@indigoai-us/hq-cli 5.103.7 → 5.103.8

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [5.103.8] — 2026-08-19
+
+### Fixed
+
+- The checkpoint stop-gate can no longer re-prompt a session forever. When the
+  checkpoint command keeps failing (e.g. a broken or mid-self-update `hq`
+  binary), the gate now fails open after 3 consecutive blocks per session and
+  re-arms once a checkpoint succeeds — a broken CLI cannot loop a session
+  indefinitely.
+- A failed startup self-update now points at `hq rescue` in addition to the
+  manual manager command. A corrupt install layout fails the manual retry the
+  same way; rescue is the path that can actually rebuild the install.
+
 ## [5.103.7] — 2026-08-19
 
 ### Fixed

package/assets/scaffold/core/scripts/checkpoint-stop-gate.sh

@@ -322,9 +322,31 @@ set -uo pipefail
     if [ "$runtime" = "codex" ]; then
       rm -f "$state_dir/codex-checkpoint-reprompt-$session_key" 2>/dev/null || true
     fi
+    rm -f "$state_dir/checkpoint-block-count-$session_key" 2>/dev/null || true
     exit 0
   fi
 
+  # Loop guard: a session whose checkpoint command keeps FAILING (a broken or
+  # mid-self-update `hq` binary) would otherwise be re-prompted on every Stop,
+  # forever — block → retry checkpoint → error → block again. Cap consecutive
+  # blocks per session; past the cap, fail open per this file's
+  # never-strand-a-session doctrine. Any successful checkpoint or idle turn
+  # resets the counter above.
+  block_count_file="$state_dir/checkpoint-block-count-$session_key"
+  block_count="$(tr -d '\r\n' <"$block_count_file" 2>/dev/null || true)"
+  case "$block_count" in
+    ''|*[!0-9]*) block_count=0 ;;
+  esac
+  if [ "$block_count" -ge 3 ]; then
+    exit 0
+  fi
+  block_count_tmp="$block_count_file.$$"
+  if (umask 077 && printf '%s' "$((block_count + 1))" >"$block_count_tmp" && mv -f "$block_count_tmp" "$block_count_file"); then
+    :
+  else
+    rm -f "$block_count_tmp" 2>/dev/null || true
+  fi
+
   # Built with printf rather than concatenation so the session id can appear in
   # both commands without re-splitting the message into fragments.
   reason="$(printf 'This turn changed something, so it needs an end-of-turn checkpoint. Two different audiences are involved — do not conflate them:\n\n1. THE USER reads your normal chat reply. If you owe them anything — a result, a link, an answer, a status — say it in the reply as usual. The checkpoint is invisible to them and is NOT a message to them; running it does not count as having replied.\n2. THE SIBLING (a background maintenance agent) reads the checkpoint payload. It never sees your chat reply, so anything it needs must go into the flags.\n\nORDER (this app folds any text that precedes a tool call into a collapsed sub-message — only text AFTER the last tool call renders in full): run the checkpoint FIRST, then deliver your COMPLETE user-facing reply as the final text of the turn. Every link, URL, instruction, command, and decision the user needs MUST appear in that final post-checkpoint message, restated in full even if you already wrote it earlier in the turn — earlier text is collapsed and the user will not see it.\n\n  hq core checkpoint --session-id %s --trigger stop-gate --summary "<what changed, in one line>" [--file <path>] [--decision "<choice and why>"] [--learning "<reusable rule>"] [--next "<outstanding step>"]\n\nOnly --summary is required, and the repeatable flags are what the sibling uses to enrich the record, distil policies and update the indexes — a bare summary gives it almost nothing to work with. Write them as machine record, not prose for the user, and pass each one that genuinely applies:\n  --file      every path you created or modified this turn\n  --decision  a choice you made that a reader would otherwise have to reverse-engineer\n  --learning  a rule that changes how someone acts next time, not a restatement of what just happened\n  --next      work that is genuinely still outstanding\nOmit a flag rather than padding it: an empty or invented learning is worse than none.\n\nIf this turn only read or inspected things and changed no state, the correct call instead is:\n\n  hq core checkpoint --session-id %s --idle' "$session_id" "$session_id")"

package/dist/utils/self-update.js

@@ -288,6 +288,14 @@ async function updateAndReexec(argv, flavor, known, deps) {
         console.error(chalk.yellow(`⚠ hq-cli ${latest} is available but the update failed` +
             `${result.detail ? `: ${result.detail}` : ""}`));
         console.error(chalk.dim(`  Try manually: ${plan.cmd} ${plan.args.join(" ")}`));
+        // A manager-level failure often means the install layout itself is broken
+        // (e.g. a hand-rolled pnpm store nested inside the app's bin dir). The
+        // manual retry above hits the same layout and fails the same way; point at
+        // the recovery path that can actually rebuild the install — except from the
+        // rescue itself, which would just recurse.
+        if (flavor.noun !== "rescue") {
+            console.error(chalk.dim(`  Or repair the install: hq rescue`));
+        }
         console.error(chalk.dim(`  Continuing the ${flavor.noun} on ${current}.`));
         return { action: "update-failed", latest };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.103.7",
+  "version": "5.103.8",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {