@indigoai-us/hq-cli 5.345.41 → 5.345.43

package/dist/commands/lanes.js

@@ -37,7 +37,7 @@ import { laneDepthCap } from "../lib/lanes/depth-cap.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "../lib/lanes/registry-flag.js";
-import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_LIST_SKIP_REMOTE_REFRESH_FLAG, LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG, LANE_REUSE_REFRESHES_PROFILE_FLAG, } from "../lib/lanes/flag-keys.js";
+import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_LIST_SKIP_REMOTE_REFRESH_FLAG, LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG, LANE_PROFILE_PIN_EXHAUSTED_FALLBACK_FLAG, LANE_REUSE_REFRESHES_PROFILE_FLAG, } from "../lib/lanes/flag-keys.js";
 import { configuredCodexRolloutHomes, retainCodexRollouts } from "../lib/lanes/disk-guard.js";
 import { isControllerAliasOutpostId } from "../lib/lanes/admission-host.js";
 import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
@@ -4221,12 +4221,99 @@ function authorizeFailedResume(ctx, lane, encodedContext) {
         }
         return context.actor;
     }
-    const callerAuthorization = callerSeniorAuthorization(ctx, lane.senior);
+    const callerAuthorization = failedResumeCallerAuthorization(ctx, lane);
     if (!callerAuthorization.authorized) {
-        throw new LanesError("failed_resume_unauthorized", appendCallerSeniorReason("Only the lane's senior may resume a failed lane with --from-failed", callerAuthorization), { lane_id: lane.lane_id, reason: callerAuthorization.reason });
+        throw new LanesError("failed_resume_unauthorized", appendCallerSeniorReason("Only an ancestor in the lane's senior history or its company manager may resume a failed lane with --from-failed", callerAuthorization), { lane_id: lane.lane_id, reason: callerAuthorization.reason });
     }
     return resumeProfileRepinActor(ctx);
 }
+function failedResumeCallerAuthorization(ctx, lane) {
+    const direct = callerSeniorAuthorization(ctx, lane.senior);
+    if (direct.authorized)
+        return direct;
+    const hqRoot = ctx.hqRoot();
+    const targetCompany = resolveLaneCompany(hqRoot, lane).company;
+    const visited = new Set();
+    const pending = [
+        lane.senior,
+        ...lane.senior_history.flatMap((entry) => [entry.from, entry.to]),
+    ];
+    while (pending.length > 0) {
+        const ref = pending.pop();
+        const key = seniorKey(ref);
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        if (ref.kind === "user") {
+            if (targetCompany === null && callerSeniorAuthorization(ctx, ref).authorized) {
+                return { authorized: true };
+            }
+            continue;
+        }
+        if (!ref.id)
+            continue;
+        if (ref.kind === "lane") {
+            const ancestor = tryReadLane(hqRoot, ref.id);
+            if (!ancestor)
+                continue;
+            const ancestorCompany = resolveLaneCompany(hqRoot, ancestor).company;
+            if (!sameLaneCompany(targetCompany, ancestorCompany))
+                continue;
+            if (callerSeniorAuthorization(ctx, ref).authorized)
+                return { authorized: true };
+            pending.push(ancestor.senior, ...ancestor.senior_history.flatMap((entry) => [entry.from, entry.to]));
+            continue;
+        }
+        if (ref.kind === "session") {
+            const loaded = loadSessionMeta(hqRoot, ref.id, ctx);
+            if (loaded.status !== "ok")
+                continue;
+            const sessionCompany = companyBindingFromSessionMeta(loaded.doc);
+            const sessionCompanyRef = sessionCompany.binding === "company"
+                ? { slug: sessionCompany.slug ?? "", uid: sessionCompany.uid ?? "" }
+                : null;
+            if (targetCompany === null) {
+                if (sessionCompany.binding !== "none")
+                    continue;
+            }
+            else if (sessionCompany.binding !== "company" ||
+                !sameLaneCompany(targetCompany, sessionCompanyRef)) {
+                continue;
+            }
+            if (callerSeniorAuthorization(ctx, ref).authorized)
+                return { authorized: true };
+            const value = sessionSeniorValue(loaded.doc);
+            if (typeof value === "string" && value.trim() !== "") {
+                try {
+                    pending.push(parseSeniorRef(value));
+                }
+                catch {
+                    continue;
+                }
+            }
+            else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+                const senior = value;
+                if (senior.kind === "user")
+                    continue;
+                if ((senior.kind === "lane" || senior.kind === "session") &&
+                    typeof senior.id === "string" && senior.id.trim() !== "") {
+                    pending.push({ kind: senior.kind, id: senior.id });
+                }
+            }
+        }
+    }
+    const callerLaneId = ctx.env.HQ_LANE_ID?.trim();
+    const callerLane = callerLaneId ? tryReadLane(hqRoot, callerLaneId) : null;
+    if (callerLane && targetCompany !== null) {
+        const callerCompany = resolveLaneCompany(hqRoot, callerLane).company;
+        if (callerCompany !== null &&
+            sameLaneCompany(targetCompany, callerCompany) &&
+            resolveManagerStatusTarget(hqRoot, callerLane).manager) {
+            return { authorized: true };
+        }
+    }
+    return { authorized: false, reason: "caller is not an ancestor lane or session, nor the lane's same-company manager" };
+}
 function workerProfileHashMismatch(lane, profile, callerAuthorization) {
     const message = `Worker profile ${JSON.stringify(profile.id)} on Outpost ${lane.host.id} does not match the hash recorded by the lane`;
     return new LanesError("worker_profile_hash_mismatch", callerAuthorization && !callerAuthorization.authorized
@@ -6836,7 +6923,7 @@ async function prepareAccountMove(ctx, lane, input) {
                 account: target,
                 ...(input.accountSource !== undefined ? { account_source: input.accountSource } : {}),
                 ...(input.accountSelection !== undefined ? { account_selection: input.accountSelection } : {}),
-                admission_accounts: undefined,
+                admission_accounts: input.preserveAdmissionAccounts ? current.admission_accounts : undefined,
                 provider_session_id: sessionId,
                 provider_session_id_absent: undefined,
                 ...(input.cliModel !== undefined
@@ -6866,6 +6953,9 @@ async function prepareAccountMove(ctx, lane, input) {
                 ...(input.refreshProfileSettings === true ? { refreshProfileSettings: true } : {}),
                 at,
             });
+            if (input.preserveAdmissionAccounts && current.admission_accounts !== undefined) {
+                next.admission_accounts = [...current.admission_accounts];
+            }
             if (input.deferTurnStart) {
                 next.state = current.state;
             }
@@ -6989,53 +7079,112 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         });
     }
     catch (err) {
-        const accountReasons = err instanceof LanesError &&
-            err.error === "claude_account_balance_no_eligible_account" &&
-            Array.isArray(err.details.account_reasons)
-            ? err.details.account_reasons.filter((reason) => reason !== null && typeof reason === "object" && !Array.isArray(reason))
-            : [];
+        if (!(err instanceof LanesError) || err.error !== "claude_account_balance_no_eligible_account")
+            throw err;
         const unavailablePinReasons = new Set(["disabled", "home_missing", "not_logged_in", "quota_held"]);
-        const everyProfileAccountUnavailable = profilePin !== undefined && profilePin.length > 0 &&
-            profilePin.every((account) => accountReasons.some((reason) => reason.account === account && typeof reason.reason === "string" && unavailablePinReasons.has(reason.reason)));
-        if (!everyProfileAccountUnavailable || lane.account === undefined ||
-            (lane.admission_accounts !== undefined && !lane.admission_accounts.includes(lane.account)))
+        if (profilePin === undefined || profilePin.length === 0)
             throw err;
-        const recordedSelection = selectClaudeAccount({
-            ...selectionInput,
-            allowedAccounts: [lane.account],
-        });
+        // Admission scope can hide the profile accounts from the first selection's
+        // diagnostics. Re-evaluate only the pin so exhaustion means an unavailable
+        // account, not merely an empty intersection with admission_accounts.
+        let pinnedAccountReasons;
+        try {
+            selectClaudeAccount({ ...selectionInput, allowedAccounts: profilePin });
+            throw err;
+        }
+        catch (pinErr) {
+            if (pinErr === err)
+                throw pinErr;
+            if (!(pinErr instanceof LanesError) || pinErr.error !== "claude_account_balance_no_eligible_account")
+                throw err;
+            pinnedAccountReasons = Array.isArray(pinErr.details.account_reasons)
+                ? pinErr.details.account_reasons.filter((reason) => reason !== null && typeof reason === "object" && !Array.isArray(reason))
+                : [];
+        }
+        pinnedAccountReasons = pinnedAccountReasons.filter((reason) => typeof reason.account === "string" && profilePin.includes(reason.account));
+        const everyProfileAccountUnavailable = profilePin.every((account) => pinnedAccountReasons.some((reason) => reason.account === account && typeof reason.reason === "string" && unavailablePinReasons.has(reason.reason)));
+        if (!everyProfileAccountUnavailable)
+            throw err;
+        // Refreshing profile settings is allowed to change the account pin. Keep
+        // that operation on its existing selection path instead of applying this
+        // fallback against a profile snapshot that is being refreshed.
+        if (options.refreshProfileSettings === true)
+            throw err;
+        let fallbackSelection;
+        if (lane.account !== undefined && lane.admission_accounts?.includes(lane.account) !== false) {
+            try {
+                fallbackSelection = selectClaudeAccount({ ...selectionInput, allowedAccounts: [lane.account] });
+            }
+            catch (recordedErr) {
+                if (!(recordedErr instanceof LanesError) || recordedErr.error !== "claude_account_balance_no_eligible_account") {
+                    throw recordedErr;
+                }
+            }
+        }
+        if (fallbackSelection === undefined) {
+            const resolution = resolveLaneCompany(hqRoot, lane);
+            const company = resolution.company ?? undefined;
+            const exhaustedPinFallbackEnabled = await readLanesRegistryFlagFailOff(LANE_PROFILE_PIN_EXHAUSTED_FALLBACK_FLAG, {
+                company,
+                ...(company ? { companyUidSource: laneCompanyUidSource(resolution.source) } : {}),
+                env: ctx.env,
+            }, readLanesRegistryFlag);
+            if (!exhaustedPinFallbackEnabled)
+                throw err;
+            try {
+                fallbackSelection = selectClaudeAccount({
+                    ...selectionInput,
+                    ...(lane.admission_accounts !== undefined ? { allowedAccounts: lane.admission_accounts } : {}),
+                });
+            }
+            catch (balanceErr) {
+                if (!(balanceErr instanceof LanesError) || balanceErr.error !== "claude_account_balance_no_eligible_account") {
+                    throw balanceErr;
+                }
+                const balancerAccountReasons = Array.isArray(balanceErr.details.account_reasons)
+                    ? balanceErr.details.account_reasons.filter((reason) => reason !== null && typeof reason === "object" && !Array.isArray(reason) &&
+                        reason.reason !== "not_allowed_by_lane")
+                    : [];
+                throw new LanesError(balanceErr.error, balanceErr.message, {
+                    ...balanceErr.details,
+                    account_reasons: balancerAccountReasons,
+                    profile_pin_reasons: pinnedAccountReasons,
+                    balancer_account_reasons: balancerAccountReasons,
+                });
+            }
+        }
         selected = {
-            ...recordedSelection,
-            considered: recordedSelection.considered.map((entry) => {
-                const pinnedReason = profilePin.includes(entry.account)
-                    ? accountReasons.find((reason) => reason.account === entry.account)?.reason
-                    : undefined;
+            ...fallbackSelection,
+            considered: fallbackSelection.considered.map((entry) => {
+                const pinnedReason = pinnedAccountReasons.find((reason) => reason.account === entry.account)?.reason;
                 return typeof pinnedReason === "string"
                     ? { ...entry, eligible: false, ineligible_reason: pinnedReason }
                     : entry;
             }),
             skipped_accounts: [
-                ...recordedSelection.skipped_accounts.filter((entry) => !profilePin.includes(entry.account)),
+                ...fallbackSelection.skipped_accounts.filter((entry) => !profilePin.includes(entry.account)),
                 ...profilePin.map((account) => ({
                     account,
                     host: lane.host,
-                    reason: String(accountReasons.find((entry) => entry.account === account)?.reason),
+                    reason: String(pinnedAccountReasons.find((entry) => entry.account === account)?.reason),
                 })),
             ],
         };
         profilePinUnavailable = true;
     }
-    const historyReason = lane.account === undefined
-        ? "load_balance"
-        : currentConfig?.enabled !== true
-            ? "account_unavailable"
-            : currentLogin === false
-                ? "recorded_account_logged_out"
-                : currentLogin !== true
-                    ? "account_unavailable"
-                    : quotaBlockFor(loadQuotaState(hqRoot), "claude", lane.account, model, ctx.now()).blocked
-                        ? "usage_limit"
-                        : "load_balance";
+    const historyReason = profilePinUnavailable
+        ? "profile_pin_exhausted"
+        : lane.account === undefined
+            ? "load_balance"
+            : currentConfig?.enabled !== true
+                ? "account_unavailable"
+                : currentLogin === false
+                    ? "recorded_account_logged_out"
+                    : currentLogin !== true
+                        ? "account_unavailable"
+                        : quotaBlockFor(loadQuotaState(hqRoot), "claude", lane.account, model, ctx.now()).blocked
+                            ? "usage_limit"
+                            : "load_balance";
     return {
         selection: {
             ...selected,
@@ -7224,19 +7373,26 @@ function assertLaneNotRunningForReparent(lane) {
         throw new LanesError("lane_running", `Cannot re-parent running lane ${lane.lane_id}; wait until it stops first`, { lane_id: lane.lane_id, state: lane.state });
     }
 }
-function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false) {
+async function runReparentLocked(ctx, laneId, opts, finishedChildrenDoNotCount = false) {
     const hqRoot = ctx.hqRoot();
     if (!opts.senior) {
         throw new LanesError("missing_senior", "--senior is required", {});
     }
     const nextSenior = parseSeniorRef(opts.senior);
     assertSeniorExists(hqRoot, nextSenior, ctx);
-    const lane = readLane(hqRoot, laneId);
+    let lane = readLane(hqRoot, laneId);
     assertLaneRunsHereForOperatorMutation(ctx, lane, "reparent");
+    assertLaneNotRunningForReparent(lane);
     const seniorCompany = companyOfSenior(hqRoot, nextSenior, ctx);
     if (lane.company === null && seniorCompany.binding === "company") {
-        const company = seniorCompany.slug ?? seniorCompany.uid ?? "<company>";
-        throw new LanesError("lane_company_missing", `Lane ${laneId} has no company attribution. Repair it with hq lanes repair-company ${laneId} --company ${company}, then retry reparent.`, { lane_id: laneId, senior: nextSenior, senior_company: serializeSeniorCompany(seniorCompany) });
+        const company = seniorCompany.slug ?? (seniorCompany.uid
+            ? canonicalCompanySlugForUid(hqRoot, seniorCompany.uid, nextSenior)
+            : undefined);
+        if (!company) {
+            throw new LanesError("lane_company_missing", `Lane ${laneId} has no company attribution and the destination senior's company cannot be resolved`, { lane_id: laneId, senior: nextSenior, senior_company: serializeSeniorCompany(seniorCompany) });
+        }
+        await repairCompanyOnOwner(ctx, laneId, { company }, false);
+        lane = readLane(hqRoot, laneId);
     }
     assertSameTenant(lane.company, nextSenior, seniorCompany, { lane_id: laneId });
     if (nextSenior.kind === "lane" && seniorKey(lane.senior) !== seniorKey(nextSenior)) {
@@ -7372,7 +7528,7 @@ async function runRepairCompany(ctx, laneId, opts) {
     }
     await repairCompanyOnOwner(ctx, laneId, opts);
 }
-async function repairCompanyOnOwner(ctx, laneId, opts) {
+async function repairCompanyOnOwner(ctx, laneId, opts, emitResult = true) {
     const hqRoot = ctx.hqRoot();
     const companySlug = opts.company?.trim();
     if (!companySlug) {
@@ -7450,7 +7606,9 @@ async function repairCompanyOnOwner(ctx, laneId, opts) {
     const repairedLane = readLane(hqRoot, laneId);
     syncLaneToProjectStoryLedger(hqRoot, repairedLane, migratedQuestionRefs);
     removeLaneFromProjectStoryLedger(hqRoot, initial);
-    printJson({ ok: true, action: "repair-company", lane_id: laneId, lane: repairedLane, migrated_pending_questions: migratedQuestionRefs.length });
+    if (emitResult) {
+        printJson({ ok: true, action: "repair-company", lane_id: laneId, lane: repairedLane, migrated_pending_questions: migratedQuestionRefs.length });
+    }
 }
 async function runRepairCompanyOwnerTarget(ctx, laneId, opts) {
     if (!ctx.isSsmOwnerDispatch()) {
@@ -8476,7 +8634,8 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
                 const moved = await prepareAccountMove(ctx, recoveredLane, {
                     account: selection.account,
                     cliModel: pendingModel,
-                    accountHistoryReason: "keep_alive_resume",
+                    accountHistoryReason: automatic.historyReason === "profile_pin_exhausted" ? automatic.historyReason : "keep_alive_resume",
+                    ...(automatic.historyReason === "profile_pin_exhausted" ? { preserveAdmissionAccounts: true } : {}),
                     ...(pendingModel === undefined && automatic.preservedModel !== undefined
                         ? { preservedModel: automatic.preservedModel }
                         : {}),
@@ -9185,10 +9344,10 @@ export function registerLanesCommand(parent, deps = {}) {
     }));
     lanes
         .command("resume")
-        .description("Resume an interrupted, done or blocked lane, or an awaiting_input lane with no answerable question; recover failed lanes with the senior-only --from-failed option")
+        .description("Resume an interrupted, done or blocked lane, or an awaiting_input lane with no answerable question; recover failed lanes with --from-failed as a senior ancestor or same-company manager")
         .argument("<lane-id>", "Lane id")
         .option("--text <msg>", "Operator message for the resumed turn")
-        .option("--from-failed", "Explicitly resume a failed lane as its senior")
+        .option("--from-failed", "Explicitly resume a failed lane as an ancestor or same-company manager")
         .option("--reason <text>", "Required explanation for resuming from failed")
         .option("--project <slug>", "Re-point project attribution; a changed story is named in the resumed prompt")
         .option("--story <id>", "Re-point story attribution; a changed story is named in the resumed prompt")

package/dist/lib/anywhere-person-setting.d.ts

@@ -1,5 +1,7 @@
 export interface ReadHqAnywherePersonSettingOptions {
     readSetting?: () => Promise<boolean | null>;
+    readFlag?: (env: NodeJS.ProcessEnv) => boolean;
+    refreshFlag?: () => Promise<void>;
     getPersonToken?: () => Promise<string>;
     fetchImpl?: typeof fetch;
     apiBaseUrl?: string;

package/dist/lib/anywhere-person-setting.js

@@ -33,7 +33,8 @@ export function evaluateAnywhereRuntime(flagEnabled, setting) {
 }
 /** The operator flag always wins; the person preference is fetched only while it is on. */
 export async function anywhereRuntimeAllowed(env = process.env, options = {}) {
-    if (!anywhereRuntimeEnabledFromSnapshot(env))
+    await options.refreshFlag?.();
+    if (!(options.readFlag ?? anywhereRuntimeEnabledFromSnapshot)(env))
         return false;
     const setting = options.readSetting ? await options.readSetting() : await readHqAnywherePersonSetting({ ...options, env });
     return evaluateAnywhereRuntime(true, setting).enabled;

package/dist/lib/anywhere-runtime-fast-flag.js

@@ -1,6 +1,6 @@
 import { readLocalOverride, resolveFlag } from "@indigoai-us/hq-flags-client";
 import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
-import { readFlagSnapshotFile } from "./flag-snapshot-file.js";
+import { readFlagSnapshotFile, readPersonFlagSnapshotFile } from "./flag-snapshot-file.js";
 import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag-key.js";
 /** Resolve the Anywhere gate from hq-flags without loading the CLI's large worker bundle. */
 export function anywhereRuntimeEnabledFromSnapshot(env = process.env) {
@@ -8,10 +8,16 @@ export function anywhereRuntimeEnabledFromSnapshot(env = process.env) {
     if (local !== null)
         return local;
     const company = resolveProcessFlagCompanyContext(env);
-    const persisted = company.companyUid ? readFlagSnapshotFile(company.companyUid, { env }) : null;
+    const hasCompanyContext = Boolean(company.companyUid || company.companySlug);
+    const persisted = company.companyUid
+        ? readFlagSnapshotFile(company.companyUid, { env })
+        : hasCompanyContext
+            ? null
+            : readPersonFlagSnapshotFile({ env });
     const snapshot = persisted
         ? { version: 0, flags: persisted.flags }
         : null;
+    // HQ Anywhere authorizes a capability, so a missing or stale snapshot fails closed.
     return resolveFlag({
         flagKey: HQ_ANYWHERE_RUNTIME_FLAG,
         env,

package/dist/lib/daemon/anywhere-listener.d.ts

@@ -0,0 +1,16 @@
+import type { HqdServer } from "./server.js";
+export interface HqdRuntimeListenerOptions {
+    isEnabled: () => Promise<boolean>;
+    startServer: () => Promise<HqdServer>;
+    onServerChange?: (server: HqdServer | null) => void;
+    intervalMs?: number;
+    schedule?: (callback: () => void, delayMs: number) => () => void;
+    log?: (error: unknown) => void;
+}
+export interface HqdRuntimeListener {
+    refresh(): Promise<void>;
+    close(): Promise<void>;
+}
+/** Keep the local hqd listener aligned with the live flag and person setting. */
+export declare function startHqdRuntimeListener(options: HqdRuntimeListenerOptions): Promise<HqdRuntimeListener>;
+//# sourceMappingURL=anywhere-listener.d.ts.map

package/dist/lib/daemon/anywhere-listener.js

@@ -0,0 +1,79 @@
+/** Keep the local hqd listener aligned with the live flag and person setting. */
+export async function startHqdRuntimeListener(options) {
+    const intervalMs = options.intervalMs ?? 60_000;
+    const log = options.log ?? (() => { });
+    const schedule = options.schedule ?? ((callback, delayMs) => {
+        const timer = setInterval(callback, delayMs);
+        timer.unref();
+        return () => clearInterval(timer);
+    });
+    let server = null;
+    let closed = false;
+    let inFlight = null;
+    const refresh = () => {
+        if (closed)
+            return Promise.resolve();
+        if (inFlight)
+            return inFlight;
+        inFlight = (async () => {
+            let enabled = false;
+            try {
+                enabled = await options.isEnabled();
+            }
+            catch (error) {
+                log(error);
+            }
+            if (closed || enabled === (server !== null))
+                return;
+            if (enabled) {
+                try {
+                    const opened = await options.startServer();
+                    if (closed) {
+                        await opened.close();
+                        return;
+                    }
+                    server = opened;
+                    options.onServerChange?.(server);
+                }
+                catch (error) {
+                    log(error);
+                }
+                return;
+            }
+            const current = server;
+            server = null;
+            options.onServerChange?.(null);
+            if (current) {
+                try {
+                    await current.close();
+                }
+                catch (error) {
+                    log(error);
+                }
+            }
+        })().finally(() => {
+            inFlight = null;
+        });
+        return inFlight;
+    };
+    await refresh();
+    if (closed)
+        return { refresh, close: async () => { } };
+    const cancel = schedule(() => { void refresh(); }, intervalMs);
+    return {
+        refresh,
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            cancel();
+            await inFlight;
+            const current = server;
+            server = null;
+            options.onServerChange?.(null);
+            if (current)
+                await current.close();
+        },
+    };
+}
+//# sourceMappingURL=anywhere-listener.js.map

package/dist/lib/daemon/run.js

@@ -35,6 +35,7 @@ import { detectMachineType } from "./machine-type.js";
 import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
 import { hqdSocketPath } from "./protocol.js";
 import { startHqdServer } from "./server.js";
+import { startHqdRuntimeListener } from "./anywhere-listener.js";
 import { heartbeatFile, startHeartbeat } from "./heartbeat.js";
 import { createProtocolTail, ensureProtocolFifo, openProtocolWriter } from "./protocol-tail.js";
 import { takeControlRequests } from "./requests.js";
@@ -835,14 +836,19 @@ export async function runDaemon(opts) {
         return on;
     };
     // hqd: the session/company socket every runtime talks to (hq-anywhere US-008).
-    let hqd = null;
     let hqdShutdown = null;
-    if (shouldStartHqd(await anywhereRuntimeAllowed(env, {
-        onError: (name) => log("warn", `hqd person setting read failed (${name}); runtime remains off`),
-    }))) {
-        try {
+    let stopHeartbeat = () => { };
+    const hqdListener = await startHqdRuntimeListener({
+        isEnabled: async () => shouldStartHqd(await anywhereRuntimeAllowed(env, {
+            refreshFlag: async () => {
+                const { refreshFlagRegistrySnapshot } = await import("../flag-registry.js");
+                await refreshFlagRegistrySnapshot(5_000);
+            },
+            onError: (name) => log("warn", `hqd person setting read failed (${name}); runtime remains off`),
+        })),
+        startServer: async () => {
             const startConfig = readDaemonConfig(paths.configPath);
-            hqd = await startHqdServer({
+            return startHqdServer({
                 socketPath: hqdSocketPath(home, env),
                 registryPath: registryFile(registryDir(home, env)),
                 hqRoot: startConfig.hqRoot ?? (env.HQ_ROOT?.trim() || undefined),
@@ -850,24 +856,25 @@ export async function runDaemon(opts) {
                 onShutdown: () => hqdShutdown?.(),
                 reportError: reportHqdCrash,
             });
-        }
-        catch (err) {
-            log("error", `hqd socket did not start; services run without it: ${err.message}`);
-        }
-    }
-    // US-012: 60s presence heartbeat with version and session count.
-    const liveHqd = hqd;
-    const stopHeartbeat = liveHqd
-        ? startHeartbeat({
-            version: CLI_VERSION,
-            sessionCount: () => liveHqd.sessions.size,
-            file: heartbeatFile(home, env),
-            log,
-        })
-        : () => { };
+        },
+        onServerChange: (server) => {
+            stopHeartbeat();
+            stopHeartbeat = () => { };
+            if (!server)
+                return;
+            // US-012: 60s presence heartbeat with version and session count.
+            stopHeartbeat = startHeartbeat({
+                version: CLI_VERSION,
+                sessionCount: () => server.sessions.size,
+                file: heartbeatFile(home, env),
+                log,
+            });
+        },
+        intervalMs: 60_000,
+        log: (error) => log("error", `hqd socket listener update failed: ${error.message ?? String(error)}`),
+    });
     const closeHqd = () => {
-        stopHeartbeat();
-        void hqd?.close().catch((err) => log("warn", `hqd socket did not close cleanly: ${err.message}`));
+        void hqdListener.close().catch((err) => log("warn", `hqd socket did not close cleanly: ${err.message}`));
     };
     return await new Promise((resolve) => {
         let stopping = false;

package/dist/lib/db/control-plane.d.ts

@@ -24,6 +24,38 @@ export interface RemoteStatusResponse {
         secretRef: string;
     } | null;
 }
+export type RemoteAppLimitState = "ok" | "warn" | "overage" | "locked";
+/** One app that owns its cluster. Cents are whole US cents; `estimate` is null for an exempt company. */
+export interface RemoteAppUsage {
+    appId: string;
+    period: string;
+    measuredAt: string | null;
+    ended: boolean;
+    state: RemoteAppLimitState;
+    locked: boolean;
+    exempt: boolean;
+    dpu: {
+        used: number;
+        included: number;
+        overage: number;
+        ceiling: number;
+        pct: number;
+    };
+    storage: {
+        usedBytes: number;
+        billedBytes: number;
+        includedBytes: number;
+        overageGbMonth: number;
+        ceilingBytes: number;
+        pct: number;
+    };
+    estimate: {
+        baseCents: number;
+        dpuOverageCents: number;
+        storageOverageCents: number;
+        totalCents: number;
+    } | null;
+}
 export interface RemoteUsageResponse {
     companyUid: string;
     dpuUsed: number;
@@ -34,7 +66,20 @@ export interface RemoteUsageResponse {
     pctStorage: number;
     period: string;
     measuredAt: string | null;
+    /** False when every app owns its own cluster and there is no shared company database. */
+    companyCluster?: boolean;
+    apps?: RemoteAppUsage[];
 }
+/** Answer for one app: its own numbers, or the company numbers when it shares the company cluster. */
+export type RemoteAppUsageResponse = (RemoteAppUsage & {
+    companyUid: string;
+    mode: "app-cluster";
+    status?: string;
+}) | (RemoteUsageResponse & {
+    appId: string;
+    mode: "company-cluster";
+    exempt?: boolean;
+});
 /**
  * Scoped temporary AWS credentials for one app's database role. The control
  * plane would issue these from `POST /v1/db/apps/{appId}/session`.
@@ -74,6 +119,7 @@ export declare class ControlPlaneDbClient {
         region?: string;
     }): Promise<RemoteProvisionResponse>;
     status(companyUid: string): Promise<RemoteStatusResponse>;
+    appUsage(companyUid: string, appId: string): Promise<RemoteAppUsageResponse>;
     usage(companyUid: string): Promise<RemoteUsageResponse>;
     appSession(input: {
         companyUid: string;

package/dist/lib/db/control-plane.js

@@ -78,6 +78,20 @@ export class ControlPlaneDbClient {
         }
         return JSON.parse(text);
     }
+    async appUsage(companyUid, appId) {
+        const token = await this.getAccessToken();
+        const query = `companyUid=${encodeURIComponent(companyUid)}&appId=${encodeURIComponent(appId)}`;
+        const res = await this.fetchImpl(`${this.baseUrl}/v1/db/usage?${query}`, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(DB_STATUS_TIMEOUT_MS),
+        });
+        const text = await res.text();
+        assertNoPostgresUrl("usage", text);
+        if (!res.ok)
+            throw httpError("usage", res.status, text);
+        return JSON.parse(text);
+    }
     async usage(companyUid) {
         const token = await this.getAccessToken();
         const url = `${this.baseUrl}/v1/db/usage?companyUid=${encodeURIComponent(companyUid)}`;