@indigoai-us/hq-cli 5.108.13 → 5.108.14

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.108.14] — 2026-09-07
+
+### Fixed
+
+- An incomplete hq install tree no longer files an unactionable crash when hq
+  fails to load one of its OWN bundled modules in-process (HQ-CLI-1M, HQ-CLI-1N).
+  Two shapes shared one cause — hq-cli's globally installed package tree was not
+  intact at the moment a command loaded a module. In HQ-CLI-1N (`hq core
+  timeout-guard` on Windows) a partial `npm i -g` left a RELATIVE sibling
+  unwritten deep inside a bundled dependency, so Node threw
+  `MODULE_NOT_FOUND`. In HQ-CLI-1M (`hq rescue` on Linux) a concurrent global
+  install rewrote the running tree, so an ESM module that existed at resolve was
+  gone at read and Node's loader raised `ENOENT` — the loader validates
+  existence at resolve, so an ENOENT at LOAD proves the file vanished mid-run
+  rather than being merely absent. Both carried no hq-cli frames, reached the
+  top-level handler's final `else`, and produced a bare Sentry crash plus an
+  `hq:` line the operator could not act on. A new in-process classifier now
+  recognises both shapes — but ONLY when the failing file sits under the running
+  install's own `node_modules/`, the CJS shape additionally requires a relative
+  specifier, and the ESM shape additionally requires an esm-loader frame — and
+  prints an input-free reinstall remedy (run the command again first, then
+  `npm i -g @indigoai-us/hq-cli` / `pnpm add -g @indigoai-us/hq-cli`) while
+  skipping Sentry capture, the same disposition established for the qmd child in
+  HQ-CLI-Y. An hq-cli packaging fault stays reportable: a miss under the
+  package's own `dist/` or `assets/`, a bare-specifier miss (a possible
+  undeclared dependency), and an esm-loader ENOENT whose path did not survive
+  delivery are NOT suppressed — the last is captured WITH a bounded
+  `incomplete_install` context so the next occurrence is attributable. The drop
+  is wired both at the top-level boundary and in the shared `beforeSend`, so it
+  covers every capture route.
+
 ## [5.108.13] — 2026-09-06
 
 ## [5.108.12] - 2026-09-05

package/dist/commands/agents.d.ts

@@ -110,9 +110,20 @@ export interface ProfilePatch {
     description?: string;
 }
 export interface RuntimeConfigPatch {
+    /**
+     * Brain/runtime provider. When present the server routes the PATCH to a
+     * PROVIDER MIGRATION (handleProviderMigration): it TERMINATES and reprovisions
+     * the box and changes the provider/auth contract. Omit for a plain tuning
+     * patch (model / effort / tier).
+     */
+    provider?: string;
     codexModel?: string;
     codexReasoningEffort?: string;
     codexServiceTier?: string;
+    /** Provider-migration auth mode: "subscription" | "apiKey". */
+    codexAuthMode?: string;
+    /** Provider-migration apiKey-mode vault key reference (never a raw secret). */
+    codexApiKeyRef?: string;
 }
 /**
  * Authenticated JSON round-trip against the agents control plane. Throws
@@ -143,7 +154,12 @@ export interface ProvisionAgentInput {
     /** Server quote assertion; hq-pro re-prices and refuses a stale amount. */
     quotedNetMonthlyCents?: number;
     quoteCatalogVersion?: string;
+    /** Funnel attribution: which client surface made the attempt. */
+    surface?: AgentCreateSurface;
 }
+/** Closed set shared with hq-pro's agent_create_* funnel contract. */
+export declare const CLI_AGENT_CREATE_SURFACE: "cli_agents_create";
+export type AgentCreateSurface = typeof CLI_AGENT_CREATE_SURFACE;
 export interface AgentCreateSizeOption {
     key: "basic" | "power" | "dev";
     productName: string;

package/dist/commands/agents.js

@@ -146,6 +146,8 @@ export function slugifyAgentName(name) {
         .replace(/[^a-z0-9]+/g, "-")
         .replace(/^-+|-+$/g, "");
 }
+/** Closed set shared with hq-pro's agent_create_* funnel contract. */
+export const CLI_AGENT_CREATE_SURFACE = "cli_agents_create";
 /** Read hq-pro's company-specific creation prices and capacities. */
 export async function getAgentCreateOptions(token, companyUid, idempotencyKey) {
     const raw = await agentsRequest({
@@ -153,7 +155,9 @@ export async function getAgentCreateOptions(token, companyUid, idempotencyKey) {
         path: "/v1/agents/provision-options",
         query: {
             companyUid,
-            ...(idempotencyKey ? { idempotencyKey } : {}),
+            ...(idempotencyKey
+                ? { idempotencyKey, surface: CLI_AGENT_CREATE_SURFACE }
+                : {}),
         },
     });
     if (!raw || typeof raw !== "object") {
@@ -842,6 +846,7 @@ export function registerAgentsCommand(program) {
                         : { desiredInstanceType: quotedSize.instanceType }),
                     quotedNetMonthlyCents: quotedSize.netMonthlyCents,
                     quoteCatalogVersion: createOptions.catalogVersion,
+                    surface: CLI_AGENT_CREATE_SURFACE,
                 });
                 const uid = typeof result.uid === "string" ? result.uid : slug;
                 console.log(chalk.green(`Provisioning started for agent "${name}".`));
@@ -999,15 +1004,54 @@ export function registerAgentsCommand(program) {
     });
     agents
         .command("config <agentUid>")
-        .description("Update an agent's runtime config (model / reasoning effort / service tier)")
+        .description("Update an agent's runtime config (model / reasoning effort / service tier), or migrate its brain/runtime provider with --provider (DESTRUCTIVE: terminates + reprovisions the box)")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--model <model>", "Codex model id")
         .option("--effort <effort>", "Reasoning effort: minimal | low | medium | high | xhigh")
         .option("--tier <tier>", "Service tier (speed): default | priority")
+        .option("--provider <provider>", "Migrate brain/runtime provider (codex | grok | claude | agents-v2). DESTRUCTIVE: terminates and reprovisions the box; requires --model and --yes.")
+        .option("--auth-mode <mode>", "Provider-migration auth mode: subscription | apiKey (default: keep current)")
+        .option("--api-key-ref <ref>", "Provider-migration apiKey-mode vault key reference (never a raw key)")
+        .option("--yes", "Confirm a destructive provider migration (required with --provider)")
         .option("--json", "Emit raw JSON")
         .action(async function (agentUid, opts) {
         try {
             const patch = {};
+            if (opts.provider !== undefined) {
+                // A `provider` field routes the server to handleProviderMigration,
+                // which TERMINATES and reprovisions the box. Guard it: valid provider,
+                // an explicit target --model (the server requires it), and --yes.
+                // Reuses the module-level VALID_PROVIDERS (shared with `provision`).
+                const provider = opts.provider.trim().toLowerCase();
+                if (!VALID_PROVIDERS.has(provider)) {
+                    console.error(chalk.red(`Invalid --provider '${opts.provider}': must be one of codex, grok, claude, agents-v2`));
+                    process.exit(1);
+                }
+                if (opts.model === undefined) {
+                    console.error(chalk.red("A provider migration requires --model (the target brain's model id)."));
+                    process.exit(1);
+                }
+                if (!opts.yes) {
+                    console.error(chalk.red(`Refusing to migrate agent ${agentUid} to provider '${provider}' without --yes.\n` +
+                        "This TERMINATES and reprovisions the box (irreversible) and changes the auth contract.\n" +
+                        "Re-run with --yes once you have confirmed the exact agent, company, and model."));
+                    process.exit(1);
+                }
+                if (provider !== "agents-v2") {
+                    // v1 RESIDENT runtime guard: codex|grok|claude migrate the agent OFF
+                    // agents-v2 onto the legacy resident runtime. Fleet boxes run
+                    // agents-v2 (brain derived from the model), so this is almost always
+                    // a mistake — warn loudly but proceed (the operator passed --yes).
+                    console.warn(chalk.yellow(`Warning: --provider ${provider} targets the V1 RESIDENT runtime, not agents-v2.\n` +
+                        "Fleet boxes run agents-v2. To keep this agent on the v2 runtime with a\n" +
+                        `${provider} brain, use: --provider agents-v2 --model <${provider} model id>`));
+                }
+                patch.provider = provider;
+                if (opts.authMode !== undefined)
+                    patch.codexAuthMode = opts.authMode;
+                if (opts.apiKeyRef !== undefined)
+                    patch.codexApiKeyRef = opts.apiKeyRef;
+            }
             if (opts.model !== undefined)
                 patch.codexModel = opts.model;
             if (opts.effort !== undefined) {

package/dist/main.js

@@ -23,6 +23,7 @@ import { qmdQueryDocumentMessage } from "./utils/qmd-query-document-error.js";
 import { qmdModelDownloadMessage } from "./utils/qmd-model-download-error.js";
 import { qmdWorkdirMissingMessage } from "./utils/qmd-workdir-missing-error.js";
 import { hqStateWriteErrorMessage } from "./utils/hq-state-write-error.js";
+import { incompleteInstallMessage, incompleteInstallCaptureContext, } from "./utils/incomplete-install-error.js";
 import { isExpectedUserError } from "./utils/expected-cli-error.js";
 import { isVarlockEnvError } from "./run/env-graph-guard.js";
 import { isEpipe } from "./utils/epipe.js";
@@ -515,7 +516,28 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         const stateWriteMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg
             ? null
             : hqStateWriteErrorMessage(err);
-        const envMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg || stateWriteMsg
+        // An IN-PROCESS module-load failure that means hq-cli's OWN installed
+        // package tree is incomplete at load time — a partial/interrupted global
+        // install left a bundled file unwritten (HQ-CLI-1N, a CJS relative-sibling
+        // MODULE_NOT_FOUND), or a concurrent global install rewrote the running
+        // tree so an ESM module present at resolve was gone at read (HQ-CLI-1M, an
+        // esm-loader ENOENT). Both carry no hq-cli frames and reached the final
+        // else, filing a bare crash and an unactionable line. An incomplete
+        // install is the caller's machine, the disposition HQ-CLI-Y already
+        // established for the qmd CHILD — print the input-free reinstall remedy and
+        // skip capture. Placed with the environmental family (after the typed qmd
+        // carriers and the hq state-write carrier, before environmentalFsErrorMessage):
+        // the signatures are disjoint — ENVIRONMENTAL_FS_CODES is only
+        // ENOSPC/EDQUOT/EROFS (never ENOENT/MODULE_NOT_FOUND), no qmd carrier sets
+        // requireStack or an esm-loader frame, and the classified file must sit
+        // under <packageRoot>/node_modules — so ordering changes nothing that
+        // exists. The UNATTRIBUTABLE shape (an esm-loader ENOENT whose path did not
+        // survive) is deliberately NOT suppressed; it is captured WITH bounded
+        // context on the generic path below.
+        const incompleteInstallMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg || stateWriteMsg
+            ? null
+            : incompleteInstallMessage(err);
+        const envMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg || stateWriteMsg || incompleteInstallMsg
             ? null
             : environmentalFsErrorMessage(err);
         // A LOCAL sync-state lock failure (@indigoai-us/hq-cloud's
@@ -532,7 +554,7 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         // environmental-fs check, before network-transport — is pinned by tests.
         // The `in-process-async-holder` reason is deliberately NOT suppressed here
         // (see sync-state-lock-error.ts); it stays captured.
-        const lockMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg || stateWriteMsg || envMsg
+        const lockMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg || stateWriteMsg || incompleteInstallMsg || envMsg
             ? null
             : syncStateLockMessage(err);
         // A raw network transport failure (undici's `TypeError: fetch failed`
@@ -556,6 +578,7 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
             modelDownloadMsg ||
             workdirMissingMsg ||
             stateWriteMsg ||
+            incompleteInstallMsg ||
             envMsg ||
             lockMsg
             ? null
@@ -593,6 +616,9 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         else if (stateWriteMsg) {
             deps.stderr.write(`hq: ${stateWriteMsg}\n`);
         }
+        else if (incompleteInstallMsg) {
+            deps.stderr.write(`hq: ${incompleteInstallMsg}\n`);
+        }
         else if (envMsg) {
             deps.stderr.write(`hq: ${envMsg}\n`);
         }
@@ -603,13 +629,18 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
             deps.stderr.write(`hq: ${transportMsg}\n`);
         }
         else {
-            // A genuinely unclassified fault is still captured exactly once. When it
-            // is a qmd spawn-level failure the fix could not attribute, attach the
-            // bounded existence context so the next occurrence carries the evidence
-            // the reported HQ-CLI-1A event lacked; every other error captures bare.
+            // A genuinely unclassified fault is still captured exactly once. Two
+            // shapes attach bounded, hq-derived context so the next occurrence
+            // carries the evidence this one lacked: a qmd spawn-level failure the fix
+            // could not attribute (HQ-CLI-1A), and an esm-loader ENOENT whose path
+            // did not survive delivery (HQ-CLI-1M — the unattributable incomplete-
+            // install shape). Every other error captures bare, exactly as before.
             const spawnContext = qmdSpawnFailureCaptureContext(err);
-            if (spawnContext) {
-                deps.sentry.captureException(err, spawnContext);
+            const installContext = incompleteInstallCaptureContext(err);
+            if (spawnContext || installContext) {
+                deps.sentry.captureException(err, {
+                    contexts: { ...spawnContext?.contexts, ...installContext },
+                });
             }
             else {
                 deps.sentry.captureException(err);

package/dist/sentry.js

@@ -6,6 +6,7 @@ import { CLI_VERSION } from "./cli-version.js";
 import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
+import { incompleteInstallMessage } from "./utils/incomplete-install-error.js";
 import { sentryFingerprintFor } from "./utils/sentry-fingerprint.js";
 /**
  * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
@@ -31,6 +32,20 @@ export function epipeAwareBeforeSend(event, hint) {
     // route, while the CLI still exits non-zero. HQ-CLI-R (Sentry 7671416365).
     if (environmentalFsErrorMessage(hint?.originalException))
         return null;
+    // Path-independent belt for an IN-PROCESS incomplete-install module-load
+    // failure — hq-cli's own globally installed tree is not intact at load time
+    // (HQ-CLI-1N, a CJS relative-sibling MODULE_NOT_FOUND under its bundled
+    // node_modules; HQ-CLI-1M, an esm-loader ENOENT for a file present at resolve
+    // and gone at read). handleTopLevelError already prints the reinstall remedy
+    // for the top-level route; dropping the event here suppresses the fatal
+    // regardless of route — the unhandled-rejection boundary, the command-level
+    // captureException sites, and bin/hq-auth-refresh — mirroring the EPIPE and
+    // environmental-fs drops above. The classifier reads only structured fields
+    // and the failing file must sit under the running install's node_modules, so
+    // an hq-cli packaging fault (a dist/ miss, a bare-specifier miss) and the
+    // path-less unattributable shape are NOT dropped here and stay captured.
+    if (incompleteInstallMessage(hint?.originalException))
+        return null;
     // Group an event that survives to send by a BOUNDED machine discriminator so
     // unrelated gateway/HTTP failures stop colliding into one fungible issue
     // (HQ-CLI collision, Sentry 7642756130). Placed here — path-independent,

package/dist/utils/incomplete-install-error.d.ts

@@ -0,0 +1,50 @@
+import * as fs from "fs";
+/**
+ * The actionable remedy shown to the operator. Input-free — nothing from the
+ * error, the argv, or the filesystem is interpolated — so there is no injection
+ * surface and no way to inflate Sentry grouping, matching the bounded-remedy
+ * discipline of every sibling classifier. Covers BOTH sub-cases in the order a
+ * user should try them: re-run first (an install that finished mid-run leaves
+ * the next invocation healthy), then reinstall if it persists.
+ */
+export declare const INCOMPLETE_INSTALL_REMEDY: string;
+/** A resolver for the running install's root; returns null instead of throwing. */
+export type PackageRootResolver = () => string | null;
+/**
+ * If `err` is an in-process incomplete-install module-load failure — either the
+ * CJS relative-sibling shape (HQ-CLI-1N) or the ESM vanished-file shape
+ * (HQ-CLI-1M), with the failing file confirmed under `<packageRoot>/node_modules/`
+ * — return the actionable, input-free reinstall remedy; otherwise return null.
+ *
+ * Mirrors qmdModuleMissingMessage so the top-level handler and beforeSend branch
+ * the same way: a non-null result means print-the-remedy-and-skip-Sentry, null
+ * means "handle as usual (capture to Sentry)". Never throws — a resolver that
+ * fails yields null.
+ */
+export declare function incompleteInstallMessage(err: unknown, resolvePackageRoot?: PackageRootResolver): string | null;
+/** Bounded, scrubber-safe diagnostics for an unattributable esm-loader ENOENT. */
+export type IncompleteInstallDiagnostics = {
+    packageRoot: string;
+    packageJsonExists: boolean;
+    nodeModulesExists: boolean;
+    esmLoaderFrame: boolean;
+    code: string;
+};
+/**
+ * When an esm-loader ENOENT reaches the capture path WITHOUT being suppressed —
+ * the exact shape the delivered HQ-CLI-1M payload arrived in, where neither the
+ * exception value nor node_system_error carried a `path` — return a bounded
+ * `contexts.incomplete_install` block so the next occurrence carries the
+ * evidence this one lacked; otherwise return undefined (bare capture). Built
+ * with the byte-capped, scrubber-safe discipline of package-root-diagnostics.ts:
+ * the resolved package root and whether its package.json / node_modules exist,
+ * the loader-frame marker, and the bounded errno code — never a caller argv,
+ * query, or user-minted value. Never throws.
+ *
+ * main.ts attaches this on the generic capture path exactly as
+ * qmdSpawnFailureCaptureContext already does.
+ */
+export declare function incompleteInstallCaptureContext(err: unknown, resolvePackageRoot?: PackageRootResolver, fileSystem?: Pick<typeof fs, "existsSync">): {
+    incomplete_install: IncompleteInstallDiagnostics;
+} | undefined;
+//# sourceMappingURL=incomplete-install-error.d.ts.map

package/dist/utils/incomplete-install-error.js

@@ -0,0 +1,250 @@
+// src/utils/incomplete-install-error.ts
+//
+// Classify an IN-PROCESS module-load failure that means hq-cli's OWN globally
+// installed package tree is not intact at the moment it loads a module — the
+// caller's incomplete install, not an hq-cli code defect. Sibling in spirit to
+// qmd-module-missing-error.ts (HQ-CLI-Y), but keyed on the ERROR OBJECT of a
+// failure inside THIS process rather than a qmd child's captured stderr, which
+// is the gap HQ-CLI-Y's classifier cannot cover.
+//
+// Two shapes, one cause — a partial/interrupted global install left a file
+// unwritten, or a concurrent global install rewrote the running tree
+// underneath a command:
+//
+//   HQ-CLI-1N (Sentry 7714890525) — CJS, in-process. `hq core timeout-guard`
+//   loads the mesh presence client, whose `import mqtt` pulls a chain that ends
+//   at js-sdsl requiring a RELATIVE sibling (`./Base/TreeIterator`) that is
+//   absent on disk inside hq-cli's own bundled node_modules. Node throws
+//   `Error{ code: 'MODULE_NOT_FOUND', requireStack: [...] }`. A relative
+//   specifier internal to a third-party package can only be a truncated on-disk
+//   copy, never an hq-cli manifest defect.
+//
+//   HQ-CLI-1M (Sentry 7714870912) — ESM load, in-process. A module that existed
+//   at RESOLVE was gone at READ (a concurrent writer rewrote the install tree),
+//   so Node's ESM loader raised `ENOENT` from getSourceSync/readFileSync/openSync
+//   with an `esm/…` loader frame in the stack. A merely-absent ESM module raises
+//   ERR_MODULE_NOT_FOUND at resolve, never ENOENT at load; an ENOENT at load
+//   proves the file vanished between resolve and read.
+//
+// Both shapes carry no hq-cli frames, reach the boundary's final `else`, and —
+// before this classifier — filed a bare captureException plus an unactionable
+// `hq: <fallback>` line. The disposition is the one HQ-CLI-Y already
+// established: an incomplete install is the caller's machine, so the CLI prints
+// an input-free reinstall remedy and skips Sentry capture.
+//
+// The gate is deliberately narrow so neither an hq-cli packaging fault nor
+// user free-text can trip it. Only structured fields are read — `code`,
+// `syscall`, `path`, `requireStack`, and the stack's loader-frame marker, plus
+// the first message line for the CJS specifier. THREE independent narrowings
+// keep a genuine hq-cli defect reportable:
+//   1. The failing file must sit under `<packageRoot>/node_modules/` — a
+//      third-party file hq-cli does not author. A miss under `<packageRoot>/dist`
+//      or `/assets` is hq-cli's OWN shipped output and stays captured.
+//   2. The CJS shape additionally requires a RELATIVE specifier — a
+//      bare-specifier miss (`Cannot find module 'mqtt'`) can be an undeclared
+//      dependency (an hq-cli manifest defect) and stays captured.
+//   3. The ESM shape additionally requires an esm-loader frame — an ordinary
+//      `fs.readFileSync` ENOENT written by hq's own code stays captured.
+import * as fs from "fs";
+import * as path from "path";
+import { packageRoot } from "./hq-roots.js";
+import { boundedDiagnosticValue } from "./package-root-diagnostics.js";
+/**
+ * The actionable remedy shown to the operator. Input-free — nothing from the
+ * error, the argv, or the filesystem is interpolated — so there is no injection
+ * surface and no way to inflate Sentry grouping, matching the bounded-remedy
+ * discipline of every sibling classifier. Covers BOTH sub-cases in the order a
+ * user should try them: re-run first (an install that finished mid-run leaves
+ * the next invocation healthy), then reinstall if it persists.
+ */
+export const INCOMPLETE_INSTALL_REMEDY = "hq couldn't load part of its own installed files, so the hq install tree is " +
+    "incomplete on this machine — most often because a global install (its own " +
+    "self-update, the desktop background installer, another hq process, or a " +
+    "hand-run install) rewrote the package while this command was running, or an " +
+    "earlier install was interrupted before every file was written. Run the " +
+    "command again first: an install that finished mid-run leaves the next " +
+    "invocation healthy. If it keeps failing, reinstall hq — for a global install " +
+    "run `npm i -g @indigoai-us/hq-cli` (or the pnpm equivalent, " +
+    "`pnpm add -g @indigoai-us/hq-cli`).";
+/** A relative module specifier — `./x`, `../x`, `.\x`, `..\x`. */
+const RELATIVE_SPECIFIER = /^\.\.?[\\/]/;
+/** A Node ESM loader frame — proves the ENOENT came from the module loader, not hq's own fs call. */
+const ESM_LOADER_FRAME = /node:internal[\\/]modules[\\/]esm[\\/]/;
+const ROOT_DIAGNOSTIC_BYTES = 256;
+const CODE_DIAGNOSTIC_BYTES = 32;
+/**
+ * packageRoot() walks up from the compiled module and THROWS
+ * PackageRootResolutionError when it cannot resolve. This classifier runs inside
+ * beforeSend on EVERY event, so it must never throw — a resolution failure
+ * returns null and the error stays captured.
+ */
+function safePackageRoot() {
+    try {
+        return packageRoot();
+    }
+    catch {
+        return null;
+    }
+}
+/** Call a (possibly injected) resolver without letting it throw. */
+function resolveRootSafely(resolve) {
+    try {
+        return resolve();
+    }
+    catch {
+        return null;
+    }
+}
+/** Fold `\`/`/` runs to a single `/` and drop any trailing separator. */
+function foldSeparators(p) {
+    return p.replace(/[\\/]+/g, "/").replace(/\/+$/, "");
+}
+/** A Windows-shaped absolute path (drive letter or UNC), regardless of host OS. */
+function looksWin32(p) {
+    return /^[a-zA-Z]:[\\/]/.test(p) || /^\\\\/.test(p);
+}
+/**
+ * Normalise a path for prefix comparison: separators folded, and case folded
+ * ONLY for a Windows-shaped path (drive-letter case and AppData\Roaming casing
+ * drift there, but POSIX paths are case-sensitive and must stay so). Detecting
+ * win32 by the path's SHAPE — not `process.platform` — lets the reported
+ * Windows path classify on a Linux CI runner.
+ */
+function normalizeForCompare(p) {
+    const folded = foldSeparators(p);
+    return looksWin32(p) ? folded.toLowerCase() : folded;
+}
+/**
+ * True when `candidate` lives under `<root>/node_modules/`. Anchored at a true
+ * directory boundary (`<root>` + sep + `node_modules` + sep) so a sibling such
+ * as `<root>-old/node_modules/...` can never match.
+ */
+function isUnderNodeModules(candidate, root) {
+    if (!candidate || !root)
+        return false;
+    const prefix = `${normalizeForCompare(root)}/node_modules/`;
+    return normalizeForCompare(candidate).startsWith(prefix);
+}
+/** The failing specifier from a `Cannot find module '<spec>'` message, or null. */
+function parseMissingSpecifier(message) {
+    if (typeof message !== "string")
+        return null;
+    const match = message.match(/Cannot find module ['"]([^'"]+)['"]/);
+    return match ? match[1] : null;
+}
+/** True when `stack` carries a Node ESM loader frame. */
+function hasEsmLoaderFrame(stack) {
+    return typeof stack === "string" && ESM_LOADER_FRAME.test(stack);
+}
+/**
+ * The ESM-loader ENOENT SIGNATURE, independent of whether a usable `path`
+ * survived: `code === 'ENOENT'`, `syscall === 'open'`, and an esm-loader frame
+ * in the stack. This is the shape the instrumentation fallback attaches context
+ * to; the message classifier additionally requires a `path` under node_modules.
+ */
+function isEsmLoaderEnoent(err) {
+    if (err === null || typeof err !== "object")
+        return false;
+    const record = err;
+    return (record.code === "ENOENT" &&
+        record.syscall === "open" &&
+        hasEsmLoaderFrame(record.stack));
+}
+/**
+ * If `err` is an in-process incomplete-install module-load failure — either the
+ * CJS relative-sibling shape (HQ-CLI-1N) or the ESM vanished-file shape
+ * (HQ-CLI-1M), with the failing file confirmed under `<packageRoot>/node_modules/`
+ * — return the actionable, input-free reinstall remedy; otherwise return null.
+ *
+ * Mirrors qmdModuleMissingMessage so the top-level handler and beforeSend branch
+ * the same way: a non-null result means print-the-remedy-and-skip-Sentry, null
+ * means "handle as usual (capture to Sentry)". Never throws — a resolver that
+ * fails yields null.
+ */
+export function incompleteInstallMessage(err, resolvePackageRoot = safePackageRoot) {
+    if (err === null || typeof err !== "object")
+        return null;
+    const record = err;
+    const code = typeof record.code === "string" ? record.code : undefined;
+    if (code !== "MODULE_NOT_FOUND" && code !== "ENOENT")
+        return null;
+    const root = resolveRootSafely(resolvePackageRoot);
+    if (!root)
+        return null;
+    if (code === "MODULE_NOT_FOUND") {
+        // Shape A (CJS, HQ-CLI-1N): a RELATIVE specifier internal to a package under
+        // the running install's node_modules can only be a truncated on-disk copy.
+        const requireStack = record.requireStack;
+        if (!Array.isArray(requireStack) || typeof requireStack[0] !== "string") {
+            return null;
+        }
+        const specifier = parseMissingSpecifier(record.message);
+        if (specifier === null || !RELATIVE_SPECIFIER.test(specifier))
+            return null;
+        return isUnderNodeModules(requireStack[0], root)
+            ? INCOMPLETE_INSTALL_REMEDY
+            : null;
+    }
+    // Shape B (ESM load, HQ-CLI-1M): an ENOENT from the module loader for a file
+    // that was present at resolve and gone at read.
+    if (record.syscall !== "open")
+        return null;
+    if (typeof record.path !== "string")
+        return null;
+    if (!hasEsmLoaderFrame(record.stack))
+        return null;
+    return isUnderNodeModules(record.path, root)
+        ? INCOMPLETE_INSTALL_REMEDY
+        : null;
+}
+/**
+ * When an esm-loader ENOENT reaches the capture path WITHOUT being suppressed —
+ * the exact shape the delivered HQ-CLI-1M payload arrived in, where neither the
+ * exception value nor node_system_error carried a `path` — return a bounded
+ * `contexts.incomplete_install` block so the next occurrence carries the
+ * evidence this one lacked; otherwise return undefined (bare capture). Built
+ * with the byte-capped, scrubber-safe discipline of package-root-diagnostics.ts:
+ * the resolved package root and whether its package.json / node_modules exist,
+ * the loader-frame marker, and the bounded errno code — never a caller argv,
+ * query, or user-minted value. Never throws.
+ *
+ * main.ts attaches this on the generic capture path exactly as
+ * qmdSpawnFailureCaptureContext already does.
+ */
+export function incompleteInstallCaptureContext(err, resolvePackageRoot = safePackageRoot, fileSystem = fs) {
+    if (!isEsmLoaderEnoent(err))
+        return undefined;
+    // Only instrument what we did NOT already confidently suppress: a path under
+    // node_modules is classified and printed above, never captured.
+    if (incompleteInstallMessage(err, resolvePackageRoot) !== null)
+        return undefined;
+    const record = err;
+    const root = resolveRootSafely(resolvePackageRoot);
+    const code = typeof record.code === "string" ? record.code : "";
+    let packageJsonExists = false;
+    let nodeModulesExists = false;
+    if (root) {
+        try {
+            packageJsonExists = fileSystem.existsSync(path.join(root, "package.json"));
+        }
+        catch {
+            packageJsonExists = false;
+        }
+        try {
+            nodeModulesExists = fileSystem.existsSync(path.join(root, "node_modules"));
+        }
+        catch {
+            nodeModulesExists = false;
+        }
+    }
+    return {
+        incomplete_install: {
+            packageRoot: boundedDiagnosticValue(root ?? "<unresolved>", ROOT_DIAGNOSTIC_BYTES),
+            packageJsonExists,
+            nodeModulesExists,
+            esmLoaderFrame: true,
+            code: boundedDiagnosticValue(code, CODE_DIAGNOSTIC_BYTES),
+        },
+    };
+}
+//# sourceMappingURL=incomplete-install-error.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.108.13",
+  "version": "5.108.14",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {