@indigoai-us/hq-cli 5.345.4 → 5.345.6

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.345.6] — 2026-10-05
+- `hq mesh context default set <slug> --count-usage` now works for people signed in with a normal HQ account. It previously refused with "the signed-in person could not be determined". An opt-in saved by 5.344.0 is ignored; run the command again to opt in.
+- `hq daemon sync status` now identifies the executing runner and derives its hq-cloud version from the owner status or runner package when needed.
+
 ## [5.345.4] — 2026-10-05
 - Run a pinned or newer managed hq-cloud sync runner ahead of the staged sync bundle, so daemon sync no longer stays on the hq-cloud version bundled with the CLI after an update or pin (hq-cli#1547).
 - Avoid dispatching the global hook when the working directory is inside an HQ root.

package/dist/commands/daemon.js

@@ -16,7 +16,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { major as semverMajor, valid as validSemver } from "semver";
+import { compare as semverCompare, major as semverMajor, valid as validSemver } from "semver";
 import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices, hqCloudUnits } from "../lib/daemon/catalog.js";
 import { applyServiceToggle, effectiveSyncOwner, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
 import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
@@ -24,13 +24,14 @@ import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/d
 import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, daemonRootRefusal, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
 import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
 import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
-import { bundledHqCloud } from "../lib/daemon/hq-cloud.js";
+import { bundledHqCloud, managedHqCloud, managedHqCloudRoot, readHqCloudCopy } from "../lib/daemon/hq-cloud.js";
 import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "../lib/daemon/machine-type.js";
 import { daemonPaths } from "../lib/daemon/paths.js";
 import { processCommandLine } from "../lib/daemon/lock.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
 import { runDaemonCall } from "../lib/daemon/command-call.js";
-import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
+import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, syncRunnerPathFromCommandLine, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
+import { stagedSyncRunnerVersion, syncRunnerBundleStageRoot } from "../lib/daemon/sync-runner-bundle.js";
 import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
 import { requireAnywhereRuntime } from "./anywhere-runtime-flag.js";
 import { hqdRequest, hqdSocketPath, HqdClientError } from "../lib/daemon/protocol.js";
@@ -440,6 +441,38 @@ function daemonSyncModeClient(d) {
         return new VaultClient(buildVaultConfig(token));
     })();
 }
+function pathIsWithin(candidate, root, platform) {
+    const pathApi = platform === "win32" ? path.win32 : path;
+    const relative = pathApi.relative(pathApi.resolve(root), pathApi.resolve(candidate));
+    return relative === "" || (relative !== ".." && !relative.startsWith(".." + pathApi.sep) && !pathApi.isAbsolute(relative));
+}
+function syncRunnerSource(runnerPath, daemonRoot, platform) {
+    if (!runnerPath)
+        return "unknown";
+    if (pathIsWithin(runnerPath, syncRunnerBundleStageRoot(daemonRoot), platform))
+        return "staged-sync";
+    if (pathIsWithin(runnerPath, managedHqCloudRoot(daemonRoot), platform))
+        return "managed-full-package";
+    const bundled = bundledHqCloud();
+    if (bundled && pathIsWithin(runnerPath, bundled.root, platform))
+        return "bundled-full-package";
+    return "unknown";
+}
+function syncVersionMismatch(status) {
+    const running = status.hqCloudVersion;
+    if (!running)
+        return null;
+    if (status.pinnedHqCloudVersion && running !== status.pinnedHqCloudVersion) {
+        return "Sync runs hq-cloud " + running + ", while the configured pin expects " + status.pinnedHqCloudVersion + ". Run hq daemon restart sync after updating hq-cli to apply it.";
+    }
+    if (status.managedHqCloudVersion
+        && validSemver(status.managedHqCloudVersion)
+        && validSemver(running)
+        && semverCompare(status.managedHqCloudVersion, running) > 0) {
+        return "Sync runs hq-cloud " + running + ", while managed hq-cloud " + status.managedHqCloudVersion + " is newer. Run hq daemon restart sync after updating hq-cli to apply it.";
+    }
+    return null;
+}
 function daemonSyncStatus(d) {
     const host = currentHost(d);
     const { paths } = host;
@@ -461,22 +494,64 @@ function daemonSyncStatus(d) {
     const ownerCommandLine = ownerStatusCandidate
         ? processCommandLine(ownerStatusCandidate.pid, { platform: d.platform, run: d.run })
         : null;
-    const ownerStatus = ownerCommandLine && isSyncRunnerCommandLine(ownerCommandLine)
-        ? ownerStatusCandidate
+    const ownerRunnerPath = ownerCommandLine && isSyncRunnerCommandLine(ownerCommandLine)
+        ? syncRunnerPathFromCommandLine(ownerCommandLine)
         : null;
-    return {
+    const ownerStatus = ownerRunnerPath ? ownerStatusCandidate : null;
+    const unitCommandLine = ownerRunnerPath || !syncUnit?.pid
+        ? null
+        : processCommandLine(syncUnit.pid, { platform: d.platform, run: d.run });
+    const unitRunnerPath = unitCommandLine && isSyncRunnerCommandLine(unitCommandLine)
+        ? syncRunnerPathFromCommandLine(unitCommandLine)
+        : null;
+    const runnerPath = ownerRunnerPath ?? unitRunnerPath;
+    const runnerSource = syncRunnerSource(runnerPath, paths.root, d.platform);
+    const managedCopy = managedHqCloud(paths.root);
+    const managedVersion = managedCopy?.version ?? null;
+    let hqCloudVersion = ownerStatus?.version ?? null;
+    let hqCloudVersionSource = hqCloudVersion ? "owner-status" : "unknown";
+    if (!hqCloudVersion && runnerPath) {
+        try {
+            const copy = runnerSource === "staged-sync"
+                ? { root: "", version: stagedSyncRunnerVersion(runnerPath) }
+                : runnerSource === "managed-full-package"
+                    ? readHqCloudCopy(managedHqCloudRoot(paths.root))
+                    : runnerSource === "bundled-full-package"
+                        ? bundledHqCloud()
+                        : null;
+            if (copy) {
+                hqCloudVersion = copy.version;
+                hqCloudVersionSource = "runner-path";
+            }
+        }
+        catch {
+            d.err("Could not read sync runner version metadata; treating it as unavailable.");
+        }
+    }
+    // Compare the executing version, not the installed managed copy: the copy can be updated on disk while an older runner still runs.
+    const runnerMatchesPin = runnerSource === "managed-full-package" && config.hqCloudVersion && hqCloudVersion
+        ? hqCloudVersion === config.hqCloudVersion
+        : null;
+    const status = {
         running: syncUnit?.status === "running",
         paused: config.syncPaused === true,
         syncOwner: effectiveSyncOwner(config, host.detected.type),
         owner: ownerStatus?.owner ?? (syncUnit?.status === "running" ? "hq-daemon" : null),
         runnerPid: ownerStatus?.pid ?? syncUnit?.pid ?? null,
-        hqCloudVersion: ownerStatus?.version ?? null,
+        hqCloudVersion,
+        hqCloudVersionSource,
+        runnerMatchesPin,
+        runnerPath,
+        runnerSource,
+        managedHqCloudVersion: managedVersion,
+        pinnedHqCloudVersion: config.hqCloudVersion ?? null,
         lastHeartbeat: syncUnit?.lastHeartbeatAt ?? ownerStatus?.heartbeatAt ?? null,
         lastPassResult: syncUnit?.lastPassResult ?? null,
         unitStatus: syncUnit?.status ?? "not-running",
         reason: syncUnit?.reason ?? null,
         logPath: paths.unitLogPath("sync"),
     };
+    return status;
 }
 async function runDaemonSyncStatus(d, opts) {
     const status = daemonSyncStatus(d);
@@ -487,6 +562,15 @@ async function runDaemonSyncStatus(d, opts) {
     d.out(`Sync ${status.running ? "running" : status.unitStatus}${status.paused ? " (paused)" : ""}.`);
     d.out(`Configured sync owner: ${status.syncOwner}.`);
     d.out(`Owner: ${status.owner ?? "none"}; runner pid: ${status.runnerPid ?? "none"}; hq-cloud: ${status.hqCloudVersion ?? "unknown"}.`);
+    d.out(`Sync runner: ${status.runnerPath ?? "unknown"} (${status.runnerSource}); hq-cloud ${status.hqCloudVersion ?? "unknown"}.`);
+    d.out("Managed hq-cloud: " + (status.managedHqCloudVersion ?? "unknown") + "; pinned hq-cloud: " + (status.pinnedHqCloudVersion ?? "none") + ".");
+    if (status.runnerSource === "managed-full-package") {
+        const pinMatch = status.runnerMatchesPin === null ? "unknown" : status.runnerMatchesPin ? "yes" : "no";
+        d.out("Managed runner matches pin: " + pinMatch + ".");
+    }
+    const versionMismatch = syncVersionMismatch(status);
+    if (versionMismatch)
+        d.out(versionMismatch);
     if (status.reason)
         d.out(`Reason: ${status.reason}`);
     d.out(`Log: ${status.logPath}`);

package/dist/commands/login.js

@@ -9,7 +9,7 @@ import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
 import * as readline from "node:readline/promises";
 import { listActiveMembershipCompanies } from "../lib/mesh/api.js";
 import { retainUsageAttributionForPerson, setDefaultCompany } from "../lib/work-context/config.js";
-import { personUidFromTokens } from "../lib/work-context/person-identity.js";
+import { cognitoSubFromTokens } from "../lib/work-context/person-identity.js";
 import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
 import { workContextRoot } from "../lib/work-context/paths.js";
 function peekIdToken(idToken) {
@@ -66,7 +66,7 @@ export function registerLoginCommand(program) {
         try {
             // The usage-attribution opt-in belongs to the person who gave it. A
             // different (or unknown) account signing in on this OS user drops it.
-            retainUsageAttributionForPerson(personUidFromTokens(loadCachedTokens()), {
+            retainUsageAttributionForPerson(cognitoSubFromTokens(loadCachedTokens()), {
                 root: workContextRoot(),
             });
         }

package/dist/commands/mesh.js

@@ -20,7 +20,7 @@ import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.j
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
 import { clearDefaultCompany, effectiveUsageAttribution, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, setUsageAttribution, } from "../lib/work-context/config.js";
 import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
-import { personUidFromTokens } from "../lib/work-context/person-identity.js";
+import { cognitoSubFromTokens } from "../lib/work-context/person-identity.js";
 import { DefaultCompanyUnavailableError, WorkContextError, } from "../lib/work-context/errors.js";
 import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
@@ -1212,17 +1212,17 @@ export async function askYesNo(question, io = {}) {
         rl.close();
     }
 }
-/** The signed-in person's prs_ uid from the cached Cognito session, or null. */
-function currentPersonUid() {
+/** The signed-in person's Cognito sub from the cached session, or null. */
+function currentCognitoSub() {
     try {
-        return personUidFromTokens(loadCachedTokens());
+        return cognitoSubFromTokens(loadCachedTokens());
     }
     catch {
         return null;
     }
 }
-function usageAttributionJson(cfg, personUid) {
-    const effective = effectiveUsageAttribution(cfg, personUid);
+function usageAttributionJson(cfg, cognitoSub) {
+    const effective = effectiveUsageAttribution(cfg, cognitoSub);
     return { countUsage: effective !== null, usageAttribution: effective };
 }
 async function runContextDefaultGet(opts) {
@@ -1244,7 +1244,7 @@ async function runContextDefaultGet(opts) {
             needsChoice: !current && !disabled && memberships.length > 1,
             memberships,
             repairHeldWithDefault: cfg.repairHeldWithDefault === true,
-            ...usageAttributionJson(cfg, currentPersonUid()),
+            ...usageAttributionJson(cfg, currentCognitoSub()),
         }, null, 2));
         return;
     }
@@ -1257,7 +1257,7 @@ async function runContextDefaultGet(opts) {
         return;
     }
     console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled} source=${source}`);
-    console.log(effectiveUsageAttribution(cfg, currentPersonUid())
+    console.log(effectiveUsageAttribution(cfg, currentCognitoSub())
         ? usageCountedLine(current.slug)
         : usageNotCountedLine(current.slug));
 }
@@ -1269,8 +1269,8 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
         : opts.countUsage === false
             ? "opt-out"
             : "keep-if-same";
-    const personUid = currentPersonUid();
-    const priorOptIn = effectiveUsageAttribution(readDeviceConfig({ root }), personUid);
+    const cognitoSub = currentCognitoSub();
+    const priorOptIn = effectiveUsageAttribution(readDeviceConfig({ root }), cognitoSub);
     let token;
     try {
         token = await requireToken();
@@ -1311,7 +1311,7 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
             root,
             migrationCapability,
             usageAttribution: usageChoice,
-            personUid,
+            cognitoSub,
             validateMembership: async (candidate) => {
                 if (!token) {
                     throw new DefaultCompanyUnavailableError(`Cannot verify membership for company "${candidate}" (no Cognito session; offline or not logged in)`);
@@ -1340,7 +1340,7 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
                 ok: true,
                 config: configured,
                 migrationWarning,
-                ...usageAttributionJson(configured, personUid),
+                ...usageAttributionJson(configured, cognitoSub),
             }, null, 2));
             return;
         }
@@ -1352,8 +1352,8 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
             (() => isInteractiveTerminal()))();
         if (usageChoice === "keep-if-same" &&
             interactive &&
-            personUid &&
-            !effectiveUsageAttribution(configured, personUid) &&
+            cognitoSub &&
+            !effectiveUsageAttribution(configured, cognitoSub) &&
             stored?.uid?.startsWith("cmp_")) {
             console.error(usageOptInExplainer(company));
             let yes = false;
@@ -1364,9 +1364,9 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
                 yes = false;
             }
             if (yes)
-                configured = setUsageAttribution({ companyUid: stored.uid, personUid }, { root });
+                configured = setUsageAttribution({ companyUid: stored.uid, cognitoSub }, { root });
         }
-        console.log(effectiveUsageAttribution(configured, personUid)
+        console.log(effectiveUsageAttribution(configured, cognitoSub)
             ? usageCountedLine(company)
             : usageNotCountedLine(company));
         if (migrationWarning)
@@ -1503,7 +1503,7 @@ async function runContextDefaultClear(opts) {
     const hadOptIn = readDeviceConfig({ root }).usageAttribution !== undefined;
     const cfg = clearDefaultCompany({ root });
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, config: cfg, ...usageAttributionJson(cfg, currentPersonUid()) }, null, 2));
+        console.log(JSON.stringify({ ok: true, config: cfg, ...usageAttributionJson(cfg, currentCognitoSub()) }, null, 2));
         return;
     }
     console.log("Default company cleared.");

package/dist/lib/daemon/hq-cloud.d.ts

@@ -60,6 +60,9 @@ export declare function hqCloudInstallCommand(prefix: string, version: string, p
     args: string[];
     shell: boolean;
 };
+export declare function readHqCloudCopy(root: string): HqCloudCopy | null;
+/** The hq-cloud copy installed in the daemon-owned managed package root. */
+export declare function managedHqCloud(daemonRoot: string): HqCloudCopy | null;
 /** The copy bundled with this CLI. */
 export declare function bundledHqCloud(): HqCloudCopy | null;
 /** The hq-cloud the daemon should run right now. */

package/dist/lib/daemon/hq-cloud.js

@@ -118,7 +118,7 @@ export function hqCloudInstallCommand(prefix, version, platform = process.platfo
     const plan = buildSpawnPlan("npm", ["install", "--prefix", prefix, "--no-audit", "--no-fund", "--omit=dev", `${HQ_CLOUD_PACKAGE}@${version}`], platform);
     return { file: plan.cmd, args: plan.args, shell: plan.shell };
 }
-function readHqCloudCopy(root) {
+export function readHqCloudCopy(root) {
     try {
         const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
         return typeof pkg.version === "string" ? { root, version: pkg.version } : null;
@@ -127,6 +127,10 @@ function readHqCloudCopy(root) {
         return null;
     }
 }
+/** The hq-cloud copy installed in the daemon-owned managed package root. */
+export function managedHqCloud(daemonRoot) {
+    return readHqCloudCopy(managedHqCloudRoot(daemonRoot));
+}
 /** The copy bundled with this CLI. */
 export function bundledHqCloud() {
     try {
@@ -140,12 +144,12 @@ export function bundledHqCloud() {
 /** The hq-cloud the daemon should run right now. */
 export function currentHqCloud(daemonRoot) {
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
-    return pickHqCloud(bundledHqCloud(), readHqCloudCopy(managedHqCloudRoot(daemonRoot)), (copy) => hqCloudRunners(copy.root).syncRunner !== null, pinnedVersion);
+    return pickHqCloud(bundledHqCloud(), managedHqCloud(daemonRoot), (copy) => hqCloudRunners(copy.root).syncRunner !== null, pinnedVersion);
 }
 /** After the CLI package lease is released, only daemon-owned package files are eligible. */
 export function currentHqCloudAfterLeaseRelease(daemonRoot, expectedVersion) {
     const config = readDaemonConfig(path.join(daemonRoot, "config.json"));
-    const managed = readHqCloudCopy(managedHqCloudRoot(daemonRoot));
+    const managed = managedHqCloud(daemonRoot);
     if (!managed || !hqCloudRunners(managed.root).syncRunner)
         return null;
     if (config.hqCloudVersion && config.hqCloudVersion !== managed.version)

package/dist/lib/daemon/sync-runner-bundle.d.ts

@@ -4,6 +4,8 @@ export declare const SYNC_RUNNER_BUNDLE_RUNNER_FILE = "bin/sync-runner.js";
 export declare const SYNC_RUNNER_BUNDLE_METADATA_FILE = "package.json";
 export declare const SYNC_RUNNER_BUNDLE_DIRECTORY = "hq-cloud-sync-runner";
 export declare const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
+/** Root directory where validated sync-runner bundles are selected. */
+export declare function syncRunnerBundleStageRoot(daemonRoot: string): string;
 /** package.json contract that the hq-cli build step emits beside the bundled bin directory. */
 export interface SyncRunnerBundleMetadata {
     name: "hq-cli-daemon-sync-runner";
@@ -32,6 +34,8 @@ export interface StageSyncRunnerBundleOptions {
     copyFile?: typeof fs.copyFileSync;
     renameDirectory?: (from: string, to: string) => void;
 }
+/** Read the validated metadata version for a runner inside its staged bundle. */
+export declare function stagedSyncRunnerVersion(runnerPath: string): string;
 /**
  * Stage one validated runner bundle into an immutable daemon-owned directory.
  * Only a completed, fsynced directory is returned; temp siblings are ignored.

package/dist/lib/daemon/sync-runner-bundle.js

@@ -9,6 +9,10 @@ export const SYNC_RUNNER_BUNDLE_RUNNER_FILE = "bin/sync-runner.js";
 export const SYNC_RUNNER_BUNDLE_METADATA_FILE = "package.json";
 export const SYNC_RUNNER_BUNDLE_DIRECTORY = "hq-cloud-sync-runner";
 export const SYNC_RUNNER_BUNDLE_FORMAT_VERSION = 1;
+/** Root directory where validated sync-runner bundles are selected. */
+export function syncRunnerBundleStageRoot(daemonRoot) {
+    return path.join(daemonRoot, "bundles", "sync-runner");
+}
 export class SyncRunnerBundleStageError extends Error {
     code;
     constructor(code, message, options) {
@@ -55,6 +59,11 @@ function readMetadata(file) {
     }
     return metadata;
 }
+/** Read the validated metadata version for a runner inside its staged bundle. */
+export function stagedSyncRunnerVersion(runnerPath) {
+    const bundleDirectory = path.dirname(path.dirname(runnerPath));
+    return readMetadata(path.join(bundleDirectory, SYNC_RUNNER_BUNDLE_METADATA_FILE)).version;
+}
 function hqCloudRange() {
     const cliPackagePath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../package.json");
     try {
@@ -138,7 +147,7 @@ export function stageSyncRunnerBundle(options) {
     if (sha256(sourceRunner) !== metadata.bundleSha256) {
         fail("HASH_MISMATCH", "The sync-runner bundle sha256 does not match its sidecar");
     }
-    const stageRoot = path.join(options.daemonRoot, "bundles", "sync-runner");
+    const stageRoot = syncRunnerBundleStageRoot(options.daemonRoot);
     const selectedDirectory = path.join(stageRoot, stagedLeaf(metadata));
     const existing = readStaged(selectedDirectory, metadata, range);
     if (existing)

package/dist/lib/daemon/sync-runner.d.ts

@@ -44,6 +44,8 @@ export declare function watchRunnerOwnerStatusPath(hqRoot: string, home?: string
 export declare function readWatchRunnerOwnerStatus(statusPath: string): WatchRunnerOwnerStatus | null;
 /** Match a live process command line to the hq-cloud watch runner executable. */
 export declare function isSyncRunnerCommandLine(commandLine: string): boolean;
+/** Return the script path from a command line already verified as a sync runner. */
+export declare function syncRunnerPathFromCommandLine(commandLine: string): string | null;
 /** Return a clear wait reason when an unleased runner already targets this HQ root. */
 export declare function syncRunnerUnleasedBlockReason(hqRoot: string, processes: readonly SyncRunnerProcess[], ownerPid: number | null, platform?: NodeJS.Platform, daemonRunnerPids?: ReadonlySet<number>): string | undefined;
 /** Read complete process command lines so root matching can include trailing arguments. */

package/dist/lib/daemon/sync-runner.js

@@ -59,6 +59,14 @@ export function readWatchRunnerOwnerStatus(statusPath) {
 export function isSyncRunnerCommandLine(commandLine) {
     return SYNC_RUNNER_COMMAND.test(commandLine);
 }
+/** Return the script path from a command line already verified as a sync runner. */
+export function syncRunnerPathFromCommandLine(commandLine) {
+    if (!isSyncRunnerCommandLine(commandLine))
+        return null;
+    const args = commandLineArgs(commandLine);
+    return args.find((arg) => (path.isAbsolute(arg) || path.win32.isAbsolute(arg))
+        && /(?:^|[\\/])(?:sync-runner\.js|hq-sync-runner(?:\.(?:cmd|exe))?)$/i.test(arg)) ?? null;
+}
 function commandLineArgs(commandLine) {
     const args = [];
     let current = "";

package/dist/lib/work-context/config.d.ts

@@ -56,15 +56,16 @@ export interface UsageAttributionOptIn {
     mode: "default-company";
     companyUid: string;
     /**
-     * The signed-in person who consented: the `custom:entityUid` claim (prs_...)
-     * of the cached Cognito person session. Consent never carries to another
-     * account on the same OS user.
+     * The signed-in person who consented: the Cognito `sub` claim of the cached
+     * person session. Consent never carries to another account on the same OS
+     * user. Older records that carry only `personUid` are treated as not opted
+     * in (fail closed).
      */
-    personUid: string;
+    cognitoSub: string;
     optedInAt: string;
 }
-/** A person principal uid, as carried in the `custom:entityUid` token claim. */
-export declare function isPersonUid(value: unknown): value is string;
+/** A Cognito `sub` claim: any non-empty string (after trimming). */
+export declare function isCognitoSub(value: unknown): value is string;
 /** How `setDefaultCompany` treats the usage-attribution opt-in. */
 export type UsageAttributionChoice = 
 /** Write an opt-in for the newly set company (requires its uid). */
@@ -113,10 +114,10 @@ export interface DeviceConfigDeps {
      */
     usageAttribution?: UsageAttributionChoice;
     /**
-     * The signed-in person (prs_...). Required to write an opt-in; an existing
+     * The signed-in person (Cognito `sub`). Required to write an opt-in; an existing
      * opt-in is kept only when it was given by this person.
      */
-    personUid?: string | null;
+    cognitoSub?: string | null;
 }
 /** Acquire an interprocess config lock; exported for direct lock regression tests. */
 export declare function acquireDeviceConfigLock(root: string, options?: {
@@ -130,7 +131,7 @@ export declare function sanitizeUsageAttribution(raw: unknown): UsageAttribution
  * default company, and given by the signed-in person. Mirrors the hq-cloud
  * reader. No signed-in person means no opt-in.
  */
-export declare function effectiveUsageAttribution(cfg: Pick<WorkContextDeviceConfig, "defaultCompany" | "usageAttribution">, personUid: string | null | undefined): UsageAttributionOptIn | null;
+export declare function effectiveUsageAttribution(cfg: Pick<WorkContextDeviceConfig, "defaultCompany" | "usageAttribution">, cognitoSub: string | null | undefined): UsageAttributionOptIn | null;
 /** Injection points for assertSafeConfigPath (tests only). */
 export interface SafeConfigPathIo {
     platform?: NodeJS.Platform;
@@ -162,14 +163,14 @@ export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps):
  */
 export declare function setUsageAttribution(optIn: {
     companyUid: string;
-    personUid: string;
+    cognitoSub: string;
 } | null, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /**
- * Drop the usage-attribution opt-in unless it was given by `personUid`. Called
+ * Drop the usage-attribution opt-in unless it was given by `cognitoSub`. Called
  * on login (identity may have changed) and logout (null: always drop). A
  * config with no opt-in, or one already matching, is left untouched.
  */
-export declare function retainUsageAttributionForPerson(personUid: string | null | undefined, deps: Pick<DeviceConfigDeps, "root" | "now">): boolean;
+export declare function retainUsageAttributionForPerson(cognitoSub: string | null | undefined, deps: Pick<DeviceConfigDeps, "root" | "now">): boolean;
 export declare function clearDefaultCompany(deps: DeviceConfigDeps): WorkContextDeviceConfig;
 /**
  * Read the persisted company mapping for a repo identity key (gap 4).

package/dist/lib/work-context/config.js

@@ -9,9 +9,9 @@ import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError
 import { workContextConfigPath } from "./paths.js";
 import { assertWindowsOwnerOnlyAcl } from "./windows-acl.js";
 const DEVICE_CONFIG_SCHEMA_VERSION = 1;
-/** A person principal uid, as carried in the `custom:entityUid` token claim. */
-export function isPersonUid(value) {
-    return typeof value === "string" && /^prs_[A-Za-z0-9]+$/.test(value);
+/** A Cognito `sub` claim: any non-empty string (after trimming). */
+export function isCognitoSub(value) {
+    return typeof value === "string" && value.trim().length > 0;
 }
 const CONFIG_LOCK_TIMEOUT_MS = 5_000;
 const CONFIG_LOCK_RETRY_MS = 10;
@@ -158,24 +158,24 @@ export function sanitizeUsageAttribution(raw) {
     if (v.mode !== "default-company")
         return undefined;
     const companyUid = typeof v.companyUid === "string" ? v.companyUid.trim() : "";
-    const personUid = typeof v.personUid === "string" ? v.personUid.trim() : "";
+    const cognitoSub = typeof v.cognitoSub === "string" ? v.cognitoSub.trim() : "";
     const optedInAt = typeof v.optedInAt === "string" ? v.optedInAt.trim() : "";
     if (!companyUid.startsWith("cmp_") ||
-        !isPersonUid(personUid) ||
+        !isCognitoSub(cognitoSub) ||
         !optedInAt ||
         !Number.isFinite(Date.parse(optedInAt))) {
         return undefined;
     }
-    return { mode: "default-company", companyUid, personUid, optedInAt };
+    return { mode: "default-company", companyUid, cognitoSub, optedInAt };
 }
 /**
  * The opt-in that is in effect: present, for the uid of the current enabled
  * default company, and given by the signed-in person. Mirrors the hq-cloud
  * reader. No signed-in person means no opt-in.
  */
-export function effectiveUsageAttribution(cfg, personUid) {
+export function effectiveUsageAttribution(cfg, cognitoSub) {
     const opt = cfg.usageAttribution;
-    if (!opt || !isPersonUid(personUid) || opt.personUid !== personUid)
+    if (!opt || !isCognitoSub(cognitoSub) || opt.cognitoSub !== cognitoSub)
         return null;
     const def = cfg.defaultCompany;
     if (!opt || !def || def.enabled !== true || def.source === "disabled")
@@ -332,27 +332,27 @@ export async function setDefaultCompany(slug, deps) {
             defaultCompany.uid = resolvedUid;
         const choice = deps.usageAttribution ?? "keep-if-same";
         let usageAttribution;
-        const personUid = isPersonUid(deps.personUid) ? deps.personUid : undefined;
+        const cognitoSub = isCognitoSub(deps.cognitoSub) ? deps.cognitoSub : undefined;
         if (choice === "opt-in") {
             if (!resolvedUid?.startsWith("cmp_")) {
                 throw new WorkContextError("UsageAttributionUnavailable", `Cannot count usage toward "${trimmed}": its company uid is unknown`);
             }
-            if (!personUid) {
+            if (!cognitoSub) {
                 throw new WorkContextError("UsageAttributionUnavailable", `Cannot count usage toward "${trimmed}": the signed-in person could not be determined`);
             }
             usageAttribution = {
                 mode: "default-company",
                 companyUid: resolvedUid,
-                personUid,
+                cognitoSub,
                 optedInAt: now().toISOString(),
             };
         }
         else if (choice === "keep-if-same") {
             usageAttribution =
                 resolvedUid &&
-                    personUid &&
+                    cognitoSub &&
                     prior.usageAttribution?.companyUid === resolvedUid &&
-                    prior.usageAttribution.personUid === personUid
+                    prior.usageAttribution.cognitoSub === cognitoSub
                     ? prior.usageAttribution
                     : undefined;
         }
@@ -388,13 +388,13 @@ export function setUsageAttribution(optIn, deps) {
                 def.source !== "chosen" ||
                 !def.uid?.startsWith("cmp_") ||
                 def.uid !== optIn.companyUid ||
-                !isPersonUid(optIn.personUid)) {
+                !isCognitoSub(optIn.cognitoSub)) {
                 throw new WorkContextError("UsageAttributionUnavailable", "Usage can only be counted toward a default company you chose on this device");
             }
             usageAttribution = {
                 mode: "default-company",
                 companyUid: def.uid,
-                personUid: optIn.personUid,
+                cognitoSub: optIn.cognitoSub,
                 optedInAt: now().toISOString(),
             };
         }
@@ -413,11 +413,11 @@ export function setUsageAttribution(optIn, deps) {
     });
 }
 /**
- * Drop the usage-attribution opt-in unless it was given by `personUid`. Called
+ * Drop the usage-attribution opt-in unless it was given by `cognitoSub`. Called
  * on login (identity may have changed) and logout (null: always drop). A
  * config with no opt-in, or one already matching, is left untouched.
  */
-export function retainUsageAttributionForPerson(personUid, deps) {
+export function retainUsageAttributionForPerson(cognitoSub, deps) {
     if (!fs.existsSync(workContextConfigPath(deps.root)))
         return false;
     return withDeviceConfigLock(deps.root, () => {
@@ -425,7 +425,7 @@ export function retainUsageAttributionForPerson(personUid, deps) {
         const opt = prior.usageAttribution;
         if (!opt)
             return false;
-        if (isPersonUid(personUid) && opt.personUid === personUid)
+        if (isCognitoSub(cognitoSub) && opt.cognitoSub === cognitoSub)
             return false;
         const now = deps.now ?? (() => new Date());
         const { usageAttribution: _dropped, ...rest } = prior;

package/dist/lib/work-context/person-identity.d.ts

@@ -2,14 +2,18 @@
  * Signed-in person identity for the usage-attribution opt-in.
  *
  * Source: the cached Cognito person session (`~/.hq/cognito-tokens.json`,
- * read through `loadCachedTokens`). The person uid is the `custom:entityUid`
- * claim of the ID token (falling back to the access token), and only a
- * `prs_` value counts. Agent (`agt_`) or unknown identities return null, so
- * no opt-in is written or kept for them. Claims are read without
- * verification; this decides only whether local consent belongs to the
- * account that is signed in, never authorization.
+ * read through `loadCachedTokens`). The identity key is the Cognito `sub`
+ * claim of the ID token (falling back to the access token); it must be a
+ * non-empty string. Human sessions carry no `custom:entityUid` claim (hq-pro
+ * sets it only on agent and outpost machine identities), so it is not used.
+ * An agent or outpost session has its own Cognito user and therefore a
+ * different `sub`, so it could never match a person's opt-in; a token that
+ * names a machine identity (`custom:entityType` agent/outpost, or a
+ * non-`prs_` `custom:entityUid`) is refused outright. Claims are read
+ * without verification; this decides only whether local consent belongs to
+ * the account that is signed in, never authorization.
  */
-export declare function personUidFromTokens(tokens: {
+export declare function cognitoSubFromTokens(tokens: {
     idToken?: string;
     accessToken?: string;
 } | null | undefined): string | null;

package/dist/lib/work-context/person-identity.js

@@ -2,14 +2,18 @@
  * Signed-in person identity for the usage-attribution opt-in.
  *
  * Source: the cached Cognito person session (`~/.hq/cognito-tokens.json`,
- * read through `loadCachedTokens`). The person uid is the `custom:entityUid`
- * claim of the ID token (falling back to the access token), and only a
- * `prs_` value counts. Agent (`agt_`) or unknown identities return null, so
- * no opt-in is written or kept for them. Claims are read without
- * verification; this decides only whether local consent belongs to the
- * account that is signed in, never authorization.
+ * read through `loadCachedTokens`). The identity key is the Cognito `sub`
+ * claim of the ID token (falling back to the access token); it must be a
+ * non-empty string. Human sessions carry no `custom:entityUid` claim (hq-pro
+ * sets it only on agent and outpost machine identities), so it is not used.
+ * An agent or outpost session has its own Cognito user and therefore a
+ * different `sub`, so it could never match a person's opt-in; a token that
+ * names a machine identity (`custom:entityType` agent/outpost, or a
+ * non-`prs_` `custom:entityUid`) is refused outright. Claims are read
+ * without verification; this decides only whether local consent belongs to
+ * the account that is signed in, never authorization.
  */
-import { isPersonUid } from "./config.js";
+import { isCognitoSub } from "./config.js";
 function claimsOf(token) {
     if (typeof token !== "string")
         return null;
@@ -26,13 +30,22 @@ function claimsOf(token) {
         return null;
     }
 }
-export function personUidFromTokens(tokens) {
+export function cognitoSubFromTokens(tokens) {
     if (!tokens)
         return null;
     for (const token of [tokens.idToken, tokens.accessToken]) {
-        const uid = claimsOf(token)?.["custom:entityUid"];
-        if (isPersonUid(uid))
-            return uid;
+        const claims = claimsOf(token);
+        if (!claims)
+            continue;
+        const entityType = claims["custom:entityType"];
+        const entityUid = claims["custom:entityUid"];
+        if (entityType === "agent" || entityType === "outpost")
+            return null;
+        if (typeof entityUid === "string" && !entityUid.startsWith("prs_"))
+            return null;
+        const sub = claims.sub;
+        if (isCognitoSub(sub))
+            return sub.trim();
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.4",
+  "version": "5.345.6",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {