@indigoai-us/hq-cli 5.345.48 → 5.345.49

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.345.49] — 2026-10-08
+- Persist terminal lane envelopes and story metadata when a final report arrives after the lane has already stopped.
+
+- Keep changelog guard coverage valid after release fragments move into CHANGELOG.md.
+- The CLI now updates the pnpm-managed `hq` install that PATH resolves first, so `hq update` converges when another pnpm home shadows the running process.
+- Preserve an explicit unknown state when the lanes flag registry cannot be read. The four message-delivery and session-wake gates now fail open on unknown; all other lanes gates retain their fail-closed behavior.
+- `hq feedback bug` can include a fail-off, hq-flags-gated agent or human reporter mark derived from runtime context.
+- HQ Anywhere remains enabled when its flag registry is unavailable, while the local kill switch still turns it off.
+- Windows native-resolve cleanup accepts taskkill exit 128 only after confirming the target process has exited.
+
 ## [5.345.48] — 2026-10-08
 - Add default-off multi-company session locks with ordered `hq-session add/remove company` updates and scope-capability enforcement.
 - Give a sync runner that reports stopping 60 seconds to persist pending pushes before SIGKILL. The daemon shutdown deadline includes that grace; other services remain capped at 15 seconds.

package/README.md

@@ -9,7 +9,8 @@ hq --help
 
 The global HQ runtime installs hooks for supported agent runtimes. When the
 `hq-anywhere-runtime` flag is enabled, the hooks use hqd and a per-user folder
-registry. The flag is off by default. See [HQ Anywhere runtime](docs/anywhere-runtime.md)
+registry. The flag defaults on when its registry row cannot be read, and an
+explicit false turns it off. See [HQ Anywhere runtime](docs/anywhere-runtime.md)
 for install and link commands.
 
 ## Live meeting transcripts

package/dist/command-catalog.generated.d.ts

@@ -3673,6 +3673,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--company <slug>";
             readonly description: "Company slug to associate with the report";
             readonly hidden: false;
+        }, {
+            readonly flags: "--reporter <kind>";
+            readonly description: "Mark this bug report as agent-filed (only 'agent' is accepted)";
+            readonly hidden: false;
         }, {
             readonly flags: "--screenshot <path>";
             readonly description: "Attach a screenshot (repeatable, up to 5; .png/.jpg/.jpeg/.webp/.gif)";
@@ -3706,6 +3710,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--company <slug>";
             readonly description: "Company slug to associate with the report";
             readonly hidden: false;
+        }, {
+            readonly flags: "--reporter <kind>";
+            readonly description: "Mark this bug report as agent-filed (only 'agent' is accepted)";
+            readonly hidden: false;
         }, {
             readonly flags: "--screenshot <path>";
             readonly description: "Attach a screenshot (repeatable, up to 5; .png/.jpg/.jpeg/.webp/.gif)";

package/dist/command-catalog.generated.js

@@ -4442,6 +4442,11 @@ export const COMMAND_CATALOG = [
                         "description": "Company slug to associate with the report",
                         "hidden": false
                     },
+                    {
+                        "flags": "--reporter <kind>",
+                        "description": "Mark this bug report as agent-filed (only 'agent' is accepted)",
+                        "hidden": false
+                    },
                     {
                         "flags": "--screenshot <path>",
                         "description": "Attach a screenshot (repeatable, up to 5; .png/.jpg/.jpeg/.webp/.gif)",
@@ -4482,6 +4487,11 @@ export const COMMAND_CATALOG = [
                         "description": "Company slug to associate with the report",
                         "hidden": false
                     },
+                    {
+                        "flags": "--reporter <kind>",
+                        "description": "Mark this bug report as agent-filed (only 'agent' is accepted)",
+                        "hidden": false
+                    },
                     {
                         "flags": "--screenshot <path>",
                         "description": "Attach a screenshot (repeatable, up to 5; .png/.jpg/.jpeg/.webp/.gif)",

package/dist/commands/anywhere-runtime-flag.js

@@ -1,5 +1,5 @@
 import { resolveFlagGate, resolveProcessFlagGate } from "../lib/flag-registry.js";
-import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG, hqAnywhereRuntimeLocallyDisabled } from "../lib/anywhere-runtime-flag-key.js";
 export { HQ_ANYWHERE_RUNTIME_FLAG };
 export class AnywhereRuntimeDisabledError extends Error {
     expected = true;
@@ -9,8 +9,10 @@ export class AnywhereRuntimeDisabledError extends Error {
     }
 }
 export function anywhereRuntimeEnabled(env = process.env) {
-    const fallback = () => false;
-    const lookup = { fallback: false };
+    if (hqAnywhereRuntimeLocallyDisabled(env))
+        return false;
+    const fallback = () => true;
+    const lookup = { fallback: true };
     return env === process.env
         ? resolveProcessFlagGate(HQ_ANYWHERE_RUNTIME_FLAG, lookup, fallback)
         : resolveFlagGate(undefined, HQ_ANYWHERE_RUNTIME_FLAG, lookup, fallback, env);

package/dist/commands/feedback.d.ts

@@ -4,6 +4,8 @@ import { collectFeedbackLogs, feedbackLogsEnabled } from "../utils/feedback-logs
 import { type LogBundleRef } from "../utils/feedback-log-bundle.js";
 export declare const FEEDBACK_LATEST_VERSION_FLAG = "feedback.latest-version";
 export declare const FEEDBACK_LATEST_VERSION_FLAG_FALLBACK = false;
+export declare const FEEDBACK_REPORTER_KIND_FLAG = "feedback.reporter-kind";
+export declare const FEEDBACK_REPORTER_KIND_FLAG_FALLBACK = true;
 export declare const BODY_MAX_BYTES: number;
 /** Validate fields that must be valid before feedback attachments are uploaded. */
 export declare function validateFeedbackContent(title: string, body: string): void;
@@ -44,7 +46,15 @@ export interface FeedbackSubmitOptions {
     diagnostics?: DiagnosticsBlob;
     /** Precomputed setting so environment lookup happens before attachments upload. */
     logsEnabled?: boolean;
+    /** Optional one-way override: callers can mark human sessions as agent. */
+    reporterOverride?: "agent";
 }
+export interface FeedbackReporterMark {
+    reporter_kind: "agent" | "human";
+    reporter_source: string;
+}
+/** Resolve a safe reporter classification without returning any env values. */
+export declare function resolveFeedbackReporter(env?: NodeJS.ProcessEnv, isTTY?: boolean, override?: string): FeedbackReporterMark;
 export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
 /**
  * Attach redacted `~/.hq` log tails to `diagnostics` if, and only if, they fit

package/dist/commands/feedback.js

@@ -10,6 +10,8 @@ import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { cachedLatestVersion } from "../utils/version-check.js";
 export const FEEDBACK_LATEST_VERSION_FLAG = "feedback.latest-version";
 export const FEEDBACK_LATEST_VERSION_FLAG_FALLBACK = false;
+export const FEEDBACK_REPORTER_KIND_FLAG = "feedback.reporter-kind";
+export const FEEDBACK_REPORTER_KIND_FLAG_FALLBACK = true;
 export const BODY_MAX_BYTES = 64 * 1024;
 /** Validate fields that must be valid before feedback attachments are uploaded. */
 export function validateFeedbackContent(title, body) {
@@ -46,6 +48,32 @@ function validateFeedbackRequestSize(requestBody) {
  * after attaching, so this reserve only needs to be roughly right.
  */
 const LOGS_ENVELOPE_RESERVE_BYTES = 1024;
+const AGENT_RUNTIME_MARKERS = [
+    "HQ_LANE_ID",
+    "HQ_POLICY_WORKER_DIR",
+    "HQ_AGENT_DIR",
+    "CODEX_THREAD_ID",
+    "CODEX_SESSION_ID",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_SESSION_ID",
+    "HQ_SESSION_ID",
+    "GROK_SESSION_ID",
+];
+/** Resolve a safe reporter classification without returning any env values. */
+export function resolveFeedbackReporter(env = process.env, isTTY = process.stdin.isTTY === true, override) {
+    for (const marker of AGENT_RUNTIME_MARKERS) {
+        if (env[marker]?.trim()) {
+            return { reporter_kind: "agent", reporter_source: marker };
+        }
+    }
+    if (override === "agent") {
+        return { reporter_kind: "agent", reporter_source: "CLI_REPORTER_OVERRIDE" };
+    }
+    return {
+        reporter_kind: "human",
+        reporter_source: isTTY ? "stdin_isTTY" : "no_agent_runtime_marker",
+    };
+}
 function buildFeedbackRequestBody(opts) {
     const requestBody = {
         type: opts.type,
@@ -53,6 +81,10 @@ function buildFeedbackRequestBody(opts) {
         body: opts.body,
         diagnostics: opts.diagnostics,
     };
+    if (opts.reporterMark) {
+        requestBody.reporter_kind = opts.reporterMark.reporter_kind;
+        requestBody.reporter_source = opts.reporterMark.reporter_source;
+    }
     if (opts.company) {
         requestBody.company = opts.company;
     }
@@ -124,6 +156,9 @@ export async function submitFeedback(opts) {
     // which invokes the same validator before uploading any attachments.
     validateFeedbackContent(opts.title, opts.body);
     const diagnostics = opts.diagnostics ?? collectDiagnostics();
+    const reporterMark = opts.type === "bug" && resolveProcessFlagGate(FEEDBACK_REPORTER_KIND_FLAG, { fallback: FEEDBACK_REPORTER_KIND_FLAG_FALLBACK }, () => FEEDBACK_REPORTER_KIND_FLAG_FALLBACK)
+        ? resolveFeedbackReporter(process.env, process.stdin.isTTY === true, opts.reporterOverride)
+        : undefined;
     const requestBody = buildFeedbackRequestBody({
         type: opts.type,
         title: opts.title,
@@ -132,6 +167,7 @@ export async function submitFeedback(opts) {
         diagnostics,
         screenshots: opts.screenshots,
         logBundle: opts.logBundle,
+        reporterMark,
     });
     // Direct callers can supply attachment references; ensure the complete base
     // envelope still fits before adding optional inline logs or making a request.
@@ -172,12 +208,16 @@ function registerSubcommand(feedbackCmd, type) {
         .requiredOption("--title <text>", "Short title for the report")
         .requiredOption("--body-file <path>", "Path to a markdown file with the body; use - to read from stdin")
         .option("--company <slug>", "Company slug to associate with the report")
+        .option("--reporter <kind>", "Mark this bug report as agent-filed (only 'agent' is accepted)")
         .option("--screenshot <path>", `Attach a screenshot (repeatable, up to ${MAX_SCREENSHOTS}; .png/.jpg/.jpeg/.webp/.gif)`, (value, prev) => [...prev, value], [])
         // Commander turns `--no-logs` into a boolean `logs` that defaults to true,
         // so the default is "attach logs" and the flag is the opt-out.
         .option("--no-logs", "Do not attach redacted tails of your ~/.hq log files (also: HQ_FEEDBACK_LOGS=0)")
         .action(async (opts) => {
         try {
+            if (opts.reporter !== undefined && (opts.reporter !== "agent" || type !== "bug")) {
+                throw new Error("Invalid --reporter value: only bug reports may use 'agent'.");
+            }
             const token = await ensureCognitoToken({ interactive: false });
             const body = await readBodyFile(opts.bodyFile);
             validateFeedbackContent(opts.title, body);
@@ -192,6 +232,9 @@ function registerSubcommand(feedbackCmd, type) {
                     diagnostics.latestVersion = latestVersion;
             }
             const logsEnabled = opts.logs !== false && feedbackLogsEnabled();
+            const reporterMark = type === "bug" && resolveProcessFlagGate(FEEDBACK_REPORTER_KIND_FLAG, { fallback: FEEDBACK_REPORTER_KIND_FLAG_FALLBACK }, () => FEEDBACK_REPORTER_KIND_FLAG_FALLBACK)
+                ? resolveFeedbackReporter(process.env, process.stdin.isTTY === true, opts.reporter)
+                : undefined;
             // Validate the serialized server request envelope before screenshots
             // or the log bundle can create remote objects. Attachment references
             // are added and checked again inside submitFeedback after upload.
@@ -201,6 +244,7 @@ function registerSubcommand(feedbackCmd, type) {
                 body,
                 company: opts.company,
                 diagnostics,
+                reporterMark,
             }));
             // vaultApiFetch can reject an hqk_ token or an invalid API base URL
             // locally before fetch. Check the mandatory POST, and the screenshot
@@ -236,6 +280,7 @@ function registerSubcommand(feedbackCmd, type) {
                 includeLogs: opts.logs !== false,
                 logBundle,
                 diagnostics,
+                reporterOverride: opts.reporter === "agent" ? "agent" : undefined,
                 logsEnabled,
             });
             console.log(`Submitted: ${result.id}`);

package/dist/commands/lanes-message.js

@@ -13,7 +13,7 @@ import { artifactIdentityKeys, rollbackStorySwitchAttribution, storySwitchNotice
 import { laneRunDir, probePidRecord, readPidRecord, readProcStarttime, spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { findRetiredLaneEntry, keepAliveExclusion, keepAliveSupersededBy, LANE_RUNNING_SUPERSEDED_MESSAGE_DELIVERY_FLAG, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds } from "../lib/lanes/keep-alive.js";
 import { isTerminalLaneState } from "../lib/lanes/types.js";
-import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
+import { readLanesRegistryFlag, readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
 import { appendLaneFocusOverride, focusGuardRefusal, makeFocusOverride } from "../lib/lanes/focus-guard.js";
 import { appendProjectFocusOverride, removeProjectFocusOverride } from "../lib/lanes/story-ledger.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
@@ -192,7 +192,7 @@ export function createLaneMessageHandlers(deps) {
                 : "superseded";
         }
         if (exclusion === "superseded" && currentLane.state !== "done" && currentLane.state !== "interrupted") {
-            const runningSupersededMessageDeliveryEnabled = await readLanesRegistryFlag(LANE_RUNNING_SUPERSEDED_MESSAGE_DELIVERY_FLAG, { company: companyForLane(currentLane), env: ctx.env });
+            const runningSupersededMessageDeliveryEnabled = await readLanesRegistryFlagFailOpen(LANE_RUNNING_SUPERSEDED_MESSAGE_DELIVERY_FLAG, { company: companyForLane(currentLane), env: ctx.env });
             if (runningSupersededMessageDeliveryEnabled) {
                 const latestLane = readLane(ctx.hqRoot(), currentLane.lane_id);
                 if (latestLane.state === "killed" || latestLane.state === "cancelled") {

package/dist/commands/lanes.js

@@ -36,7 +36,7 @@ import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { laneDepthCap } from "../lib/lanes/depth-cap.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
-import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "../lib/lanes/registry-flag.js";
+import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff, readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
 import { appendProjectFocusOverride, readProjectStoryFocusData, removeProjectFocusOverride } from "../lib/lanes/story-ledger.js";
 import { appendLaneFocusOverride, assertFocusGuardAllows, makeFocusOverride } from "../lib/lanes/focus-guard.js";
 import { LANE_FOCUS_GUARD_FLAG, LANE_FOCUS_DASHBOARD_FLAG, LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_LIST_SKIP_REMOTE_REFRESH_FLAG, LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG, LANE_PROFILE_PIN_EXHAUSTED_FALLBACK_FLAG, LANE_REUSE_REFRESHES_PROFILE_FLAG, } from "../lib/lanes/flag-keys.js";
@@ -1898,7 +1898,7 @@ async function resolveMessageLaneTarget(ctx, laneId) {
                 const localOverride = readLanesFlagLocalOverride(LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, ctx.env);
                 return localOverride ?? "check-company";
             }
-            return readLanesRegistryFlag(LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, {
+            return readLanesRegistryFlagFailOpen(LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, {
                 company,
                 env: ctx.env,
             });

package/dist/commands/mcp-serve.js

@@ -16,12 +16,16 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
 import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
-import { anywhereRuntimeAllowed } from "../lib/anywhere-person-setting.js";
 import { createLineSplitter, HqdClientError, hqdRequest, hqdSocketPath } from "../lib/daemon/protocol.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure, RESIDENT_PACKAGE_MODULES } from "../utils/resident-package-preload.js";
 export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
 const UNREACHABLE_CODES = new Set(["ENOENT", "ECONNREFUSED", "ECONNRESET", "EPIPE", "ETIMEDOUT", "ESOCKET", "EACCES"]);
+function hasPersonTokenCache(env, home) {
+    // Mirrors personTokenCacheFile() in utils/cognito-session.ts; duplicated so this path does not load that module.
+    const stateDir = env.HQ_STATE_DIR?.trim() || path.join(home, ".hq");
+    return fs.existsSync(path.join(stateDir, "cognito-tokens.json"));
+}
 /** HQ root for prompts: HQ_ROOT, else the ~/.hq/root pointer written by `hq install --global`. */
 export function readHqRoot(env, home) {
     const fromEnv = env.HQ_ROOT?.trim();
@@ -54,9 +58,18 @@ export async function runMcpServe(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const socketPath = hqdSocketPath(home, env);
     const timeoutMs = opts.timeoutMs ?? 120_000;
-    if (!(await (opts.runtimeAllowed ?? (() => anywhereRuntimeAllowed(env, {
-        onError: (name) => process.stderr.write(`HQ Anywhere person setting unavailable (${name}); access remains off.\n`),
-    })))())) {
+    const runtimeAllowed = opts.runtimeAllowed ?? (async () => {
+        // A person token is required to read the opt-in setting. Deny a fresh
+        // install before loading the hq-flags and Cognito readers.
+        if (!hasPersonTokenCache(env, home))
+            return false;
+        const { anywhereRuntimeAllowed } = await import("../lib/anywhere-person-setting.js");
+        return anywhereRuntimeAllowed(env, {
+            home,
+            onError: (name) => process.stderr.write(`HQ Anywhere person setting unavailable (${name}); access remains off.\n`),
+        });
+    });
+    if (!(await runtimeAllowed())) {
         process.stderr.write(`HQ Anywhere is not enabled. The ${HQ_ANYWHERE_RUNTIME_FLAG} flag and your HQ Anywhere person setting must both be on.\n`);
         process.exitCode = 1;
         return;

package/dist/lib/anywhere-person-setting.d.ts

@@ -6,6 +6,7 @@ export interface ReadHqAnywherePersonSettingOptions {
     fetchImpl?: typeof fetch;
     apiBaseUrl?: string;
     env?: NodeJS.ProcessEnv;
+    home?: string;
     onError?: (errorName: string) => void;
 }
 /** Returns null when the person preference cannot be read; callers must fail closed. */

package/dist/lib/anywhere-person-setting.js

@@ -1,8 +1,20 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
 import { anywhereRuntimeEnabledFromSnapshot } from "./anywhere-runtime-fast-flag.js";
+function hasPersonTokenCache(env, home) {
+    // Mirrors personTokenCacheFile() in utils/cognito-session.ts; duplicated so this path does not load that module.
+    const stateDir = env.HQ_STATE_DIR?.trim() || path.join(home, ".hq");
+    return fs.existsSync(path.join(stateDir, "cognito-tokens.json"));
+}
 /** Returns null when the person preference cannot be read; callers must fail closed. */
 export async function readHqAnywherePersonSetting(options = {}) {
     const env = options.env ?? process.env;
     try {
+        // Avoid loading the Cognito SDK on the common fresh-install path. There is
+        // no person token to refresh or use until a cache exists.
+        if (!options.getPersonToken && !hasPersonTokenCache(env, options.home ?? env.HOME ?? os.homedir()))
+            return null;
         const getPersonToken = options.getPersonToken ?? (async () => {
             const { ensureCognitoToken } = await import("../utils/cognito-session.js");
             return ensureCognitoToken({ interactive: false, tokenSource: "person" });

package/dist/lib/anywhere-runtime-fast-flag.js

@@ -1,9 +1,11 @@
 import { readLocalOverride, resolveFlag } from "@indigoai-us/hq-flags-client";
 import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 import { readFlagSnapshotFile, readPersonFlagSnapshotFile } from "./flag-snapshot-file.js";
-import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag-key.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG, hqAnywhereRuntimeLocallyDisabled } from "./anywhere-runtime-flag-key.js";
 /** Resolve the Anywhere gate from hq-flags without loading the CLI's large worker bundle. */
 export function anywhereRuntimeEnabledFromSnapshot(env = process.env) {
+    if (hqAnywhereRuntimeLocallyDisabled(env))
+        return false;
     const local = readLocalOverride(HQ_ANYWHERE_RUNTIME_FLAG, env);
     if (local !== null)
         return local;
@@ -17,13 +19,13 @@ export function anywhereRuntimeEnabledFromSnapshot(env = process.env) {
     const snapshot = persisted
         ? { version: 0, flags: persisted.flags }
         : null;
-    // HQ Anywhere authorizes a capability, so a missing or stale snapshot fails closed.
+    // The flag is a fail-safe kill switch: unknown registry state keeps HQ Anywhere enabled.
     return resolveFlag({
         flagKey: HQ_ANYWHERE_RUNTIME_FLAG,
         env,
         snapshot,
         companyIdentifiers: [company.companyUid, company.companySlug].filter((value) => Boolean(value)),
-        lookup: { fallback: false },
+        lookup: { fallback: true },
     }).value;
 }
 //# sourceMappingURL=anywhere-runtime-fast-flag.js.map

package/dist/lib/anywhere-runtime-flag-key.d.ts

@@ -1,3 +1,5 @@
-/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is on. */
 export declare const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+/** The HQ Anywhere environment kill switch stays compatible with managed provider wrappers. */
+export declare function hqAnywhereRuntimeLocallyDisabled(env?: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=anywhere-runtime-flag-key.d.ts.map

package/dist/lib/anywhere-runtime-flag-key.js

@@ -1,3 +1,8 @@
-/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is on. */
 export const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+/** The HQ Anywhere environment kill switch stays compatible with managed provider wrappers. */
+export function hqAnywhereRuntimeLocallyDisabled(env = process.env) {
+    const value = env.HQ_FLAG_HQ_ANYWHERE_RUNTIME;
+    return value === "false" || value === "0";
+}
 //# sourceMappingURL=anywhere-runtime-flag-key.js.map

package/dist/lib/daemon/flag.d.ts

@@ -1,7 +1,7 @@
 /**
  * Feature flags read by the daemon. The daemon runs for weeks, so each read
  * asks the registry again instead of holding a per-process answer, and it
- * reads as off unless the registry itself says on (or a local override does).
+ * reads as each flag's fallback unless the registry or a local override decides it.
  */
 import { type FlagClientOptions, type FlagResolution } from "@indigoai-us/hq-flags-client";
 /** Outposts hand running services to the next daemon on a CLI update instead of restarting them all. */

package/dist/lib/daemon/flag.js

@@ -1,12 +1,13 @@
 /**
  * Feature flags read by the daemon. The daemon runs for weeks, so each read
  * asks the registry again instead of holding a per-process answer, and it
- * reads as off unless the registry itself says on (or a local override does).
+ * reads as each flag's fallback unless the registry or a local override decides it.
  */
 import { createFlagClient, readLocalOverride, } from "@indigoai-us/hq-flags-client";
 import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
 import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
 import { resolveProcessFlagCompanyContext } from "../flag-registry.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG, hqAnywhereRuntimeLocallyDisabled } from "../anywhere-runtime-flag-key.js";
 /** Outposts hand running services to the next daemon on a CLI update instead of restarting them all. */
 export const SUPERVISOR_HANDOFF_FLAG = "daemon.supervisor-handoff";
 /** Self-updates build the new CLI beside the running one and swap it in, so `hq` never disappears mid-update. */
@@ -14,6 +15,9 @@ export const STAGED_SELF_UPDATE_FLAG = "cli.staged-self-update";
 const READ_TIMEOUT_MS = 5_000;
 export async function readDaemonFlag(flagKey, options = {}) {
     const env = options.env ?? process.env;
+    if (flagKey === HQ_ANYWHERE_RUNTIME_FLAG && hqAnywhereRuntimeLocallyDisabled(env))
+        return false;
+    const fallback = flagKey === HQ_ANYWHERE_RUNTIME_FLAG;
     const override = readLocalOverride(flagKey, env);
     const localOverrideMode = options.localOverrideMode ?? "respect";
     if (override !== null && (localOverrideMode === "respect" || (localOverrideMode === "off-only" && !override)))
@@ -28,10 +32,10 @@ export async function readDaemonFlag(flagKey, options = {}) {
     let client;
     try {
         const company = resolveProcessFlagCompanyContext(env);
-        // Signed out reads as off without reaching the registry.
+        // Signed out reads as the flag fallback without reaching the registry.
         const token = await (options.getToken ?? (() => ensureCognitoIdToken({ interactive: false })))();
         if (typeof token !== "string" || token.trim() === "")
-            return false;
+            return fallback;
         client = (options.createClient ?? createFlagClient)({
             endpoint: resolveFlagRegistryEndpoint(undefined, env),
             getToken: () => token,
@@ -42,20 +46,27 @@ export async function readDaemonFlag(flagKey, options = {}) {
             ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
             onError,
         });
-        await client.ready();
-        const resolution = client.explain(flagKey, { fallback: false });
-        if (failed && options.throwOnError) {
+        try {
+            await client.ready();
+        }
+        catch (error) {
+            onError(error);
+        }
+        const resolution = client.explain(flagKey, { fallback });
+        if (failed && options.throwOnError && !fallback) {
             throw new Error("hq-flags registry read failed", { cause: reportedError });
         }
-        return !failed && resolution.source === "snapshot" && resolution.value === true;
+        if (resolution.source === "snapshot")
+            return resolution.value === true;
+        return fallback && resolution.value === true;
     }
     catch (error) {
         if (!failed)
             onError(error);
-        if (options.throwOnError && failed) {
+        if (options.throwOnError && failed && !fallback) {
             throw new Error("hq-flags registry read failed", { cause: reportedError ?? error });
         }
-        return false;
+        return fallback;
     }
     finally {
         try {

package/dist/lib/daemon/server.d.ts

@@ -39,7 +39,7 @@ export interface HqdServerOptions {
     env?: NodeJS.ProcessEnv;
     /** Work-mesh root override for mesh.presence (tests). */
     workMeshRoot?: string;
-    /** Test seam for the hq-anywhere-runtime default-off gate. */
+    /** Test seam for the hq-anywhere-runtime fail-safe gate. */
     mcpEnabled?: () => boolean | Promise<boolean>;
     /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
     runtimeFlagReader?: (options: ReadDaemonFlagOptions) => Promise<boolean>;

package/dist/lib/lanes/reconcile.js

@@ -22,7 +22,7 @@ import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDa
 import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, envelopeRepairMode, isPidRecordAlive, laneRunDir, nextEnvelopePath, readPidRecord, readProcStarttime, readSpawnManifest, markSpawnFailure, stopLaneProcesses, spawnEnvelopeRepair, spawnLaneWorker, retryLaneOnAlternateAccount, } from "./spawn.js";
 import { appendCappedHistory, lanesStoreRoot, parseLaneRecord, parseQuestionRecord, readLane, readQuestion, listQuestionIds, updateLane, updateQuestion, } from "./store.js";
 import { applyThrottleDecision, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyObservation, recordCpuBusyObservation, throttleStatePath, writeThrottleState, } from "./throttle.js";
-import { readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "./registry-flag.js";
+import { readLanesRegistryFlag, readLanesRegistryFlagFailOff, readLanesRegistryFlagFailOpen } from "./registry-flag.js";
 import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, LANE_LEAD_ADMISSION_PRIORITY_FLAG, LANE_QUOTA_ACCOUNT_FAILOVER_FLAG, } from "./flag-keys.js";
 import { checkLaneDiskSpace, configuredCodexRolloutHomes, laneDiskAccount, retainCodexRollouts } from "./disk-guard.js";
 import { laneCompanyUidSource, resolveLaneCompany } from "./lane-company.js";
@@ -1216,6 +1216,7 @@ export async function runPassBody(hqRoot, deps) {
         }
     }
     const readRegistryFlag = deps.readRegistryFlag ?? readLanesRegistryFlag;
+    const readRegistryFlagFailOpen = deps.readRegistryFlag ?? readLanesRegistryFlagFailOpen;
     const storyCloseCompanies = new Map();
     for (const lane of lanes) {
         if (lane.depth < 1 || lane.state !== "interrupted" || lane.keep_alive === true ||
@@ -1303,10 +1304,10 @@ export async function runPassBody(hqRoot, deps) {
             readRegistryFlag(LEAD_LANE_KEEP_ALIVE_FLAG, options),
             readRegistryFlag(LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, options),
             hasBlockedKeepAliveLane
-                ? readRegistryFlag(LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, options)
+                ? readRegistryFlagFailOpen(LEAD_LANE_KEEP_ALIVE_RESUME_BLOCKED_FLAG, options)
                 : Promise.resolve(false),
             readRegistryFlag(LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, options),
-            readRegistryFlag(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
+            readRegistryFlagFailOpen(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
         ]);
         keepAliveFlagByCompany.set(key, keepAliveEnabled);
         blockedResumeFlagByCompany.set(key, blockedResumeEnabled);
@@ -3585,6 +3586,7 @@ async function runTerminalKeepAliveCandidatePass(hqRoot, lanes, summary, deps, n
     if (company === null)
         return summary;
     const readFlag = deps.readRegistryFlag ?? readLanesRegistryFlag;
+    const readFlagFailOpen = deps.readRegistryFlag ?? readLanesRegistryFlagFailOpen;
     const options = { company, env: deps.env ?? process.env };
     let keepAliveEnabled;
     let lineageAware;
@@ -3595,7 +3597,7 @@ async function runTerminalKeepAliveCandidatePass(hqRoot, lanes, summary, deps, n
             readFlag(LEAD_LANE_KEEP_ALIVE_FLAG, options),
             readFlag(LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, options),
             readFlag(LEAD_LANE_KEEP_ALIVE_IMMEDIATE_FIRST_RESUME_FLAG, options),
-            readFlag(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
+            readFlagFailOpen(LANE_KEEP_ALIVE_DUE_WAKE_PRECISE_FLAG, options),
         ]);
     }
     catch (err) {

package/dist/lib/lanes/registry-flag.d.ts

@@ -19,12 +19,22 @@ export interface ReadLanesFlagOptions {
     reportFailure?: (error: unknown) => void;
 }
 export declare function readLanesFlagLocalOverride(flagKey: string, env?: NodeJS.ProcessEnv): boolean | null;
+export type LanesRegistryFlagResult = {
+    state: "resolved";
+    value: boolean;
+} | {
+    state: "unknown";
+};
 /**
  * Read a lanes flag once for each company identity in this CLI process. The
- * cache contains only an in-flight or settled boolean promise; it is never
+ * cache contains only an in-flight or settled decision result; it is never
  * written to disk. A local override is checked on every call and wins first.
  */
 export declare function readLanesRegistryFlag(flagKey: string, options?: ReadLanesFlagOptions): Promise<boolean>;
+/** Read a lanes flag while preserving registry failure as an explicit unknown state. */
+export declare function readLanesRegistryFlagResult(flagKey: string, options?: ReadLanesFlagOptions): Promise<LanesRegistryFlagResult>;
+/** Delivery and wake call sites opt in to availability when the registry is unreadable. */
+export declare function readLanesRegistryFlagFailOpen(flagKey: string, options?: ReadLanesFlagOptions): Promise<boolean>;
 /**
  * Flag readers normally report their own failures and return the safe default.
  * Keep enforcement callers safe if an injected or unexpected reader rejects.

package/dist/lib/lanes/registry-flag.js

@@ -8,6 +8,7 @@ export function readLanesFlagLocalOverride(flagKey, env = process.env) {
 }
 const registryReads = new Map();
 const reportedThrownFlagReads = new Set();
+const reportedRegistryFailureFallbacks = new Set();
 class MissingFlagTokenError extends Error {
     constructor() {
         super("No cached HQ identity token is available");
@@ -17,13 +18,13 @@ class MissingFlagTokenError extends Error {
 function errorClass(error) {
     return error instanceof Error ? error.name : "UnknownError";
 }
-function reportReadFailure(flagKey, error) {
+function reportReadFailure(flagKey, error, fallback) {
     const suffix = flagKey.replace(/^lanes\./, "").replaceAll(/[^a-zA-Z0-9]+/g, "_");
     process.stderr.write(`${JSON.stringify({
         event: `lanes.${suffix}.flag_read_failed`,
         flag: flagKey,
         error: errorClass(error),
-        fallback: false,
+        fallback,
     })}\n`);
 }
 function reportInvalidCompanyUid(flagKey, source) {
@@ -46,27 +47,42 @@ function cacheKey(flagKey, company, endpoint) {
 }
 /**
  * Read a lanes flag once for each company identity in this CLI process. The
- * cache contains only an in-flight or settled boolean promise; it is never
+ * cache contains only an in-flight or settled decision result; it is never
  * written to disk. A local override is checked on every call and wins first.
  */
 export async function readLanesRegistryFlag(flagKey, options = {}) {
+    const result = await readLanesRegistryFlagResult(flagKey, options);
+    return result.state === "resolved" ? result.value : false;
+}
+/** Read a lanes flag while preserving registry failure as an explicit unknown state. */
+export async function readLanesRegistryFlagResult(flagKey, options = {}) {
+    const outcome = await readRegistryFlagOutcome(flagKey, options, false);
+    return outcome.result;
+}
+async function readRegistryFlagOutcome(flagKey, options, failOpen) {
     const env = options.env ?? process.env;
     const localOverride = readLanesFlagLocalOverride(flagKey, env);
     if (localOverride !== null)
-        return localOverride;
+        return { result: { state: "resolved", value: localOverride } };
     const companyUid = options.company?.uid?.trim();
     if (companyUid && !companyUid.startsWith("cmp_")) {
         reportInvalidCompanyUid(flagKey, options.companyUidSource ?? "company.uid");
-        return false;
+        return { result: { state: "resolved", value: false } };
     }
     const endpoint = resolveFlagRegistryEndpoint(undefined, env);
     const key = cacheKey(flagKey, options.company, endpoint);
     const cached = registryReads.get(key);
-    if (cached)
-        return cached;
-    const pending = readRegistryValue(flagKey, endpoint, options);
-    registryReads.set(key, pending);
-    return pending;
+    const pending = cached ?? readRegistryValue(flagKey, endpoint, options);
+    if (!cached)
+        registryReads.set(key, pending);
+    const outcome = await pending;
+    reportRegistryFailure(flagKey, key, outcome, options, failOpen);
+    return outcome;
+}
+/** Delivery and wake call sites opt in to availability when the registry is unreadable. */
+export async function readLanesRegistryFlagFailOpen(flagKey, options = {}) {
+    const outcome = await readRegistryFlagOutcome(flagKey, options, true);
+    return outcome.result.state === "unknown" ? true : outcome.result.value;
 }
 /**
  * Flag readers normally report their own failures and return the safe default.
@@ -97,15 +113,10 @@ async function readRegistryValue(flagKey, endpoint, options) {
     const companyUid = company?.uid?.trim();
     const companySlug = company?.slug?.trim();
     let client;
-    let enabled = false;
-    let failed = false;
-    let reported = false;
-    const reportFailure = (error) => {
-        failed = true;
-        if (reported)
-            return;
-        reported = true;
-        (options.reportFailure ?? ((cause) => reportReadFailure(flagKey, cause)))(error);
+    let resolution;
+    let failure;
+    const rememberFailure = (error) => {
+        failure ??= { error };
     };
     try {
         const acquireToken = options.getToken ?? (async () => {
@@ -135,30 +146,58 @@ async function readRegistryValue(flagKey, endpoint, options) {
             requestTimeoutMs: LANES_FLAG_READ_TIMEOUT_MS,
             ...(companyUid ? { companyUid } : {}),
             ...(companySlug ? { companyIdentifiers: [companySlug] } : {}),
-            onError: reportFailure,
+            onError: rememberFailure,
         });
-        await client.ready();
-        const resolution = client.explain(flagKey, { fallback: false });
-        if (failed)
-            return false;
-        if (resolution.source === "snapshot" || resolution.source === "local-override") {
-            enabled = resolution.value;
+        try {
+            await client.ready();
+        }
+        catch (error) {
+            rememberFailure(error);
+        }
+        try {
+            resolution = client.explain(flagKey, { fallback: false });
+        }
+        catch (error) {
+            rememberFailure(error);
         }
     }
     catch (error) {
-        reportFailure(error);
+        rememberFailure(error);
     }
     finally {
         try {
             client?.close();
         }
         catch (error) {
-            reportFailure(error);
+            rememberFailure(error);
         }
     }
-    return failed ? false : enabled;
+    if (resolution?.source === "snapshot" || resolution?.source === "local-override") {
+        return { result: { state: "resolved", value: resolution.value }, ...(failure ? { failure } : {}) };
+    }
+    if (failure)
+        return { result: { state: "unknown" }, failure };
+    return { result: { state: "resolved", value: resolution?.value ?? false } };
+}
+function reportRegistryFailure(flagKey, key, outcome, options, failOpen) {
+    if (!outcome.failure)
+        return;
+    const fallback = outcome.result.state === "resolved"
+        ? outcome.result.value
+        : failOpen;
+    const reportKey = `${key}:${fallback}`;
+    if (reportedRegistryFailureFallbacks.has(reportKey))
+        return;
+    reportedRegistryFailureFallbacks.add(reportKey);
+    const reportFailure = options.reportFailure;
+    if (reportFailure) {
+        reportFailure(outcome.failure.error);
+        return;
+    }
+    reportReadFailure(flagKey, outcome.failure.error, fallback);
 }
 export function _resetLanesRegistryFlagCacheForTests() {
     registryReads.clear();
+    reportedRegistryFailureFallbacks.clear();
 }
 //# sourceMappingURL=registry-flag.js.map

package/dist/lib/lanes/watcher.js

@@ -398,8 +398,69 @@ function applyTerminalToLaneWithResult(hqRoot, laneId, classification, opts = {}
             current.state === "interrupted" ||
             current.state === "cancelled" ||
             current.state === "killed";
-        if (terminal)
-            return current;
+        if (terminal) {
+            // A terminal state may have been recorded before the worker's final
+            // report arrived. The report is durable output from work that already
+            // ran, so preserve it without reopening the lane or rechecking admission.
+            if (opts.envelope === undefined || opts.envelope === null)
+                return current;
+            const approvalGate = enforceRegistryApprovalGate(current, opts.envelope);
+            effectiveEnvelope = approvalGate.envelope;
+            effectiveClassification = approvalGate.violation
+                ? { state: "blocked", reason: "approval_gate_violated" }
+                : terminalClassification;
+            const envelope = effectiveEnvelope;
+            const storySwitch = applyStorySwitchEnvelope(current, envelope, at, envelopeRef);
+            const next = {
+                ...current,
+                last_envelope: {
+                    ref: envelopeRef,
+                    decision: envelope.decision,
+                    at,
+                    artifacts: envelope.artifacts,
+                    ...(envelope.blocked_reason !== undefined ? { blocked_reason: envelope.blocked_reason } : {}),
+                    ...(envelope.next_check_at !== undefined ? { next_check_at: envelope.next_check_at } : {}),
+                },
+                ...(envelope.decision !== "blocked" ? { keep_alive_blocked_resume_streak: 0 } : {}),
+                envelope_validation_errors: opts.envelopeValidationErrors,
+            };
+            if (!approvalGate.violation && approvalGate.approvedIdsToConsume.length > 0) {
+                next.registry_worker_approval_history = approvalGate.approvedIdsToConsume.reduce((history, approvalId) => appendCappedHistory(history, {
+                    event: "consumed",
+                    approval_id: approvalId,
+                    envelope_ref: envelopeRef,
+                    at,
+                }), current.registry_worker_approval_history ?? []);
+            }
+            if (current.state === "cancelled" || current.state === "killed") {
+                return JSON.stringify(next) !== JSON.stringify(current) ? next : current;
+            }
+            const storyStatus = storySwitch.suppressCompletion
+                ? "in_progress"
+                : terminalEnvelopeStoryStatus(current, envelope.decision, envelope.story_status);
+            if (storyStatus !== undefined) {
+                next.story_status = storySwitch.suppressCompletion ? "in_progress" : envelope.story_status;
+                next.story_complete = storySwitch.suppressCompletion ? false : envelope.story_complete;
+                next.story_complete_reason = storySwitch.suppressCompletion ? undefined : envelope.story_complete_reason;
+                next.stories = laneStories(current).map((story) => story.project_id === current.project_id && story.story_id === current.story_id
+                    ? {
+                        ...story,
+                        status: storyStatus,
+                        updated_at: at,
+                        ...(envelope.decision === "blocked"
+                            ? { blocked_reason: envelope.blocked_reason ?? "" }
+                            : { blocked_reason: undefined }),
+                    }
+                    : story);
+            }
+            if (storySwitch.clearPending)
+                next.story_switch_pending = undefined;
+            if (storySwitch.storySwitchUnacknowledged !== undefined) {
+                next.story_switch_unacknowledged = storySwitch.storySwitchUnacknowledged;
+                next.attribution_history = storySwitch.attributionHistory ?? current.attribution_history;
+            }
+            return JSON.stringify(next) !== JSON.stringify(current) ? next : current;
+        }
         if (current.state === "awaiting_input" || current.state === "blocked") {
             if (current.state === effectiveClassification.state)
                 return current;

package/dist/utils/resident-package-preload.js

@@ -40,7 +40,7 @@ export const RESIDENT_PACKAGE_MODULES = {
         "@indigoai-us/hq-cloud",
     ],
     "bot-logs-follow": [],
-    mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client"],
+    mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../lib/anywhere-person-setting.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client"],
     childWrapper: ["../main.js"],
     coreJobRun: ["../lib/flag-registry.js"],
     "daemon-call": ["../lib/daemon/protocol.js"],
@@ -76,6 +76,7 @@ export const RESIDENT_PACKAGE_MODULES = {
         "../utils/plan-gate-error.js",
         "open",
         "../commands/mcp-serve.js",
+        "../lib/anywhere-person-setting.js",
         "../lib/daemon/mcp-oauth.js",
         "../lib/mcp/tools.js",
         "../lib/mcp/prompts.js",
@@ -187,6 +188,7 @@ const LOADERS = {
     mcp: [
         () => import("../lib/mcp/tools.js"),
         () => import("../lib/mcp/prompts.js"),
+        () => import("../lib/anywhere-person-setting.js"),
         () => import("../utils/cognito-session.js"),
         () => import("@indigoai-us/hq-cloud"),
         async () => {
@@ -347,6 +349,7 @@ const LOADERS = {
         () => import("../utils/plan-gate-error.js"),
         () => import("open"),
         () => import("../commands/mcp-serve.js"),
+        () => import("../lib/anywhere-person-setting.js"),
         () => import("../lib/daemon/mcp-oauth.js"),
         () => import("../lib/mcp/tools.js"),
         () => import("../lib/mcp/prompts.js"),

package/dist/utils/self-update.js

@@ -65,7 +65,7 @@ import chalk from "chalk";
 import { Sentry } from "../sentry.js";
 import { isCliTelemetryDisabled } from "./cli-telemetry.js";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmPathConflict, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, resolvePnpmPathInstall, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
 import { canStageInstall, stagedNpmInstall } from "./staged-install.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
@@ -926,17 +926,18 @@ async function attemptUpdateAndReexec(argv, flavor, known, deps, env) {
     // actually running would stay exactly as stale as it started while the CLI
     // reported success and re-exec'd into the same build. That is the shape of
     // the 2026-09-02 gate loop — see isLocalDependencyInstall in version-gate.ts.
-    const install = (deps.resolveInstall ?? resolveRunningInstall)();
+    let install = (deps.resolveInstall ?? resolveRunningInstall)();
     if (isLocalDependencyInstall(install)) {
         console.error(chalk.dim(`hq-cli ${latest} is available, but this copy is a local dependency (${install.packageRoot}) — update the project that owns it.`));
         return { action: "skipped", latest };
     }
     if (install.manager === "pnpm") {
-        const conflict = pnpmPathConflict(install);
-        if (conflict) {
-            console.error(chalk.yellow(`⚠ hq self-update refused: ${conflict}`));
+        const pathTarget = resolvePnpmPathInstall(install);
+        if (pathTarget.refusal) {
+            console.error(chalk.yellow(`⚠ hq self-update refused: ${pathTarget.refusal}`));
             return { action: "skipped", latest };
         }
+        install = pathTarget.install;
     }
     const releaseLock = flavor.lock ? (deps.acquireLock ?? acquireUpdateLock)() : () => { };
     if (!releaseLock)

package/dist/utils/version-gate.d.ts

@@ -194,6 +194,8 @@ export declare function isPrefixWritable(prefix: string, access?: (target: strin
  * existing ancestor: npm can create a child only if that ancestor is writable.
  */
 export declare function canWriteNpmInstall(prefix: string, packageRoot: string, access?: (target: string, mode: number) => void, platform?: NodeJS.Platform): boolean;
+/** Check whether pnpm can replace its global package and PATH shim. */
+export declare function canWritePnpmInstall(install: RunningInstall, access?: (target: string, mode: number) => void): boolean;
 /** Claim the one local warning/report for this installed version and prefix. */
 export declare function claimNonWritableNpmPrefixNotice(install: Pick<RunningInstall, "manager" | "prefix" | "packageRoot">, fromVersion: string, homeDir?: string, kind?: "user" | "report"): boolean;
 /** Emit one path-free warning event for a handled non-writable npm prefix. */
@@ -223,10 +225,12 @@ export declare function derivePnpmHome(install: RunningInstall): string | null;
  * Environment for the pnpm self-update spawn. pnpm requires its configured
  * global bin directory to be on PATH; pnpm 12.5.1 reports
  * `ERR_PNPM_GLOBAL_BIN_DIR_NOT_IN_PATH` otherwise. Minimal-environment parents
- * may also lack PNPM_HOME, so derive it from the running install when needed.
+ * may also lack PNPM_HOME, so derive it from the selected install when needed.
  *
- * A no-op for npm/bun installs. Never override a caller's PNPM_HOME. Returns
- * `undefined` only when the inherited environment already has both values.
+ * A no-op for npm/bun installs. The selected install's home owns its global
+ * bin directory, so it takes precedence over an inherited PNPM_HOME after the
+ * updater retargets the install. Returns `undefined` only when the inherited
+ * environment already has the required values.
  */
 export declare function pnpmUpdateEnv(install: RunningInstall, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv | undefined;
 export declare function buildPrefixedInstallArgv(prefix: string): string[];
@@ -436,7 +440,10 @@ declare function probeCliVersion(bin: string): string | null;
  * shims, so writing one home cannot change a different home that appears first
  * on PATH.
  */
-export declare function pnpmPathConflict(install: RunningInstall): string | null;
+export declare function resolvePnpmPathInstall(install: RunningInstall, canWrite?: (target: RunningInstall) => boolean): {
+    install: RunningInstall;
+    refusal: string | null;
+};
 /**
  * Read-your-writes convergence check, run after an install reports success.
  *

package/dist/utils/version-gate.js

@@ -101,11 +101,11 @@ function findRunningPackageRoot() {
     return findCliPackageRoot(path.dirname(fileURLToPath(import.meta.url)));
 }
 /** Resolve an on-PATH executable back to the installed hq-cli package it loads. */
-function findPackageRootForExecutable(bin) {
+function resolvePackageRootForExecutable(bin) {
     try {
         const packageRoot = findCliPackageRoot(path.dirname(realpathSync(bin)));
         if (packageRoot)
-            return packageRoot;
+            return { packageRoot, candidates: [packageRoot] };
     }
     catch {
         // A missing or inaccessible executable may still be recoverable from the
@@ -115,25 +115,26 @@ function findPackageRootForExecutable(bin) {
     // resolves symlinks, but a generated shim is a regular file, so walking up
     // from its real path never reaches the package it invokes. Look up only the
     // hq-cli package under the matching PNPM_HOME/global layout instead.
-    const binDir = path.dirname(bin);
+    const shimBinDir = path.dirname(bin);
     const configuredHome = process.env.PNPM_HOME;
-    const inferredHome = path.basename(binDir).toLowerCase() === "bin"
-        ? path.dirname(binDir)
-        : binDir;
+    const inferredHome = path.basename(shimBinDir).toLowerCase() === "bin"
+        ? path.dirname(shimBinDir)
+        : shimBinDir;
     const candidateHomes = [configuredHome, inferredHome].filter((home, index, homes) => Boolean(home) && homes.findIndex((candidate) => candidate === home) === index);
-    const home = candidateHomes.find((candidate) => samePath(binDir, candidate) ||
-        samePath(binDir, path.join(candidate, "bin")));
+    const home = candidateHomes.find((candidate) => samePath(shimBinDir, candidate) ||
+        samePath(shimBinDir, path.join(candidate, "bin")));
     if (!home)
-        return null;
+        return { packageRoot: null, candidates: [] };
     const globalRoot = path.join(home, "global");
     let storeVersions;
     try {
         storeVersions = readdirSync(globalRoot);
     }
     catch {
-        return null;
+        return { packageRoot: null, candidates: [] };
     }
     const packageSegments = CLI_NAME.split("/");
+    const candidates = new Set();
     for (const storeVersion of storeVersions) {
         const storeRoot = path.join(globalRoot, storeVersion);
         const packageRoots = [
@@ -156,11 +157,38 @@ function findPackageRootForExecutable(bin) {
             if (packageRoot &&
                 samePath(packageRoot, candidate) &&
                 isPnpmManagedPackageDir(packageRoot)) {
-                return packageRoot;
+                candidates.add(packageRoot);
             }
         }
     }
-    return null;
+    const roots = [...candidates];
+    if (roots.length <= 1)
+        return { packageRoot: roots[0] ?? null, candidates: roots };
+    // pnpm's generated shim identifies the package entry point it will execute.
+    // Use that target to select among v11 hash directories instead of letting
+    // directory enumeration order choose the global project and virtual store.
+    let shimContents;
+    try {
+        shimContents = readFileSync(bin, "utf8").replace(/\\/g, "/");
+    }
+    catch {
+        return { packageRoot: null, candidates: roots };
+    }
+    const selected = roots.filter((root) => {
+        const entryPoint = installedHqEntryPoint({ manager: "pnpm", prefix: null, packageRoot: root });
+        if (!entryPoint)
+            return false;
+        const absolute = entryPoint.replace(/\\/g, "/");
+        const relative = path.relative(shimBinDir, entryPoint).replace(/\\/g, "/");
+        return shimContents.includes(absolute) || shimContents.includes(relative);
+    });
+    return {
+        packageRoot: selected.length === 1 ? selected[0] : null,
+        candidates: roots,
+    };
+}
+function findPackageRootForExecutable(bin) {
+    return resolvePackageRootForExecutable(bin).packageRoot;
 }
 function samePath(left, right) {
     const canonical = (value) => {
@@ -507,6 +535,39 @@ export function canWriteNpmInstall(prefix, packageRoot, access = (target, mode)
         }
     });
 }
+/** Check whether pnpm can replace its global package and PATH shim. */
+export function canWritePnpmInstall(install, access = (target, mode) => accessSync(target, mode)) {
+    const home = derivePnpmHome(install);
+    if (!home || !install.packageRoot)
+        return false;
+    const mode = fsConstants.W_OK | fsConstants.X_OK;
+    const dirs = pnpmInstallDirs(install);
+    const targets = [
+        home,
+        path.join(home, "global"),
+        path.join(home, "store"),
+        ...(dirs ? [dirs.globalDir, dirs.storeDir, dirs.virtualStoreDir] : []),
+        path.dirname(install.packageRoot),
+    ];
+    return targets.every((target) => {
+        let candidate = path.resolve(target);
+        while (true) {
+            try {
+                access(candidate, mode);
+                return true;
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT")
+                    return false;
+                // pnpm creates missing targets under the nearest existing writable ancestor.
+                const parent = path.dirname(candidate);
+                if (parent === candidate)
+                    return false;
+                candidate = parent;
+            }
+        }
+    });
+}
 const nonWritablePrefixNotices = new Set();
 /** Claim the one local warning/report for this installed version and prefix. */
 export function claimNonWritableNpmPrefixNotice(install, fromVersion, homeDir = os.homedir(), kind = "user") {
@@ -601,18 +662,22 @@ export function derivePnpmHome(install) {
  * Environment for the pnpm self-update spawn. pnpm requires its configured
  * global bin directory to be on PATH; pnpm 12.5.1 reports
  * `ERR_PNPM_GLOBAL_BIN_DIR_NOT_IN_PATH` otherwise. Minimal-environment parents
- * may also lack PNPM_HOME, so derive it from the running install when needed.
+ * may also lack PNPM_HOME, so derive it from the selected install when needed.
  *
- * A no-op for npm/bun installs. Never override a caller's PNPM_HOME. Returns
- * `undefined` only when the inherited environment already has both values.
+ * A no-op for npm/bun installs. The selected install's home owns its global
+ * bin directory, so it takes precedence over an inherited PNPM_HOME after the
+ * updater retargets the install. Returns `undefined` only when the inherited
+ * environment already has the required values.
  */
 export function pnpmUpdateEnv(install, base = process.env) {
     if (install.manager !== "pnpm")
         return undefined;
-    const home = base.PNPM_HOME || derivePnpmHome(install);
+    const home = derivePnpmHome(install) ?? base.PNPM_HOME;
     if (!home)
         return undefined;
-    const binDir = path.join(home, "bin");
+    // pnpm's own `bin -g` command reports PNPM_HOME itself as the global bin
+    // directory; it must be that directory, not a guessed `<home>/bin` child.
+    const binDir = home;
     const pathKey = Object.keys(base).find((key) => key.toLowerCase() === "path") ?? "PATH";
     const currentPath = base[pathKey] ?? "";
     const normalizedBinDir = path.resolve(binDir);
@@ -633,7 +698,7 @@ export function pnpmUpdateEnv(install, base = process.env) {
         COREPACK_DEFAULT_TO_LATEST: "0",
         COREPACK_ENABLE_AUTO_PIN: "0",
     };
-    if (!base.PNPM_HOME)
+    if (base.PNPM_HOME !== home)
         result.PNPM_HOME = home;
     if (!alreadyOnPath)
         result[pathKey] = [currentPath, binDir].filter(Boolean).join(path.delimiter);
@@ -1401,36 +1466,62 @@ function probeCliVersion(bin) {
  * shims, so writing one home cannot change a different home that appears first
  * on PATH.
  */
-export function pnpmPathConflict(install) {
+export function resolvePnpmPathInstall(install, canWrite = canWritePnpmInstall) {
     if (install.manager !== "pnpm" || !install.packageRoot)
-        return null;
+        return { install, refusal: null };
     const bin = resolveHqOnPath();
     if (!bin)
-        return null;
-    const pathPackageRoot = findPackageRootForExecutable(bin);
-    if (!pathPackageRoot ||
-        globalInstallManagerForPath(bin, pathPackageRoot) !== "pnpm") {
-        return null;
-    }
-    // The fallback resolver scans every hash in a PNPM_HOME because generated
-    // shims do not expose their target. Multiple installs in the SAME home can
-    // therefore produce an arbitrary package root; only a different home means
-    // that updating this install cannot change which global shim wins PATH.
+        return { install, refusal: null };
     const runningHome = derivePnpmHome(install);
+    const packageRootLookup = resolvePackageRootForExecutable(bin);
+    const pathPackageRoot = packageRootLookup.packageRoot;
+    if (!pathPackageRoot) {
+        if (packageRootLookup.candidates.length > 1) {
+            return {
+                install,
+                refusal: `could not identify which pnpm package PATH binary ${bin} resolves to; matching global packages: ${packageRootLookup.candidates.join(", ")}`,
+            };
+        }
+        const binDirectory = path.dirname(bin);
+        const binHome = path.basename(binDirectory).toLowerCase() === "bin"
+            ? path.dirname(binDirectory)
+            : binDirectory;
+        if (runningHome && binHome && samePath(runningHome, binHome)) {
+            if (canWrite(install))
+                return { install, refusal: null };
+            return {
+                install,
+                refusal: `cannot update the pnpm install resolved by PATH at ${bin}: its pnpm home is not writable`,
+            };
+        }
+        return { install, refusal: `could not identify the pnpm-managed install resolved by PATH at ${bin}` };
+    }
+    const pathManager = globalInstallManagerForPath(bin, pathPackageRoot);
+    if (pathManager !== "pnpm") {
+        if (pathManager === "npm" || pathManager === "bun") {
+            // Updating the running pnpm install still makes progress when a known
+            // npm/Bun install shadows it; refusing would guarantee no convergence.
+            return { install, refusal: null };
+        }
+        return { install, refusal: `PATH resolves ${bin} to an install that is not verified as pnpm-managed` };
+    }
+    // The resolver uses the generated shim's target when a pnpm v11 home has
+    // multiple package hashes. Its selected package root must drive the global
+    // directory and virtual store used by the update.
     const pathHome = derivePnpmHome({ manager: "pnpm", prefix: null, packageRoot: pathPackageRoot });
-    if (!runningHome || !pathHome || samePath(runningHome, pathHome))
-        return null;
-    let resolvedBin = bin;
-    try {
-        resolvedBin = realpathSync(bin);
+    if (!runningHome || !pathHome) {
+        return { install, refusal: `could not identify the PNPM_HOME for PATH binary ${bin}` };
     }
-    catch {
-        // Keep the PATH entry when a platform shim cannot be canonicalized.
+    const targetInstall = samePath(runningHome, pathHome)
+        ? install
+        : { manager: "pnpm", prefix: null, packageRoot: pathPackageRoot };
+    if (!canWrite(targetInstall)) {
+        return {
+            install,
+            refusal: `cannot update the pnpm install resolved by PATH at ${bin}: its pnpm home is not writable`,
+        };
     }
-    const version = probeCliVersion(bin) ?? "unknown";
-    return (`PATH resolves ${resolvedBin} at version ${version} (manager: pnpm), ` +
-        `but this process is running from a different pnpm install at ${install.packageRoot}. ` +
-        "Refusing to update one pnpm home while another hq-cli install wins PATH resolution.");
+    return { install: targetInstall, refusal: null };
 }
 /**
  * Read-your-writes convergence check, run after an install reports success.

package/docs/anywhere-runtime.md

@@ -5,7 +5,9 @@ local hqd daemon on macOS, Linux, and Windows. On Windows, hqd uses a bundled
 PowerShell pipe host that applies and verifies a user-only named-pipe DACL
 before becoming ready. A per-user
 registry links repositories to HQ companies. The `hq-anywhere-runtime` flag
-is the operator kill switch and is off by default. Runtime access also
+is an operator kill switch that defaults on when its registry row is absent,
+archived, or unreadable. An explicit registry false or the local
+`HQ_FLAG_HQ_ANYWHERE_RUNTIME=false|0` override turns it off. Runtime access also
 requires the current person to enable the `hq-anywhere` setting in HQ. If that
 setting cannot be read, runtime access stays off.
 
@@ -34,8 +36,8 @@ stored in a repository or synced HQ folder.
 Windows requires Windows PowerShell 5.1 or PowerShell 7 for the bundled pipe
 host. If it is unavailable, the pipe cannot be created with a verified
 current-user-only DACL, or another process already owns the pipe name, hqd
-refuses to start. The `hq-anywhere-runtime` flag remains off by default on all
-platforms.
+refuses to start. The flag's missing-row fallback is on across platforms; an
+explicit false remains the operator kill switch.
 
 On macOS and Linux, hqd checks the socket directory and socket path with
 `lstat` before serving. It refuses symlinked, shared, or foreign-owned paths.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.48",
+  "version": "5.345.49",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {