@indigoai-us/hq-cli 5.84.0 → 5.85.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.85.0]
+
+### Changed
+
+- Checkpoint Stop-gate eligibility is now runtime-specific: Claude Code is
+  enabled for every HQ account, Codex is enabled only for the designated
+  operator account (including delegated identities), and other Codex accounts
+  and runtimes remain disabled. Runtime-specific verdict caches prevent one
+  host's eligibility from leaking into another. (#295)
+
 ## [5.84.0]
 
 ### Added

package/dist/commands/core-checkpoint.js

@@ -307,12 +307,23 @@ function writeStamps(liveRoot, sessionId) {
         fs.writeFileSync(stampPath, timestamp);
     return stampPaths;
 }
-function gateEligibility() {
+const CODEX_CHECKPOINT_ACCOUNT = "hassaan@getindigo.ai";
+function checkpointGateRuntime() {
+    const runtime = (process.env.HQ_CHECKPOINT_RUNTIME ?? "claude").trim().toLowerCase();
+    if (runtime === "claude" || runtime === "codex")
+        return runtime;
+    return "other";
+}
+function gateEligibility(runtime) {
     const forced = process.env.HQ_CHECKPOINT_GATE;
     if (forced === "0")
         return false;
     if (forced === "1")
         return true;
+    if (runtime === "claude")
+        return true;
+    if (runtime !== "codex")
+        return false;
     try {
         const tokenPath = path.join(homedir(), ".hq", "cognito-tokens.json");
         const tokens = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
@@ -320,19 +331,7 @@ function gateEligibility() {
             return false;
         const claims = peekIdToken(tokens.idToken);
         const candidateEmails = [claims.email, claims["custom:delegatedEmail"]];
-        const configured = (process.env.HQ_CHECKPOINT_GATE_DOMAINS ?? "")
-            .split(",")
-            .map((candidate) => candidate.trim().toLowerCase())
-            .filter(Boolean);
-        const hasEligibleDomain = (candidate) => {
-            if (typeof candidate !== "string")
-                return false;
-            const domain = candidate.split("@").at(-1)?.toLowerCase();
-            if (!domain)
-                return false;
-            return domain === "getindigo.ai" || configured.includes(domain);
-        };
-        return candidateEmails.some(hasEligibleDomain);
+        return candidateEmails.some((candidate) => typeof candidate === "string" && candidate.toLowerCase() === CODEX_CHECKPOINT_ACCOUNT);
     }
     catch {
         return false;
@@ -341,8 +340,9 @@ function gateEligibility() {
 function writeGateVerdict(liveRoot) {
     const stateDir = path.join(liveRoot, "workspace", "orchestrator", "hook-state");
     fs.mkdirSync(stateDir, { recursive: true });
-    const eligible = gateEligibility();
-    fs.writeFileSync(path.join(stateDir, "checkpoint-gate-eligible"), eligible ? "1" : "0");
+    const runtime = checkpointGateRuntime();
+    const eligible = gateEligibility(runtime);
+    fs.writeFileSync(path.join(stateDir, `checkpoint-gate-eligible-${runtime}`), eligible ? "1" : "0");
     printResult(eligible ? "eligible" : "ineligible");
 }
 function backendOnPath(name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.84.0",
+  "version": "5.85.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {