@indigoai-us/hq-cli 5.345.61 → 5.345.62

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [5.345.62] — 2026-10-09
+- Repair the scope capability from the validated metadata set when `hq core hq-session add company` is repeated for a company already listed in the session.
+
+- `hq daemon sync status --json` reports daemon-owned hq-cloud updater checks, target, outcome, closed failure class, and pin status. Registry lookups are bounded to 15 seconds and installs to 2 minutes; success is reported only after the installed package converges to the selected version.
+
 ## [5.345.61] — 2026-10-09
 
 ## [5.345.60] — 2026-10-09

package/dist/commands/core-hq-session-native.js

@@ -657,8 +657,12 @@ export function executeHqSession(argv, context, overrides = {}) {
                 const oldText = existed ? deps.readFile(target, "utf8") : `session_id: ${sessionId}\nstarted_at: "${timestamp(deps.now())}"\nsenior: user\n`;
                 const rawCompanies = metaCompanySlugs(oldText);
                 const companies = rawCompanies.filter((company) => company === "personal" || exactCompanyDir(root, company, deps));
-                if (subcommand === "add" && companies.includes(slug))
+                if (subcommand === "add" && companies.includes(slug)) {
+                    if (!mintScopeCapability(root, sessionId, companies, deps, true)) {
+                        return { code: 1, stdout: "", stderr: `hq-session: failed to repair scope-capability for session ${sessionId}; metadata was unchanged\n` };
+                    }
                     return { code: 0, stdout: "", stderr: "" };
+                }
                 const next = subcommand === "add"
                     ? [...(companies[0] === "personal" ? [] : companies), slug]
                     : companies.filter((value) => value !== slug);

package/dist/commands/daemon.js

@@ -24,7 +24,7 @@ import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/d
 import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, daemonRootRefusal, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
 import { describeLegacyUnit, findLegacyUnits } from "../lib/daemon/legacy.js";
 import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
-import { bundledHqCloud, managedHqCloud, managedHqCloudRoot, readHqCloudCopy } from "../lib/daemon/hq-cloud.js";
+import { bundledHqCloud, managedHqCloud, managedHqCloudRoot, readHqCloudCopy, readHqCloudUpdateState } from "../lib/daemon/hq-cloud.js";
 import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "../lib/daemon/machine-type.js";
 import { daemonPaths } from "../lib/daemon/paths.js";
 import { processCommandLine } from "../lib/daemon/lock.js";
@@ -510,6 +510,7 @@ function daemonSyncStatus(d) {
     const runnerSource = syncRunnerSource(runnerPath, paths.root, d.platform);
     const managedCopy = managedHqCloud(paths.root);
     const managedVersion = managedCopy?.version ?? null;
+    const hqCloudUpdate = readHqCloudUpdateState(paths.root);
     let hqCloudVersion = ownerStatus?.version ?? null;
     let hqCloudVersionSource = hqCloudVersion ? "owner-status" : "unknown";
     if (!hqCloudVersion && runnerPath) {
@@ -547,6 +548,10 @@ function daemonSyncStatus(d) {
         runnerSource,
         managedHqCloudVersion: managedVersion,
         pinnedHqCloudVersion: config.hqCloudVersion ?? null,
+        hqCloudUpdateLastCheckAt: hqCloudUpdate?.lastCheckAt ?? null,
+        hqCloudUpdateOutcome: hqCloudUpdate?.outcome ?? null,
+        hqCloudUpdateTarget: hqCloudUpdate?.target ?? null,
+        hqCloudUpdateErrorClass: hqCloudUpdate?.errorClass ?? null,
         lastHeartbeat: syncUnit?.lastHeartbeatAt ?? ownerStatus?.heartbeatAt ?? null,
         lastPassResult: syncUnit?.lastPassResult ?? null,
         unitStatus: syncUnit?.status ?? "not-running",

package/dist/lib/daemon/hq-cloud.d.ts

@@ -71,8 +71,19 @@ export interface HqCloudUpdateOutcome {
     ok: boolean;
     from: string | null;
     to: string | null;
+    outcome?: HqCloudUpdateState["outcome"];
+    target?: string | null;
+    errorClass?: HqCloudUpdateState["errorClass"];
+    lastCheckAt?: string;
     detail?: string;
 }
+export interface HqCloudUpdateState {
+    lastCheckAt: string;
+    outcome: "updated" | "up_to_date" | "pinned" | "failed";
+    target: string | null;
+    errorClass: "registry" | "install" | "convergence" | "filesystem" | "unknown" | null;
+}
+export declare function readHqCloudUpdateState(daemonRoot: string): HqCloudUpdateState | null;
 interface NpmRunResult {
     status: number | null;
     stdout?: string | null;
@@ -80,11 +91,12 @@ interface NpmRunResult {
     error?: Error;
 }
 export interface UpdateHqCloudDeps {
-    run?: (file: string, args: string[], shell: boolean, env: NodeJS.ProcessEnv) => NpmRunResult;
+    run?: (file: string, args: string[], shell: boolean, env: NodeJS.ProcessEnv, timeoutMs: number) => NpmRunResult;
     bundled?: HqCloudCopy | null;
     platform?: NodeJS.Platform;
     /** Test seam for bounded install retry delays. */
     sleep?: (ms: number) => void;
+    now?: () => Date;
 }
 /** Install or update the updater's copy, as this (the login) user. */
 export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv, deps?: UpdateHqCloudDeps): HqCloudUpdateOutcome;

package/dist/lib/daemon/hq-cloud.js

@@ -161,6 +161,47 @@ export function currentHqCloudAfterLeaseRelease(daemonRoot, expectedVersion) {
         return null;
     return { ...managed, source: "managed" };
 }
+const HQ_CLOUD_UPDATE_STATE_FILE = "hq-cloud-update-state.json";
+const HQ_CLOUD_UPDATE_STATE_MAX_BYTES = 4_096;
+const HQ_CLOUD_UPDATE_OUTCOMES = new Set(["updated", "up_to_date", "pinned", "failed"]);
+const HQ_CLOUD_UPDATE_ERROR_CLASSES = new Set([
+    "registry", "install", "convergence", "filesystem", "unknown",
+]);
+export function readHqCloudUpdateState(daemonRoot) {
+    try {
+        const file = path.join(daemonRoot, HQ_CLOUD_UPDATE_STATE_FILE);
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.size > HQ_CLOUD_UPDATE_STATE_MAX_BYTES) {
+            throw new Error("updater state is not a small regular file");
+        }
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (typeof raw.lastCheckAt !== "string"
+            || !HQ_CLOUD_UPDATE_OUTCOMES.has(raw.outcome)
+            || !(raw.target === null || typeof raw.target === "string")
+            || !(raw.errorClass === null || HQ_CLOUD_UPDATE_ERROR_CLASSES.has(raw.errorClass)))
+            return null;
+        return raw;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            console.warn("Could not read daemon hq-cloud updater state; status will omit it:", error instanceof Error ? error.message : String(error));
+        }
+        return null;
+    }
+}
+function writeHqCloudUpdateState(daemonRoot, state) {
+    const file = path.join(daemonRoot, HQ_CLOUD_UPDATE_STATE_FILE);
+    const temporary = `${file}.tmp-${process.pid}`;
+    fs.writeFileSync(temporary, JSON.stringify(state) + "\n", { mode: 0o600 });
+    fs.renameSync(temporary, file);
+}
+function updateErrorClass(detail, fallback) {
+    if (/could not look up|npm listed no/i.test(detail))
+        return "registry";
+    return fallback;
+}
+const HQ_CLOUD_REGISTRY_TIMEOUT_MS = 15_000;
+const HQ_CLOUD_INSTALL_TIMEOUT_MS = 120_000;
 function isTransientNpmFailure(result) {
     // spawnSync's ETIMEDOUT means this attempt hit our full 10-minute process
     // timeout. Retrying that result would multiply one stall across every attempt.
@@ -172,11 +213,11 @@ function isTransientNpmFailure(result) {
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-function runNpm(file, args, shell, env) {
+function runNpm(file, args, shell, env, timeoutMs) {
     return spawnSync(file, args, {
         encoding: "utf8",
         env,
-        timeout: 10 * 60_000,
+        timeout: timeoutMs,
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
         shell,
@@ -193,24 +234,40 @@ export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
     const bundled = deps.bundled !== undefined ? deps.bundled : bundledHqCloud();
     const from = managedHqCloud(daemonRoot)?.version ?? bundled?.version ?? null;
+    const checkedAt = (deps.now ?? (() => new Date()))().toISOString();
+    const finish = (result, outcome, target, errorClass) => {
+        const state = { lastCheckAt: checkedAt, outcome, target, errorClass };
+        try {
+            fs.mkdirSync(daemonRoot, { recursive: true, mode: 0o700 });
+            writeHqCloudUpdateState(daemonRoot, state);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            console.warn("Could not persist daemon hq-cloud updater state; preserving update result:", detail);
+        }
+        return { ...result, outcome, target, errorClass, lastCheckAt: checkedAt };
+    };
     if (!bundled)
-        return { ok: false, from, to: null, detail: "this CLI install has no bundled hq-cloud to match" };
+        return finish({ ok: false, from, to: null, detail: "this CLI install has no bundled hq-cloud to match" }, "failed", pinnedVersion ?? null, "unknown");
     const prefix = managedHqCloudDir(daemonRoot);
     try {
         fs.mkdirSync(prefix, { recursive: true, mode: 0o700 });
     }
     catch (err) {
-        return { ok: false, from, to: null, detail: `could not create ${prefix}: ${err instanceof Error ? err.message : String(err)}` };
+        return finish({ ok: false, from, to: null, detail: `could not create ${prefix}: ${err instanceof Error ? err.message : String(err)}` }, "failed", pinnedVersion ?? null, "filesystem");
     }
     let version = pinnedVersion;
     if (!version) {
         const view = hqCloudLatestCommand(bundled.version, platform);
-        const r = run(view.file, view.args, view.shell, env);
-        if (r.status !== 0)
-            return { ok: false, from, to: null, detail: `could not look up the newest hq-cloud: ${npmFailure(r)}` };
+        const r = run(view.file, view.args, view.shell, env, HQ_CLOUD_REGISTRY_TIMEOUT_MS);
+        if (r.status !== 0) {
+            const detail = `could not look up the newest hq-cloud: ${npmFailure(r)}`;
+            return finish({ ok: false, from, to: null, detail }, "failed", null, updateErrorClass(detail, "registry"));
+        }
         const latest = latestSameMajor(r.stdout ?? "", bundled.version);
         if (!latest) {
-            return { ok: false, from, to: null, detail: `npm listed no hq-cloud release at or above ${bundled.version} in the same major version` };
+            const detail = `npm listed no hq-cloud release at or above ${bundled.version} in the same major version`;
+            return finish({ ok: false, from, to: null, detail }, "failed", null, "registry");
         }
         version = latest;
     }
@@ -219,22 +276,28 @@ export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
     const sleep = deps.sleep ?? sleepSync;
     let r;
     for (let attempt = 0;; attempt++) {
-        r = run(cmd.file, cmd.args, cmd.shell, env);
+        r = run(cmd.file, cmd.args, cmd.shell, env, HQ_CLOUD_INSTALL_TIMEOUT_MS);
         if (r.status === 0)
             break;
         const retryable = pinnedVersion !== undefined && pinnedVersion !== null && isTransientNpmFailure(r);
         const delay = retryDelays[attempt];
         if (!retryable || delay === undefined) {
             const retries = retryable ? attempt : 0;
-            return {
-                ok: false,
-                from,
-                to: null,
-                detail: retries > 0 ? `pinned hq-cloud install failed after ${retries + 1} attempts: ${npmFailure(r)}` : npmFailure(r),
-            };
+            const detail = retries > 0 ? `pinned hq-cloud install failed after ${retries + 1} attempts: ${npmFailure(r)}` : npmFailure(r);
+            return finish({ ok: false, from, to: null, detail }, "failed", version, retryable ? "registry" : "install");
         }
         sleep(delay);
     }
-    return { ok: true, from, to: managedHqCloud(daemonRoot)?.version ?? null };
+    const installedPackage = managedHqCloud(daemonRoot);
+    const installedVersion = installedPackage?.version ?? null;
+    const syncRunner = installedPackage ? hqCloudRunners(installedPackage.root).syncRunner : null;
+    if (installedVersion !== version || !syncRunner) {
+        const detail = installedVersion !== version
+            ? `hq-cloud install exited successfully but installed ${installedVersion ?? "no readable package"}, expected ${version}`
+            : `hq-cloud install exited successfully at ${version} but has no dist/bin/sync-runner.js`;
+        return finish({ ok: false, from, to: installedVersion, detail }, "failed", version, "convergence");
+    }
+    const outcome = pinnedVersion ? "pinned" : installedVersion === from ? "up_to_date" : "updated";
+    return finish({ ok: true, from, to: installedVersion }, outcome, version, null);
 }
 //# sourceMappingURL=hq-cloud.js.map

package/dist/utils/client-health-contract.d.ts

@@ -53,6 +53,13 @@ export type ClientHealthSyncState = (typeof CLIENT_HEALTH_SYNC_STATES)[number];
  */
 export declare const CLIENT_HEALTH_UPDATER_STATES: readonly ["unchecked", "up_to_date", "update_available", "update_downloading", "update_ready", "update_failed", "unsupported"];
 export type ClientHealthUpdaterState = (typeof CLIENT_HEALTH_UPDATER_STATES)[number];
+/** Origin of the runner currently used by desktop sync. */
+export declare const CLIENT_HEALTH_SYNC_RUNNER_SOURCES: readonly ["npx", "daemon_managed", "daemon_staged", "daemon_bundled", "unknown"];
+export type ClientHealthSyncRunnerSource = (typeof CLIENT_HEALTH_SYNC_RUNNER_SOURCES)[number];
+export declare const CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_OUTCOMES: readonly ["updated", "up_to_date", "pinned", "failed"];
+export type ClientHealthDaemonHqCloudUpdateOutcome = (typeof CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_OUTCOMES)[number];
+export declare const CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_ERROR_CLASSES: readonly ["registry", "install", "convergence", "filesystem", "unknown"];
+export type ClientHealthDaemonHqCloudUpdateErrorClass = (typeof CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_ERROR_CLASSES)[number];
 /** Closed failure/blocker reason codes — the ONLY reasons that cross the wire. */
 export declare const CLIENT_HEALTH_FAILURE_REASONS: readonly ["SYNC_PAUSED", "CONFLICT_BLOCKED", "DESKTOP_OUTDATED", "CLI_OUTDATED", "CORE_OUTDATED", "AUTH_EXPIRED", "UPDATE_FAILED", "RUNNER_FAILED", "PERMISSION_DENIED", "DISK_FULL", "HEARTBEAT_STALE"];
 export type ClientHealthFailureReason = (typeof CLIENT_HEALTH_FAILURE_REASONS)[number];
@@ -139,6 +146,11 @@ export interface ClientHealthHeartbeat {
     conflictCount?: number;
     updaterState?: ClientHealthUpdaterState;
     failureReason?: ClientHealthFailureReason;
+    syncRunnerSource?: ClientHealthSyncRunnerSource;
+    daemonHqCloudUpdateLastCheckAt?: string;
+    daemonHqCloudUpdateOutcome?: ClientHealthDaemonHqCloudUpdateOutcome;
+    daemonHqCloudUpdateTarget?: string;
+    daemonHqCloudUpdateErrorClass?: ClientHealthDaemonHqCloudUpdateErrorClass;
     /** Absent on older clients / non-sync-outcome events. See {@link ClientHealthLocalFilesOverview}. */
     localFilesOverview?: ClientHealthLocalFilesOverview;
 }

package/dist/utils/client-health-contract.js

@@ -65,6 +65,27 @@ export const CLIENT_HEALTH_UPDATER_STATES = [
     "update_failed",
     "unsupported",
 ];
+/** Origin of the runner currently used by desktop sync. */
+export const CLIENT_HEALTH_SYNC_RUNNER_SOURCES = [
+    "npx",
+    "daemon_managed",
+    "daemon_staged",
+    "daemon_bundled",
+    "unknown",
+];
+export const CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_OUTCOMES = [
+    "updated",
+    "up_to_date",
+    "pinned",
+    "failed",
+];
+export const CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_ERROR_CLASSES = [
+    "registry",
+    "install",
+    "convergence",
+    "filesystem",
+    "unknown",
+];
 /** Closed failure/blocker reason codes — the ONLY reasons that cross the wire. */
 export const CLIENT_HEALTH_FAILURE_REASONS = [
     "SYNC_PAUSED",
@@ -193,6 +214,23 @@ function assertEnum(field, value, allowed) {
     }
     return safe;
 }
+function copyValidOptionalDiagnostic(field, value, validate) {
+    try {
+        return validate(field, value);
+    }
+    catch (error) {
+        if (error instanceof ClientHealthContractError)
+            return undefined;
+        throw error;
+    }
+}
+function copyKnownOptionalEnum(target, field, value, allowed) {
+    if (value === undefined)
+        return;
+    const parsed = copyValidOptionalDiagnostic(field, value, (name, input) => assertEnum(name, input, allowed));
+    if (parsed !== undefined)
+        Object.assign(target, { [field]: parsed });
+}
 function assertBoundedInt(field, value, max) {
     if (value === undefined || value === null)
         throw new ClientHealthContractError("MISSING_FIELD", field);
@@ -264,6 +302,19 @@ export function parseClientHealthHeartbeat(input) {
     if (raw.failureReason !== undefined) {
         heartbeat.failureReason = assertEnum("failureReason", raw.failureReason, CLIENT_HEALTH_FAILURE_REASONS);
     }
+    copyKnownOptionalEnum(heartbeat, "syncRunnerSource", raw.syncRunnerSource, CLIENT_HEALTH_SYNC_RUNNER_SOURCES);
+    if (raw.daemonHqCloudUpdateLastCheckAt !== undefined) {
+        const lastCheckAt = copyValidOptionalDiagnostic("daemonHqCloudUpdateLastCheckAt", raw.daemonHqCloudUpdateLastCheckAt, assertIsoUtc);
+        if (lastCheckAt !== undefined)
+            heartbeat.daemonHqCloudUpdateLastCheckAt = lastCheckAt;
+    }
+    copyKnownOptionalEnum(heartbeat, "daemonHqCloudUpdateOutcome", raw.daemonHqCloudUpdateOutcome, CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_OUTCOMES);
+    if (raw.daemonHqCloudUpdateTarget !== undefined) {
+        const target = copyValidOptionalDiagnostic("daemonHqCloudUpdateTarget", raw.daemonHqCloudUpdateTarget, assertVersion);
+        if (target !== undefined)
+            heartbeat.daemonHqCloudUpdateTarget = target;
+    }
+    copyKnownOptionalEnum(heartbeat, "daemonHqCloudUpdateErrorClass", raw.daemonHqCloudUpdateErrorClass, CLIENT_HEALTH_DAEMON_HQ_CLOUD_UPDATE_ERROR_CLASSES);
     if (raw.localFilesOverview !== undefined) {
         heartbeat.localFilesOverview = parseClientHealthLocalFilesOverview("localFilesOverview", raw.localFilesOverview);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.61",
+  "version": "5.345.62",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {