface UpdateCheck {
+    name: string;
+    transport: string;
+    current?: string;
+    latest?: string;
+    updateAvailable: boolean | null;
+    applied: boolean;
+    reason?: string;
+    error?: string;
+}
+interface UpdateOpts extends CommonOpts {
+    checkOnly?: boolean;
+    refresh?: boolean;
+    yes?: boolean;
+    allowHooks?: boolean;
+    allowMcp?: boolean;
+    branch?: boolean;
+}
+export interface UpdateDependencies {
+    runtimeAllowed?: () => Promise<boolean>;
+}
+export declare function runUpdate(name: string | undefined, opts: UpdateOpts, deps?: UpdateDependencies): Promise<UpdateCheck[]>;
 export declare function registerPacksListCommand(parent: Command): void;
 export declare function registerPacksCommand(parent: Command): void;
 export {};

package/dist/commands/packs.js

@@ -26,6 +26,7 @@ import chalk from 'chalk';
 import semverSatisfies from 'semver/functions/satisfies.js';
 import { findHqRoot } from '../utils/manifest.js';
 import { resolveHqRoot as resolveDetectedHqRoot } from './doctor.js';
+import { anywhereRuntimeAllowed } from '../lib/anywhere-person-setting.js';
 import { classify, PINNED_HQ_ANYWHERE_SOURCE, resolveLatest, resolveLatestMarketplace, runScanPackages, installPack, } from './pack-install.js';
 import { contributionLinks, linkStatus, listInstalledPacks, findDependentPacks, readPackManifest, unwirePack, unwirePackMcp, readHqVersion, readRecommendedPackages, packagesDir, } from '../utils/pack-contributions.js';
 import { syncCodexPackHooks, syncCodexPackSkills } from '../lib/install/codex-pack-contributions.js';
@@ -207,7 +208,7 @@ function printListHuman(view) {
         console.log(chalk.dim('\n  Install with: hq install <source>\n'));
     }
 }
-async function runUpdate(name, opts) {
+export async function runUpdate(name, opts, deps = {}) {
     const hqRoot = resolveRoot(opts);
     let packs = listInstalledPacks(hqRoot).filter((p) => p.manifest);
     if (name) {
@@ -225,6 +226,16 @@ async function runUpdate(name, opts) {
             results.push({ name: pname, transport: 'unknown', updateAvailable: null, applied: false, error: 'no stamped source -- cannot update' });
             continue;
         }
+        if (pname === 'hq-anywhere' && !(await (deps.runtimeAllowed ?? (() => anywhereRuntimeAllowed(process.env)))())) {
+            results.push({
+                name: pname,
+                transport: safeClassify(source) ?? 'unknown',
+                updateAvailable: null,
+                applied: false,
+                error: 'Updating hq-anywhere requires both the hq-anywhere-runtime flag and your person setting.',
+            });
+            continue;
+        }
         // US-006: marketplace sources need the async listings probe (network) —
         // the sync `resolveLatest` cannot make that call and returns null. Every
         // other transport keeps the existing synchronous probe unchanged.

package/dist/commands/pkg-install.js

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 import { peekHqApiKey, requireApiKeyCapability, } from '../utils/resolve-vault-credential.js';
 import { MARKETPLACE_PREFIX, PINNED_HQ_ANYWHERE_SOURCE, installPack, sourceMatchesPackPattern, } from './pack-install.js';
-import { anywhereRuntimeEnabled } from './anywhere-runtime-flag.js';
+import { anywhereRuntimeAllowed } from '../lib/anywhere-person-setting.js';
 /**
  * True when `source` installs through the marketplace — an explicit
  * `marketplace:` source, or a bare slug (which the dispatch below rewrites into
@@ -68,15 +68,16 @@ export function registerPackageInstallCommand(parent) {
                 process.exitCode = 1;
                 return;
             }
-            let marketplaceDir = opts.marketplaceDir;
+            const marketplaceDir = opts.marketplaceDir;
             if (opts.via === 'plugin' &&
                 !marketplaceDir?.trim() &&
-                !process.env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim() &&
-                anywhereRuntimeEnabled(process.env)) {
-                runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
-                return;
+                !process.env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim()) {
+                if (await anywhereRuntimeAllowed(process.env)) {
+                    await runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
+                    return;
+                }
             }
-            runInstallGlobal({ ...opts, marketplaceDir });
+            await runInstallGlobal({ ...opts, marketplaceDir });
             return;
         }
         if (!source) {
@@ -95,8 +96,8 @@ export function registerPackageInstallCommand(parent) {
             requireApiKeyCapability('packs:install', 'hq install');
             assertApiKeyCanAuthorizeInstall(source);
             if (source === '@indigoai-us/hq-anywhere') {
-                if (!anywhereRuntimeEnabled()) {
-                    console.error(chalk.red('Install failed:'), 'HQ Anywhere installation is disabled by the hq-anywhere-runtime flag.');
+                if (!(await anywhereRuntimeAllowed(process.env))) {
+                    console.error(chalk.red('Install failed:'), 'HQ Anywhere installation requires both the hq-anywhere-runtime flag and your person setting.');
                     process.exit(1);
                 }
                 await installPack(PINNED_HQ_ANYWHERE_SOURCE, {

package/dist/commands/update.d.ts

@@ -15,6 +15,7 @@ export interface RestartAndVerifyDeps extends ConvergenceDeps {
     env?: NodeJS.ProcessEnv;
     installedVersion?: () => string | null;
     log?: (line: string) => void;
+    runtimeAllowed?: () => boolean | Promise<boolean>;
 }
 /**
  * Restart the daemon after an update and verify it converged on the installed

package/dist/commands/update.js

@@ -10,14 +10,14 @@ import { daemonPaths } from "../lib/daemon/paths.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
 import { hqdSocketPath } from "../lib/daemon/protocol.js";
 import { describeNonConvergence, installedCliVersion, pingHqdVersion, verifyDaemonConvergence, } from "../lib/daemon/convergence.js";
-import { anywhereRuntimeEnabled } from "./anywhere-runtime-flag.js";
+import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 /**
  * Restart the daemon after an update and verify it converged on the installed
  * hq-cli (policy hq-self-updater-must-verify-convergence-after-install).
  * Returns false when it did not; the caller must report that as a failure.
  */
 export async function restartAndVerifyDaemon(hqRoot, deps = {}) {
-    if (!anywhereRuntimeEnabled())
+    if (!(await (deps.runtimeAllowed ?? (() => anywhereRuntimeAllowed(deps.env ?? process.env)))()))
         return true;
     const log = deps.log ?? ((line) => console.log(line));
     const env = deps.env ?? process.env;

package/dist/lib/anywhere-person-setting.d.ts

@@ -0,0 +1,17 @@
+export interface ReadHqAnywherePersonSettingOptions {
+    readSetting?: () => Promise<boolean | null>;
+    getPersonToken?: () => Promise<string>;
+    fetchImpl?: typeof fetch;
+    apiBaseUrl?: string;
+    env?: NodeJS.ProcessEnv;
+    onError?: (errorName: string) => void;
+}
+/** Returns null when the person preference cannot be read; callers must fail closed. */
+export declare function readHqAnywherePersonSetting(options?: ReadHqAnywherePersonSettingOptions): Promise<boolean | null>;
+export declare function evaluateAnywhereRuntime(flagEnabled: boolean, setting: boolean | null): {
+    enabled: boolean;
+    setting: boolean | null;
+};
+/** The operator flag always wins; the person preference is fetched only while it is on. */
+export declare function anywhereRuntimeAllowed(env?: NodeJS.ProcessEnv, options?: ReadHqAnywherePersonSettingOptions): Promise<boolean>;
+//# sourceMappingURL=anywhere-person-setting.d.ts.map

package/dist/lib/anywhere-person-setting.js

@@ -0,0 +1,41 @@
+import { anywhereRuntimeEnabledFromSnapshot } from "./anywhere-runtime-fast-flag.js";
+/** Returns null when the person preference cannot be read; callers must fail closed. */
+export async function readHqAnywherePersonSetting(options = {}) {
+    const env = options.env ?? process.env;
+    try {
+        const getPersonToken = options.getPersonToken ?? (async () => {
+            const { ensureCognitoToken } = await import("../utils/cognito-session.js");
+            return ensureCognitoToken({ interactive: false, tokenSource: "person" });
+        });
+        const token = await getPersonToken();
+        const apiBaseUrl = options.apiBaseUrl ?? env.HQ_PRO_API_URL ?? env.HQ_API_URL ?? env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
+        const response = await (options.fetchImpl ?? fetch)(`${apiBaseUrl.replace(/\/$/, "")}/v1/bot/auto-schedule?setting=hq-anywhere`, { method: "GET", headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(5_000) });
+        if (!response.ok)
+            throw new Error(`Http${response.status}`);
+        const body = await response.json();
+        if (typeof body !== "object" || body === null || Array.isArray(body))
+            throw new Error("InvalidEnvelope");
+        const envelope = body;
+        if (envelope.key !== "hq-anywhere" || typeof envelope.value !== "boolean")
+            throw new Error("InvalidEnvelope");
+        return envelope.value;
+    }
+    catch (error) {
+        const errorName = error instanceof Error && /^[A-Za-z][A-Za-z0-9]{0,63}$/.test(error.name)
+            ? error.name
+            : "UnknownError";
+        (options.onError ?? ((name) => console.error(`HQ Anywhere person setting unavailable (${name}); access remains off.`)))(errorName);
+        return null;
+    }
+}
+export function evaluateAnywhereRuntime(flagEnabled, setting) {
+    return { enabled: flagEnabled && setting === true, setting };
+}
+/** The operator flag always wins; the person preference is fetched only while it is on. */
+export async function anywhereRuntimeAllowed(env = process.env, options = {}) {
+    if (!anywhereRuntimeEnabledFromSnapshot(env))
+        return false;
+    const setting = options.readSetting ? await options.readSetting() : await readHqAnywherePersonSetting({ ...options, env });
+    return evaluateAnywhereRuntime(true, setting).enabled;
+}
+//# sourceMappingURL=anywhere-person-setting.js.map

package/dist/lib/daemon/mcp-oauth.d.ts

@@ -9,7 +9,7 @@ export interface McpOAuthOptions {
     fetchImpl?: typeof fetch;
     openBrowser?: (url: string) => Promise<unknown>;
     writeOutput?: (message: string) => void;
-    isEnabled?: () => boolean;
+    isEnabled?: () => boolean | Promise<boolean>;
     isMachine?: () => boolean;
     now?: () => number;
     callbackTimeoutMs?: number;

package/dist/lib/daemon/mcp-oauth.js

@@ -6,7 +6,7 @@ import * as path from "node:path";
 import open from "open";
 import { resolveCognitoTokenSource } from "../../utils/cognito-session.js";
 import { markExpectedUserError } from "../../utils/expected-cli-error.js";
-import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
+import { anywhereRuntimeAllowed } from "../anywhere-person-setting.js";
 import { resolveHqMcpOAuthOrigin } from "./mcp-endpoint.js";
 const MCP_SCOPE = "openid email profile hq-mcp/use";
 const EXPIRY_SKEW_MS = 60_000;
@@ -128,8 +128,8 @@ function newPkce() {
 }
 async function runLogin(options) {
     const env = options.env ?? process.env;
-    if (!(options.isEnabled ?? (() => anywhereRuntimeEnabled(env)))()) {
-        throw markExpectedUserError(new McpOAuthError("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use `hq mcp login`."));
+    if (!(await (options.isEnabled ?? (() => anywhereRuntimeAllowed(env)))())) {
+        throw markExpectedUserError(new McpOAuthError("HQ Anywhere is not enabled. The hq-anywhere-runtime flag and your HQ Anywhere person setting must both be on to use `hq mcp login`."));
     }
     if ((options.isMachine ?? (() => resolveCognitoTokenSource(env) === "machine"))()) {
         throw new McpOAuthError("`hq mcp login` is for person accounts; this box uses machine credentials.");

package/dist/lib/daemon/run.js

@@ -14,6 +14,7 @@ import { fileURLToPath } from "node:url";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { CLI_VERSION } from "../../cli-version.js";
 import { anywhereRuntimeEnabled } from "../../commands/anywhere-runtime-flag.js";
+import { anywhereRuntimeAllowed } from "../anywhere-person-setting.js";
 import { currentPackageUseLeaseInstall, currentPackageUseUpdateRequested } from "../../utils/package-use-lease.js";
 import { isLocalDependencyInstall, resolveRunningInstall } from "../../utils/version-gate.js";
 import { agentKitPaths } from "../agent-kit/paths.js";
@@ -836,7 +837,9 @@ export async function runDaemon(opts) {
     // hqd: the session/company socket every runtime talks to (hq-anywhere US-008).
     let hqd = null;
     let hqdShutdown = null;
-    if (shouldStartHqd(anywhereRuntimeEnabled())) {
+    if (shouldStartHqd(await anywhereRuntimeAllowed(env, {
+        onError: (name) => log("warn", `hqd person setting read failed (${name}); runtime remains off`),
+    }))) {
         try {
             const startConfig = readDaemonConfig(paths.configPath);
             hqd = await startHqdServer({

package/dist/lib/daemon/server.d.ts

@@ -43,6 +43,8 @@ export interface HqdServerOptions {
     mcpEnabled?: () => boolean | Promise<boolean>;
     /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
     runtimeFlagReader?: (options: ReadDaemonFlagOptions) => Promise<boolean>;
+    /** Test seam for the human opt-in setting; production reads hq-pro. */
+    personSettingReader?: () => Promise<boolean | null>;
     /** Test seam for the hosted Streamable HTTP MCP transport. */
     mcpBridge?: HqMcpBridge;
     /** Test seam for machine login while keeping production credentials off disk. */

package/dist/lib/daemon/server.js

@@ -23,6 +23,7 @@ import { defaultMcpToken, HqMcpBridge, jsonResult, McpOpError, runWorker } from
 import { authenticateMachineCredentials, machineTokenExpiresAt, MachineLoginError, parseStdinMachineCredentials } from "./machine-login.js";
 import { HQ_MCP_TOOL_NAMES, HQD_NATIVE_TOOL_NAMES } from "../mcp/tools.js";
 import { HQ_ANYWHERE_RUNTIME_FLAG } from "../../commands/anywhere-runtime-flag.js";
+import { readHqAnywherePersonSetting } from "../anywhere-person-setting.js";
 import { createBoundedDaemonFlagMonitor } from "./flag-monitor.js";
 import { readDaemonFlag } from "./flag.js";
 import { startWindowsPipeHost, validateWindowsPipeAcl, WINDOWS_PIPE_STARTUP_REFUSAL } from "./windows-pipe-host.js";
@@ -396,16 +397,23 @@ export async function startHqdServer(opts) {
         }
     }
     const runtimeFlagMonitor = opts.mcpEnabled ? undefined : createBoundedDaemonFlagMonitor({
-        read: () => {
+        read: async () => {
             const options = {
                 env,
                 throwOnError: true,
                 // A local opt-out is honored, while a local opt-in cannot override the operator kill switch.
                 localOverrideMode: "off-only",
             };
-            return opts.runtimeFlagReader
+            const flagEnabled = await (opts.runtimeFlagReader
                 ? opts.runtimeFlagReader(options)
-                : readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, options);
+                : readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, options));
+            if (!flagEnabled)
+                return false;
+            const personSetting = await (opts.personSettingReader ?? (() => readHqAnywherePersonSetting({
+                env,
+                onError: (name) => log("warn", `hqd person setting refresh failed (${name}); keeping HQ Anywhere off`),
+            })))();
+            return personSetting === true;
         },
         onChange: (enabled) => {
             if (!enabled) {

package/dist/lib/doctor/__testing__/run-doctor.js

@@ -2,6 +2,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { runDoctor as runDoctorCommand, } from "../../../commands/doctor.js";
+import { createAnywhereFamily } from "../checks/anywhere.js";
+import { createDefaultRegistry } from "../registry.js";
 /**
  * Run doctor tests against synthetic state. The production registry normally
  * reads local HQ work-context, sync, daemon, and session state; tests must not
@@ -37,7 +39,14 @@ export async function runDoctorForTest(options = {}) {
             else
                 process.env[key] = value;
         }
-        return await runDoctorCommand({ ...options, integrations: false });
+        let registry = options.registry;
+        if (!registry) {
+            registry = createDefaultRegistry();
+            // Command tests exercise doctor rendering and exit behavior offline. The
+            // real person preference is covered in the anywhere-family tests.
+            registry.register(createAnywhereFamily({ personSettingReader: async () => false }));
+        }
+        return await runDoctorCommand({ ...options, registry, integrations: false });
     }
     finally {
         for (const [key, value] of originalEnv) {

package/dist/lib/doctor/checks/anywhere.d.ts

@@ -31,6 +31,8 @@ export interface AnywhereDeps {
     health?: (cwd: string) => Promise<HqdHealthResult>;
     /** Test seam for the local runtime gate used to keep other checks out of a disabled runtime. */
     runtimeEnabled?: () => boolean;
+    /** Test seam for the per-person HQ Anywhere setting; production reads hq-pro. */
+    personSettingReader?: () => Promise<boolean | null>;
     /** The hq-cli version installed on this machine. Default: this CLI's version. */
     cliVersion?: string;
     serviceState?: () => DaemonServiceState;

package/dist/lib/doctor/checks/anywhere.js

@@ -24,6 +24,7 @@ import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK } from "
 import { hqdSocketPath } from "../../daemon/protocol.js";
 import { readRegistry, registryDir, registryFile } from "../../registry/registry.js";
 import { anywhereRuntimeEnabled } from "../../../commands/anywhere-runtime-flag.js";
+import { readHqAnywherePersonSetting } from "../../anywhere-person-setting.js";
 const ANYWHERE_FAMILY_ID = "anywhere";
 export const REMEDIATION = {
     installClaude: "hq install --global --runtime claude",
@@ -44,7 +45,15 @@ async function runAnywhereChecks(context, deps = {}) {
     const env = deps.env ?? process.env;
     const socketPath = hqdSocketPath(home, env);
     const cwd = context.cwd ?? process.cwd();
-    const runtimeEnabled = (deps.runtimeEnabled ?? anywhereRuntimeEnabled)();
+    const flagEnabled = (deps.runtimeEnabled ?? anywhereRuntimeEnabled)();
+    const personSetting = await (deps.personSettingReader ?? (deps.runtimeEnabled ? async () => true : () => readHqAnywherePersonSetting({
+        env,
+        onError: (name) => process.stderr.write(`HQ Anywhere person setting unavailable (${name}); access remains off.\n`),
+    })))();
+    const runtimeEnabled = flagEnabled && personSetting === true;
+    const settingCheck = personSetting === null
+        ? result("UNKNOWN", "person-setting", "HQ Anywhere person setting could not be read; runtime access is off")
+        : result(personSetting ? "PASS" : "WARN", "person-setting", `HQ Anywhere person setting is ${personSetting ? "on" : "off"}`);
     let health;
     let healthUnsupported = false;
     try {
@@ -107,12 +116,12 @@ async function runAnywhereChecks(context, deps = {}) {
         : undefined;
     const healthCheck = runtimeHealthCheck(health, healthUnsupported, serviceState);
     if (!runtimeEnabled)
-        return [healthCheck];
+        return [healthCheck, settingCheck];
     const remoteModes = [
         result("WARN", "chatgpt-mode", `ChatGPT integration mode: ${CHATGPT_MODE}; host connector setup is managed in ChatGPT`, "hq install --global --runtime chatgpt"),
         result("WARN", "grok-mode", `Grok integration mode: ${GROK_MODE}; host connector setup is managed in Grok`, "hq install --global --runtime grok"),
     ];
-    const out = [healthCheck, ...remoteModes];
+    const out = [healthCheck, settingCheck, ...remoteModes];
     if (!installed) {
         return [...out, result("NA", "installed", "HQ local anywhere runtime is not installed on this machine", REMEDIATION.installClaude)];
     }

package/dist/utils/resident-package-preload.js

@@ -40,7 +40,7 @@ export const RESIDENT_PACKAGE_MODULES = {
         "@indigoai-us/hq-cloud",
     ],
     "bot-logs-follow": [],
-    mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js"],
+    mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js"],
     childWrapper: ["../main.js"],
     coreJobRun: ["../lib/flag-registry.js"],
     "daemon-call": ["../lib/daemon/protocol.js"],
@@ -170,6 +170,12 @@ const LOADERS = {
     mcp: [
         () => import("../lib/mcp/tools.js"),
         () => import("../lib/mcp/prompts.js"),
+        () => import("../utils/cognito-session.js"),
+        () => import("@indigoai-us/hq-cloud"),
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
     ],
     childWrapper: [
         () => import("../main.js"),

package/docs/anywhere-runtime.md

@@ -5,7 +5,9 @@ local hqd daemon on macOS, Linux, and Windows. On Windows, hqd uses a bundled
 PowerShell pipe host that applies and verifies a user-only named-pipe DACL
 before becoming ready. A per-user
 registry links repositories to HQ companies. The `hq-anywhere-runtime` flag
-controls these features and is off by default.
+is the operator kill switch and is off by default. Runtime access also
+requires the current person to enable the `hq-anywhere` setting in HQ. If that
+setting cannot be read, runtime access stays off.
 
 ## Install
 
@@ -18,10 +20,12 @@ hq daemon status
 hq install --global --runtime claude
 ```
 
-`hq install --global` defaults to Claude. Select other supported runtimes
-explicitly with `--runtime codex`, `--runtime chatgpt`, or `--runtime grok`.
+`hq install --global` defaults to Claude and requires both the runtime flag
+and the current person's `hq-anywhere` setting. Select other supported
+runtimes explicitly with `--runtime codex`, `--runtime chatgpt`, or
+`--runtime grok`.
 Claude and Codex receive local hook configuration. ChatGPT and Grok print
-connector setup instructions and require the runtime flag to be enabled.
+connector setup instructions and require both gates to be enabled.
 
 The CLI stores the HQ root at `~/.hq/root` and keeps the folder registry in
 `~/.hq/registry.json`. These files belong to the current host. They are not
@@ -66,7 +70,9 @@ request error. The daemon process itself does not terminate.
 
 `hq doctor` reports hqd reachability, version and uptime, the last successful
 runtime-flag read and its age, and whether hqd is holding that decision after a
-read error. It also reports the company selected for the current directory or
+read error. It reports the current person's `hq-anywhere` setting as on, off,
+or unknown when the setting endpoint cannot be read; unknown keeps runtime
+access off. It also reports the company selected for the current directory or
 the reason it fell back to personal context. On Unix, the socket line includes
 its permission mode, owner check and whether it is user-only. Windows reports
 the named-pipe transport without Unix mode or owner fields. Use `hq doctor
@@ -80,8 +86,8 @@ resident daemon does not support the health operation, doctor falls back to
 `ping` for reachability, version and uptime, then warns that a restart is needed
 for full diagnostics.
 
-The hq-anywhere-runtime flag also gates the published Claude plugin marketplace
-and Codex pack source. When enabled, hq-cli adds the `indigoai-us/hq-packages`
+The flag and person setting also gate the published Claude plugin marketplace
+and Codex pack source. When both are on, hq-cli adds the `indigoai-us/hq-packages`
 Claude marketplace and installs the `hq` plugin, or resolves the exact
 `@indigoai-us/hq-anywhere` alias to
 `github:indigoai-us/hq-packages#packages/hq-pack-hq-anywhere`. The flag-off

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.30",
+  "version": "5.345.32",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {