@indigoai-us/hq-cli 5.85.1 → 5.85.2

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [5.85.2]
+
+### Fixed
+
+- Bumped the `@indigoai-us/hq-cloud` floor to ^6.14.45, which scopes the sync
+  watcher to paths that can actually upload. On a large HQ root the watcher had
+  been asking the OS to report every directory in the tree — including
+  `repos/`, `workspace/worktrees/`, `node_modules/` and build output that sync
+  never uploads — and paying a blocking stat per event before discarding it.
+  One observed root reported 154,489 directories where 20,308 were in scope,
+  with the sync runner pinned above 100% CPU in garbage collection and growing
+  to 1.2 GB RSS over a 12-hour run. (hq-cloud#283)
+
 ## [5.85.1]
 
 ### Fixed

package/dist/commands/core-checkpoint.js

@@ -307,7 +307,20 @@ function writeStamps(liveRoot, sessionId) {
         fs.writeFileSync(stampPath, timestamp);
     return stampPaths;
 }
-const CODEX_CHECKPOINT_ACCOUNT = "hassaan@getindigo.ai";
+/**
+ * Codex Stop-gate rollout scope: every HQ user on the operator domain, rather
+ * than the single account that dogfooded it first. Eligibility is decided on
+ * the email domain alone — a candidate must have exactly one `@` and the part
+ * after it must equal this domain, so lookalikes never pass (`xgetindigo.ai`,
+ * `getindigo.ai.evil.test`, `a@b@getindigo.ai`).
+ */
+const CODEX_CHECKPOINT_DOMAIN = "getindigo.ai";
+function hasCodexCheckpointDomain(candidate) {
+    if (typeof candidate !== "string")
+        return false;
+    const parts = candidate.trim().toLowerCase().split("@");
+    return parts.length === 2 && parts[0].length > 0 && parts[1] === CODEX_CHECKPOINT_DOMAIN;
+}
 function checkpointGateRuntime() {
     const runtime = (process.env.HQ_CHECKPOINT_RUNTIME ?? "claude").trim().toLowerCase();
     if (runtime === "claude" || runtime === "codex")
@@ -331,7 +344,7 @@ function gateEligibility(runtime) {
             return false;
         const claims = peekIdToken(tokens.idToken);
         const candidateEmails = [claims.email, claims["custom:delegatedEmail"]];
-        return candidateEmails.some((candidate) => typeof candidate === "string" && candidate.toLowerCase() === CODEX_CHECKPOINT_ACCOUNT);
+        return candidateEmails.some(hasCodexCheckpointDomain);
     }
     catch {
         return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.85.1",
+  "version": "5.85.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -29,7 +29,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "^6.14.37",
+    "@indigoai-us/hq-cloud": "^6.14.45",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "better-sqlite3": "^12.11.1",