@indigoai-us/hq-cli 5.345.46 → 5.345.47

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.345.47] — 2026-10-08
+- `hq files share` now shows the server's reason when a private folder conflicts with its shared folder glob, for example that the glob still has grants or that only its creator or a company admin can replace it.
+- After `hq install --global`, unauthenticated `claude` and `codex` commands show provider-specific sign-in instructions; Codex HTTP 401 transport text is kept in the HQ log.
+- The CLI now stops before updating when a separate pnpm global install shadows the running `hq` command on PATH, preventing an update from modifying the wrong install tree.
+- Keep lanes resumable when a provider quota refusal includes a known reset, and retry them after reset when quota account failover is enabled. Record generic rate limits separately from account quotas, billing refusals, and auth failures.
+- Windows delegate send parity tests now budget the Bash fallback and reuse the runtime probe.
+
 ## [5.345.46] — 2026-10-08
 - Global Claude hooks installed by `hq install --global` now point `HQ_ROOT` and `CLAUDE_PROJECT_DIR` at the HQ root. Sessions outside the HQ folder now load HQ policies, and hook state stays inside HQ instead of creating a `workspace/` folder in the project. To update an existing install, re-run `hq install --global --runtime claude`.
 - `hq install --global --runtime codex` now trusts the HQ hooks it registers in `~/.codex/hooks.json`. Codex skips untrusted hooks, so before this HQ hooks never ran in Codex sessions outside the HQ folder. Only HQ entries are trusted; other hooks in the file are left alone. If Codex cannot be reached, the install still completes and tells you to approve the hooks with `/hooks`.

package/dist/commands/files.js

@@ -835,7 +835,10 @@ async function runDirectGrant(params) {
             console.error(chalk.red("ACL record not found — the prefix may not have an ACL yet"));
         }
         else if (res.status === 409 && body.code === "ACL_PATTERN_CONFLICT") {
-            console.error(chalk.red(formatAclPatternConflict(canonicalPrefix, body.message)));
+            // hq-pro sends the specific reason (the sibling still has grants, or only
+            // its creator or an admin may replace it) in `error`; older servers used
+            // `message`. Show whichever is present instead of dropping it.
+            console.error(chalk.red(formatAclPatternConflict(canonicalPrefix, body.message ?? body.error)));
         }
         else if (res.status === 409) {
             console.error(chalk.red("Concurrent modification — please retry"));

package/dist/commands/install-global.d.ts

@@ -22,6 +22,8 @@ export interface GlobalInstallOptions {
     via?: 'direct' | 'plugin';
     /** Local Claude Code marketplace directory (or HQ_CLAUDE_PLUGIN_MARKETPLACE). */
     marketplaceDir?: string;
+    /** Install the provider PATH wrappers after the hq-anywhere flag check. */
+    installProviderWrappers?: boolean;
     /** GitHub repository for the published HQ plugin marketplace. */
     marketplaceRepository?: string;
     /** Test seam for the Claude Code CLI; production uses `claude`. */

package/dist/commands/install-global.js

@@ -27,6 +27,7 @@ import { trustCodexUserHooks } from '../utils/hook-trust.js';
 import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK, SYSTEM_UNIT_DIR } from '../lib/daemon/install.js';
 import { readDaemonConfig } from '../lib/daemon/config.js';
 import { daemonPaths } from '../lib/daemon/paths.js';
+import { assertProviderWrappersInstallable, installProviderWrappers, providerWrapperInstallPaths, removeProviderWrappers } from '../lib/install/provider-wrappers.js';
 import { addAgentsMdBlock, addCodexHooks, classifyLegacySkills, codexAdapterPath, codexCharterSource, codexHookTrustKeys, codexTargets, hasAllCodexHooks, HQ_OWNED_MARKER, LEGACY_BACKUP_NAME, LEGACY_SKILLS_NAME, removeAgentsMdBlock, removeCodexHooks, } from '../lib/install/codex-targets.js';
 import { addClaudeMdBlock, addHqHooks, charterPath, claudeTargets, hasAllHqHooks, HQ_ANYWHERE_PACK, HQ_MCP_SERVER_NAME, hqSkillsSource, lineDiff, masterHookPath, shimPath, MCP_SUBPROCESS_PATH, removeClaudeMdBlock, removeHqHooks, SKILL_LINK_PREFIX, } from '../lib/install/claude-targets.js';
 /** True when an hq daemon unit (launchd plist or systemd unit) exists. */
@@ -348,7 +349,14 @@ export function installGlobalClaude(opts) {
     const env = opts.env ?? process.env;
     const log = opts.log ?? ((l) => console.log(l));
     const hqRoot = opts.hqRoot;
+    const providerBin = path.join(home, '.hq', 'bin');
+    // The wrappers are /bin/sh scripts reached through POSIX startup files, so a
+    // Windows shell would never pick them up. Skip them until a native shim exists.
+    const providerWrappersEnabled = process.platform !== 'win32'
+        && (opts.installProviderWrappers ?? isAnywhereEnabled(home, env));
     assertHqRoot(hqRoot);
+    if (providerWrappersEnabled)
+        assertProviderWrappersInstallable(providerBin);
     const t = claudeTargets(home);
     const prior = readState(t);
     const pluginSource = opts.via === 'plugin' ? resolveClaudePluginSource(opts.marketplaceDir, env, opts.marketplaceRepository) : undefined;
@@ -429,6 +437,8 @@ export function installGlobalClaude(opts) {
     if (pluginSource)
         touched.push(t.settingsJson);
     touched.push(regFile, t.stateFile);
+    if (providerWrappersEnabled)
+        touched.push(...providerWrapperInstallPaths(home));
     if (opts.dryRun) {
         log(`hq install --global --runtime claude --dry-run (HQ root ${hqRoot})`);
         log('Would write:');
@@ -560,6 +570,8 @@ export function installGlobalClaude(opts) {
         seeded: [...new Set([...(prior?.seeded ?? []), ...ownedSeeded])].sort(),
     };
     writeFileAtomic(t.stateFile, `${JSON.stringify(state, null, 2)}\n`);
+    if (providerWrappersEnabled)
+        installProviderWrappers(providerBin, home);
     log(`HQ installed for Claude Code from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
     reportSkippedSkills(skills, log, false);
@@ -634,6 +646,9 @@ export function uninstallGlobalClaude(opts = {}) {
     }
     const pointer = readOrNull(t.hqPointer);
     const codexStillInstalled = fs.existsSync(codexTargets(home).stateFile);
+    const providerBin = path.join(home, '.hq', 'bin');
+    if (!codexStillInstalled)
+        touched.push(path.join(providerBin, 'claude'), path.join(providerBin, 'codex'));
     const pointerOwned = !codexStillInstalled && pointer !== null && pointer.trim() === hqRoot;
     if (pointerOwned)
         touched.push(t.hqPointer);
@@ -656,6 +671,8 @@ export function uninstallGlobalClaude(opts = {}) {
     if (pluginSource && state?.plugin?.marketplaceAdded) {
         runClaude(['marketplace', 'remove', '--scope', 'user', pluginSource.marketplaceName], home, env);
     }
+    if (!codexStillInstalled)
+        removeProviderWrappers(providerBin);
     unregisterClaudeServer({ name: HQ_MCP_SERVER_NAME, pack: HQ_ANYWHERE_PACK, env: { home } });
     if (fs.existsSync(t.settingsJson)) {
         writeConfigAtomic({
@@ -739,7 +756,14 @@ export function installGlobalCodex(opts) {
     const env = opts.env ?? process.env;
     const log = opts.log ?? ((l) => console.log(l));
     const hqRoot = opts.hqRoot;
+    const providerBin = path.join(home, '.hq', 'bin');
+    // The wrappers are /bin/sh scripts reached through POSIX startup files, so a
+    // Windows shell would never pick them up. Skip them until a native shim exists.
+    const providerWrappersEnabled = process.platform !== 'win32'
+        && (opts.installProviderWrappers ?? isAnywhereEnabled(home, env));
     assertCodexHqRoot(hqRoot);
+    if (providerWrappersEnabled)
+        assertProviderWrappersInstallable(providerBin);
     if (!isCodexInstalled({ home })) {
         throw Object.assign(new Error(`Codex is not installed (${path.join(home, '.codex')} is missing).`), {
             expected: true,
@@ -793,6 +817,8 @@ export function installGlobalCodex(opts) {
     if (tomlNext !== tomlDoc || legacyPackServerPresent)
         touched.push(t.configToml);
     touched.push(regFile, t.stateFile);
+    if (providerWrappersEnabled)
+        touched.push(...providerWrapperInstallPaths(home));
     if (opts.dryRun) {
         log(`hq install --global --runtime codex --dry-run (HQ root ${hqRoot})`);
         log('Would write:');
@@ -875,6 +901,8 @@ export function installGlobalCodex(opts) {
         seeded: [...new Set([...(prior?.seeded ?? []), ...ownedSeeded])].sort(),
     };
     writeFileAtomic(t.stateFile, `${JSON.stringify(state, null, 2)}\n`);
+    if (providerWrappersEnabled)
+        installProviderWrappers(providerBin, home);
     log(`HQ installed for Codex from ${hqRoot}.`);
     log(`  skills linked: ${skills.link.length} new, ${skills.already.length} already present, ${skills.skipped.length} skipped`);
     reportSkippedSkills(skills, log, false);
@@ -895,8 +923,11 @@ export function uninstallGlobalCodex(opts = {}) {
         throw new Error('No HQ global install found (no install state and no ~/.hq/root).');
     const regFile = opts.registryFile ?? registryFile(registryDir(home, env));
     const claudeStillInstalled = fs.existsSync(claudeTargets(home).stateFile);
+    const providerBin = path.join(home, '.hq', 'bin');
     const packStillInstalled = fs.existsSync(path.join(hqRoot, 'core', 'packages', 'hq-anywhere', 'package.yaml'));
     const touched = [];
+    if (!claudeStillInstalled)
+        touched.push(path.join(providerBin, 'claude'), path.join(providerBin, 'codex'));
     const tomlDoc = readConfigDoc(t.configToml, codexConfigFormat).doc;
     const servers = tomlDoc.value.mcp_servers;
     if (!packStillInstalled && servers?.[HQ_MCP_SERVER_NAME]?._hqPack === HQ_ANYWHERE_PACK)
@@ -954,6 +985,8 @@ export function uninstallGlobalCodex(opts = {}) {
     }
     if (!packStillInstalled)
         unregisterCodexServer({ name: HQ_MCP_SERVER_NAME, pack: HQ_ANYWHERE_PACK, env: { home } });
+    if (!claudeStillInstalled)
+        removeProviderWrappers(providerBin);
     // Removal re-serializes the TOML (dropping comments). When what is left equals
     // the pre-install document, put the original bytes back.
     const tomlOriginal = state?.configToml.original ?? null;
@@ -1059,11 +1092,11 @@ export function resolveInstallRoot(explicit, options = {}) {
 export async function runInstallGlobal(opts) {
     const runtime = assertRuntime(opts.runtime);
     const env = opts.env ?? process.env;
+    const enabled = await anywhereRuntimeAllowed(env, {
+        ...(opts.personSettingReader ? { readSetting: opts.personSettingReader } : {}),
+        onError: (name) => (opts.log ?? console.log)(`HQ Anywhere person setting unavailable (${name}); access remains off.`),
+    });
     if (runtime === 'chatgpt' || runtime === 'grok' || opts.dryRun) {
-        const enabled = await anywhereRuntimeAllowed(env, {
-            ...(opts.personSettingReader ? { readSetting: opts.personSettingReader } : {}),
-            onError: (name) => (opts.log ?? console.log)(`HQ Anywhere person setting unavailable (${name}); access remains off.`),
-        });
         if (!enabled)
             throw new AnywhereRuntimeDisabledError();
         if (runtime === 'chatgpt' || runtime === 'grok') {
@@ -1083,6 +1116,7 @@ export async function runInstallGlobal(opts) {
         via: opts.via,
         marketplaceDir: opts.marketplaceDir,
         marketplaceRepository: opts.marketplaceRepository,
+        installProviderWrappers: enabled,
         env,
         log: opts.log,
     });

package/dist/lib/install/provider-wrappers.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Throw if either wrapper target holds a non-HQ command. Callers run this before
+ * any install mutation so a collision cannot leave HQ half-installed.
+ */
+export declare function assertProviderWrappersInstallable(binDir: string): void;
+export declare function providerWrapperInstallPaths(home: string): string[];
+export declare function installProviderWrappers(binDir: string, home?: string): string[];
+export declare function removeProviderWrappers(binDir: string): string[];
+//# sourceMappingURL=provider-wrappers.d.ts.map

package/dist/lib/install/provider-wrappers.js

@@ -0,0 +1,190 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+const marker = '# hq-anywhere provider sign-in wrapper';
+const PROVIDER_PATH_RC_FILES = ['.bashrc', '.bash_profile', '.zshrc', '.zprofile', '.profile'];
+const wrapperHeader = (provider) => `#!/bin/sh\n${marker}: ${provider}\n`;
+/**
+ * Throw if either wrapper target holds a non-HQ command. Callers run this before
+ * any install mutation so a collision cannot leave HQ half-installed.
+ */
+export function assertProviderWrappersInstallable(binDir) {
+    for (const provider of ['claude', 'codex']) {
+        const file = path.join(binDir, provider);
+        let current;
+        try {
+            current = fs.readFileSync(file, 'utf8');
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                continue;
+            throw e;
+        }
+        if (!current.startsWith(wrapperHeader(provider))) {
+            throw new Error(`Refusing to replace an existing ${provider} command at ${file}.`);
+        }
+    }
+}
+export function providerWrapperInstallPaths(home) {
+    const binDir = path.join(home, '.hq', 'bin');
+    const paths = ['claude', 'codex'].map((provider) => path.join(binDir, provider));
+    const pathSetupMarker = path.join(home, '.hq', 'provider-path-installed');
+    if (!fs.existsSync(pathSetupMarker)) {
+        paths.push(pathSetupMarker, ...PROVIDER_PATH_RC_FILES.map((rc) => path.join(home, rc)));
+    }
+    return paths;
+}
+function wrapperSource(provider) {
+    const pretty = provider === 'claude' ? 'Claude Code' : 'Codex';
+    const login = provider === 'claude' ? 'claude /login' : 'codex login';
+    const statusArgs = provider === 'claude' ? 'auth status' : 'login status';
+    const authFailure = provider === 'codex'
+        ? '401|unauthorized|not logged in|signed out|not authenticated|authentication required|unauthenticated|missing.*(bearer|credential|auth)|websocket.*auth'
+        : '401|unauthorized|not logged in|signed out|not authenticated|authentication required|unauthenticated|missing.*(bearer|credential|auth)';
+    const runAuthFailure = provider === 'codex'
+        ? 'HTTP error: *401|status 401|401 Unauthorized|websocket.*auth|not logged in|signed out|not authenticated|authentication required|unauthenticated'
+        : 'HTTP error: *401|status 401|401 Unauthorized|not logged in|signed out|not authenticated|authentication required|unauthenticated';
+    return [
+        '#!/bin/sh',
+        `${marker}: ${provider}`,
+        'set -u',
+        'umask 077',
+        `name=${provider}`,
+        `pretty='${pretty}'`,
+        `login='${login}'`,
+        `provider='${provider}'`,
+        '',
+        '# Skip this managed wrapper and locate the provider executable later in PATH.',
+        'self=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)/$(basename -- "$0")',
+        'real=',
+        'old_ifs=$IFS',
+        'IFS=:',
+        'for dir in $PATH; do',
+        '  [ -n "$dir" ] || dir=.',
+        '  candidate=$(CDPATH= cd -- "$dir" 2>/dev/null && pwd -P)/$name',
+        '  if [ -x "$candidate" ] && [ "$candidate" != "$self" ]; then real=$candidate; break; fi',
+        'done',
+        'IFS=$old_ifs',
+        'if [ -z "$real" ]; then printf \'%s CLI was not found on PATH.\\n\' "$pretty" >&2; exit 127; fi',
+        '',
+        '# The flag override is part of the existing hq-anywhere-runtime flag contract.',
+        'case "${HQ_FLAG_HQ_ANYWHERE_RUNTIME:-}" in false|0) exec "$real" "$@" ;; esac',
+        '',
+        '# Login, auth, and informational commands must remain reachable while signed out.',
+        'case "${1:-}" in',
+        '  --version|-v|--help|-h) exec "$real" "$@" ;;',
+        `  ${provider === 'claude' ? '/login|auth' : 'login'}) exec "$real" "$@" ;;`,
+        'esac',
+        '',
+        'log_dir="$HOME/.hq/logs"',
+        'mkdir -p "$log_dir" 2>/dev/null || :',
+        'log_file="$log_dir/provider-auth.log"',
+        'tmp=$(mktemp -d "${TMPDIR:-/tmp}/hq-provider.XXXXXX") || exit 1',
+        'trap \'rm -rf "$tmp"\' EXIT HUP INT TERM',
+        `if command -v timeout >/dev/null 2>&1; then timeout 5 "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; elif command -v perl >/dev/null 2>&1; then perl -e 'alarm 5; exec @ARGV' "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; else auth_status=124; fi`,
+        'case "$auth_status" in 124|142) : >"$tmp/status-timeout" ;; esac',
+        'if [ "$auth_status" -ne 0 ]; then cat "$tmp/status" >>"$log_file" 2>/dev/null || :; fi',
+        `if [ ! -e "$tmp/status-timeout" ] && grep -Eiq '${authFailure}' "$tmp/status"; then`,
+        '  cat "$tmp/status" >>"$log_file" 2>/dev/null || :',
+        '  printf \'%s\\n\' "[$(date -u +%FT%TZ)] $pretty sign-in check reported unauthenticated" >>"$log_file" 2>/dev/null || :',
+        '  printf \'%s is not signed in. Sign in to use HQ Anywhere:\\n  %s\\n\' "$pretty" "$login" >&2',
+        '  exit 1',
+        'fi',
+        'if [ -t 1 ] && { [ "$provider" = claude ] && [ "${1:-}" != -p ] && [ "${1:-}" != --print ] || [ "$provider" = codex ] && [ "${1:-}" != exec ]; }; then exec "$real" "$@"; fi',
+        '',
+        '# Leave provider stdout attached to the caller so streaming and TTY state survive.',
+        'mkfifo "$tmp/stderr.pipe"',
+        'filter_stderr() {',
+        '  trap - EXIT HUP INT TERM',
+        '  while :; do',
+        '    line=',
+        '    IFS= read -r line',
+        '    read_status=$?',
+        '    [ -n "$line" ] || [ "$read_status" -eq 0 ] || break',
+        '    if printf \'%s\\n\' "$line" | grep -Eiq "' + runAuthFailure + '"; then',
+        '      printf \'%s\\n\' "$line" >>"$tmp/auth-found"',
+        '    else',
+        '      printf \'%s\' "$line" >&2',
+        '      [ "$read_status" -eq 0 ] && printf \'\\n\' >&2',
+        '    fi',
+        '    [ "$read_status" -eq 0 ] || break',
+        '  done <"$tmp/stderr.pipe"',
+        '}',
+        'filter_stderr &',
+        'filter_pid=$!',
+        '"$real" "$@" 2>"$tmp/stderr.pipe"',
+        'status=$?',
+        'wait "$filter_pid"',
+        `if [ "$status" -ne 0 ] && [ -f "$tmp/auth-found" ]; then`,
+        '  # Only the matched authentication lines are logged; the run\'s other output can',
+        '  # carry prompts, source or downstream secrets and never reaches this file.',
+        '  { printf \'\\n[hq-anywhere] %s returned an authentication failure.\\n\' "$pretty"; cat "$tmp/auth-found"; } >>"$log_file" 2>/dev/null || :',
+        `  printf \'%s could not authenticate this run. Sign in to use HQ Anywhere:\\n  %s\\n\' "$pretty" "$login" >&2`,
+        '  exit "$status"',
+        'fi',
+        'exit "$status"',
+        '',
+    ].join('\n');
+}
+export function installProviderWrappers(binDir, home = path.dirname(path.dirname(binDir))) {
+    fs.mkdirSync(binDir, { recursive: true, mode: 0o755 });
+    const files = ['claude', 'codex'].map((provider) => path.join(binDir, provider));
+    // Both targets are checked before either is written, so a collision on codex
+    // cannot leave a freshly written claude wrapper behind.
+    assertProviderWrappersInstallable(binDir);
+    for (const provider of ['claude', 'codex']) {
+        const file = path.join(binDir, provider);
+        fs.writeFileSync(file, wrapperSource(provider), { mode: 0o755 });
+        fs.chmodSync(file, 0o755);
+    }
+    // Startup files are append-only. The marker avoids reading any shell startup file.
+    const pathSetupMarker = path.join(path.dirname(binDir), 'provider-path-installed');
+    if (!fs.existsSync(pathSetupMarker)) {
+        const pathLine = '\nexport PATH="$HOME/.hq/bin:$PATH" # hq-anywhere provider commands\n';
+        // Only startup files that already exist are edited. Creating .bash_profile or
+        // .zprofile would make the login shell select it and stop reading the user's
+        // existing .profile, silently dropping their environment setup.
+        const existing = PROVIDER_PATH_RC_FILES.filter((rc) => fs.existsSync(path.join(home, rc)));
+        const createdRcFiles = [];
+        if (existing.length === 0) {
+            // .profile shadows nothing: every POSIX login shell reads it, and no other
+            // startup file is present for it to take precedence over.
+            createdRcFiles.push('.profile');
+        }
+        for (const rc of [...existing, ...createdRcFiles]) {
+            fs.appendFileSync(path.join(home, rc), pathLine, { mode: 0o600 });
+        }
+        fs.writeFileSync(pathSetupMarker, `${createdRcFiles.join('\n')}\n`, { mode: 0o600 });
+    }
+    return files;
+}
+export function removeProviderWrappers(binDir) {
+    const removed = [];
+    for (const provider of ['claude', 'codex']) {
+        const file = path.join(binDir, provider);
+        if (!fs.existsSync(file))
+            continue;
+        const current = fs.readFileSync(file, 'utf8');
+        if (!current.startsWith(wrapperHeader(provider)))
+            continue;
+        fs.unlinkSync(file);
+        removed.push(file);
+    }
+    const home = path.dirname(path.dirname(binDir));
+    const pathSetupMarker = path.join(home, '.hq', 'provider-path-installed');
+    if (fs.existsSync(pathSetupMarker)) {
+        const createdRcFiles = new Set(fs.readFileSync(pathSetupMarker, 'utf8').split('\n').filter(Boolean));
+        const deletePathSetup = 's/\\nexport PATH="\\$HOME\\/\\.hq\\/bin:\\$PATH" # hq-anywhere provider commands\\n//';
+        for (const rc of PROVIDER_PATH_RC_FILES) {
+            const file = path.join(home, rc);
+            if (fs.existsSync(file)) {
+                execFileSync('perl', ['-0pi', '-e', deletePathSetup, file]);
+                if (createdRcFiles.has(rc))
+                    fs.unlinkSync(file);
+            }
+        }
+        fs.unlinkSync(pathSetupMarker);
+    }
+    return removed;
+}
+//# sourceMappingURL=provider-wrappers.js.map

package/dist/lib/lanes/provider-rejection.d.ts

@@ -6,13 +6,13 @@
  * output and no envelope. Without this module the watcher classifies that
  * `interrupted` with `exited_with_partial_output`, and the operator has to
  * read the raw log to learn why. Here the failure is named: the lane is
- * `failed` with `terminal_reason: provider_rejected` and the provider's own
- * message on `terminal_details`.
+ * terminalized with a named provider reason and the provider's own message on
+ * `terminal_details`; transient failures remain resumable.
  *
  * A 429 is parsed here like any other status so that a codex or grok 429,
- * which the claude-shaped quota reader cannot see, still reaches the quota
- * path: the watcher routes a `status === QUOTA_STATUS` failure to quota.ts
- * (reset time, account hold) and everything else to `provider_rejected`.
+ * which the claude-shaped quota reader cannot see, still reaches the watcher.
+ * Quota-specific messages become account holds; generic rate-limit responses
+ * remain retryable provider rejections.
  *
  * Only the fields named below are read out of the payload. The prompt, the
  * response body and everything else stay on disk. Nothing here logs.

package/dist/lib/lanes/provider-rejection.js

@@ -6,13 +6,13 @@
  * output and no envelope. Without this module the watcher classifies that
  * `interrupted` with `exited_with_partial_output`, and the operator has to
  * read the raw log to learn why. Here the failure is named: the lane is
- * `failed` with `terminal_reason: provider_rejected` and the provider's own
- * message on `terminal_details`.
+ * terminalized with a named provider reason and the provider's own message on
+ * `terminal_details`; transient failures remain resumable.
  *
  * A 429 is parsed here like any other status so that a codex or grok 429,
- * which the claude-shaped quota reader cannot see, still reaches the quota
- * path: the watcher routes a `status === QUOTA_STATUS` failure to quota.ts
- * (reset time, account hold) and everything else to `provider_rejected`.
+ * which the claude-shaped quota reader cannot see, still reaches the watcher.
+ * Quota-specific messages become account holds; generic rate-limit responses
+ * remain retryable provider rejections.
  *
  * Only the fields named below are read out of the payload. The prompt, the
  * response body and everything else stay on disk. Nothing here logs.
@@ -114,10 +114,14 @@ function capMessage(message) {
 export function retryableFromStatus(status) {
     if (status === null)
         return false;
-    if (status === 408 || status === 425)
+    if (status === 408 || status === 425 || status === 429)
         return true;
     return status >= 500 && status <= 599;
 }
+function retryableProviderFailure(status, message) {
+    return retryableFromStatus(status) ||
+        (status === null && /\b(?:rate limit|too many requests)\b/i.test(message));
+}
 /**
  * Codex `exec --json`: `{"type":"turn.failed","error":{"message":"<text>"}}`.
  * Measured 2026-09-22 (lane 01M34HCCP1ZDN3H68ESCRZE7RZ): the message is
@@ -151,7 +155,7 @@ export function parseCodexTurnFailed(text) {
             message: capMessage(message),
             status,
             error_type: errorType,
-            retryable: retryableFromStatus(status),
+            retryable: retryableProviderFailure(status, message),
             event: "codex.turn.failed",
         };
     });
@@ -175,15 +179,16 @@ export function parseClaudeResultRejection(text) {
         if (rec.is_error !== true && !loginFailure)
             return NOT_REJECTED;
         const status = statusOf(rec.api_error_status);
-        if (status === null && !loginFailure)
+        if (status === null && !loginFailure && !retryableProviderFailure(status, message)) {
             return NOT_REJECTED;
+        }
         return {
             reason: PROVIDER_REJECTED_REASON,
             provider: "claude",
             message: capMessage(message),
             status,
             error_type: typeof rec.subtype === "string" ? rec.subtype : null,
-            retryable: retryableFromStatus(status),
+            retryable: retryableProviderFailure(status, message),
             event: loginFailure && rec.is_error !== true
                 ? "claude.result.login_failure"
                 : "claude.result.is_error",
@@ -231,7 +236,7 @@ function grokRejectionFrom(rec) {
         message: capMessage(message),
         status,
         error_type: null,
-        retryable: retryableFromStatus(status),
+        retryable: retryableProviderFailure(status, message),
         event: "grok.error",
     };
 }

package/dist/lib/lanes/spawn.js

@@ -1621,11 +1621,16 @@ export function markSpawnFailure(hqRoot, laneId, reasonRaw, details, options = {
                 : []),
         ].filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)));
         const quotaResetAt = resetCandidates.sort((a, b) => Date.parse(a) - Date.parse(b))[0];
-        const resumableQuotaHold = current.keep_alive === true &&
-            (current.pending_resume !== undefined || options.resumeTrigger !== undefined) &&
-            (reason === "account_quota_exhausted" || reason === "account_model_unavailable") &&
+        // Initial queued lanes can be retried by reconcile without a session;
+        // ordinary resumes keep their existing failed-state behavior.
+        const initialQueuedSpawn = current.state === "queued" &&
+            current.pending_resume === undefined && options.resumeTrigger === undefined;
+        const keepAliveResume = current.keep_alive === true &&
+            (current.pending_resume !== undefined || options.resumeTrigger !== undefined);
+        const resumableQuotaHold = (reason === "account_quota_exhausted" || reason === "account_model_unavailable") &&
             typeof quotaResetAt === "string" &&
-            Number.isFinite(Date.parse(quotaResetAt));
+            Number.isFinite(Date.parse(quotaResetAt)) &&
+            (initialQueuedSpawn || keepAliveResume);
         if (current.state === "failed" && existing === reason && !resumableQuotaHold)
             return current;
         const operatorQuotaHold = resumableQuotaHold && options.resumeTrigger !== undefined;

package/dist/lib/lanes/watcher.d.ts

@@ -76,6 +76,7 @@ export interface WatcherTickInput {
         errors: string[];
     } | null;
     providerRejection?: ProviderRejection | null;
+    hasProviderSession?: boolean;
 }
 export interface WatcherTickResult {
     emit?: WatcherSignal;
@@ -103,10 +104,13 @@ export declare function classifyLaneExit(input: {
     /**
      * Set when the worker's output stream carries a provider-level turn
      * failure (codex `turn.failed`, a Claude error result with an HTTP status,
-     * a grok error object). Failed, never interrupted: the provider refused
-     * the turn, so there is nothing to resume and no envelope to repair.
+     * a grok error object). A retryable refusal interrupts only when a provider
+     * session exists to resume; without one, the lane fails with the named
+     * provider reason. Neither path attempts envelope repair.
      */
     providerRejection?: ProviderRejection | null;
+    /** True only when the lane has a current or prior provider session id. */
+    hasProviderSession?: boolean;
 }): TerminalClassification;
 export declare function routeProviderFailure(failure: ProviderRejection | null, readQuota: () => QuotaSignal | null, model: string | undefined, now: Date): {
     quota: QuotaSignal | null;

package/dist/lib/lanes/watcher.js

@@ -106,11 +106,19 @@ export function classifyLaneExit(input) {
         throw new LanesError("unknown_envelope_decision", `Unknown envelope decision ${JSON.stringify(input.envelope.decision)}. Accepted: done, ask, blocked`, { accepted: ["done", "ask", "blocked"], value: input.envelope.decision });
     }
     if (input.providerRejection) {
+        const rejection = input.providerRejection;
+        const reason = isProviderLoginFailure(rejection)
+            ? "account_not_logged_in"
+            : rejection.status === 402
+                ? "provider_billing_required"
+                : rejection.status === 401 || rejection.status === 403
+                    ? "provider_auth_failed"
+                    : rejection.status === 429 || /\b(?:rate limit|too many requests)\b/i.test(rejection.message)
+                        ? "provider_rate_limited"
+                        : PROVIDER_REJECTED_REASON;
         return {
-            state: "failed",
-            reason: isProviderLoginFailure(input.providerRejection)
-                ? "account_not_logged_in"
-                : PROVIDER_REJECTED_REASON,
+            state: rejection.retryable && input.hasProviderSession === true ? "interrupted" : "failed",
+            reason,
         };
     }
     if (input.invalidEnvelope) {
@@ -129,15 +137,14 @@ export function classifyLaneExit(input) {
 }
 /**
  * One decision for an exited worker's output. An explicit provider status
- * wins over the quota text heuristics: a 429 from any provider (including
- * codex `turn.failed` and grok error objects, which the claude-shaped quota
- * reader never sees) becomes a quota signal; any other explicit status is a
- * rejection even when its text sounds like a quota message (a 402 "requires
- * usage credits" is a rejection, not a hold). A failure with no status at
- * all is matched against the quota text heuristics first: a status-less
- * "usage limit" / "rate limit" turn.failed still creates the account hold;
- * any other status-less message is a rejection. Only when the stream
- * carries no failure object does the quota reader's own read apply.
+ * wins over the quota text heuristics: a 429 with quota-specific text or a
+ * usage-limit error type becomes an account hold; a generic rate-limit
+ * response stays a retryable provider rejection. Any other explicit status
+ * is a rejection even when its text sounds like a quota message (a 402
+ * "requires usage credits" is a billing refusal, not a hold). A status-less
+ * usage-limit message can create an account hold, while a status-less
+ * rate-limit message remains a retryable provider rejection. Only when the
+ * stream carries no failure object does the quota reader's own read apply.
  */
 function validFailureOutputTime(value, fallback) {
     const parsed = new Date(value);
@@ -146,21 +153,31 @@ function validFailureOutputTime(value, fallback) {
         : fallback;
 }
 export function routeProviderFailure(failure, readQuota, model, now) {
-    if (failure && failure.status === QUOTA_STATUS) {
+    if (failure && failure.status === QUOTA_STATUS && isAccountQuotaFailure(failure)) {
         return {
             quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now),
             rejection: null,
         };
     }
-    if (failure && failure.status === null) {
+    if (failure && failure.status === null && isAccountQuotaFailure(failure)) {
         const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now);
         if (quota)
             return { quota, rejection: null };
     }
-    if (failure)
-        return { quota: null, rejection: failure };
+    if (failure) {
+        return {
+            quota: null,
+            rejection: failure.status === QUOTA_STATUS
+                ? { ...failure, retryable: true }
+                : failure,
+        };
+    }
     return { quota: readQuota(), rejection: null };
 }
+function isAccountQuotaFailure(failure) {
+    return failure.error_type === "usage_limit_reached" ||
+        /weekly limit|usage limit|quota|usage credits|hit your .+ limit/i.test(failure.message);
+}
 export function tickWatcher(input) {
     const silenceMs = input.silenceMs ?? SILENCE_MS;
     const at = new Date(input.nowMs).toISOString();
@@ -171,6 +188,7 @@ export function tickWatcher(input) {
             quota: input.quota,
             invalidEnvelope: input.invalidEnvelope,
             providerRejection: input.providerRejection,
+            hasProviderSession: input.hasProviderSession,
         });
         return {
             emit: { kind: "terminal", at, classification },
@@ -1578,6 +1596,8 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
             quota,
             invalidEnvelope,
             providerRejection,
+            hasProviderSession: typeof quotaLane?.provider_session_id === "string" &&
+                quotaLane.provider_session_id.trim().length > 0,
         });
         if (processAlive) {
             maybeHeartbeatLane(hqRoot, laneId, now());

package/dist/utils/self-update.js

@@ -65,7 +65,7 @@ import chalk from "chalk";
 import { Sentry } from "../sentry.js";
 import { isCliTelemetryDisabled } from "./cli-telemetry.js";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmPathConflict, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
 import { canStageInstall, stagedNpmInstall } from "./staged-install.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
@@ -931,6 +931,13 @@ async function attemptUpdateAndReexec(argv, flavor, known, deps, env) {
         console.error(chalk.dim(`hq-cli ${latest} is available, but this copy is a local dependency (${install.packageRoot}) — update the project that owns it.`));
         return { action: "skipped", latest };
     }
+    if (install.manager === "pnpm") {
+        const conflict = pnpmPathConflict(install);
+        if (conflict) {
+            console.error(chalk.yellow(`⚠ hq self-update refused: ${conflict}`));
+            return { action: "skipped", latest };
+        }
+    }
     const releaseLock = flavor.lock ? (deps.acquireLock ?? acquireUpdateLock)() : () => { };
     if (!releaseLock)
         return { action: "skipped", latest };

package/dist/utils/version-gate.d.ts

@@ -430,6 +430,13 @@ declare function resolveHqOnPath(): string | null;
 export declare function parseReportedCliVersion(stdout: string): string | null;
 /** `<bin> --version` output (trimmed), or null on any failure/timeout. */
 declare function probeCliVersion(bin: string): string | null;
+/**
+ * Detect a second pnpm global install winning PATH before the updater mutates
+ * the running install. pnpm homes have independent global package trees and
+ * shims, so writing one home cannot change a different home that appears first
+ * on PATH.
+ */
+export declare function pnpmPathConflict(install: RunningInstall): string | null;
 /**
  * Read-your-writes convergence check, run after an install reports success.
  *

package/dist/utils/version-gate.js

@@ -1395,6 +1395,43 @@ function probeCliVersion(bin) {
         return null;
     }
 }
+/**
+ * Detect a second pnpm global install winning PATH before the updater mutates
+ * the running install. pnpm homes have independent global package trees and
+ * shims, so writing one home cannot change a different home that appears first
+ * on PATH.
+ */
+export function pnpmPathConflict(install) {
+    if (install.manager !== "pnpm" || !install.packageRoot)
+        return null;
+    const bin = resolveHqOnPath();
+    if (!bin)
+        return null;
+    const pathPackageRoot = findPackageRootForExecutable(bin);
+    if (!pathPackageRoot ||
+        globalInstallManagerForPath(bin, pathPackageRoot) !== "pnpm") {
+        return null;
+    }
+    // The fallback resolver scans every hash in a PNPM_HOME because generated
+    // shims do not expose their target. Multiple installs in the SAME home can
+    // therefore produce an arbitrary package root; only a different home means
+    // that updating this install cannot change which global shim wins PATH.
+    const runningHome = derivePnpmHome(install);
+    const pathHome = derivePnpmHome({ manager: "pnpm", prefix: null, packageRoot: pathPackageRoot });
+    if (!runningHome || !pathHome || samePath(runningHome, pathHome))
+        return null;
+    let resolvedBin = bin;
+    try {
+        resolvedBin = realpathSync(bin);
+    }
+    catch {
+        // Keep the PATH entry when a platform shim cannot be canonicalized.
+    }
+    const version = probeCliVersion(bin) ?? "unknown";
+    return (`PATH resolves ${resolvedBin} at version ${version} (manager: pnpm), ` +
+        `but this process is running from a different pnpm install at ${install.packageRoot}. ` +
+        "Refusing to update one pnpm home while another hq-cli install wins PATH resolution.");
+}
 /**
  * Read-your-writes convergence check, run after an install reports success.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.46",
+  "version": "5.345.47",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {