@indigoai-us/hq-cli 5.345.58 → 5.345.60

package/dist/lib/agent-kit/run/stop-signals.d.ts

@@ -0,0 +1,14 @@
+import { EventEmitter } from "node:events";
+export declare const KIT_STOP_GRACE_MS = 10000;
+interface KitStopControllerOptions {
+    emitter?: Pick<EventEmitter, "once" | "removeListener">;
+    forceExit?: (code: number) => void;
+    timeoutMs?: number;
+}
+/** Abort service work on stop, with a deadline if an awaited operation stalls. */
+export declare function createKitStopController(options?: KitStopControllerOptions): {
+    signal: AbortSignal;
+    dispose(): void;
+};
+export {};
+//# sourceMappingURL=stop-signals.d.ts.map

package/dist/lib/agent-kit/run/stop-signals.js

@@ -0,0 +1,26 @@
+export const KIT_STOP_GRACE_MS = 10_000;
+/** Abort service work on stop, with a deadline if an awaited operation stalls. */
+export function createKitStopController(options = {}) {
+    const emitter = options.emitter ?? process;
+    const forceExit = options.forceExit ?? ((code) => process.exit(code));
+    const controller = new AbortController();
+    let deadline;
+    const stop = () => {
+        if (controller.signal.aborted)
+            return;
+        controller.abort();
+        deadline = setTimeout(() => forceExit(0), options.timeoutMs ?? KIT_STOP_GRACE_MS);
+    };
+    emitter.once("SIGTERM", stop);
+    emitter.once("SIGINT", stop);
+    return {
+        signal: controller.signal,
+        dispose() {
+            if (deadline)
+                clearTimeout(deadline);
+            emitter.removeListener("SIGTERM", stop);
+            emitter.removeListener("SIGINT", stop);
+        },
+    };
+}
+//# sourceMappingURL=stop-signals.js.map

package/dist/lib/agent-kit/services.d.ts

@@ -14,8 +14,8 @@ export declare function isKitService(value: string): value is KitService;
  * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
  * relocated kit consistent across restarts.
  */
-export declare function kitServiceEnv(paths: AgentKitPaths): Record<string, string>;
-export declare function kitServiceSpec(service: KitService, paths: AgentKitPaths): ServiceSpec;
+export declare function kitServiceEnv(paths: AgentKitPaths, env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function kitServiceSpec(service: KitService, paths: AgentKitPaths, env?: NodeJS.ProcessEnv): ServiceSpec;
 /**
  * Services to install. `sync` is included only when the kit is configured to
  * mirror the vault to disk; by default a bot reads files on demand through the

package/dist/lib/agent-kit/services.js

@@ -20,14 +20,16 @@ const DESCRIPTIONS = {
  * file a loud error instead of a browser-login hang; HQ_AGENT_DIR keeps a
  * relocated kit consistent across restarts.
  */
-export function kitServiceEnv(paths) {
+export function kitServiceEnv(paths, env = process.env) {
+    const flagsApiUrl = env.HQ_FLAGS_API_URL;
     return {
         HQ_AGENT_DIR: paths.agentDir,
         HQ_MACHINE_CREDS_FILE: paths.machineCredsPath,
         HQ_REQUIRE_MACHINE_IDENTITY: "1",
+        ...(flagsApiUrl?.trim() ? { HQ_FLAGS_API_URL: flagsApiUrl } : {}),
     };
 }
-export function kitServiceSpec(service, paths) {
+export function kitServiceSpec(service, paths, env = process.env) {
     return {
         name: service,
         label: `${KIT_LABEL_PREFIX}.${service}`,
@@ -35,7 +37,7 @@ export function kitServiceSpec(service, paths) {
         args: ["agent", "kit", "run", service],
         logPath: serviceLogPath(paths, service),
         workingDir: paths.agentDir,
-        env: kitServiceEnv(paths),
+        env: kitServiceEnv(paths, env),
         restartSec: 10,
     };
 }

package/dist/lib/anywhere-runtime-flag-key.d.ts

@@ -1,5 +1,6 @@
 /** hq-flags key for the staged HQ Anywhere runtime. The registry default is on. */
 export declare const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+export declare const HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER = "hq-anywhere-runtime.revoked";
 /** The HQ Anywhere environment kill switch stays compatible with managed provider wrappers. */
 export declare function hqAnywhereRuntimeLocallyDisabled(env?: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=anywhere-runtime-flag-key.d.ts.map

package/dist/lib/anywhere-runtime-flag-key.js

@@ -1,5 +1,6 @@
 /** hq-flags key for the staged HQ Anywhere runtime. The registry default is on. */
 export const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+export const HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER = "hq-anywhere-runtime.revoked";
 /** The HQ Anywhere environment kill switch stays compatible with managed provider wrappers. */
 export function hqAnywhereRuntimeLocallyDisabled(env = process.env) {
     const value = env.HQ_FLAG_HQ_ANYWHERE_RUNTIME;

package/dist/lib/anywhere-runtime-revocation-marker.d.ts

@@ -0,0 +1,4 @@
+export declare function anywhereRuntimeRevocationMarkerPath(home?: string, env?: NodeJS.ProcessEnv): string;
+/** Keep installed wrappers aligned with the daemon's refreshed access decision. */
+export declare function updateAnywhereRuntimeRevocationMarker(enabled: boolean, home?: string, env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=anywhere-runtime-revocation-marker.d.ts.map

package/dist/lib/anywhere-runtime-revocation-marker.js

@@ -0,0 +1,26 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER } from "./anywhere-runtime-flag-key.js";
+import { registryDir } from "./registry/registry.js";
+export function anywhereRuntimeRevocationMarkerPath(home = os.homedir(), env = process.env) {
+    return path.join(registryDir(home, env), HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER);
+}
+/** Keep installed wrappers aligned with the daemon's refreshed access decision. */
+export function updateAnywhereRuntimeRevocationMarker(enabled, home = os.homedir(), env = process.env) {
+    const marker = anywhereRuntimeRevocationMarkerPath(home, env);
+    if (!enabled) {
+        fs.mkdirSync(path.dirname(marker), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(marker, "revoked\n", { mode: 0o600 });
+        fs.chmodSync(marker, 0o600);
+        return;
+    }
+    try {
+        fs.unlinkSync(marker);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+//# sourceMappingURL=anywhere-runtime-revocation-marker.js.map

package/dist/lib/daemon/run.d.ts

@@ -29,6 +29,15 @@ export interface DaemonLockConflictOutcome {
 export declare function daemonLockConflictOutcome(lock: DaemonLockResult, anywhereEnabled: boolean): DaemonLockConflictOutcome | null;
 /** hqd is available on every platform while Anywhere is enabled; its listener fails closed if setup is unsafe. */
 export declare function shouldStartHqd(anywhereEnabled: boolean): boolean;
+/**
+ * Resolve the supervisor's runtime-access decision and reflect it in the local
+ * markers: the wrapper revocation marker and the hook shims' hqd enabled marker.
+ * Turning on publishes the enabled marker before lifting revocation, and turning
+ * off revokes before withdrawing it, so no hook ever sees revocation lifted while
+ * the shim would stay inert. If the enabled marker cannot be published,
+ * revocation stays in place.
+ */
+export declare function refreshHqdRuntimeDecision(readDecision: () => Promise<boolean>, home: string, env: NodeJS.ProcessEnv, onMarkerError?: (error: unknown) => void, syncEnabledMarker?: (enabled: boolean) => void): Promise<boolean>;
 /** Route an updater request through the daemon's existing graceful handoff. */
 export declare function handoffForPackageUpdateRequest(requested: boolean, restartDaemon: () => void): void;
 export interface RunDaemonOptions {

package/dist/lib/daemon/run.js

@@ -30,11 +30,12 @@ import { retireLegacyMeshUnits } from "./migrate.js";
 import { daemonDir as meshDaemonDir, daemonPidPath as meshDaemonPidPath } from "../mesh/live/daemon/paths.js";
 import { readPidLock } from "../mesh/live/daemon/pid-lock.js";
 import { registryDir, registryFile } from "../registry/registry.js";
+import { updateAnywhereRuntimeRevocationMarker } from "../anywhere-runtime-revocation-marker.js";
 import { daemonRootRefusal } from "./install.js";
 import { detectMachineType } from "./machine-type.js";
 import { appendPrivate, daemonPaths, ensurePrivateDir, openPrivateAppend } from "./paths.js";
 import { hqdSocketPath } from "./protocol.js";
-import { startHqdServer } from "./server.js";
+import { startHqdServer, syncHqdEnabledMarker } from "./server.js";
 import { startHqdRuntimeListener } from "./anywhere-listener.js";
 import { heartbeatFile, startHeartbeat } from "./heartbeat.js";
 import { createProtocolTail, ensureProtocolFifo, openProtocolWriter } from "./protocol-tail.js";
@@ -93,6 +94,41 @@ export function daemonLockConflictOutcome(lock, anywhereEnabled) {
 export function shouldStartHqd(anywhereEnabled) {
     return anywhereEnabled;
 }
+/**
+ * Resolve the supervisor's runtime-access decision and reflect it in the local
+ * markers: the wrapper revocation marker and the hook shims' hqd enabled marker.
+ * Turning on publishes the enabled marker before lifting revocation, and turning
+ * off revokes before withdrawing it, so no hook ever sees revocation lifted while
+ * the shim would stay inert. If the enabled marker cannot be published,
+ * revocation stays in place.
+ */
+export async function refreshHqdRuntimeDecision(readDecision, home, env, onMarkerError = () => { }, syncEnabledMarker = () => { }) {
+    const enabled = await readDecision();
+    if (enabled) {
+        try {
+            syncEnabledMarker(true);
+        }
+        catch (error) {
+            onMarkerError(error);
+            return enabled;
+        }
+    }
+    try {
+        updateAnywhereRuntimeRevocationMarker(enabled, home, env);
+    }
+    catch (error) {
+        onMarkerError(error);
+    }
+    if (!enabled) {
+        try {
+            syncEnabledMarker(false);
+        }
+        catch (error) {
+            onMarkerError(error);
+        }
+    }
+    return enabled;
+}
 /** Route an updater request through the daemon's existing graceful handoff. */
 export function handoffForPackageUpdateRequest(requested, restartDaemon) {
     if (requested)
@@ -897,13 +933,13 @@ export async function runDaemon(opts) {
         onError: (name) => log("warn", `hqd person setting read failed (${name}); keeping the last read value for up to ${HQD_PERSON_SETTING_GRACE_MS / 60_000} minutes`),
     }), { graceMs: HQD_PERSON_SETTING_GRACE_MS });
     const hqdListener = await startHqdRuntimeListener({
-        isEnabled: async () => shouldStartHqd(await anywhereRuntimeAllowed(env, {
+        isEnabled: async () => refreshHqdRuntimeDecision(async () => shouldStartHqd(await anywhereRuntimeAllowed(env, {
             refreshFlag: async () => {
                 const { refreshFlagRegistrySnapshot } = await import("../flag-registry.js");
                 await refreshFlagRegistrySnapshot(5_000);
             },
             readSetting: readPersonSetting,
-        })),
+        })), home, env, (error) => log("warn", `hqd runtime marker update failed: ${error.message ?? String(error)}`), (enabled) => syncHqdEnabledMarker(hqdSocketPath(home, env), enabled)),
         startServer: async () => {
             const startConfig = readDaemonConfig(paths.configPath);
             return startHqdServer({
@@ -959,8 +995,9 @@ export async function runDaemon(opts) {
                 releaseDaemonLock(paths.lockPath);
                 resolve(exitCode);
                 // Pipes, sockets and unrelated timers can outlive a clean shutdown.
-                // Keep restart and signal exits bounded just like the handoff path.
-                setTimeout(() => process.exit(exitCode), 5_000).unref();
+                // Services and the lock are already stopped; unrelated handles should
+                // not hold a restart or signal exit open for another service interval.
+                setTimeout(() => process.exit(exitCode), 1_000).unref();
             });
         };
         /** Exit for a restart but leave the services running for the next daemon to adopt. */

package/dist/lib/daemon/server.d.ts

@@ -68,5 +68,16 @@ export declare function createResolver(registryPath: string, options?: {
     readRegistry?: typeof readRegistry;
     readCompaniesManifest?: typeof readCompaniesManifestMap;
 }): (cwd: string) => ResolveResult;
+/** Marker beside the hqd socket; hook shims fail closed only where it (or the socket) exists. */
+export declare const HQD_ENABLED_MARKER = "hqd.enabled";
+/**
+ * Keep `<socket dir>/hqd.enabled` in step with the hqd gate. The POSIX hook
+ * shim reads it to tell "hqd should answer" from "hqd is not set up here".
+ * The directory gets the same trust checks as the socket itself, and the
+ * marker is opened without following symlinks or blocking on a FIFO, so a
+ * pre-planted entry is refused instead of written through. Throws when the
+ * marker cannot be published safely. Windows named pipes have no marker.
+ */
+export declare function syncHqdEnabledMarker(socketPath: string, enabled: boolean): void;
 export declare function startHqdServer(opts: HqdServerOptions): Promise<HqdServer>;
 //# sourceMappingURL=server.d.ts.map

package/dist/lib/daemon/server.js

@@ -23,6 +23,7 @@ import { defaultMcpToken, HqMcpBridge, jsonResult, McpOpError, runWorker } from
 import { authenticateMachineCredentials, machineTokenExpiresAt, MachineLoginError, parseStdinMachineCredentials } from "./machine-login.js";
 import { HQ_MCP_TOOL_NAMES, HQD_NATIVE_TOOL_NAMES } from "../mcp/tools.js";
 import { HQ_ANYWHERE_RUNTIME_FLAG } from "../../commands/anywhere-runtime-flag.js";
+import { updateAnywhereRuntimeRevocationMarker } from "../anywhere-runtime-revocation-marker.js";
 import { readHqAnywherePersonSetting } from "../anywhere-person-setting.js";
 import { createBoundedDaemonFlagMonitor } from "./flag-monitor.js";
 import { readDaemonFlag } from "./flag.js";
@@ -304,6 +305,57 @@ function prepareSocketDirectory(directory, lstat, uid) {
         throw new Error(`${directory}: newly created socket directory mode is not 0700 after chmod`);
     }
 }
+/** Marker beside the hqd socket; hook shims fail closed only where it (or the socket) exists. */
+export const HQD_ENABLED_MARKER = "hqd.enabled";
+/**
+ * Keep `<socket dir>/hqd.enabled` in step with the hqd gate. The POSIX hook
+ * shim reads it to tell "hqd should answer" from "hqd is not set up here".
+ * The directory gets the same trust checks as the socket itself, and the
+ * marker is opened without following symlinks or blocking on a FIFO, so a
+ * pre-planted entry is refused instead of written through. Throws when the
+ * marker cannot be published safely. Windows named pipes have no marker.
+ */
+export function syncHqdEnabledMarker(socketPath, enabled) {
+    if (socketPath.startsWith("\\\\.\\pipe\\"))
+        return;
+    const directory = path.dirname(path.resolve(socketPath));
+    const marker = path.join(directory, HQD_ENABLED_MARKER);
+    const lstat = (candidate) => fs.lstatSync(candidate);
+    const uid = process.getuid?.();
+    if (uid === undefined)
+        throw new Error(`${directory}: cannot verify current uid for the hqd enabled marker`);
+    if (!enabled) {
+        assertTrustedSocketPathComponents(directory, lstat, uid);
+        try {
+            fs.unlinkSync(marker);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        return;
+    }
+    prepareSocketDirectory(directory, lstat, uid);
+    const { O_WRONLY, O_CREAT, O_NOFOLLOW, O_NONBLOCK } = fs.constants;
+    let fd;
+    try {
+        fd = fs.openSync(marker, O_WRONLY | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(`${marker}: cannot open hqd enabled marker safely: ${detail}`);
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error(`${marker}: existing path is not a regular file`);
+        if (stat.uid !== uid)
+            throw new Error(`${marker}: existing marker is not owned by the current uid`);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 function verifyUserOnlySocket(socketPath, lstat, uid) {
     assertTrustedSocketPathComponents(path.dirname(socketPath), lstat, uid);
     const before = socketLstatOrMissing(socketPath, lstat);
@@ -416,6 +468,12 @@ export async function startHqdServer(opts) {
             return personSetting === true;
         },
         onChange: (enabled) => {
+            try {
+                updateAnywhereRuntimeRevocationMarker(enabled, env.HOME?.trim() || undefined, env);
+            }
+            catch (error) {
+                log("warn", `hqd runtime revocation marker update failed (${error instanceof Error ? error.name : "UnknownError"})`);
+            }
             if (!enabled) {
                 flagRevocationGeneration += 1;
                 ephemeralMachineToken = undefined;

package/dist/lib/db/control-plane.d.ts

@@ -71,7 +71,18 @@ export interface RemoteUsageResponse {
     apps?: RemoteAppUsage[];
 }
 /** Answer for one app: its own numbers, or the company numbers when it shares the company cluster. */
-export type RemoteAppUsageResponse = (RemoteAppUsage & {
+export interface RemoteRemovedAppUsage {
+    companyUid: string;
+    appId: string;
+    mode: "app-cluster" | "company-cluster";
+    status: "detached" | "purged";
+    removedAt: string;
+    retainUntil: string | null;
+    purgedAt: string | null;
+    billed: false;
+    exempt: boolean;
+}
+export type RemoteAppUsageResponse = RemoteRemovedAppUsage | (RemoteAppUsage & {
     companyUid: string;
     mode: "app-cluster";
     status?: string;

package/dist/lib/db/usage-format.d.ts

@@ -1,7 +1,8 @@
-import type { RemoteAppUsage, RemoteAppUsageResponse, RemoteUsageResponse } from "./control-plane.js";
+import type { RemoteAppUsage, RemoteAppUsageResponse, RemoteRemovedAppUsage, RemoteUsageResponse } from "./control-plane.js";
 export declare function formatBytes(bytes: number): string;
 export declare function formatUsage(usage: RemoteUsageResponse): string;
 export declare function formatAppUsage(usage: RemoteAppUsage): string;
+export declare function formatRemovedAppUsage(usage: RemoteRemovedAppUsage): string;
 export declare function formatAppUsageResponse(response: RemoteAppUsageResponse): string;
 export declare function formatCompanyApps(apps: RemoteAppUsage[]): string;
 //# sourceMappingURL=usage-format.d.ts.map

package/dist/lib/db/usage-format.js

@@ -80,7 +80,26 @@ export function formatAppUsage(usage) {
         : `Last measured ${usage.measuredAt}. Numbers can lag by a few minutes.`);
     return lines.join("\n");
 }
+function day(iso) {
+    return iso.slice(0, 10);
+}
+export function formatRemovedAppUsage(usage) {
+    const lines = [`The database for app ${usage.appId} was removed on ${day(usage.removedAt)}.`];
+    if (usage.purgedAt) {
+        lines.push(`Its data was deleted for good on ${day(usage.purgedAt)}.`);
+    }
+    else if (usage.retainUntil) {
+        lines.push(`Its data is kept until ${day(usage.retainUntil)}, then deleted for good.`);
+    }
+    lines.push("It is not billed.");
+    return lines.join("\n");
+}
+function isRemoved(response) {
+    return "status" in response && (response.status === "detached" || response.status === "purged");
+}
 export function formatAppUsageResponse(response) {
+    if (isRemoved(response))
+        return formatRemovedAppUsage(response);
     if (response.mode === "company-cluster") {
         return [
             `App ${response.appId} uses the shared company database, so these are the company numbers.`,

package/dist/lib/install/provider-wrappers.js

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
+import { HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER } from '../anywhere-runtime-flag-key.js';
 const marker = '# hq-anywhere provider sign-in wrapper';
 const PROVIDER_PATH_RC_FILES = ['.bashrc', '.bash_profile', '.zshrc', '.zprofile', '.profile'];
 const wrapperHeader = (provider) => `#!/bin/sh\n${marker}: ${provider}\n`;
@@ -76,6 +77,18 @@ function wrapperSource(provider) {
         `  ${provider === 'claude' ? '/login|auth' : 'login'}) exec "$real" "$@" ;;`,
         'esac',
         '',
+        '# The local marker mirrors registryDir: trim the override and use ~/.hq when empty.',
+        'registry_dir=${HQ_REGISTRY_DIR:-}',
+        "registry_dir=$(printf '%s' \"$registry_dir\" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')",
+        'if [ -z "$registry_dir" ]; then',
+        '  registry_dir=${HOME:-}',
+        '  [ -n "$registry_dir" ] && registry_dir="$registry_dir/.hq"',
+        'fi',
+        'if [ -n "$registry_dir" ]; then',
+        '  case "$registry_dir" in /*) ;; *) registry_dir="$PWD/$registry_dir" ;; esac',
+        `  if [ -e "$registry_dir/${HQ_ANYWHERE_RUNTIME_REVOCATION_MARKER}" ]; then exec "$real" "$@"; fi`,
+        'fi',
+        '',
         'log_dir="$HOME/.hq/logs"',
         'mkdir -p "$log_dir" 2>/dev/null || :',
         'log_file="$log_dir/provider-auth.log"',

package/dist/lib/lanes/loop.d.ts

@@ -60,6 +60,13 @@ export interface LoopResult {
     session_id?: string;
     resumed?: boolean;
     fresh_fallback?: boolean;
+    question_id?: string;
+    decision?: {
+        question_id: string;
+        choice: string;
+        notes?: string;
+        at: string;
+    };
 }
 export interface Section8Handoff {
     schema: typeof PHASE_HANDOFF_SCHEMA;
@@ -103,6 +110,7 @@ export interface LoopRunnerOptions {
         envelopeId: string;
         attempt: number;
         error: string;
+        questionId: string;
     }): Promise<void> | void;
     defaultDeadlineSeconds?: number;
     now?: () => Date;
@@ -120,7 +128,6 @@ interface StoredEnvelope {
     envelope_id: string;
     queued_at: string;
     deadline_budget_seconds?: number;
-    deadline_at_ms?: number;
     envelope: LoopEnvelope;
 }
 /** Validate both hq-cli phase envelopes and the conduct protocol §8 shape. */
@@ -148,6 +155,21 @@ export declare function interruptLoopQueue(runDir: string): {
     withdrawn: string[];
     already_picked_up: string[];
 };
+export declare function interruptLoopQueueForStory(runDir: string, storyId: string, phase?: string): {
+    withdrawn: string[];
+    already_picked_up: string[];
+};
+export declare function applyLoopStallAnswer(input: {
+    runDir: string;
+    questionId: string;
+    choice: string;
+    notes?: string;
+    at: string;
+}): {
+    lane_id: string;
+    envelope_id: string;
+    action: "requeued" | "parked";
+} | undefined;
 export declare function loopStatus(runDir: string, laneId: string): LoopStatus;
 export declare function setLoopControllerPid(runDir: string, laneId: string, pid: number | undefined): void;
 export declare function clearLoopControllerPid(runDir: string, laneId: string, pid: number): void;