@indigoai-us/hq-cli 5.345.46 → 5.345.48

package/dist/lib/daemon/run.d.ts

@@ -14,6 +14,12 @@ import { type HostApp } from "./supervisor.js";
 export declare const LOG_ROTATE_BYTES: number;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export declare const RESTART_EXIT_CODE = 75;
+/** A bounded shutdown deadline that can account for sync push persistence. */
+export declare function createShutdownCap(): {
+    promise: Promise<"timeout">;
+    extendForSyncRunnerPersist(): void;
+    clear(): void;
+};
 export interface DaemonLockConflictOutcome {
     exitCode: 0 | 1;
     stdout?: string;

package/dist/lib/daemon/run.js

@@ -45,12 +45,36 @@ import { stageHqChildBootstrap } from "./hq-child-bootstrap-stage.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
 import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
-import { STOP_ESCALATION_MS, createSupervisor, } from "./supervisor.js";
+import { STOP_ESCALATION_MS, SYNC_RUNNER_PERSIST_GRACE_MS, createSupervisor, } from "./supervisor.js";
 import { userToolDirs } from "./tools.js";
 import { daemonRunGuard } from "./lanes-reconcile-guard.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export const RESTART_EXIT_CODE = 75;
+const NON_SYNC_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + 5_000;
+const SYNC_RUNNER_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + SYNC_RUNNER_PERSIST_GRACE_MS + 5_000;
+/** A bounded shutdown deadline that can account for sync push persistence. */
+export function createShutdownCap() {
+    const startedAt = Date.now();
+    let deadline = startedAt + NON_SYNC_SHUTDOWN_CAP_MS;
+    let resolveCap;
+    let timer;
+    const promise = new Promise((resolve) => { resolveCap = resolve; });
+    const arm = () => {
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => resolveCap("timeout"), Math.max(0, deadline - Date.now()));
+    };
+    arm();
+    return {
+        promise,
+        extendForSyncRunnerPersist() {
+            deadline = Math.max(deadline, startedAt + SYNC_RUNNER_SHUTDOWN_CAP_MS);
+            arm();
+        },
+        clear() { clearTimeout(timer); },
+    };
+}
 /** Preserve the legacy lock failure unless Anywhere explicitly enables the no-op behavior. */
 export function daemonLockConflictOutcome(lock, anywhereEnabled) {
     if (lock.ok)
@@ -772,6 +796,7 @@ export async function runDaemon(opts) {
     };
     // Set once the shutdown path exists below; a restart request before then is dropped.
     let restartDaemon = () => false;
+    let extendSyncShutdownCap;
     const supervisor = createSupervisor({
         machineType,
         host: opts.host,
@@ -794,6 +819,7 @@ export async function runDaemon(opts) {
         runGuard: daemonRunGuard,
         writeState: (state) => writeJsonAtomic(paths.statePath, state),
         log,
+        onSyncRunnerStopping: () => extendSyncShutdownCap?.(),
         syncOwnerBlockReason: () => {
             const config = readDaemonConfig(paths.configPath);
             const hqRoot = config.hqRoot ?? env.HQ_ROOT?.trim();
@@ -891,14 +917,15 @@ export async function runDaemon(opts) {
             stopping = true;
             log("info", `${why}; stopping services`);
             closeHqd();
-            // The supervisor escalates to SIGKILL after STOP_ESCALATION_MS; the extra
-            // margin only covers a child that survives even that.
-            let capTimer;
-            const cap = new Promise((r) => {
-                capTimer = setTimeout(() => r("timeout"), STOP_ESCALATION_MS + 5_000);
-            });
-            void Promise.race([supervisor.stop(), cap]).then((result) => {
-                clearTimeout(capTimer);
+            // Keep shutdown bounded, but let a stopping sync runner reach its persist deadline.
+            const cap = createShutdownCap();
+            extendSyncShutdownCap = cap.extendForSyncRunnerPersist;
+            if (supervisor.hasStoppingSyncRunner())
+                cap.extendForSyncRunnerPersist();
+            const servicesStopped = supervisor.stop();
+            void Promise.race([servicesStopped, cap.promise]).then((result) => {
+                cap.clear();
+                extendSyncShutdownCap = undefined;
                 if (result === "timeout")
                     log("error", "some services did not exit after SIGKILL; releasing the lock anyway");
                 else

package/dist/lib/daemon/supervisor.d.ts

@@ -13,7 +13,8 @@
  * - restart/trigger/stop requests from the CLI are polled and applied; a
  *   request for a unit that is not planned yet re-reads the plan first;
  * - stop() sends SIGTERM to every child, escalates to SIGKILL after
- *   STOP_ESCALATION_MS, and resolves once every child has exited;
+ *   STOP_ESCALATION_MS except for a sync runner already stopping, which it lets
+ *   finish persisting pending pushes before resolving;
  * - release() instead leaves every child running and reports the long-running
  *   ones, so the next daemon can adopt them (`adopt`). Adopted units whose
  *   command is unchanged keep running; changed ones are replaced one at a
@@ -26,6 +27,7 @@ import type { MachineType } from "./machine-type.js";
 import type { ControlRequest } from "./requests.js";
 import { syncPassResult } from "./sync-runner.js";
 export declare const STOP_ESCALATION_MS = 10000;
+export declare const SYNC_RUNNER_PERSIST_GRACE_MS = 60000;
 export declare const CLI_UPDATE_SYNC_IDLE_KILL_GRACE_MS = 60000;
 /** After a handoff, how long a replaced unit must stay up before the next one is replaced. */
 export declare const HANDOFF_STAGGER_MS = 15000;
@@ -98,6 +100,8 @@ export interface SupervisorDeps {
     restartDaemon?: () => void | boolean | Promise<boolean | void>;
     writeState: (state: DaemonState) => void;
     log: (level: "info" | "warn" | "error", msg: string) => void;
+    /** Extend the daemon shutdown deadline when a sync runner reports stopping. */
+    onSyncRunnerStopping?: () => void;
     now?: () => number;
     setTimeout?: (fn: () => void, ms: number) => unknown;
     clearTimeout?: (handle: unknown) => void;
@@ -120,6 +124,8 @@ export interface Supervisor {
     stop(): Promise<void>;
     reconcile(): void;
     state(): DaemonState;
+    /** True while a live sync runner has reported that it is persisting pushes. */
+    hasStoppingSyncRunner(): boolean;
     /** Stop supervising without signalling any child; returns the long-running units left running. */
     release(): ReleasedUnit[];
 }

package/dist/lib/daemon/supervisor.js

@@ -13,7 +13,8 @@
  * - restart/trigger/stop requests from the CLI are polled and applied; a
  *   request for a unit that is not planned yet re-reads the plan first;
  * - stop() sends SIGTERM to every child, escalates to SIGKILL after
- *   STOP_ESCALATION_MS, and resolves once every child has exited;
+ *   STOP_ESCALATION_MS except for a sync runner already stopping, which it lets
+ *   finish persisting pending pushes before resolving;
  * - release() instead leaves every child running and reports the long-running
  *   ones, so the next daemon can adopt them (`adopt`). Adopted units whose
  *   command is unchanged keep running; changed ones are replaced one at a
@@ -27,6 +28,7 @@ const BACKOFF_BASE_MS = 1_000;
 const BACKOFF_MAX_MS = 60_000;
 const HEALTHY_RUN_MS = 60_000;
 export const STOP_ESCALATION_MS = 10_000;
+export const SYNC_RUNNER_PERSIST_GRACE_MS = 60_000;
 const CLI_UPDATE_SYNC_IDLE_MAX_MS = 10 * 60_000;
 export const CLI_UPDATE_SYNC_IDLE_KILL_GRACE_MS = 60_000;
 const MESH_OWNER_RECHECK_MS = 15_000;
@@ -91,6 +93,7 @@ export function createSupervisor(deps) {
     let handoffTimer;
     /** Every child process not yet known to have exited, including ones the slots have let go of. */
     const live = new Set();
+    const liveOwners = new Map();
     let drained = null;
     let onDrained = null;
     let deferredCliRestart = false;
@@ -247,6 +250,16 @@ export function createSupervisor(deps) {
             deps.log("error", `could not send ${signal} to ${slot.plan.id}: ${errorMessage(err)}`);
         }
     };
+    const syncRunnerIsStopping = (slot) => slot?.plan.service === "sync" && slot.lastProtocolStatus === "stopping";
+    const scheduleSyncRunnerPersistEscalation = (slot, child) => {
+        slot.killTimer = setT(() => {
+            slot.killTimer = undefined;
+            if (slot.child !== child)
+                return;
+            deps.log("warn", `${slot.plan.id} did not finish persisting pending pushes within ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s; sending SIGKILL${lastProtocolHint(slot)}`);
+            signalChild(slot, child, "SIGKILL");
+        }, SYNC_RUNNER_PERSIST_GRACE_MS);
+    };
     /**
      * Stop the slot's child (if any), then run `then` once it has exited. With
      * `drain`, a unit that has a drain signal gets it first and SIGTERM only
@@ -276,6 +289,11 @@ export function createSupervisor(deps) {
                 slot.killTimer = undefined;
                 if (slot.child !== child)
                     return;
+                if (syncRunnerIsStopping(slot)) {
+                    deps.log("info", `${slot.plan.id} is stopping; allowing ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s for pending pushes to persist`);
+                    scheduleSyncRunnerPersistEscalation(slot, child);
+                    return;
+                }
                 deps.log("warn", `${slot.plan.id} did not exit within ${killGraceMs / 1_000} s of SIGTERM; sending SIGKILL${lastProtocolHint(slot)}`);
                 signalChild(slot, child, "SIGKILL");
             }, killGraceMs);
@@ -313,6 +331,7 @@ export function createSupervisor(deps) {
     };
     const watch = (slot, child) => {
         live.add(child);
+        liveOwners.set(child, slot);
         let ended = false;
         const timeoutMs = slot.plan.heartbeatTimeoutMs;
         const decoder = timeoutMs ? new StringDecoder("utf8") : null;
@@ -350,6 +369,8 @@ export function createSupervisor(deps) {
                     slot.syncPassActive = false;
                 else if (event.type === "status" && typeof event.state === "string") {
                     slot.lastProtocolStatus = event.state;
+                    if (event.state === "stopping")
+                        deps.onSyncRunnerStopping?.();
                     if (event.state === "stopped" || event.state === "waiting-for-lock")
                         slot.syncPassActive = false;
                     else if (slot.syncPassActive === undefined && (event.state === "starting" || event.state === "running")) {
@@ -405,6 +426,7 @@ export function createSupervisor(deps) {
                 return;
             ended = true;
             live.delete(child);
+            liveOwners.delete(child);
             if (live.size === 0)
                 onDrained?.();
             if (slot.child !== child)
@@ -991,10 +1013,8 @@ export function createSupervisor(deps) {
                 clearT(handoffTimer);
             clearDeferredCliRestart();
             clearPendingSyncCommandRestart();
-            const childOwners = new Map();
+            const childOwners = new Map(liveOwners);
             for (const slot of slots.values()) {
-                if (slot.child)
-                    childOwners.set(slot.child, slot);
                 clearTimer(slot);
                 clearHeartbeatTimer(slot);
                 slot.child = undefined;
@@ -1020,9 +1040,16 @@ export function createSupervisor(deps) {
                     resolve();
                     return;
                 }
+                const persistingSyncRunners = new Set();
+                let persistEscalation;
                 const escalation = setT(() => {
                     for (const child of live) {
                         const owner = childOwners.get(child);
+                        if (owner && syncRunnerIsStopping(owner)) {
+                            deps.log("info", `${owner.plan.id} is stopping; allowing ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s for pending pushes to persist`);
+                            persistingSyncRunners.add(child);
+                            continue;
+                        }
                         deps.log("warn", `${owner?.plan.id ?? `pid ${child.pid ?? "?"}`} did not exit within ${STOP_ESCALATION_MS / 1_000} s of SIGTERM; sending SIGKILL${owner ? lastProtocolHint(owner) : ""}`);
                         try {
                             child.kill("SIGKILL");
@@ -1031,10 +1058,28 @@ export function createSupervisor(deps) {
                             deps.log("error", `could not SIGKILL pid ${child.pid ?? "?"}: ${errorMessage(err)}`);
                         }
                     }
+                    if (persistingSyncRunners.size > 0) {
+                        persistEscalation = setT(() => {
+                            for (const child of persistingSyncRunners) {
+                                if (!live.has(child))
+                                    continue;
+                                const owner = childOwners.get(child);
+                                deps.log("warn", `${owner?.plan.id ?? `pid ${child.pid ?? "?"}`} did not finish persisting pending pushes within ${SYNC_RUNNER_PERSIST_GRACE_MS / 1_000} s; sending SIGKILL${owner ? lastProtocolHint(owner) : ""}`);
+                                try {
+                                    child.kill("SIGKILL");
+                                }
+                                catch (err) {
+                                    deps.log("error", `could not SIGKILL pid ${child.pid ?? "?"}: ${errorMessage(err)}`);
+                                }
+                            }
+                        }, SYNC_RUNNER_PERSIST_GRACE_MS);
+                    }
                 }, STOP_ESCALATION_MS);
                 onDrained = () => {
                     onDrained = null;
                     clearT(escalation);
+                    if (persistEscalation !== undefined)
+                        clearT(persistEscalation);
                     resolve();
                 };
             });
@@ -1042,6 +1087,7 @@ export function createSupervisor(deps) {
         },
         reconcile,
         state: snapshot,
+        hasStoppingSyncRunner: () => [...liveOwners.values()].some(syncRunnerIsStopping),
         release() {
             const released = [];
             for (const slot of slots.values()) {

package/dist/lib/install/provider-wrappers.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Throw if either wrapper target holds a non-HQ command. Callers run this before
+ * any install mutation so a collision cannot leave HQ half-installed.
+ */
+export declare function assertProviderWrappersInstallable(binDir: string): void;
+export declare function providerWrapperInstallPaths(home: string): string[];
+export declare function installProviderWrappers(binDir: string, home?: string): string[];
+export declare function removeProviderWrappers(binDir: string): string[];
+//# sourceMappingURL=provider-wrappers.d.ts.map

package/dist/lib/install/provider-wrappers.js

@@ -0,0 +1,190 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { execFileSync } from 'node:child_process';
+const marker = '# hq-anywhere provider sign-in wrapper';
+const PROVIDER_PATH_RC_FILES = ['.bashrc', '.bash_profile', '.zshrc', '.zprofile', '.profile'];
+const wrapperHeader = (provider) => `#!/bin/sh\n${marker}: ${provider}\n`;
+/**
+ * Throw if either wrapper target holds a non-HQ command. Callers run this before
+ * any install mutation so a collision cannot leave HQ half-installed.
+ */
+export function assertProviderWrappersInstallable(binDir) {
+    for (const provider of ['claude', 'codex']) {
+        const file = path.join(binDir, provider);
+        let current;
+        try {
+            current = fs.readFileSync(file, 'utf8');
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                continue;
+            throw e;
+        }
+        if (!current.startsWith(wrapperHeader(provider))) {
+            throw new Error(`Refusing to replace an existing ${provider} command at ${file}.`);
+        }
+    }
+}
+export function providerWrapperInstallPaths(home) {
+    const binDir = path.join(home, '.hq', 'bin');
+    const paths = ['claude', 'codex'].map((provider) => path.join(binDir, provider));
+    const pathSetupMarker = path.join(home, '.hq', 'provider-path-installed');
+    if (!fs.existsSync(pathSetupMarker)) {
+        paths.push(pathSetupMarker, ...PROVIDER_PATH_RC_FILES.map((rc) => path.join(home, rc)));
+    }
+    return paths;
+}
+function wrapperSource(provider) {
+    const pretty = provider === 'claude' ? 'Claude Code' : 'Codex';
+    const login = provider === 'claude' ? 'claude /login' : 'codex login';
+    const statusArgs = provider === 'claude' ? 'auth status' : 'login status';
+    const authFailure = provider === 'codex'
+        ? '401|unauthorized|not logged in|signed out|not authenticated|authentication required|unauthenticated|missing.*(bearer|credential|auth)|websocket.*auth'
+        : '401|unauthorized|not logged in|signed out|not authenticated|authentication required|unauthenticated|missing.*(bearer|credential|auth)';
+    const runAuthFailure = provider === 'codex'
+        ? 'HTTP error: *401|status 401|401 Unauthorized|websocket.*auth|not logged in|signed out|not authenticated|authentication required|unauthenticated'
+        : 'HTTP error: *401|status 401|401 Unauthorized|not logged in|signed out|not authenticated|authentication required|unauthenticated';
+    return [
+        '#!/bin/sh',
+        `${marker}: ${provider}`,
+        'set -u',
+        'umask 077',
+        `name=${provider}`,
+        `pretty='${pretty}'`,
+        `login='${login}'`,
+        `provider='${provider}'`,
+        '',
+        '# Skip this managed wrapper and locate the provider executable later in PATH.',
+        'self=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)/$(basename -- "$0")',
+        'real=',
+        'old_ifs=$IFS',
+        'IFS=:',
+        'for dir in $PATH; do',
+        '  [ -n "$dir" ] || dir=.',
+        '  candidate=$(CDPATH= cd -- "$dir" 2>/dev/null && pwd -P)/$name',
+        '  if [ -x "$candidate" ] && [ "$candidate" != "$self" ]; then real=$candidate; break; fi',
+        'done',
+        'IFS=$old_ifs',
+        'if [ -z "$real" ]; then printf \'%s CLI was not found on PATH.\\n\' "$pretty" >&2; exit 127; fi',
+        '',
+        '# The flag override is part of the existing hq-anywhere-runtime flag contract.',
+        'case "${HQ_FLAG_HQ_ANYWHERE_RUNTIME:-}" in false|0) exec "$real" "$@" ;; esac',
+        '',
+        '# Login, auth, and informational commands must remain reachable while signed out.',
+        'case "${1:-}" in',
+        '  --version|-v|--help|-h) exec "$real" "$@" ;;',
+        `  ${provider === 'claude' ? '/login|auth' : 'login'}) exec "$real" "$@" ;;`,
+        'esac',
+        '',
+        'log_dir="$HOME/.hq/logs"',
+        'mkdir -p "$log_dir" 2>/dev/null || :',
+        'log_file="$log_dir/provider-auth.log"',
+        'tmp=$(mktemp -d "${TMPDIR:-/tmp}/hq-provider.XXXXXX") || exit 1',
+        'trap \'rm -rf "$tmp"\' EXIT HUP INT TERM',
+        `if command -v timeout >/dev/null 2>&1; then timeout 5 "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; elif command -v perl >/dev/null 2>&1; then perl -e 'alarm 5; exec @ARGV' "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; else auth_status=124; fi`,
+        'case "$auth_status" in 124|142) : >"$tmp/status-timeout" ;; esac',
+        'if [ "$auth_status" -ne 0 ]; then cat "$tmp/status" >>"$log_file" 2>/dev/null || :; fi',
+        `if [ ! -e "$tmp/status-timeout" ] && grep -Eiq '${authFailure}' "$tmp/status"; then`,
+        '  cat "$tmp/status" >>"$log_file" 2>/dev/null || :',
+        '  printf \'%s\\n\' "[$(date -u +%FT%TZ)] $pretty sign-in check reported unauthenticated" >>"$log_file" 2>/dev/null || :',
+        '  printf \'%s is not signed in. Sign in to use HQ Anywhere:\\n  %s\\n\' "$pretty" "$login" >&2',
+        '  exit 1',
+        'fi',
+        'if [ -t 1 ] && { [ "$provider" = claude ] && [ "${1:-}" != -p ] && [ "${1:-}" != --print ] || [ "$provider" = codex ] && [ "${1:-}" != exec ]; }; then exec "$real" "$@"; fi',
+        '',
+        '# Leave provider stdout attached to the caller so streaming and TTY state survive.',
+        'mkfifo "$tmp/stderr.pipe"',
+        'filter_stderr() {',
+        '  trap - EXIT HUP INT TERM',
+        '  while :; do',
+        '    line=',
+        '    IFS= read -r line',
+        '    read_status=$?',
+        '    [ -n "$line" ] || [ "$read_status" -eq 0 ] || break',
+        '    if printf \'%s\\n\' "$line" | grep -Eiq "' + runAuthFailure + '"; then',
+        '      printf \'%s\\n\' "$line" >>"$tmp/auth-found"',
+        '    else',
+        '      printf \'%s\' "$line" >&2',
+        '      [ "$read_status" -eq 0 ] && printf \'\\n\' >&2',
+        '    fi',
+        '    [ "$read_status" -eq 0 ] || break',
+        '  done <"$tmp/stderr.pipe"',
+        '}',
+        'filter_stderr &',
+        'filter_pid=$!',
+        '"$real" "$@" 2>"$tmp/stderr.pipe"',
+        'status=$?',
+        'wait "$filter_pid"',
+        `if [ "$status" -ne 0 ] && [ -f "$tmp/auth-found" ]; then`,
+        '  # Only the matched authentication lines are logged; the run\'s other output can',
+        '  # carry prompts, source or downstream secrets and never reaches this file.',
+        '  { printf \'\\n[hq-anywhere] %s returned an authentication failure.\\n\' "$pretty"; cat "$tmp/auth-found"; } >>"$log_file" 2>/dev/null || :',
+        `  printf \'%s could not authenticate this run. Sign in to use HQ Anywhere:\\n  %s\\n\' "$pretty" "$login" >&2`,
+        '  exit "$status"',
+        'fi',
+        'exit "$status"',
+        '',
+    ].join('\n');
+}
+export function installProviderWrappers(binDir, home = path.dirname(path.dirname(binDir))) {
+    fs.mkdirSync(binDir, { recursive: true, mode: 0o755 });
+    const files = ['claude', 'codex'].map((provider) => path.join(binDir, provider));
+    // Both targets are checked before either is written, so a collision on codex
+    // cannot leave a freshly written claude wrapper behind.
+    assertProviderWrappersInstallable(binDir);
+    for (const provider of ['claude', 'codex']) {
+        const file = path.join(binDir, provider);
+        fs.writeFileSync(file, wrapperSource(provider), { mode: 0o755 });
+        fs.chmodSync(file, 0o755);
+    }
+    // Startup files are append-only. The marker avoids reading any shell startup file.
+    const pathSetupMarker = path.join(path.dirname(binDir), 'provider-path-installed');
+    if (!fs.existsSync(pathSetupMarker)) {
+        const pathLine = '\nexport PATH="$HOME/.hq/bin:$PATH" # hq-anywhere provider commands\n';
+        // Only startup files that already exist are edited. Creating .bash_profile or
+        // .zprofile would make the login shell select it and stop reading the user's
+        // existing .profile, silently dropping their environment setup.
+        const existing = PROVIDER_PATH_RC_FILES.filter((rc) => fs.existsSync(path.join(home, rc)));
+        const createdRcFiles = [];
+        if (existing.length === 0) {
+            // .profile shadows nothing: every POSIX login shell reads it, and no other
+            // startup file is present for it to take precedence over.
+            createdRcFiles.push('.profile');
+        }
+        for (const rc of [...existing, ...createdRcFiles]) {
+            fs.appendFileSync(path.join(home, rc), pathLine, { mode: 0o600 });
+        }
+        fs.writeFileSync(pathSetupMarker, `${createdRcFiles.join('\n')}\n`, { mode: 0o600 });
+    }
+    return files;
+}
+export function removeProviderWrappers(binDir) {
+    const removed = [];
+    for (const provider of ['claude', 'codex']) {
+        const file = path.join(binDir, provider);
+        if (!fs.existsSync(file))
+            continue;
+        const current = fs.readFileSync(file, 'utf8');
+        if (!current.startsWith(wrapperHeader(provider)))
+            continue;
+        fs.unlinkSync(file);
+        removed.push(file);
+    }
+    const home = path.dirname(path.dirname(binDir));
+    const pathSetupMarker = path.join(home, '.hq', 'provider-path-installed');
+    if (fs.existsSync(pathSetupMarker)) {
+        const createdRcFiles = new Set(fs.readFileSync(pathSetupMarker, 'utf8').split('\n').filter(Boolean));
+        const deletePathSetup = 's/\\nexport PATH="\\$HOME\\/\\.hq\\/bin:\\$PATH" # hq-anywhere provider commands\\n//';
+        for (const rc of PROVIDER_PATH_RC_FILES) {
+            const file = path.join(home, rc);
+            if (fs.existsSync(file)) {
+                execFileSync('perl', ['-0pi', '-e', deletePathSetup, file]);
+                if (createdRcFiles.has(rc))
+                    fs.unlinkSync(file);
+            }
+        }
+        fs.unlinkSync(pathSetupMarker);
+    }
+    return removed;
+}
+//# sourceMappingURL=provider-wrappers.js.map

package/dist/lib/lanes/provider-rejection.d.ts

@@ -6,13 +6,13 @@
  * output and no envelope. Without this module the watcher classifies that
  * `interrupted` with `exited_with_partial_output`, and the operator has to
  * read the raw log to learn why. Here the failure is named: the lane is
- * `failed` with `terminal_reason: provider_rejected` and the provider's own
- * message on `terminal_details`.
+ * terminalized with a named provider reason and the provider's own message on
+ * `terminal_details`; transient failures remain resumable.
  *
  * A 429 is parsed here like any other status so that a codex or grok 429,
- * which the claude-shaped quota reader cannot see, still reaches the quota
- * path: the watcher routes a `status === QUOTA_STATUS` failure to quota.ts
- * (reset time, account hold) and everything else to `provider_rejected`.
+ * which the claude-shaped quota reader cannot see, still reaches the watcher.
+ * Quota-specific messages become account holds; generic rate-limit responses
+ * remain retryable provider rejections.
  *
  * Only the fields named below are read out of the payload. The prompt, the
  * response body and everything else stay on disk. Nothing here logs.

package/dist/lib/lanes/provider-rejection.js

@@ -6,13 +6,13 @@
  * output and no envelope. Without this module the watcher classifies that
  * `interrupted` with `exited_with_partial_output`, and the operator has to
  * read the raw log to learn why. Here the failure is named: the lane is
- * `failed` with `terminal_reason: provider_rejected` and the provider's own
- * message on `terminal_details`.
+ * terminalized with a named provider reason and the provider's own message on
+ * `terminal_details`; transient failures remain resumable.
  *
  * A 429 is parsed here like any other status so that a codex or grok 429,
- * which the claude-shaped quota reader cannot see, still reaches the quota
- * path: the watcher routes a `status === QUOTA_STATUS` failure to quota.ts
- * (reset time, account hold) and everything else to `provider_rejected`.
+ * which the claude-shaped quota reader cannot see, still reaches the watcher.
+ * Quota-specific messages become account holds; generic rate-limit responses
+ * remain retryable provider rejections.
  *
  * Only the fields named below are read out of the payload. The prompt, the
  * response body and everything else stay on disk. Nothing here logs.
@@ -114,10 +114,14 @@ function capMessage(message) {
 export function retryableFromStatus(status) {
     if (status === null)
         return false;
-    if (status === 408 || status === 425)
+    if (status === 408 || status === 425 || status === 429)
         return true;
     return status >= 500 && status <= 599;
 }
+function retryableProviderFailure(status, message) {
+    return retryableFromStatus(status) ||
+        (status === null && /\b(?:rate limit|too many requests)\b/i.test(message));
+}
 /**
  * Codex `exec --json`: `{"type":"turn.failed","error":{"message":"<text>"}}`.
  * Measured 2026-09-22 (lane 01M34HCCP1ZDN3H68ESCRZE7RZ): the message is
@@ -151,7 +155,7 @@ export function parseCodexTurnFailed(text) {
             message: capMessage(message),
             status,
             error_type: errorType,
-            retryable: retryableFromStatus(status),
+            retryable: retryableProviderFailure(status, message),
             event: "codex.turn.failed",
         };
     });
@@ -175,15 +179,16 @@ export function parseClaudeResultRejection(text) {
         if (rec.is_error !== true && !loginFailure)
             return NOT_REJECTED;
         const status = statusOf(rec.api_error_status);
-        if (status === null && !loginFailure)
+        if (status === null && !loginFailure && !retryableProviderFailure(status, message)) {
             return NOT_REJECTED;
+        }
         return {
             reason: PROVIDER_REJECTED_REASON,
             provider: "claude",
             message: capMessage(message),
             status,
             error_type: typeof rec.subtype === "string" ? rec.subtype : null,
-            retryable: retryableFromStatus(status),
+            retryable: retryableProviderFailure(status, message),
             event: loginFailure && rec.is_error !== true
                 ? "claude.result.login_failure"
                 : "claude.result.is_error",
@@ -231,7 +236,7 @@ function grokRejectionFrom(rec) {
         message: capMessage(message),
         status,
         error_type: null,
-        retryable: retryableFromStatus(status),
+        retryable: retryableProviderFailure(status, message),
         event: "grok.error",
     };
 }

package/dist/lib/lanes/spawn.js

@@ -1621,11 +1621,16 @@ export function markSpawnFailure(hqRoot, laneId, reasonRaw, details, options = {
                 : []),
         ].filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)));
         const quotaResetAt = resetCandidates.sort((a, b) => Date.parse(a) - Date.parse(b))[0];
-        const resumableQuotaHold = current.keep_alive === true &&
-            (current.pending_resume !== undefined || options.resumeTrigger !== undefined) &&
-            (reason === "account_quota_exhausted" || reason === "account_model_unavailable") &&
+        // Initial queued lanes can be retried by reconcile without a session;
+        // ordinary resumes keep their existing failed-state behavior.
+        const initialQueuedSpawn = current.state === "queued" &&
+            current.pending_resume === undefined && options.resumeTrigger === undefined;
+        const keepAliveResume = current.keep_alive === true &&
+            (current.pending_resume !== undefined || options.resumeTrigger !== undefined);
+        const resumableQuotaHold = (reason === "account_quota_exhausted" || reason === "account_model_unavailable") &&
             typeof quotaResetAt === "string" &&
-            Number.isFinite(Date.parse(quotaResetAt));
+            Number.isFinite(Date.parse(quotaResetAt)) &&
+            (initialQueuedSpawn || keepAliveResume);
         if (current.state === "failed" && existing === reason && !resumableQuotaHold)
             return current;
         const operatorQuotaHold = resumableQuotaHold && options.resumeTrigger !== undefined;

package/dist/lib/lanes/watcher.d.ts

@@ -76,6 +76,7 @@ export interface WatcherTickInput {
         errors: string[];
     } | null;
     providerRejection?: ProviderRejection | null;
+    hasProviderSession?: boolean;
 }
 export interface WatcherTickResult {
     emit?: WatcherSignal;
@@ -103,10 +104,13 @@ export declare function classifyLaneExit(input: {
     /**
      * Set when the worker's output stream carries a provider-level turn
      * failure (codex `turn.failed`, a Claude error result with an HTTP status,
-     * a grok error object). Failed, never interrupted: the provider refused
-     * the turn, so there is nothing to resume and no envelope to repair.
+     * a grok error object). A retryable refusal interrupts only when a provider
+     * session exists to resume; without one, the lane fails with the named
+     * provider reason. Neither path attempts envelope repair.
      */
     providerRejection?: ProviderRejection | null;
+    /** True only when the lane has a current or prior provider session id. */
+    hasProviderSession?: boolean;
 }): TerminalClassification;
 export declare function routeProviderFailure(failure: ProviderRejection | null, readQuota: () => QuotaSignal | null, model: string | undefined, now: Date): {
     quota: QuotaSignal | null;