@indigoai-us/hq-cli 5.101.1 → 5.101.3

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.101.3] — 2026-08-15
+
+## [5.101.2] — 2026-08-15
+
+### Fixed
+
+- Self-update now detects Bun-managed global installs and runs `bun add -g`
+  through the owning package manager. Existing pnpm-managed and npm prefix
+  installs, including Homebrew prefixes such as `/opt/homebrew`, continue to
+  update the copy that is actually running without an unnecessary `sudo`.
+
 ## [5.101.1] — 2026-08-14
 
 ### Fixed

package/dist/commands/agents.js

@@ -27,6 +27,7 @@ import * as readline from "node:readline";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { confirmChargeOrExit, formatUsd, parseBillingPayload, surfaceBillingBlocked, } from "../utils/billing-gate.js";
 /** Reasoning-effort values hq-pro accepts on `runtime-config`. */
 export const VALID_EFFORTS = new Set([
@@ -381,6 +382,10 @@ function sleep(ms) {
 // Command registration
 // ---------------------------------------------------------------------------
 function fail(err) {
+    // Let the CLI boundary render and offer the one shared Team checkout flow.
+    // Local exits would otherwise prevent interactive plan-limit remediation.
+    if (isPlanGateError(err))
+        throw err;
     if (err instanceof AgentsHttpError) {
         console.error(chalk.red(err.message));
     }

package/dist/commands/billing.js

@@ -16,6 +16,7 @@ import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { mintPaymentLink } from "../utils/billing-gate.js";
+import { upgradeToTeam } from "../utils/team-upgrade.js";
 function fail(err) {
     console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
     process.exit(1);
@@ -107,5 +108,23 @@ export function registerBillingCommand(program) {
             fail(err);
         }
     });
+    billing
+        .command("upgrade")
+        .description("Open Stripe Checkout to upgrade this company to HQ Team ($500/mo)")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--no-browser", "Print the Stripe Checkout URL instead of opening it")
+        .option("--json", "Emit the Checkout URL as JSON")
+        .action(async function (opts) {
+        try {
+            await upgradeToTeam({
+                company: companyOf(this),
+                noBrowser: opts.browser === false,
+                json: opts.json,
+            });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
 }
 //# sourceMappingURL=billing.js.map

package/dist/commands/outposts.js

@@ -439,6 +439,10 @@ function bashSingleQuote(value) {
 function systemdQuoted(value) {
     return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
+// U60 records this compatible hq-cloud artifact. Outpost launchers must stay
+// reproducible: `@latest` could silently opt a long-lived box into a different
+// sync protocol before its server-side eligibility is evaluated.
+const OUTPOST_HQ_CLOUD_VERSION = "6.15.1";
 function renderSelfDeploySyncScript(hqRoot) {
     return `#!/usr/bin/env bash
 set -u
@@ -448,7 +452,7 @@ HQ_ROOT=${bashSingleQuote(hqRoot)}
 cd "$HQ_ROOT"
 while true; do
   hq auth refresh || echo "[outpost-sync] auth refresh failed, continuing"
-  npx -y --package=@indigoai-us/hq-cloud@latest hq-sync-runner \\
+  npx -y --package=@indigoai-us/hq-cloud@${OUTPOST_HQ_CLOUD_VERSION} hq-sync-runner \\
     --companies \\
     --direction both \\
     --on-conflict keep \\

package/dist/lib/db/control-plane.js

@@ -36,7 +36,7 @@ export class ControlPlaneDbClient {
             catch {
                 /* keep */
             }
-            const planGate = planGateErrorFromPayload(res.status, payload);
+            const planGate = planGateErrorFromPayload(res.status, payload, input.companyUid);
             if (planGate)
                 throw planGate;
             const err = new Error(msg);

package/dist/lib/search-index/index.d.ts

@@ -63,6 +63,22 @@ export declare class QmdExitError extends Error {
 export declare class QmdCollectionMissingError extends QmdExitError {
     name: string;
 }
+/**
+ * qmd's `collection add` exited non-zero because the requested name is ALREADY
+ * registered in qmd's YAML config under exactly that name — the idempotent,
+ * already-satisfied duplicate (qmd 2.5.3 prints `Collection '<name>' already
+ * exists.`). `collectionName` carries the parsed name so a caller can confirm
+ * the duplicate is the collection it was adding. Distinct from qmd's DIFFERENT
+ * path+pattern duplicate ("A collection already exists for this path and
+ * pattern:"), which names ANOTHER collection, carries no quoted-name form, and
+ * stays a plain {@link QmdExitError} so it keeps failing loud. HQ-CLI-Q
+ * (Sentry 7670823899).
+ */
+export declare class QmdCollectionExistsError extends QmdExitError {
+    readonly collectionName: string;
+    name: string;
+    constructor(message: string, args: string[], status: number | null, stdout: string, stderr: string, collectionName: string);
+}
 export type ResolveQmdBinOptions = {
     env?: Record<string, string | undefined>;
     isExecutable?: (candidate: string) => boolean;
@@ -241,7 +257,21 @@ export type ReconcileCollectionsOptions = {
     bin?: string;
     runner?: QmdProcessRunner;
 };
-/** Register expected collections that qmd does not yet know about. */
+/**
+ * Register expected collections that qmd does not yet know about, returning the
+ * collections this call actually created (a `collection add` that exited 0).
+ *
+ * A same-name idempotent duplicate — qmd already owns the exact requested name
+ * in its YAML config (`Collection '<name>' already exists.`), while the
+ * SQLite-backed `collection list` we derive `missing` from had diverged — is
+ * NOT a failure. Reconciliation still issues the `context add`, whose qmd-side
+ * resyncConfig re-syncs YAML into SQLite and heals the divergence that provoked
+ * the retry, then continues with later collections; such a pre-existing
+ * collection is excluded from the returned list. Every other qmd failure still
+ * propagates: the DIFFERENT path+pattern duplicate, a same-name duplicate that
+ * named a different collection, a missing collection, a `context add` failure,
+ * a missing/unbuilt qmd binary. HQ-CLI-Q (Sentry 7670823899).
+ */
 export declare function reconcileCollections(hqRoot: string, options?: ReconcileCollectionsOptions): SearchCollection[];
 export declare function listRegisteredCollections(hqRoot: string, options?: RunQmdOptions): Set<string>;
 export {};

package/dist/lib/search-index/index.js

@@ -42,6 +42,25 @@ export class QmdExitError extends Error {
 export class QmdCollectionMissingError extends QmdExitError {
     name = 'QmdCollectionMissingError';
 }
+/**
+ * qmd's `collection add` exited non-zero because the requested name is ALREADY
+ * registered in qmd's YAML config under exactly that name — the idempotent,
+ * already-satisfied duplicate (qmd 2.5.3 prints `Collection '<name>' already
+ * exists.`). `collectionName` carries the parsed name so a caller can confirm
+ * the duplicate is the collection it was adding. Distinct from qmd's DIFFERENT
+ * path+pattern duplicate ("A collection already exists for this path and
+ * pattern:"), which names ANOTHER collection, carries no quoted-name form, and
+ * stays a plain {@link QmdExitError} so it keeps failing loud. HQ-CLI-Q
+ * (Sentry 7670823899).
+ */
+export class QmdCollectionExistsError extends QmdExitError {
+    collectionName;
+    name = 'QmdCollectionExistsError';
+    constructor(message, args, status, stdout, stderr, collectionName) {
+        super(message, args, status, stdout, stderr);
+        this.collectionName = collectionName;
+    }
+}
 function isExecutable(candidate) {
     try {
         fs.accessSync(candidate, fs.constants.X_OK);
@@ -643,6 +662,18 @@ function finishRunQmd(result, bin, args) {
     if (/(?:collection|qmd:\/\/).*(?:not found|does not exist|unknown)|(?:not found|does not exist).*collection/i.test(detail)) {
         throw new QmdCollectionMissingError(message, args, normalized.status, normalized.stdout, normalized.stderr);
     }
+    // qmd's same-name duplicate: `collection add` targeted a name YAML already
+    // owns (`Collection '<name>' already exists.`). Reconciliation treats this
+    // exact shape as already-satisfied (HQ-CLI-Q). The DIFFERENT path+pattern
+    // duplicate ("A collection already exists for this path and pattern:") names
+    // another collection and carries no quoted-name form, so it never matches and
+    // stays a plain QmdExitError. Colour is off under capture (qmd gates on
+    // isTTY) and any surrounding ANSI sits outside this substring, so the plain
+    // match is robust either way.
+    const alreadyExists = /Collection '([^']+)' already exists\./.exec(detail);
+    if (alreadyExists) {
+        throw new QmdCollectionExistsError(message, args, normalized.status, normalized.stdout, normalized.stderr, alreadyExists[1]);
+    }
     throw new QmdExitError(message, args, normalized.status, normalized.stdout, normalized.stderr);
 }
 /** Run qmd with captured output and typed failures. */
@@ -741,16 +772,41 @@ export function deriveCollections(hqRoot) {
     }
     return collections;
 }
-/** Register expected collections that qmd does not yet know about. */
+/**
+ * Register expected collections that qmd does not yet know about, returning the
+ * collections this call actually created (a `collection add` that exited 0).
+ *
+ * A same-name idempotent duplicate — qmd already owns the exact requested name
+ * in its YAML config (`Collection '<name>' already exists.`), while the
+ * SQLite-backed `collection list` we derive `missing` from had diverged — is
+ * NOT a failure. Reconciliation still issues the `context add`, whose qmd-side
+ * resyncConfig re-syncs YAML into SQLite and heals the divergence that provoked
+ * the retry, then continues with later collections; such a pre-existing
+ * collection is excluded from the returned list. Every other qmd failure still
+ * propagates: the DIFFERENT path+pattern duplicate, a same-name duplicate that
+ * named a different collection, a missing collection, a `context add` failure,
+ * a missing/unbuilt qmd binary. HQ-CLI-Q (Sentry 7670823899).
+ */
 export function reconcileCollections(hqRoot, options = {}) {
     const runOptions = { bin: options.bin, runner: options.runner, cwd: hqRoot };
     const registered = listRegisteredCollections(hqRoot, runOptions);
     const missing = deriveCollections(hqRoot).filter((collection) => !registered.has(collection.name));
+    const created = [];
     for (const collection of missing) {
-        runQmd(['collection', 'add', collection.path, '--name', collection.name, '--mask', collection.mask], runOptions);
+        try {
+            runQmd(['collection', 'add', collection.path, '--name', collection.name, '--mask', collection.mask], runOptions);
+            created.push(collection);
+        }
+        catch (error) {
+            // Only the exact same-name duplicate for THIS collection is already
+            // satisfied. Anything else — including a same-name duplicate that names a
+            // different collection — stays fatal.
+            if (!(error instanceof QmdCollectionExistsError) || error.collectionName !== collection.name)
+                throw error;
+        }
         runQmd(['context', 'add', `qmd://${collection.name}`, collection.context], runOptions);
     }
-    return missing;
+    return created;
 }
 export function listRegisteredCollections(hqRoot, options = {}) {
     const result = runQmd(['collection', 'list'], { ...options, cwd: options.cwd ?? hqRoot });

package/dist/main.d.ts

@@ -5,6 +5,11 @@
 import "./node-preflight.js";
 import "./node-network-compat.js";
 import { Sentry } from "./sentry.js";
+export type StreamErrorDependencies = {
+    stderr: Pick<typeof process.stderr, "write">;
+    exit: (code: number) => void;
+};
+export declare function handleStreamError(err: NodeJS.ErrnoException, deps?: StreamErrorDependencies): void;
 export declare function runCli(): Promise<void>;
 export type TopLevelErrorDependencies = {
     sentry: Pick<typeof Sentry, "captureException">;
@@ -12,5 +17,5 @@ export type TopLevelErrorDependencies = {
     setExitCode: (code: number) => void;
 };
 /** Classify a top-level failure without making the CLI process boundary opaque to tests. */
-export declare function handleTopLevelError(err: unknown, deps?: TopLevelErrorDependencies): void;
+export declare function handleTopLevelError(err: unknown, deps?: TopLevelErrorDependencies): Promise<void>;
 //# sourceMappingURL=main.d.ts.map

package/dist/main.js

@@ -70,7 +70,8 @@ import { isEpipe } from "./utils/epipe.js";
 import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
 import { isAuthError } from "./utils/auth-error.js";
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
-import { formatPlanGateError, isPlanGateError, } from "./utils/plan-gate-error.js";
+import { canOfferTeamUpgrade, formatPlanGateError, isPlanGateError, offerTeamUpgrade, } from "./utils/plan-gate-error.js";
+import { upgradeToTeam } from "./utils/team-upgrade.js";
 import { refreshVersionCache, staleAgainstCachedLatest, } from "./utils/version-check.js";
 import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { autoUpdateAndReexec } from "./utils/self-update.js";
@@ -82,19 +83,47 @@ import { isPackageRootResolutionError, packageRootCaptureContext, } from "./util
 import { fallbackOperatorMessage, unexpectedCliErrorMessage } from "./utils/unexpected-cli-error.js";
 /** Hard upper bound for non-user-visible release-health finalization. */
 const RELEASE_HEALTH_SETTLE_TIMEOUT_MS = 3_000;
-// Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes
-// the pipe early. This covers the ASYNC path — an 'error' event emitted on the
-// stream. The SYNCHRONOUS path (a `write EPIPE` thrown straight out of
-// console.log inside a command) is handled in the top-level catch below; both
-// share `isEpipe` (HQ-6B).
-const onPipeError = (err) => {
+const defaultStreamErrorDependencies = {
+    stderr: process.stderr,
+    exit: (code) => process.exit(code),
+};
+// Handle an 'error' event on process.stdout/stderr without turning a benign
+// machine-state condition into a Sentry fatal.
+//   - EPIPE: a downstream reader closed the pipe early (`hq … | head`,
+//     `source <(hq …)`, a parent that exited) — a clean exit 0, no capture. The
+//     SYNCHRONOUS path (a `write EPIPE` thrown straight out of console.log) is
+//     handled in the top-level catch below; both share `isEpipe` (HQ-6B).
+//   - ENOSPC / EDQUOT / EROFS: a full disk, exhausted quota, or read-only mount
+//     (e.g. stdout redirected to a file that fills up) — the user's machine,
+//     not an hq-cli defect. Print one actionable line (best-effort; the same
+//     disk may reject it) and exit 1 WITHOUT rethrowing, so it never becomes an
+//     uncaughtException that ships a fatal (HQ-CLI-R). sentry.ts's
+//     path-independent beforeSend also drops it, covering the buffered-write
+//     route that never surfaces here.
+//   - Anything else: rethrow — an unknown stream failure must stay loud.
+// Exported in dependency-injectable form (mirroring handleTopLevelError) so the
+// process boundary stays unit-testable through the ./main.js import seam.
+export function handleStreamError(err, deps = defaultStreamErrorDependencies) {
     if (isEpipe(err)) {
-        process.exit(0);
+        deps.exit(0);
+        return;
+    }
+    const envMessage = environmentalFsErrorMessage(err);
+    if (envMessage) {
+        try {
+            deps.stderr.write(`hq: ${envMessage}\n`);
+        }
+        catch {
+            // The same full disk / read-only mount can reject this write too; there
+            // is nothing more to surface, but we still exit non-zero below.
+        }
+        deps.exit(1);
+        return;
     }
     throw err;
-};
-process.stdout.on("error", onPipeError);
-process.stderr.on("error", onPipeError);
+}
+process.stdout.on("error", (err) => handleStreamError(err));
+process.stderr.on("error", (err) => handleStreamError(err));
 initSentry();
 const program = new Command();
 program
@@ -292,7 +321,7 @@ export async function runCli() {
         await program.parseAsync();
     }
     catch (err) {
-        handleTopLevelError(err);
+        await handleTopLevelError(err);
     }
     finally {
         // Plan-limit nag (US-016): stderr-only, never throws, never touches
@@ -319,7 +348,7 @@ const defaultTopLevelErrorDependencies = {
     },
 };
 /** Classify a top-level failure without making the CLI process boundary opaque to tests. */
-export function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies) {
+export async function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies) {
     // A broken pipe (EPIPE) means the reader of `hq`'s output closed it early
     // (`hq … | head`, `source <(hq …)`, a parent that exited). That is normal
     // Unix behavior with no user-facing degradation — exit cleanly (0) and
@@ -366,6 +395,17 @@ export function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies
         // envelope; do not expose its raw body or retry a rejected creation.
         deps.stderr.write(`hq: ${formatPlanGateError(err)}\n`);
         deps.setExitCode(1);
+        if (canOfferTeamUpgrade()) {
+            try {
+                await offerTeamUpgrade(async () => {
+                    await upgradeToTeam({ companyUid: err.details.companyUid });
+                });
+            }
+            catch (upgradeErr) {
+                const message = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
+                deps.stderr.write(`hq: ${message}\n`);
+            }
+        }
     }
     else if (isExpectedUserError(err)) {
         // HQ-CLI-6: a user-facing, client-caused error (a non-owner running

package/dist/sentry.js

@@ -5,6 +5,7 @@ import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
+import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 /**
  * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
  * reader (`hq … | head`, `source <(hq …)`, a parent that exited) is normal
@@ -18,6 +19,17 @@ import { isEpipe } from "./utils/epipe.js";
 export function epipeAwareBeforeSend(event, hint) {
     if (isEpipe(hint?.originalException))
         return null;
+    // Path-independent belt for environmental filesystem failures (ENOSPC /
+    // EDQUOT / EROFS — a full disk, exhausted quota, or read-only mount, e.g.
+    // stdout redirected to a file that fills up). These are the user's machine,
+    // never an hq-cli defect, and can surface by several routes: a synchronous
+    // throw through the top-level boundary, a rethrow from the stdout/stderr
+    // 'error' listener, or a buffered-write uncaughtException that never reaches
+    // either. handleTopLevelError already prints an actionable message for the
+    // boundary route; dropping the event here suppresses the fatal regardless of
+    // route, while the CLI still exits non-zero. HQ-CLI-R (Sentry 7671416365).
+    if (environmentalFsErrorMessage(hint?.originalException))
+        return null;
     return beforeSend(event, hint);
 }
 export function initSentry() {

package/dist/utils/plan-gate-error.d.ts

@@ -9,6 +9,8 @@ export interface PlanGateDetails {
     used?: number;
     limit?: number;
     upgradeUrl?: string;
+    /** Best-effort target captured by the shared HTTP client for interactive checkout. */
+    companyUid?: string;
 }
 export declare class PlanGateError extends Error {
     readonly code: PlanGateCode;
@@ -17,13 +19,20 @@ export declare class PlanGateError extends Error {
 }
 export declare function isPlanGateError(err: unknown): err is PlanGateError;
 export declare function formatPlanGateError(err: PlanGateError): string;
+export declare function canOfferTeamUpgrade(argv?: readonly string[]): boolean;
+/** Ask once, only on a real interactive terminal. */
+export declare function offerTeamUpgrade(onConfirm: () => Promise<void>, deps?: {
+    ask?: (question: string) => Promise<string>;
+    argv?: readonly string[];
+    interactive?: boolean;
+}): Promise<boolean>;
 /** Decode an already-read JSON envelope from either shared HTTP client. */
-export declare function planGateErrorFromPayload(status: number, body: unknown): PlanGateError | null;
+export declare function planGateErrorFromPayload(status: number, body: unknown, companyUid?: string): PlanGateError | null;
 /**
  * Decode only the two deliberate plan-gate envelopes. Malformed, unrelated,
  * or non-402 responses retain their existing command-specific handling.
  */
-export declare function planGateErrorFromResponse(response: Response): Promise<{
+export declare function planGateErrorFromResponse(response: Response, companyUid?: string): Promise<{
     error: PlanGateError | null;
     response: Response;
 }>;

package/dist/utils/plan-gate-error.js

@@ -1,3 +1,4 @@
+const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to Team.";
 export class PlanGateError extends Error {
     code;
     details;
@@ -5,7 +6,7 @@ export class PlanGateError extends Error {
         // Commands with their own expected-error boundary commonly print
         // `err.message`. Keeping the friendly copy here means those boundaries
         // retain the same plan-gate voice as main.ts without per-command handling.
-        super(formatPlanGateDetails(code, details));
+        super([formatPlanGateDetails(code, details), TEAM_UPGRADE_HINT].join("\n"));
         this.code = code;
         this.details = details;
         this.name = "PlanGateError";
@@ -40,10 +41,42 @@ function formatPlanGateDetails(code, details) {
     ].join("\n");
 }
 export function formatPlanGateError(err) {
-    return formatPlanGateDetails(err.code, err.details);
+    return [
+        formatPlanGateDetails(err.code, err.details),
+        TEAM_UPGRADE_HINT,
+    ].join("\n");
+}
+export function canOfferTeamUpgrade(argv = process.argv) {
+    return Boolean(process.stdin.isTTY && process.stderr.isTTY) &&
+        !process.env.CI &&
+        !argv.includes("--json");
+}
+/** Ask once, only on a real interactive terminal. */
+export async function offerTeamUpgrade(onConfirm, deps = {}) {
+    if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
+        return false;
+    if (deps.ask) {
+        const answer = await deps.ask("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        if (!/^y(?:es)?$/i.test(answer.trim()))
+            return false;
+        await onConfirm();
+        return true;
+    }
+    const { createInterface } = await import("node:readline/promises");
+    const readline = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await readline.question("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        if (!/^y(?:es)?$/i.test(answer.trim()))
+            return false;
+        await onConfirm();
+        return true;
+    }
+    finally {
+        readline.close();
+    }
 }
 /** Decode an already-read JSON envelope from either shared HTTP client. */
-export function planGateErrorFromPayload(status, body) {
+export function planGateErrorFromPayload(status, body, companyUid) {
     if (status !== 402 || !body || typeof body !== "object")
         return null;
     const payload = body;
@@ -55,13 +88,14 @@ export function planGateErrorFromPayload(status, body) {
         ...(typeof payload.used === "number" ? { used: payload.used } : {}),
         ...(typeof payload.limit === "number" ? { limit: payload.limit } : {}),
         ...(typeof payload.upgradeUrl === "string" ? { upgradeUrl: payload.upgradeUrl } : {}),
+        ...(companyUid ? { companyUid } : {}),
     });
 }
 /**
  * Decode only the two deliberate plan-gate envelopes. Malformed, unrelated,
  * or non-402 responses retain their existing command-specific handling.
  */
-export async function planGateErrorFromResponse(response) {
+export async function planGateErrorFromResponse(response, companyUid) {
     // Leave every non-402 response untouched for its command-specific handler.
     // A non-plan 402 is buffered and re-wrapped below so its useful error
     // payload remains available to the existing command-specific handler.
@@ -82,7 +116,7 @@ export async function planGateErrorFromResponse(response) {
         // Preserve the original non-JSON 402 body below for its existing handler.
     }
     return {
-        error: planGateErrorFromPayload(response.status, body),
+        error: planGateErrorFromPayload(response.status, body, companyUid),
         response: new Response(buffer, {
             status: response.status,
             statusText: response.statusText,

package/dist/utils/self-update.d.ts

@@ -23,7 +23,7 @@
  *   - `version-check.ts` maintains the cached npm `latest` that the startup
  *     path reads, so the common case costs a small file read, not a fetch.
  *
- * Best-effort by design: registry unreachable, npm/pnpm missing, install
+ * Best-effort by design: registry unreachable, npm/pnpm/Bun missing, install
  * failure, or `hq` not on PATH for the re-exec all degrade to running the
  * command on the current version. Self-updating must never make a command less
  * available than it was before.
@@ -56,9 +56,9 @@ export interface SelfUpdateOutcome {
 }
 /**
  * The manager-aware install argv for this layout — same routing as the hard
- * gate: a pnpm-managed install must be updated by pnpm (npm would drop a copy
- * the pnpm shim never reads), and an npm install goes through the resolved
- * prefix so the copy that is actually running is the one replaced.
+ * gate: pnpm- and Bun-managed installs must be updated by their owning manager
+ * (npm would drop a copy their shims never read), and an npm install goes
+ * through the resolved prefix so the copy that is actually running is replaced.
  */
 export declare function buildSelfUpdatePlan(install: RunningInstall): {
     cmd: string;

package/dist/utils/self-update.js

@@ -23,7 +23,7 @@
  *   - `version-check.ts` maintains the cached npm `latest` that the startup
  *     path reads, so the common case costs a small file read, not a fetch.
  *
- * Best-effort by design: registry unreachable, npm/pnpm missing, install
+ * Best-effort by design: registry unreachable, npm/pnpm/Bun missing, install
  * failure, or `hq` not on PATH for the re-exec all degrade to running the
  * command on the current version. Self-updating must never make a command less
  * available than it was before.
@@ -38,7 +38,7 @@ import * as path from "node:path";
 import semver from "semver";
 import chalk from "chalk";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, resolveRunningInstall, runUpdateCommand, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, resolveRunningInstall, runUpdateCommand, } from "./version-gate.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
  * One update + one re-exec per user invocation, ever.
@@ -68,13 +68,15 @@ async function fetchLatestVersion() {
 }
 /**
  * The manager-aware install argv for this layout — same routing as the hard
- * gate: a pnpm-managed install must be updated by pnpm (npm would drop a copy
- * the pnpm shim never reads), and an npm install goes through the resolved
- * prefix so the copy that is actually running is the one replaced.
+ * gate: pnpm- and Bun-managed installs must be updated by their owning manager
+ * (npm would drop a copy their shims never read), and an npm install goes
+ * through the resolved prefix so the copy that is actually running is replaced.
  */
 export function buildSelfUpdatePlan(install) {
     if (install.manager === "pnpm")
         return { cmd: "pnpm", args: buildPnpmInstallArgv() };
+    if (install.manager === "bun")
+        return { cmd: "bun", args: buildBunInstallArgv() };
     if (install.prefix)
         return { cmd: "npm", args: buildPrefixedInstallArgv(install.prefix) };
     return { cmd: "npm", args: ["install", "-g", `${CLI_NAME}@latest`] };

package/dist/utils/team-upgrade.d.ts

@@ -0,0 +1,17 @@
+export interface TeamUpgradeOptions {
+    company?: string;
+    companyUid?: string;
+    noBrowser?: boolean;
+    /** Testable override for environments where browser availability is known. */
+    headless?: boolean;
+    json?: boolean;
+    openUrl?: (url: string) => Promise<unknown>;
+    write?: (text: string) => void;
+    error?: (text: string) => void;
+}
+/**
+ * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * in its hosted browser page; the CLI never receives card data.
+ */
+export declare function upgradeToTeam(opts?: TeamUpgradeOptions): Promise<string>;
+//# sourceMappingURL=team-upgrade.d.ts.map

package/dist/utils/team-upgrade.js

@@ -0,0 +1,63 @@
+import open from "open";
+import { ensureCognitoToken } from "./cognito-session.js";
+import { getCompanyUid, vaultApiFetch } from "./vault-api.js";
+const CHECKOUT_SUCCESS_URL = "https://hq.computer/billing?checkout=success";
+const CHECKOUT_CANCEL_URL = "https://hq.computer/billing?checkout=cancel";
+function isHeadless() {
+    if (process.env.CI)
+        return true;
+    if (process.platform !== "linux")
+        return false;
+    return !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
+}
+function ownerUpgradeError() {
+    return Object.assign(new Error("Only a company owner can upgrade. Ask a company owner to upgrade."), { expected: true });
+}
+/**
+ * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * in its hosted browser page; the CLI never receives card data.
+ */
+export async function upgradeToTeam(opts = {}) {
+    const token = await ensureCognitoToken();
+    const companyUid = opts.companyUid ?? await getCompanyUid(token, opts.company);
+    const response = await vaultApiFetch({
+        token,
+        path: "/v1/billing/checkout/team",
+        method: "POST",
+        body: {
+            companyUid,
+            successUrl: CHECKOUT_SUCCESS_URL,
+            cancelUrl: CHECKOUT_CANCEL_URL,
+        },
+    });
+    if (!response.ok) {
+        const body = (await response.json().catch(() => ({})));
+        if (response.status === 403 || /owner/i.test(`${body.error ?? ""} ${body.message ?? ""}`)) {
+            throw ownerUpgradeError();
+        }
+        throw Object.assign(new Error(`Could not start HQ Team checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
+    }
+    const { url } = (await response.json());
+    if (typeof url !== "string" || !url) {
+        throw new Error("Checkout response did not include a hosted checkout URL.");
+    }
+    const write = opts.write ?? ((text) => process.stdout.write(text));
+    if (opts.json) {
+        write(`${JSON.stringify({ url })}\n`);
+        return url;
+    }
+    write("Opening HQ Team checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
+    const skipBrowser = opts.noBrowser || (opts.headless ?? isHeadless());
+    if (skipBrowser) {
+        write(`Open this URL to continue: ${url}\n`);
+        return url;
+    }
+    try {
+        await (opts.openUrl ?? open)(url);
+    }
+    catch (err) {
+        (opts.error ?? ((text) => process.stderr.write(text)))(`Couldn't launch your browser (${err instanceof Error ? err.message : String(err)}). Open this URL to continue: ${url}\n`);
+    }
+    return url;
+}
+//# sourceMappingURL=team-upgrade.js.map

package/dist/utils/vault-api.js

@@ -187,7 +187,13 @@ export async function vaultApiFetch(opts) {
         // A plan gate is a normal, user-actionable denial. Decode it at the one
         // shared HTTP seam so every resource-creation command reaches main.ts's
         // friendly renderer without duplicating response parsing or retrying.
-        const planGate = await planGateErrorFromResponse(response);
+        // The failed request usually already carries the target company in its
+        // body or path. Preserve it on the typed gate so an interactive checkout
+        // upgrades the same company without asking a multi-company caller again.
+        const companyUid = typeof opts.body?.companyUid === "string"
+            ? opts.body.companyUid
+            : /\/(cmp_[^/?]+)/.exec(opts.path)?.[1];
+        const planGate = await planGateErrorFromResponse(response, companyUid);
         if (planGate.error)
             throw planGate.error;
         return planGate.response;

package/dist/utils/version-gate.d.ts

@@ -29,7 +29,7 @@
  */
 import { buildSpawnPlan, quoteForWindowsShell } from "./windows-spawn.js";
 /** Which package manager owns the running global install. */
-export type InstallManager = "npm" | "pnpm";
+export type InstallManager = "npm" | "pnpm" | "bun";
 export interface VersionCheckResponse {
     clientId: string;
     currentVersion: string;
@@ -67,13 +67,15 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
 export declare function isPnpmManagedPackageDir(pkgDir: string): boolean;
+/** Whether the running package lives inside Bun's global install tree. */
+export declare function isBunManagedPackageDir(pkgDir: string): boolean;
 /**
  * Where the running CLI is installed and who owns it. Resolved in ONE pass so
  * the package-root walk (which reads and parses a `package.json` per directory
  * level) happens once per invocation, and so the manager and the prefix can
  * never disagree because the filesystem shifted between two separate walks.
  *
- * `prefix` is `null` for a pnpm-managed install even though a prefix-shaped
+ * `prefix` is `null` for pnpm- and Bun-managed installs even though a prefix-shaped
  * string *can* be derived from those paths: `npmPrefixFromPackageDir` would
  * happily hand back the pnpm store directory, and `npm install -g --prefix
  * <store>` then unpacks a fresh copy into `<store>/lib/node_modules`, which
@@ -101,6 +103,8 @@ export declare function buildPrefixedInstallArgv(prefix: string): string[];
  * the new version — which is the whole point of routing here instead of npm.
  */
 export declare function buildPnpmInstallArgv(): string[];
+/** Argv for updating a Bun-managed global install. */
+export declare function buildBunInstallArgv(): string[];
 /**
  * Filesystem surface used by {@link cleanStalePartialInstall}. Injected so the
  * cleanup logic is unit-testable without touching a real global prefix.
@@ -209,11 +213,13 @@ export declare const __test__: {
     CLIENT_ID: string;
     ENDPOINT_PATH: string;
     FETCH_TIMEOUT_MS: number;
+    buildBunInstallArgv: typeof buildBunInstallArgv;
     buildPnpmInstallArgv: typeof buildPnpmInstallArgv;
     buildPrefixedInstallArgv: typeof buildPrefixedInstallArgv;
     buildSpawnPlan: typeof buildSpawnPlan;
     cleanStalePartialInstall: typeof cleanStalePartialInstall;
     enforceUpdateRequired: typeof enforceUpdateRequired;
+    isBunManagedPackageDir: typeof isBunManagedPackageDir;
     isPnpmManagedPackageDir: typeof isPnpmManagedPackageDir;
     npmPrefixFromPackageDir: typeof npmPrefixFromPackageDir;
     nudgeUpdateRecommended: typeof nudgeUpdateRecommended;

package/dist/utils/version-gate.js

@@ -125,6 +125,19 @@ export function isPnpmManagedPackageDir(pkgDir) {
     }
     return false;
 }
+/** Whether the running package lives inside Bun's global install tree. */
+export function isBunManagedPackageDir(pkgDir) {
+    const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
+    const segments = normalized.split("/").filter(Boolean);
+    for (let i = 0; i < segments.length - 2; i += 1) {
+        if (segments[i] === "install" &&
+            segments[i + 1] === "global" &&
+            segments[i + 2] === "node_modules") {
+            return true;
+        }
+    }
+    return false;
+}
 export function resolveRunningInstall() {
     try {
         const packageRoot = findRunningPackageRoot();
@@ -133,6 +146,9 @@ export function resolveRunningInstall() {
         if (isPnpmManagedPackageDir(packageRoot)) {
             return { manager: "pnpm", prefix: null, packageRoot };
         }
+        if (isBunManagedPackageDir(packageRoot)) {
+            return { manager: "bun", prefix: null, packageRoot };
+        }
         return {
             manager: "npm",
             prefix: npmPrefixFromPackageDir(packageRoot),
@@ -162,6 +178,10 @@ export function buildPrefixedInstallArgv(prefix) {
 export function buildPnpmInstallArgv() {
     return ["add", "-g", LATEST_PACKAGE_SPEC];
 }
+/** Argv for updating a Bun-managed global install. */
+export function buildBunInstallArgv() {
+    return ["add", "-g", LATEST_PACKAGE_SPEC];
+}
 const nodeStaleInstallFs = {
     readdirSync: (dir) => readdirSync(dir),
     existsSync,
@@ -338,6 +358,8 @@ function performUpdate(command, runner = runUpdateCommand) {
 function manualUpdateCommand(install, decision) {
     if (install.manager === "pnpm")
         return `pnpm ${buildPnpmInstallArgv().join(" ")}`;
+    if (install.manager === "bun")
+        return `bun ${buildBunInstallArgv().join(" ")}`;
     if (install.prefix)
         return `npm ${buildPrefixedInstallArgv(install.prefix).join(" ")}`;
     return decision.updateCommand;
@@ -360,7 +382,9 @@ function nudgeUpdateRecommended(decision, install = resolveRunningInstall()) {
     console.error(msg);
     const command = install.manager === "pnpm"
         ? `pnpm ${buildPnpmInstallArgv().join(" ")}`
-        : decision.updateCommand;
+        : install.manager === "bun"
+            ? `bun ${buildBunInstallArgv().join(" ")}`
+            : decision.updateCommand;
     if (command) {
         console.error(chalk.dim(`  Update: ${command}`));
     }
@@ -382,13 +406,14 @@ function enforceUpdateRequired(decision, deps = {}) {
         console.error(chalk.dim(`  ${decision.message}`));
     const command = decision.updateCommand;
     // ONE package-root walk decides both the manager and the prefix. A
-    // pnpm-managed install must be updated by pnpm; the server's `updateCommand`
-    // and any npm prefix are both wrong for that layout, so `resolveRunningInstall`
+    // A pnpm- or Bun-managed install must be updated by its owning manager; the
+    // server's `updateCommand` and any npm prefix are wrong for those layouts, so
+    // `resolveRunningInstall`
     // already reports `prefix: null` there and neither is consulted below.
     const install = (deps.resolveInstall ?? resolveRunningInstall)();
-    const isPnpm = install.manager === "pnpm";
+    const isManagedOutsideNpm = install.manager !== "npm";
     const prefix = install.prefix;
-    if (!isPnpm && !command && !prefix) {
+    if (!isManagedOutsideNpm && !command && !prefix) {
         console.error(chalk.red("  No updateCommand provided by hq-pro — see https://hq.indigo.ai/docs/cli-update for manual steps."));
         if (decision.downloadUrl) {
             console.error(chalk.dim(`  Download: ${decision.downloadUrl}`));
@@ -400,10 +425,14 @@ function enforceUpdateRequired(decision, deps = {}) {
     // the EXACT same command under elevation.
     let primaryCmd;
     let primaryArgs;
-    if (isPnpm) {
+    if (install.manager === "pnpm") {
         primaryCmd = "pnpm";
         primaryArgs = buildPnpmInstallArgv();
     }
+    else if (install.manager === "bun") {
+        primaryCmd = "bun";
+        primaryArgs = buildBunInstallArgv();
+    }
     else if (prefix) {
         primaryCmd = "npm";
         primaryArgs = buildPrefixedInstallArgv(prefix);
@@ -414,10 +443,10 @@ function enforceUpdateRequired(decision, deps = {}) {
         primaryArgs = parts.slice(1);
     }
     let result;
-    if (isPnpm) {
-        console.error(chalk.dim("  Detected a pnpm-managed global install; updating with pnpm"));
-        console.error(chalk.dim(`  Running: pnpm ${primaryArgs.join(" ")}`));
-        result = performUpdateCommand("pnpm", primaryArgs, runner);
+    if (isManagedOutsideNpm) {
+        console.error(chalk.dim(`  Detected a ${install.manager}-managed global install; updating with ${install.manager}`));
+        console.error(chalk.dim(`  Running: ${primaryCmd} ${primaryArgs.join(" ")}`));
+        result = performUpdateCommand(primaryCmd, primaryArgs, runner);
     }
     else if (prefix) {
         console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
@@ -455,10 +484,10 @@ function enforceUpdateRequired(decision, deps = {}) {
     // through to the manual path unchanged, while headless boxes with passwordless
     // sudo self-update cleanly.
     //
-    // Never for pnpm: `sudo -n pnpm add -g` installs into ROOT's PNPM_HOME, which
-    // leaves the user's shim untouched while reporting success — the same silent
-    // no-op this fix exists to remove. A failed pnpm update must surface instead.
-    if (!result.ok && primaryCmd && !isPnpm) {
+    // Never for pnpm or Bun: elevation changes the package manager's global home,
+    // leaving the user's shim untouched while reporting success. A failed
+    // non-npm update must surface instead.
+    if (!result.ok && primaryCmd && !isManagedOutsideNpm) {
         console.error(chalk.dim(`  Update failed unprivileged; retrying with: sudo -n ${primaryCmd} ${primaryArgs.join(" ")}`));
         const sudoResult = performUpdateCommand("sudo", ["-n", primaryCmd, ...primaryArgs], runner);
         if (sudoResult.ok)
@@ -476,9 +505,9 @@ function enforceUpdateRequired(decision, deps = {}) {
         const manual = manualUpdateCommand(install, decision) ?? command;
         console.error(chalk.dim(`  Try manually: ${manual}`));
         // Only informational, and only when we could not run the right manager at
-        // all: hq-pro's command is npm-shaped, so following it on a pnpm layout is
-        // what produced the stale-shim loop in the first place.
-        if (isPnpm && result.code === "ENOENT" && command) {
+        // all: hq-pro's command is npm-shaped, so following it on a pnpm or Bun
+        // layout would update a different copy and leave the running shim stale.
+        if (isManagedOutsideNpm && result.code === "ENOENT" && command) {
             console.error(chalk.dim(`  (hq-pro suggests \`${command}\` — that is for npm-managed installs; use it only if you have switched this install to npm.)`));
         }
         process.exit(75);
@@ -524,11 +553,13 @@ export const __test__ = {
     CLIENT_ID,
     ENDPOINT_PATH,
     FETCH_TIMEOUT_MS,
+    buildBunInstallArgv,
     buildPnpmInstallArgv,
     buildPrefixedInstallArgv,
     buildSpawnPlan,
     cleanStalePartialInstall,
     enforceUpdateRequired,
+    isBunManagedPackageDir,
     isPnpmManagedPackageDir,
     npmPrefixFromPackageDir,
     nudgeUpdateRecommended,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.101.1",
+  "version": "5.101.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {