@indigoai-us/hq-cli 5.101.0 → 5.101.2

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [5.101.2] — 2026-08-15
+
+### Fixed
+
+- Self-update now detects Bun-managed global installs and runs `bun add -g`
+  through the owning package manager. Existing pnpm-managed and npm prefix
+  installs, including Homebrew prefixes such as `/opt/homebrew`, continue to
+  update the copy that is actually running without an unnecessary `sudo`.
+
+## [5.101.1] — 2026-08-14
+
+### Fixed
+
+- `hq core rebuild-index threads` no longer crashes with an `ENOENT` stat error
+  when a `workspace/threads/T-*.json` entry that the directory scan listed can no
+  longer be resolved — removed mid-scan by a concurrent writer (HQ Sync, another
+  session, or `archive-old-threads`) or left as a dangling symlink. The renderer
+  now stats each file exactly once before sorting (a Schwartzian transform rather
+  than statting inside the sort comparator), skips entries that vanished (logging
+  a single summary line by basename), and still fails loudly on a genuine stat
+  error such as `EACCES`. Both `INDEX.md` and `recent.md` are regenerated as
+  before. Sentry 7669694322 (HQ-CLI-P).
+
 ## [5.101.0] — 2026-08-13
 
 ### Added

package/dist/commands/agents.js

@@ -27,6 +27,7 @@ import * as readline from "node:readline";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { confirmChargeOrExit, formatUsd, parseBillingPayload, surfaceBillingBlocked, } from "../utils/billing-gate.js";
 /** Reasoning-effort values hq-pro accepts on `runtime-config`. */
 export const VALID_EFFORTS = new Set([
@@ -381,6 +382,10 @@ function sleep(ms) {
 // Command registration
 // ---------------------------------------------------------------------------
 function fail(err) {
+    // Let the CLI boundary render and offer the one shared Team checkout flow.
+    // Local exits would otherwise prevent interactive plan-limit remediation.
+    if (isPlanGateError(err))
+        throw err;
     if (err instanceof AgentsHttpError) {
         console.error(chalk.red(err.message));
     }

package/dist/commands/billing.js

@@ -16,6 +16,7 @@ import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { mintPaymentLink } from "../utils/billing-gate.js";
+import { upgradeToTeam } from "../utils/team-upgrade.js";
 function fail(err) {
     console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
     process.exit(1);
@@ -107,5 +108,23 @@ export function registerBillingCommand(program) {
             fail(err);
         }
     });
+    billing
+        .command("upgrade")
+        .description("Open Stripe Checkout to upgrade this company to HQ Team ($500/mo)")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--no-browser", "Print the Stripe Checkout URL instead of opening it")
+        .option("--json", "Emit the Checkout URL as JSON")
+        .action(async function (opts) {
+        try {
+            await upgradeToTeam({
+                company: companyOf(this),
+                noBrowser: opts.browser === false,
+                json: opts.json,
+            });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
 }
 //# sourceMappingURL=billing.js.map

package/dist/commands/outposts.js

@@ -439,6 +439,10 @@ function bashSingleQuote(value) {
 function systemdQuoted(value) {
     return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
+// U60 records this compatible hq-cloud artifact. Outpost launchers must stay
+// reproducible: `@latest` could silently opt a long-lived box into a different
+// sync protocol before its server-side eligibility is evaluated.
+const OUTPOST_HQ_CLOUD_VERSION = "6.15.1";
 function renderSelfDeploySyncScript(hqRoot) {
     return `#!/usr/bin/env bash
 set -u
@@ -448,7 +452,7 @@ HQ_ROOT=${bashSingleQuote(hqRoot)}
 cd "$HQ_ROOT"
 while true; do
   hq auth refresh || echo "[outpost-sync] auth refresh failed, continuing"
-  npx -y --package=@indigoai-us/hq-cloud@latest hq-sync-runner \\
+  npx -y --package=@indigoai-us/hq-cloud@${OUTPOST_HQ_CLOUD_VERSION} hq-sync-runner \\
     --companies \\
     --direction both \\
     --on-conflict keep \\

package/dist/lib/db/control-plane.js

@@ -36,7 +36,7 @@ export class ControlPlaneDbClient {
             catch {
                 /* keep */
             }
-            const planGate = planGateErrorFromPayload(res.status, payload);
+            const planGate = planGateErrorFromPayload(res.status, payload, input.companyUid);
             if (planGate)
                 throw planGate;
             const err = new Error(msg);

package/dist/lib/index-render/shared.d.ts

@@ -31,5 +31,24 @@ export declare function projectStatus(root: string, project: string, prdPath: st
 export declare function basename(file: string): string;
 export declare function isHidden(name: string): boolean;
 export declare function mtime(file: string): number;
+/**
+ * Sort key for newest-first ordering: the file's modification time in
+ * nanoseconds. Stat the file exactly once, before sorting — never from inside a
+ * comparator, where a throw aborts `Array.sort` and an mtime that changes
+ * mid-sort makes the comparator inconsistent.
+ *
+ * Returns `undefined` when the entry a directory scan just listed can no longer
+ * be resolved: it was removed between the `readdirSync` snapshot and this stat
+ * (a time-of-check-to-time-of-use race in a hot, multi-writer directory), or it
+ * is a symlink whose target is missing (`statSync` follows symlinks). Callers
+ * drop such entries — mirroring how `immediateEntries` and `readJson` already
+ * tolerate a vanished file — so the render never crashes on a benign race.
+ *
+ * Any other stat failure (EACCES, EIO, …) is a genuine fault and is rethrown
+ * with the offending file's BASENAME attached, never its absolute path, which
+ * must not reach error reporting such as Sentry. The original errno `code` is
+ * preserved so upstream error classification is unaffected.
+ */
+export declare function sortKeyMtimeNs(file: string): bigint | undefined;
 export declare function tempDirectory(prefix: string): string;
 //# sourceMappingURL=shared.d.ts.map

package/dist/lib/index-render/shared.js

@@ -120,6 +120,38 @@ export function mtime(file) { try {
 catch {
     return 0;
 } }
+/**
+ * Sort key for newest-first ordering: the file's modification time in
+ * nanoseconds. Stat the file exactly once, before sorting — never from inside a
+ * comparator, where a throw aborts `Array.sort` and an mtime that changes
+ * mid-sort makes the comparator inconsistent.
+ *
+ * Returns `undefined` when the entry a directory scan just listed can no longer
+ * be resolved: it was removed between the `readdirSync` snapshot and this stat
+ * (a time-of-check-to-time-of-use race in a hot, multi-writer directory), or it
+ * is a symlink whose target is missing (`statSync` follows symlinks). Callers
+ * drop such entries — mirroring how `immediateEntries` and `readJson` already
+ * tolerate a vanished file — so the render never crashes on a benign race.
+ *
+ * Any other stat failure (EACCES, EIO, …) is a genuine fault and is rethrown
+ * with the offending file's BASENAME attached, never its absolute path, which
+ * must not reach error reporting such as Sentry. The original errno `code` is
+ * preserved so upstream error classification is unaffected.
+ */
+export function sortKeyMtimeNs(file) {
+    try {
+        return fs.statSync(file, { bigint: true }).mtimeNs;
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return undefined;
+        const wrapped = new Error(`failed to stat ${basename(file)} (${code ?? "unknown error"})`);
+        if (code !== undefined)
+            wrapped.code = code;
+        throw wrapped;
+    }
+}
 // Kept exported for primitive tests and consumers that need a temp base without
 // relying on an application-specific fixture location.
 export function tempDirectory(prefix) { return fs.mkdtempSync(path.join(os.tmpdir(), prefix)); }

package/dist/lib/index-render/threads.js

@@ -1,19 +1,40 @@
 import * as fs from "fs";
-import { at, log, readJson, sanitize, timestamp, write } from "./shared.js";
+import { at, basename, log, readJson, sanitize, sortKeyMtimeNs, timestamp, write } from "./shared.js";
 export function renderThreads(context, args = []) {
     const mode = args[0] ?? "--index";
     const directory = at(context.root, "workspace/threads");
     fs.mkdirSync(directory, { recursive: true });
     // Match `ls -t`: newest filesystem modification time first. `updated_at` is
     // rendered metadata only, and must not influence the order.
+    //
+    // Stat every listed file exactly once, BEFORE sorting (a Schwartzian
+    // transform), never from inside the comparator. workspace/threads is a hot,
+    // multi-writer directory (HQ Sync reconciliation, concurrent agent sessions,
+    // and `archive-old-threads` renaming T-*.json out of it), so an entry
+    // readdirSync just snapshotted can vanish before it is stat'ed. Statting
+    // inside the comparator turned that time-of-check-to-time-of-use window — and
+    // any dangling symlink — into an ENOENT that aborted the whole command before
+    // either file was written. Precompute the key, drop entries that no longer
+    // resolve (as `readJson` already drops unreadable files), then compare only
+    // precomputed keys so the comparator can neither throw nor be inconsistent.
+    const skipped = [];
     const files = fs.readdirSync(directory)
         .filter((name) => /^T-.*\.json$/.test(name) && !name.endsWith(".changeset.json"))
         .map((name) => `${directory}/${name}`)
-        .sort((a, b) => {
-        const aTime = fs.statSync(a, { bigint: true }).mtimeNs;
-        const bTime = fs.statSync(b, { bigint: true }).mtimeNs;
-        return bTime > aTime ? 1 : bTime < aTime ? -1 : 0;
-    });
+        .map((file) => ({ file, key: sortKeyMtimeNs(file) }))
+        .filter((entry) => {
+        if (entry.key === undefined) {
+            skipped.push(basename(entry.file));
+            return false;
+        }
+        return true;
+    })
+        .sort((a, b) => (b.key > a.key ? 1 : b.key < a.key ? -1 : 0))
+        .map((entry) => entry.file);
+    if (skipped.length > 0) {
+        const shown = skipped.slice(0, 10).join(", ");
+        log(context, `rebuild-threads-index: skipped ${skipped.length} thread file(s) that vanished during the scan: ${shown}${skipped.length > 10 ? ", …" : ""}`);
+    }
     const rows = files.flatMap((file) => {
         const data = readJson(file);
         if (!data)

package/dist/main.d.ts

@@ -12,5 +12,5 @@ export type TopLevelErrorDependencies = {
     setExitCode: (code: number) => void;
 };
 /** Classify a top-level failure without making the CLI process boundary opaque to tests. */
-export declare function handleTopLevelError(err: unknown, deps?: TopLevelErrorDependencies): void;
+export declare function handleTopLevelError(err: unknown, deps?: TopLevelErrorDependencies): Promise<void>;
 //# sourceMappingURL=main.d.ts.map

package/dist/main.js

@@ -70,7 +70,8 @@ import { isEpipe } from "./utils/epipe.js";
 import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
 import { isAuthError } from "./utils/auth-error.js";
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
-import { formatPlanGateError, isPlanGateError, } from "./utils/plan-gate-error.js";
+import { canOfferTeamUpgrade, formatPlanGateError, isPlanGateError, offerTeamUpgrade, } from "./utils/plan-gate-error.js";
+import { upgradeToTeam } from "./utils/team-upgrade.js";
 import { refreshVersionCache, staleAgainstCachedLatest, } from "./utils/version-check.js";
 import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { autoUpdateAndReexec } from "./utils/self-update.js";
@@ -292,7 +293,7 @@ export async function runCli() {
         await program.parseAsync();
     }
     catch (err) {
-        handleTopLevelError(err);
+        await handleTopLevelError(err);
     }
     finally {
         // Plan-limit nag (US-016): stderr-only, never throws, never touches
@@ -319,7 +320,7 @@ const defaultTopLevelErrorDependencies = {
     },
 };
 /** Classify a top-level failure without making the CLI process boundary opaque to tests. */
-export function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies) {
+export async function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies) {
     // A broken pipe (EPIPE) means the reader of `hq`'s output closed it early
     // (`hq … | head`, `source <(hq …)`, a parent that exited). That is normal
     // Unix behavior with no user-facing degradation — exit cleanly (0) and
@@ -366,6 +367,17 @@ export function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies
         // envelope; do not expose its raw body or retry a rejected creation.
         deps.stderr.write(`hq: ${formatPlanGateError(err)}\n`);
         deps.setExitCode(1);
+        if (canOfferTeamUpgrade()) {
+            try {
+                await offerTeamUpgrade(async () => {
+                    await upgradeToTeam({ companyUid: err.details.companyUid });
+                });
+            }
+            catch (upgradeErr) {
+                const message = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
+                deps.stderr.write(`hq: ${message}\n`);
+            }
+        }
     }
     else if (isExpectedUserError(err)) {
         // HQ-CLI-6: a user-facing, client-caused error (a non-owner running

package/dist/utils/plan-gate-error.d.ts

@@ -9,6 +9,8 @@ export interface PlanGateDetails {
     used?: number;
     limit?: number;
     upgradeUrl?: string;
+    /** Best-effort target captured by the shared HTTP client for interactive checkout. */
+    companyUid?: string;
 }
 export declare class PlanGateError extends Error {
     readonly code: PlanGateCode;
@@ -17,13 +19,20 @@ export declare class PlanGateError extends Error {
 }
 export declare function isPlanGateError(err: unknown): err is PlanGateError;
 export declare function formatPlanGateError(err: PlanGateError): string;
+export declare function canOfferTeamUpgrade(argv?: readonly string[]): boolean;
+/** Ask once, only on a real interactive terminal. */
+export declare function offerTeamUpgrade(onConfirm: () => Promise<void>, deps?: {
+    ask?: (question: string) => Promise<string>;
+    argv?: readonly string[];
+    interactive?: boolean;
+}): Promise<boolean>;
 /** Decode an already-read JSON envelope from either shared HTTP client. */
-export declare function planGateErrorFromPayload(status: number, body: unknown): PlanGateError | null;
+export declare function planGateErrorFromPayload(status: number, body: unknown, companyUid?: string): PlanGateError | null;
 /**
  * Decode only the two deliberate plan-gate envelopes. Malformed, unrelated,
  * or non-402 responses retain their existing command-specific handling.
  */
-export declare function planGateErrorFromResponse(response: Response): Promise<{
+export declare function planGateErrorFromResponse(response: Response, companyUid?: string): Promise<{
     error: PlanGateError | null;
     response: Response;
 }>;

package/dist/utils/plan-gate-error.js

@@ -1,3 +1,4 @@
+const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to Team.";
 export class PlanGateError extends Error {
     code;
     details;
@@ -5,7 +6,7 @@ export class PlanGateError extends Error {
         // Commands with their own expected-error boundary commonly print
         // `err.message`. Keeping the friendly copy here means those boundaries
         // retain the same plan-gate voice as main.ts without per-command handling.
-        super(formatPlanGateDetails(code, details));
+        super([formatPlanGateDetails(code, details), TEAM_UPGRADE_HINT].join("\n"));
         this.code = code;
         this.details = details;
         this.name = "PlanGateError";
@@ -40,10 +41,42 @@ function formatPlanGateDetails(code, details) {
     ].join("\n");
 }
 export function formatPlanGateError(err) {
-    return formatPlanGateDetails(err.code, err.details);
+    return [
+        formatPlanGateDetails(err.code, err.details),
+        TEAM_UPGRADE_HINT,
+    ].join("\n");
+}
+export function canOfferTeamUpgrade(argv = process.argv) {
+    return Boolean(process.stdin.isTTY && process.stderr.isTTY) &&
+        !process.env.CI &&
+        !argv.includes("--json");
+}
+/** Ask once, only on a real interactive terminal. */
+export async function offerTeamUpgrade(onConfirm, deps = {}) {
+    if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
+        return false;
+    if (deps.ask) {
+        const answer = await deps.ask("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        if (!/^y(?:es)?$/i.test(answer.trim()))
+            return false;
+        await onConfirm();
+        return true;
+    }
+    const { createInterface } = await import("node:readline/promises");
+    const readline = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await readline.question("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        if (!/^y(?:es)?$/i.test(answer.trim()))
+            return false;
+        await onConfirm();
+        return true;
+    }
+    finally {
+        readline.close();
+    }
 }
 /** Decode an already-read JSON envelope from either shared HTTP client. */
-export function planGateErrorFromPayload(status, body) {
+export function planGateErrorFromPayload(status, body, companyUid) {
     if (status !== 402 || !body || typeof body !== "object")
         return null;
     const payload = body;
@@ -55,13 +88,14 @@ export function planGateErrorFromPayload(status, body) {
         ...(typeof payload.used === "number" ? { used: payload.used } : {}),
         ...(typeof payload.limit === "number" ? { limit: payload.limit } : {}),
         ...(typeof payload.upgradeUrl === "string" ? { upgradeUrl: payload.upgradeUrl } : {}),
+        ...(companyUid ? { companyUid } : {}),
     });
 }
 /**
  * Decode only the two deliberate plan-gate envelopes. Malformed, unrelated,
  * or non-402 responses retain their existing command-specific handling.
  */
-export async function planGateErrorFromResponse(response) {
+export async function planGateErrorFromResponse(response, companyUid) {
     // Leave every non-402 response untouched for its command-specific handler.
     // A non-plan 402 is buffered and re-wrapped below so its useful error
     // payload remains available to the existing command-specific handler.
@@ -82,7 +116,7 @@ export async function planGateErrorFromResponse(response) {
         // Preserve the original non-JSON 402 body below for its existing handler.
     }
     return {
-        error: planGateErrorFromPayload(response.status, body),
+        error: planGateErrorFromPayload(response.status, body, companyUid),
         response: new Response(buffer, {
             status: response.status,
             statusText: response.statusText,

package/dist/utils/self-update.d.ts

@@ -23,7 +23,7 @@
  *   - `version-check.ts` maintains the cached npm `latest` that the startup
  *     path reads, so the common case costs a small file read, not a fetch.
  *
- * Best-effort by design: registry unreachable, npm/pnpm missing, install
+ * Best-effort by design: registry unreachable, npm/pnpm/Bun missing, install
  * failure, or `hq` not on PATH for the re-exec all degrade to running the
  * command on the current version. Self-updating must never make a command less
  * available than it was before.
@@ -56,9 +56,9 @@ export interface SelfUpdateOutcome {
 }
 /**
  * The manager-aware install argv for this layout — same routing as the hard
- * gate: a pnpm-managed install must be updated by pnpm (npm would drop a copy
- * the pnpm shim never reads), and an npm install goes through the resolved
- * prefix so the copy that is actually running is the one replaced.
+ * gate: pnpm- and Bun-managed installs must be updated by their owning manager
+ * (npm would drop a copy their shims never read), and an npm install goes
+ * through the resolved prefix so the copy that is actually running is replaced.
  */
 export declare function buildSelfUpdatePlan(install: RunningInstall): {
     cmd: string;

package/dist/utils/self-update.js

@@ -23,7 +23,7 @@
  *   - `version-check.ts` maintains the cached npm `latest` that the startup
  *     path reads, so the common case costs a small file read, not a fetch.
  *
- * Best-effort by design: registry unreachable, npm/pnpm missing, install
+ * Best-effort by design: registry unreachable, npm/pnpm/Bun missing, install
  * failure, or `hq` not on PATH for the re-exec all degrade to running the
  * command on the current version. Self-updating must never make a command less
  * available than it was before.
@@ -38,7 +38,7 @@ import * as path from "node:path";
 import semver from "semver";
 import chalk from "chalk";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, resolveRunningInstall, runUpdateCommand, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, resolveRunningInstall, runUpdateCommand, } from "./version-gate.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
@@ -68,13 +68,15 @@ async function fetchLatestVersion() {
 }
 /**
  * The manager-aware install argv for this layout — same routing as the hard
- * gate: a pnpm-managed install must be updated by pnpm (npm would drop a copy
- * the pnpm shim never reads), and an npm install goes through the resolved
- * prefix so the copy that is actually running is the one replaced.
+ * gate: pnpm- and Bun-managed installs must be updated by their owning manager
+ * (npm would drop a copy their shims never read), and an npm install goes
+ * through the resolved prefix so the copy that is actually running is replaced.
  */
 export function buildSelfUpdatePlan(install) {
     if (install.manager === "pnpm")
         return { cmd: "pnpm", args: buildPnpmInstallArgv() };
+    if (install.manager === "bun")
+        return { cmd: "bun", args: buildBunInstallArgv() };
     if (install.prefix)
         return { cmd: "npm", args: buildPrefixedInstallArgv(install.prefix) };
     return { cmd: "npm", args: ["install", "-g", `${CLI_NAME}@latest`] };

package/dist/utils/team-upgrade.d.ts

@@ -0,0 +1,17 @@
+export interface TeamUpgradeOptions {
+    company?: string;
+    companyUid?: string;
+    noBrowser?: boolean;
+    /** Testable override for environments where browser availability is known. */
+    headless?: boolean;
+    json?: boolean;
+    openUrl?: (url: string) => Promise<unknown>;
+    write?: (text: string) => void;
+    error?: (text: string) => void;
+}
+/**
+ * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * in its hosted browser page; the CLI never receives card data.
+ */
+export declare function upgradeToTeam(opts?: TeamUpgradeOptions): Promise<string>;
+//# sourceMappingURL=team-upgrade.d.ts.map

package/dist/utils/team-upgrade.js

@@ -0,0 +1,63 @@
+import open from "open";
+import { ensureCognitoToken } from "./cognito-session.js";
+import { getCompanyUid, vaultApiFetch } from "./vault-api.js";
+const CHECKOUT_SUCCESS_URL = "https://hq.computer/billing?checkout=success";
+const CHECKOUT_CANCEL_URL = "https://hq.computer/billing?checkout=cancel";
+function isHeadless() {
+    if (process.env.CI)
+        return true;
+    if (process.platform !== "linux")
+        return false;
+    return !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
+}
+function ownerUpgradeError() {
+    return Object.assign(new Error("Only a company owner can upgrade. Ask a company owner to upgrade."), { expected: true });
+}
+/**
+ * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * in its hosted browser page; the CLI never receives card data.
+ */
+export async function upgradeToTeam(opts = {}) {
+    const token = await ensureCognitoToken();
+    const companyUid = opts.companyUid ?? await getCompanyUid(token, opts.company);
+    const response = await vaultApiFetch({
+        token,
+        path: "/v1/billing/checkout/team",
+        method: "POST",
+        body: {
+            companyUid,
+            successUrl: CHECKOUT_SUCCESS_URL,
+            cancelUrl: CHECKOUT_CANCEL_URL,
+        },
+    });
+    if (!response.ok) {
+        const body = (await response.json().catch(() => ({})));
+        if (response.status === 403 || /owner/i.test(`${body.error ?? ""} ${body.message ?? ""}`)) {
+            throw ownerUpgradeError();
+        }
+        throw Object.assign(new Error(`Could not start HQ Team checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
+    }
+    const { url } = (await response.json());
+    if (typeof url !== "string" || !url) {
+        throw new Error("Checkout response did not include a hosted checkout URL.");
+    }
+    const write = opts.write ?? ((text) => process.stdout.write(text));
+    if (opts.json) {
+        write(`${JSON.stringify({ url })}\n`);
+        return url;
+    }
+    write("Opening HQ Team checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
+    const skipBrowser = opts.noBrowser || (opts.headless ?? isHeadless());
+    if (skipBrowser) {
+        write(`Open this URL to continue: ${url}\n`);
+        return url;
+    }
+    try {
+        await (opts.openUrl ?? open)(url);
+    }
+    catch (err) {
+        (opts.error ?? ((text) => process.stderr.write(text)))(`Couldn't launch your browser (${err instanceof Error ? err.message : String(err)}). Open this URL to continue: ${url}\n`);
+    }
+    return url;
+}
+//# sourceMappingURL=team-upgrade.js.map

package/dist/utils/vault-api.js

@@ -187,7 +187,13 @@ export async function vaultApiFetch(opts) {
         // A plan gate is a normal, user-actionable denial. Decode it at the one
         // shared HTTP seam so every resource-creation command reaches main.ts's
         // friendly renderer without duplicating response parsing or retrying.
-        const planGate = await planGateErrorFromResponse(response);
+        // The failed request usually already carries the target company in its
+        // body or path. Preserve it on the typed gate so an interactive checkout
+        // upgrades the same company without asking a multi-company caller again.
+        const companyUid = typeof opts.body?.companyUid === "string"
+            ? opts.body.companyUid
+            : /\/(cmp_[^/?]+)/.exec(opts.path)?.[1];
+        const planGate = await planGateErrorFromResponse(response, companyUid);
         if (planGate.error)
             throw planGate.error;
         return planGate.response;

package/dist/utils/version-gate.d.ts

@@ -29,7 +29,7 @@
  */
 import { buildSpawnPlan, quoteForWindowsShell } from "./windows-spawn.js";
 /** Which package manager owns the running global install. */
-export type InstallManager = "npm" | "pnpm";
+export type InstallManager = "npm" | "pnpm" | "bun";
 export interface VersionCheckResponse {
     clientId: string;
     currentVersion: string;
@@ -67,13 +67,15 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
 export declare function isPnpmManagedPackageDir(pkgDir: string): boolean;
+/** Whether the running package lives inside Bun's global install tree. */
+export declare function isBunManagedPackageDir(pkgDir: string): boolean;
 /**
  * Where the running CLI is installed and who owns it. Resolved in ONE pass so
  * the package-root walk (which reads and parses a `package.json` per directory
  * level) happens once per invocation, and so the manager and the prefix can
  * never disagree because the filesystem shifted between two separate walks.
  *
- * `prefix` is `null` for a pnpm-managed install even though a prefix-shaped
+ * `prefix` is `null` for pnpm- and Bun-managed installs even though a prefix-shaped
  * string *can* be derived from those paths: `npmPrefixFromPackageDir` would
  * happily hand back the pnpm store directory, and `npm install -g --prefix
  * <store>` then unpacks a fresh copy into `<store>/lib/node_modules`, which
@@ -101,6 +103,8 @@ export declare function buildPrefixedInstallArgv(prefix: string): string[];
  * the new version — which is the whole point of routing here instead of npm.
  */
 export declare function buildPnpmInstallArgv(): string[];
+/** Argv for updating a Bun-managed global install. */
+export declare function buildBunInstallArgv(): string[];
 /**
  * Filesystem surface used by {@link cleanStalePartialInstall}. Injected so the
  * cleanup logic is unit-testable without touching a real global prefix.
@@ -209,11 +213,13 @@ export declare const __test__: {
     CLIENT_ID: string;
     ENDPOINT_PATH: string;
     FETCH_TIMEOUT_MS: number;
+    buildBunInstallArgv: typeof buildBunInstallArgv;
     buildPnpmInstallArgv: typeof buildPnpmInstallArgv;
     buildPrefixedInstallArgv: typeof buildPrefixedInstallArgv;
     buildSpawnPlan: typeof buildSpawnPlan;
     cleanStalePartialInstall: typeof cleanStalePartialInstall;
     enforceUpdateRequired: typeof enforceUpdateRequired;
+    isBunManagedPackageDir: typeof isBunManagedPackageDir;
     isPnpmManagedPackageDir: typeof isPnpmManagedPackageDir;
     npmPrefixFromPackageDir: typeof npmPrefixFromPackageDir;
     nudgeUpdateRecommended: typeof nudgeUpdateRecommended;

package/dist/utils/version-gate.js

@@ -125,6 +125,19 @@ export function isPnpmManagedPackageDir(pkgDir) {
     }
     return false;
 }
+/** Whether the running package lives inside Bun's global install tree. */
+export function isBunManagedPackageDir(pkgDir) {
+    const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
+    const segments = normalized.split("/").filter(Boolean);
+    for (let i = 0; i < segments.length - 2; i += 1) {
+        if (segments[i] === "install" &&
+            segments[i + 1] === "global" &&
+            segments[i + 2] === "node_modules") {
+            return true;
+        }
+    }
+    return false;
+}
 export function resolveRunningInstall() {
     try {
         const packageRoot = findRunningPackageRoot();
@@ -133,6 +146,9 @@ export function resolveRunningInstall() {
         if (isPnpmManagedPackageDir(packageRoot)) {
             return { manager: "pnpm", prefix: null, packageRoot };
         }
+        if (isBunManagedPackageDir(packageRoot)) {
+            return { manager: "bun", prefix: null, packageRoot };
+        }
         return {
             manager: "npm",
             prefix: npmPrefixFromPackageDir(packageRoot),
@@ -162,6 +178,10 @@ export function buildPrefixedInstallArgv(prefix) {
 export function buildPnpmInstallArgv() {
     return ["add", "-g", LATEST_PACKAGE_SPEC];
 }
+/** Argv for updating a Bun-managed global install. */
+export function buildBunInstallArgv() {
+    return ["add", "-g", LATEST_PACKAGE_SPEC];
+}
 const nodeStaleInstallFs = {
     readdirSync: (dir) => readdirSync(dir),
     existsSync,
@@ -338,6 +358,8 @@ function performUpdate(command, runner = runUpdateCommand) {
 function manualUpdateCommand(install, decision) {
     if (install.manager === "pnpm")
         return `pnpm ${buildPnpmInstallArgv().join(" ")}`;
+    if (install.manager === "bun")
+        return `bun ${buildBunInstallArgv().join(" ")}`;
     if (install.prefix)
         return `npm ${buildPrefixedInstallArgv(install.prefix).join(" ")}`;
     return decision.updateCommand;
@@ -360,7 +382,9 @@ function nudgeUpdateRecommended(decision, install = resolveRunningInstall()) {
     console.error(msg);
     const command = install.manager === "pnpm"
         ? `pnpm ${buildPnpmInstallArgv().join(" ")}`
-        : decision.updateCommand;
+        : install.manager === "bun"
+            ? `bun ${buildBunInstallArgv().join(" ")}`
+            : decision.updateCommand;
     if (command) {
         console.error(chalk.dim(`  Update: ${command}`));
     }
@@ -382,13 +406,14 @@ function enforceUpdateRequired(decision, deps = {}) {
         console.error(chalk.dim(`  ${decision.message}`));
     const command = decision.updateCommand;
     // ONE package-root walk decides both the manager and the prefix. A
-    // pnpm-managed install must be updated by pnpm; the server's `updateCommand`
-    // and any npm prefix are both wrong for that layout, so `resolveRunningInstall`
+    // A pnpm- or Bun-managed install must be updated by its owning manager; the
+    // server's `updateCommand` and any npm prefix are wrong for those layouts, so
+    // `resolveRunningInstall`
     // already reports `prefix: null` there and neither is consulted below.
     const install = (deps.resolveInstall ?? resolveRunningInstall)();
-    const isPnpm = install.manager === "pnpm";
+    const isManagedOutsideNpm = install.manager !== "npm";
     const prefix = install.prefix;
-    if (!isPnpm && !command && !prefix) {
+    if (!isManagedOutsideNpm && !command && !prefix) {
         console.error(chalk.red("  No updateCommand provided by hq-pro — see https://hq.indigo.ai/docs/cli-update for manual steps."));
         if (decision.downloadUrl) {
             console.error(chalk.dim(`  Download: ${decision.downloadUrl}`));
@@ -400,10 +425,14 @@ function enforceUpdateRequired(decision, deps = {}) {
     // the EXACT same command under elevation.
     let primaryCmd;
     let primaryArgs;
-    if (isPnpm) {
+    if (install.manager === "pnpm") {
         primaryCmd = "pnpm";
         primaryArgs = buildPnpmInstallArgv();
     }
+    else if (install.manager === "bun") {
+        primaryCmd = "bun";
+        primaryArgs = buildBunInstallArgv();
+    }
     else if (prefix) {
         primaryCmd = "npm";
         primaryArgs = buildPrefixedInstallArgv(prefix);
@@ -414,10 +443,10 @@ function enforceUpdateRequired(decision, deps = {}) {
         primaryArgs = parts.slice(1);
     }
     let result;
-    if (isPnpm) {
-        console.error(chalk.dim("  Detected a pnpm-managed global install; updating with pnpm"));
-        console.error(chalk.dim(`  Running: pnpm ${primaryArgs.join(" ")}`));
-        result = performUpdateCommand("pnpm", primaryArgs, runner);
+    if (isManagedOutsideNpm) {
+        console.error(chalk.dim(`  Detected a ${install.manager}-managed global install; updating with ${install.manager}`));
+        console.error(chalk.dim(`  Running: ${primaryCmd} ${primaryArgs.join(" ")}`));
+        result = performUpdateCommand(primaryCmd, primaryArgs, runner);
     }
     else if (prefix) {
         console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
@@ -455,10 +484,10 @@ function enforceUpdateRequired(decision, deps = {}) {
     // through to the manual path unchanged, while headless boxes with passwordless
     // sudo self-update cleanly.
     //
-    // Never for pnpm: `sudo -n pnpm add -g` installs into ROOT's PNPM_HOME, which
-    // leaves the user's shim untouched while reporting success — the same silent
-    // no-op this fix exists to remove. A failed pnpm update must surface instead.
-    if (!result.ok && primaryCmd && !isPnpm) {
+    // Never for pnpm or Bun: elevation changes the package manager's global home,
+    // leaving the user's shim untouched while reporting success. A failed
+    // non-npm update must surface instead.
+    if (!result.ok && primaryCmd && !isManagedOutsideNpm) {
         console.error(chalk.dim(`  Update failed unprivileged; retrying with: sudo -n ${primaryCmd} ${primaryArgs.join(" ")}`));
         const sudoResult = performUpdateCommand("sudo", ["-n", primaryCmd, ...primaryArgs], runner);
         if (sudoResult.ok)
@@ -476,9 +505,9 @@ function enforceUpdateRequired(decision, deps = {}) {
         const manual = manualUpdateCommand(install, decision) ?? command;
         console.error(chalk.dim(`  Try manually: ${manual}`));
         // Only informational, and only when we could not run the right manager at
-        // all: hq-pro's command is npm-shaped, so following it on a pnpm layout is
-        // what produced the stale-shim loop in the first place.
-        if (isPnpm && result.code === "ENOENT" && command) {
+        // all: hq-pro's command is npm-shaped, so following it on a pnpm or Bun
+        // layout would update a different copy and leave the running shim stale.
+        if (isManagedOutsideNpm && result.code === "ENOENT" && command) {
             console.error(chalk.dim(`  (hq-pro suggests \`${command}\` — that is for npm-managed installs; use it only if you have switched this install to npm.)`));
         }
         process.exit(75);
@@ -524,11 +553,13 @@ export const __test__ = {
     CLIENT_ID,
     ENDPOINT_PATH,
     FETCH_TIMEOUT_MS,
+    buildBunInstallArgv,
     buildPnpmInstallArgv,
     buildPrefixedInstallArgv,
     buildSpawnPlan,
     cleanStalePartialInstall,
     enforceUpdateRequired,
+    isBunManagedPackageDir,
     isPnpmManagedPackageDir,
     npmPrefixFromPackageDir,
     nudgeUpdateRecommended,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.101.0",
+  "version": "5.101.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -29,7 +29,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "^6.14.50",
+    "@indigoai-us/hq-cloud": "~6.15.0",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",