@indigoai-us/hq-cli 5.109.5 → 5.109.7

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 ## [Unreleased]
 
+## [5.109.7] — 2026-09-10
+
+### Fixed
+
+- Add `whoami --json`, structured `files acl --json` with explicit absence,
+  and `people resolve --membership-only` with canonical company/person IDs.
+  Delegation helpers can now verify exact grants without parsing display tables
+  or treating a missing ACL as a transport failure. Existing human output stays available.
+
+## [5.109.6] — 2026-09-10
+
+### Fixed
+
+- A torn hq install no longer files an unactionable crash when a bundled
+  third-party dependency of a dependency is missing (HQ-CLI-1Q). `hq packs list`
+  loaded the mesh presence client, whose `import mqtt` chain reached
+  mqtt-packet's `parser.js` requiring `bl` — mqtt-packet's OWN declared
+  transitive dependency — which a partial Windows global install had left
+  unwritten. The in-process incomplete-install classifier shipped in 5.108.14
+  recognised only a RELATIVE missing specifier for the CJS shape, so this BARE
+  specifier fell through to a bare Sentry crash plus an `hq:` line the operator
+  could not act on. The classifier now also recognises a bare miss from UNDER
+  the running install's own `node_modules/`, but ONLY when the missing specifier
+  names a WHOLE package (not a subpath like `bl/lib/x`, which can mean the
+  package is present and only that file gone to a version mismatch) AND the
+  REQUIRING third-party package's own manifest declares it in its REQUIRED
+  `dependencies` (`optionalDependencies` are excluded, being not guaranteed
+  installed) — a correct install always writes such a
+  dependency, so its absence beside a present requirer can only be a torn
+  install, never an hq-cli manifest defect. Those are printed with the same
+  input-free reinstall remedy and skipped, at the top-level boundary and in the
+  shared `beforeSend`. A bare miss the requirer does NOT declare (a possible
+  undeclared or peer-only dependency) stays reported, now enriched on every
+  capture route with a bounded `incomplete_install` context naming both packages
+  so the next occurrence is attributable instead of bare.
+
 ## [5.109.5] — 2026-09-10
 
 ## [5.109.4] — 2026-09-09
@@ -344,12 +380,13 @@
   `npm i -g @indigoai-us/hq-cli` / `pnpm add -g @indigoai-us/hq-cli`) while
   skipping Sentry capture, the same disposition established for the qmd child in
   HQ-CLI-Y. An hq-cli packaging fault stays reportable: a miss under the
-  package's own `dist/` or `assets/`, a bare-specifier miss (a possible
-  undeclared dependency), and an esm-loader ENOENT whose path did not survive
-  delivery are NOT suppressed — the last is captured WITH a bounded
-  `incomplete_install` context so the next occurrence is attributable. The drop
-  is wired both at the top-level boundary and in the shared `beforeSend`, so it
-  covers every capture route.
+  package's own `dist/` or `assets/`, a bare-specifier miss (then kept loud as a
+  possible undeclared dependency — refined for a dependency the requiring package
+  actually declares in HQ-CLI-1Q, see Unreleased), and an esm-loader ENOENT whose
+  path did not survive delivery are NOT suppressed — the last is captured WITH a
+  bounded `incomplete_install` context so the next occurrence is attributable.
+  The drop is wired both at the top-level boundary and in the shared
+  `beforeSend`, so it covers every capture route.
 
 ## [5.108.13] — 2026-09-06
 

package/dist/commands/files.js

@@ -276,7 +276,8 @@ export function registerFilesCommand(program) {
     files
         .command("acl <prefix>")
         .description("Show the ACL (access control list) for a file prefix")
-        .action(async (prefix) => {
+        .option("--json", "Output structured ACL data, including explicit absence")
+        .action(async (prefix, opts) => {
         try {
             // Read-only, so stripping is safe — but a mismatched anchor would show
             // a DIFFERENT company's ACL than the one the operator pasted.
@@ -321,7 +322,16 @@ export function registerFilesCommand(program) {
                 process.exit(1);
             }
             const tree = (await treeRes.json());
+            if (!tree || typeof tree.prefix !== 'string' || !Array.isArray(tree.direct)
+                || !Array.isArray(tree.inherited) || !Array.isArray(tree.children)
+                || !(tree.directRow === null || (typeof tree.directRow === 'object' && tree.directRow))) {
+                throw new Error('Invalid ACL tree response');
+            }
             const row = tree.directRow;
+            if (opts.json) {
+                console.log(JSON.stringify({ ...tree, schemaVersion: 1, companyUid, exists: row !== null }, null, 2));
+                return;
+            }
             // No own row AND nothing inherited or granted below — preserve the
             // original "no ACL record" exit path.
             if (!row && tree.inherited.length === 0 && tree.children.length === 0) {

package/dist/commands/people.d.ts

@@ -20,6 +20,7 @@ interface PeopleCommandDeps {
 }
 interface PeopleLookupOpts {
     localOnly?: boolean;
+    membershipOnly?: boolean;
     json?: boolean;
 }
 export declare function activeMemberToPersonRecord(m: ActiveMember): PersonRecord | null;

package/dist/commands/people.js

@@ -41,6 +41,8 @@ export function activeMemberToPersonRecord(m) {
         slug,
         name,
         email,
+        personUid: m.personUid,
+        companyUid: m.companyUid,
         role: m.role || undefined,
         type: "internal",
         source: `hq-pro membership: /membership/company/${m.companyUid}`,
@@ -147,6 +149,13 @@ async function tryFetchRoster(fetchRoster, hqRoot, slug) {
     }
 }
 export async function resolvePersonWithRosterFallback(input) {
+    if (input.opts?.membershipOnly) {
+        if (input.opts.localOnly)
+            throw new Error('--membership-only cannot be combined with --local-only');
+        // No local fallback: callers need authoritative IDs and must see transport errors.
+        const roster = await (input.fetchRoster ?? fetchMembershipRoster)(input.hqRoot, input.slug);
+        return resolveNameToEmail(roster, input.name);
+    }
     const localPeople = listCompanyPeople(input.hqRoot, input.slug);
     const local = resolveNameToEmail(localPeople, input.name);
     if (local.status !== "not_found" || input.opts?.localOnly)
@@ -239,6 +248,7 @@ export function registerPeopleCommand(program, deps = {}) {
     people
         .command("resolve <name>")
         .description("Resolve a person name to their email address")
+        .option("--membership-only", "Resolve from authoritative company membership, ignoring local records")
         .option("--json", "Output JSON instead of plain text")
         .option("--local-only", "Skip network fallback; resolve only from the local people roster")
         .action(async (name, opts) => {

package/dist/commands/pkg-install.d.ts

@@ -1,17 +1,3 @@
-/**
- * hq packages install <slug> — download, verify, and extract a package (US-005)
- *
- * Flow:
- * 1. Check auth (prompt login if needed)
- * 2. Check entitlement via API
- * 3. Download tarball via presigned URL
- * 4. Verify SHA256 hash
- * 5. Verify RSA signature (if provided)
- * 6. Extract to packages/installed/<slug>/
- * 7. Validate extracted package.yaml slug matches
- * 8. Update packages/registry.yaml
- * 9. Print next-step message
- */
 import { Command } from 'commander';
 export declare function registerPackageInstallCommand(parent: Command): void;
 //# sourceMappingURL=pkg-install.d.ts.map

package/dist/commands/pkg-install.js

@@ -1,28 +1,4 @@
-/**
- * hq packages install <slug> — download, verify, and extract a package (US-005)
- *
- * Flow:
- * 1. Check auth (prompt login if needed)
- * 2. Check entitlement via API
- * 3. Download tarball via presigned URL
- * 4. Verify SHA256 hash
- * 5. Verify RSA signature (if provided)
- * 6. Extract to packages/installed/<slug>/
- * 7. Validate extracted package.yaml slug matches
- * 8. Update packages/registry.yaml
- * 9. Print next-step message
- */
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { parseUserYaml } from '../utils/user-yaml-error.js';
-import { execSync } from 'child_process';
 import chalk from 'chalk';
-import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
-import { getRegistryUrl, RegistryClient, } from '../utils/registry-client.js';
-import { verifySha256, verifyRsaSignature } from '../utils/integrity.js';
-import { addToRegistry } from '../utils/registry.js';
 import { peekHqApiKey, requireApiKeyCapability, } from '../utils/resolve-vault-credential.js';
 import { MARKETPLACE_PREFIX, installPack, sourceMatchesPackPattern, } from './pack-install.js';
 /**
@@ -105,107 +81,4 @@ export function registerPackageInstallCommand(parent) {
         }
     });
 }
-async function installPackage(slug, company) {
-    // 1. Auth
-    const accessToken = await ensureCognitoToken();
-    const registryUrl = getRegistryUrl();
-    const client = new RegistryClient(registryUrl, accessToken);
-    // 2. Check entitlement
-    console.log(chalk.dim(`Checking entitlement for ${slug}...`));
-    const entitlement = await client.checkEntitlement(slug);
-    if (!entitlement.entitled) {
-        throw new Error(`You are not entitled to package "${slug}". Visit the registry to purchase or request access.`);
-    }
-    // 3. Get download URL
-    console.log(chalk.dim('Fetching download URL...'));
-    const download = await client.getDownloadUrl(slug);
-    // 4. Download to temp file
-    const tmpDir = os.tmpdir();
-    const tmpFile = path.resolve(tmpDir, `hq-pkg-${slug}-${Date.now()}.tar.gz`);
-    try {
-        console.log(chalk.dim('Downloading package...'));
-        const response = await fetch(download.url, {
-            signal: AbortSignal.timeout(120_000),
-        });
-        if (!response.ok) {
-            throw new Error(`Download failed (${response.status})`);
-        }
-        const buffer = Buffer.from(await response.arrayBuffer());
-        fs.writeFileSync(tmpFile, buffer);
-        // 5. Verify SHA256
-        console.log(chalk.dim('Verifying integrity...'));
-        const hashValid = await verifySha256(tmpFile, download.sha256);
-        if (!hashValid) {
-            throw new Error('SHA256 hash mismatch — the downloaded file may be corrupted or tampered with.');
-        }
-        // 6. Verify RSA signature (if provided)
-        if (download.signature) {
-            const sigValid = verifyRsaSignature(download.sha256, download.signature);
-            if (!sigValid) {
-                throw new Error('RSA signature verification failed — the package may have been tampered with or the public key is missing/invalid. Aborting install.');
-            }
-        }
-        // 7. Extract
-        const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-        const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
-        // Clean existing installation
-        if (fs.existsSync(installDir)) {
-            fs.rmSync(installDir, { recursive: true, force: true });
-        }
-        fs.mkdirSync(installDir, { recursive: true });
-        execSync(`tar -xzf "${tmpFile}" -C "${installDir}"`, {
-            stdio: 'pipe',
-        });
-        // 8. Validate package.yaml slug
-        const packageYamlPath = path.resolve(installDir, 'package.yaml');
-        if (fs.existsSync(packageYamlPath)) {
-            const pkgContent = fs.readFileSync(packageYamlPath, 'utf-8');
-            const pkgMeta = parseUserYaml(pkgContent, packageYamlPath);
-            if (pkgMeta?.slug && pkgMeta.slug !== slug) {
-                // Mismatch — clean up and abort
-                fs.rmSync(installDir, { recursive: true, force: true });
-                throw new Error(`Package slug mismatch: expected "${slug}", got "${pkgMeta.slug}"`);
-            }
-        }
-        // 9. Get package info for registry entry
-        let version = 'unknown';
-        let name = slug;
-        try {
-            const pkgInfo = await client.getPackage(slug);
-            version = pkgInfo.package.latest_version;
-            name = pkgInfo.package.name;
-        }
-        catch {
-            // Best-effort — fall back to package.yaml if present
-            const packageYaml = path.resolve(installDir, 'package.yaml');
-            if (fs.existsSync(packageYaml)) {
-                const content = fs.readFileSync(packageYaml, 'utf-8');
-                const meta = parseUserYaml(content, packageYaml);
-                if (meta?.version)
-                    version = meta.version;
-                if (meta?.name)
-                    name = meta.name;
-            }
-        }
-        // 10. Update registry.yaml
-        const now = new Date().toISOString();
-        addToRegistry(hqRoot, {
-            name,
-            slug,
-            version,
-            source: registryUrl,
-            scope: company,
-            installed_at: now,
-            updated_at: now,
-        });
-        console.log(chalk.green(`\nInstalled ${slug}@${version} to packages/installed/${slug}/`));
-        console.log(chalk.cyan('Run /package-install ' + slug + ' in Claude to merge into your HQ.'));
-    }
-    finally {
-        // Clean up temp file — never leave partial downloads
-        if (fs.existsSync(tmpFile)) {
-            fs.unlinkSync(tmpFile);
-        }
-    }
-}
 //# sourceMappingURL=pkg-install.js.map

package/dist/commands/whoami.js

@@ -4,7 +4,7 @@
 import chalk from 'chalk';
 import { loadCachedTokens, isExpiring, loadMachineCreds, } from '@indigoai-us/hq-cloud';
 import { peekIdToken as decodeIdToken } from "../utils/id-token.js";
-import { resolveCognitoTokenSource } from "../utils/cognito-session.js";
+import { loadMachineCachedTokens, resolveCognitoTokenSource } from "../utils/cognito-session.js";
 function peekIdToken(idToken) {
     const decoded = decodeIdToken(idToken);
     return {
@@ -22,13 +22,39 @@ export function registerWhoamiCommand(program) {
     program
         .command('whoami')
         .description('Show the currently authenticated user')
-        .action(async () => {
+        .option('--json', 'Output identity metadata as JSON (never tokens)')
+        .action(async (opts) => {
         try {
             // Effective source (same as auth status / ensureCognitoToken): env
             // opt-in, fresh-box default-creds when no usable person session, or
             // after a definitive person-refresh rejection marked the session rejected.
             const machine = resolveCognitoTokenSource() === "machine";
             const cached = loadCachedTokens();
+            if (opts.json) {
+                const machineCreds = machine ? loadMachineCreds() : null;
+                const identityCache = machine ? loadMachineCachedTokens() : cached;
+                const identity = identityCache ? peekIdToken(identityCache.idToken) : {};
+                const claims = identityCache ? decodeIdToken(identityCache.idToken) : {};
+                // Modern credentials carry the canonical UID. Legacy caches may only
+                // supply a UID when their subject is bound to the selected username.
+                const boundLegacyAgent = machineCreds && identity.entityType === 'agent'
+                    && (claims['cognito:username'] === machineCreds.username
+                        || claims.username === machineCreds.username || claims.sub === machineCreds.username)
+                    ? identity.entityUid ?? null : null;
+                const agentUid = machineCreds?.entityUid !== undefined
+                    ? (machineCreds.entityUid.startsWith('agt_') ? machineCreds.entityUid : null)
+                    : boundLegacyAgent;
+                console.log(JSON.stringify({
+                    schemaVersion: 1,
+                    authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
+                    tokenSource: machine ? 'machine' : 'person',
+                    email: machine ? null : identity.email ?? null,
+                    personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
+                    agentUid,
+                    username: machineCreds?.username ?? null,
+                }, null, 2));
+                return;
+            }
             if (machine) {
                 // Machine identities (company agents) mint sessions on demand from
                 // long-lived creds — report the machine identity honestly even when

package/dist/lib/doctor/checks/runtime-probe.d.ts

@@ -50,7 +50,7 @@ export declare const POLICY_TRIGGER_LEDGER_RELPATH = "workspace/orchestrator/pol
 /** The two lifecycle events `check-hq-hooks.sh` requires a command hook on. */
 export declare const REQUIRED_HOOK_EVENTS: readonly ["SessionStart", "PreToolUse"];
 /**
- * Default runtime marker path an agents-v2 (hermes) box writes its runtime mode
+ * Default runtime marker path an agents-v2 (hq-fleet) box writes its runtime mode
  * to. Overridable via `HQ_RUNTIME_MARKER_FILE`, exactly as the shell reads
  * `${HQ_RUNTIME_MARKER_FILE:-/var/lib/hq-agent/runtime.json}`.
  */
@@ -129,31 +129,31 @@ export interface AgentsV2AttestationOptions {
  */
 export declare function isAgentsV2Runtime(hqRoot: string, env?: NodeJS.ProcessEnv): boolean;
 /**
- * Env var overriding the agents-v2 runtime (hermes) config path (chiefly for
+ * Env var overriding the agents-v2 runtime (hq-fleet) config path (chiefly for
  * tests), mirroring `HQ_RUNTIME_MARKER_FILE` and the shell's
- * `HQ_HERMES_CONFIG_FILE`.
+ * `HQ_FLEET_CONFIG_FILE`.
  */
-export declare const HQ_HERMES_CONFIG_ENV = "HQ_HERMES_CONFIG_FILE";
+export declare const HQ_FLEET_CONFIG_ENV = "HQ_FLEET_CONFIG_FILE";
 /**
- * The agents-v2 runtime (hermes) config whose `hooks:` block wires the on-box
- * adapter into every lifecycle event — the env override, else `~/.hermes/config.yaml`
+ * The agents-v2 runtime (hq-fleet) config whose `hooks:` block wires the on-box
+ * adapter into every lifecycle event — the env override, else `~/.hq-fleet/config.yaml`
  * (where `provision/render-config.sh` renders it). Mirrors the shell's
- * `HQ_HERMES_CONFIG_FILE="${HQ_HERMES_CONFIG_FILE:-$HOME/.hermes/config.yaml}"`.
+ * `HQ_FLEET_CONFIG_FILE="${HQ_FLEET_CONFIG_FILE:-$HOME/.hq-fleet/config.yaml}"`.
  */
-export declare function resolveHermesConfigPath(env?: NodeJS.ProcessEnv): string;
+export declare function resolveHqFleetConfigPath(env?: NodeJS.ProcessEnv): string;
 /**
  * Whether the agents-v2 runtime actually wires the on-box hook adapter.
  *
  * The wiring lives in the RUNTIME's hook config, not `.claude/settings.json`. On
  * a real box the v2 runtime's shell-hook dispatcher (`agent/shell_hooks.py`)
- * reads a `hooks:` block from `~/.hermes/config.yaml` with one entry per
+ * reads a `hooks:` block from `~/.hq-fleet/config.yaml` with one entry per
  * lifecycle event, each invoking `hq-agents-v2-hook-adapter.sh`; the adapter in
  * turn READS `.claude/settings.json` (via `hook-adapter-core.sh`) to fan out to
  * the classic `.claude/hooks` set. So `.claude/settings.json` never NAMES the
  * adapter — it wires the classic `hook-gate.sh` hooks — and grepping it for the
  * adapter always fails on a real box (verified on the v2.17 canary
  * i-0277243ad3aed8109, 2026-09-05: settings.json had 0 adapter refs / 94
- * hook-gate.sh refs, while ~/.hermes/config.yaml wired the adapter across 7
+ * hook-gate.sh refs, while ~/.hq-fleet/config.yaml wired the adapter across 7
  * events). Require BOTH the adapter installed under the tree at
  * {@link AGENTS_V2_ADAPTER_RELPATH} AND the runtime config invoking it. Mirrors
  * `hq_runtime_config_wires_v2_adapter` in `check-hq-hooks.sh`.
@@ -169,7 +169,7 @@ export declare function runtimeConfigWiresV2Adapter(hqRoot: string, env?: NodeJS
 export declare function v2LedgerPresent(opts: AgentsV2AttestationOptions): boolean;
 /**
  * All three agents-v2 self-attestation conditions. Used only to GRANT PASS to a
- * hermes box that host detection leaves platform-unknown; never to withhold it.
+ * hq-fleet box that host detection leaves platform-unknown; never to withhold it.
  * The exact conjunction of `agents_v2_attested` in `check-hq-hooks.sh`.
  */
 export declare function agentsV2Attested(opts: AgentsV2AttestationOptions): boolean;

package/dist/lib/doctor/checks/runtime-probe.js

@@ -53,7 +53,7 @@ export const POLICY_TRIGGER_LEDGER_RELPATH = "workspace/orchestrator/policy-trig
 /** The two lifecycle events `check-hq-hooks.sh` requires a command hook on. */
 export const REQUIRED_HOOK_EVENTS = ["SessionStart", "PreToolUse"];
 /**
- * Default runtime marker path an agents-v2 (hermes) box writes its runtime mode
+ * Default runtime marker path an agents-v2 (hq-fleet) box writes its runtime mode
  * to. Overridable via `HQ_RUNTIME_MARKER_FILE`, exactly as the shell reads
  * `${HQ_RUNTIME_MARKER_FILE:-/var/lib/hq-agent/runtime.json}`.
  */
@@ -161,36 +161,36 @@ function readRuntimeMarkerMode(markerPath) {
     }
 }
 /**
- * Env var overriding the agents-v2 runtime (hermes) config path (chiefly for
+ * Env var overriding the agents-v2 runtime (hq-fleet) config path (chiefly for
  * tests), mirroring `HQ_RUNTIME_MARKER_FILE` and the shell's
- * `HQ_HERMES_CONFIG_FILE`.
+ * `HQ_FLEET_CONFIG_FILE`.
  */
-export const HQ_HERMES_CONFIG_ENV = "HQ_HERMES_CONFIG_FILE";
+export const HQ_FLEET_CONFIG_ENV = "HQ_FLEET_CONFIG_FILE";
 /**
- * The agents-v2 runtime (hermes) config whose `hooks:` block wires the on-box
- * adapter into every lifecycle event — the env override, else `~/.hermes/config.yaml`
+ * The agents-v2 runtime (hq-fleet) config whose `hooks:` block wires the on-box
+ * adapter into every lifecycle event — the env override, else `~/.hq-fleet/config.yaml`
  * (where `provision/render-config.sh` renders it). Mirrors the shell's
- * `HQ_HERMES_CONFIG_FILE="${HQ_HERMES_CONFIG_FILE:-$HOME/.hermes/config.yaml}"`.
+ * `HQ_FLEET_CONFIG_FILE="${HQ_FLEET_CONFIG_FILE:-$HOME/.hq-fleet/config.yaml}"`.
  */
-export function resolveHermesConfigPath(env = process.env) {
-    const override = env[HQ_HERMES_CONFIG_ENV]?.trim();
+export function resolveHqFleetConfigPath(env = process.env) {
+    const override = env[HQ_FLEET_CONFIG_ENV]?.trim();
     if (override)
         return override;
-    return path.join(os.homedir(), ".hermes", "config.yaml");
+    return path.join(os.homedir(), ".hq-fleet", "config.yaml");
 }
 /**
  * Whether the agents-v2 runtime actually wires the on-box hook adapter.
  *
  * The wiring lives in the RUNTIME's hook config, not `.claude/settings.json`. On
  * a real box the v2 runtime's shell-hook dispatcher (`agent/shell_hooks.py`)
- * reads a `hooks:` block from `~/.hermes/config.yaml` with one entry per
+ * reads a `hooks:` block from `~/.hq-fleet/config.yaml` with one entry per
  * lifecycle event, each invoking `hq-agents-v2-hook-adapter.sh`; the adapter in
  * turn READS `.claude/settings.json` (via `hook-adapter-core.sh`) to fan out to
  * the classic `.claude/hooks` set. So `.claude/settings.json` never NAMES the
  * adapter — it wires the classic `hook-gate.sh` hooks — and grepping it for the
  * adapter always fails on a real box (verified on the v2.17 canary
  * i-0277243ad3aed8109, 2026-09-05: settings.json had 0 adapter refs / 94
- * hook-gate.sh refs, while ~/.hermes/config.yaml wired the adapter across 7
+ * hook-gate.sh refs, while ~/.hq-fleet/config.yaml wired the adapter across 7
  * events). Require BOTH the adapter installed under the tree at
  * {@link AGENTS_V2_ADAPTER_RELPATH} AND the runtime config invoking it. Mirrors
  * `hq_runtime_config_wires_v2_adapter` in `check-hq-hooks.sh`.
@@ -201,7 +201,7 @@ export function runtimeConfigWiresV2Adapter(hqRoot, env = process.env) {
         return false;
     let raw;
     try {
-        raw = fs.readFileSync(resolveHermesConfigPath(env), "utf8");
+        raw = fs.readFileSync(resolveHqFleetConfigPath(env), "utf8");
     }
     catch {
         return false;
@@ -265,7 +265,7 @@ function ledgerDirHasFreshTxt(dir, cutoffMs) {
 }
 /**
  * All three agents-v2 self-attestation conditions. Used only to GRANT PASS to a
- * hermes box that host detection leaves platform-unknown; never to withhold it.
+ * hq-fleet box that host detection leaves platform-unknown; never to withhold it.
  * The exact conjunction of `agents_v2_attested` in `check-hq-hooks.sh`.
  */
 export function agentsV2Attested(opts) {
@@ -286,7 +286,7 @@ export function checkRuntimeProbe(context) {
     const checkId = `${RUNTIME_PROBE_PREFIX}.enforcement`;
     const target = POLICY_TRIGGER_LEDGER_RELPATH;
     const scope = sessionId ? ` for session ${sessionId}` : "";
-    // agents-v2 (hermes) self-attestation. hq doctor leaves the hermes host
+    // agents-v2 (hq-fleet) self-attestation. hq doctor leaves the hq-fleet host
     // platform-unknown and, on an unknown host, the probe would report UNKNOWN
     // below. But the on-box adapter provably wrote the ledger through the same
     // .claude hooks, so grant PASS — and report platform "agents-v2" — when, and

package/dist/lib/doctor/compat.d.ts

@@ -75,12 +75,12 @@ export interface DeriveVerdictOptions {
      */
     requireLedger?: boolean;
     /**
-     * Whether this is an attested agents-v2 (hermes) box: the runtime is
+     * Whether this is an attested agents-v2 (hq-fleet) box: the runtime is
      * agents-v2, `.claude/settings.json` wires the on-box adapter, and a
      * policy-trigger ledger exists (the exact session's when a session id is
      * given; otherwise a ledger fresh within the freshness window). When true,
      * OBSERVED is granted even though the doctor's runtime check did not report
-     * PASS — because hq doctor leaves the hermes host platform-unknown, yet the
+     * PASS — because hq doctor leaves the hq-fleet host platform-unknown, yet the
      * on-box adapter provably wrote the ledger through the same .claude hooks.
      *
      * This is the exact twin of the `agents_v2_attested` override in

package/dist/lib/doctor/compat.js

@@ -81,7 +81,7 @@ export function deriveCheckHqHooksVerdict(doc, options = {}) {
     // ledger" contract.
     const runtimeResult = doc.results.find((result) => result.checkId === RUNTIME_ENFORCEMENT_CHECK_ID);
     let runtime = observeRuntime(runtimeResult?.status, requireLedger);
-    // agents-v2 self-attestation: hq doctor leaves the hermes host
+    // agents-v2 self-attestation: hq doctor leaves the hq-fleet host
     // platform-unknown and so does not report the runtime check as PASS, but the
     // on-box adapter provably wrote the ledger through the same .claude hooks.
     // Grant the identical OBSERVED verdict rather than relaying the host-unknown

package/dist/main.js

@@ -563,21 +563,24 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         // An IN-PROCESS module-load failure that means hq-cli's OWN installed
         // package tree is incomplete at load time — a partial/interrupted global
         // install left a bundled file unwritten (HQ-CLI-1N, a CJS relative-sibling
-        // MODULE_NOT_FOUND), or a concurrent global install rewrote the running
-        // tree so an ESM module present at resolve was gone at read (HQ-CLI-1M, an
-        // esm-loader ENOENT). Both carry no hq-cli frames and reached the final
-        // else, filing a bare crash and an unactionable line. An incomplete
-        // install is the caller's machine, the disposition HQ-CLI-Y already
-        // established for the qmd CHILD — print the input-free reinstall remedy and
-        // skip capture. Placed with the environmental family (after the typed qmd
-        // carriers and the hq state-write carrier, before environmentalFsErrorMessage):
-        // the signatures are disjoint — ENVIRONMENTAL_FS_CODES is only
-        // ENOSPC/EDQUOT/EROFS (never ENOENT/MODULE_NOT_FOUND), no qmd carrier sets
-        // requireStack or an esm-loader frame, and the classified file must sit
-        // under <packageRoot>/node_modules — so ordering changes nothing that
-        // exists. The UNATTRIBUTABLE shape (an esm-loader ENOENT whose path did not
-        // survive) is deliberately NOT suppressed; it is captured WITH bounded
-        // context on the generic path below.
+        // MODULE_NOT_FOUND; HQ-CLI-1Q, a CJS BARE-specifier MODULE_NOT_FOUND for a
+        // dependency the requiring third-party package's own manifest declares), or
+        // a concurrent global install rewrote the running tree so an ESM module
+        // present at resolve was gone at read (HQ-CLI-1M, an esm-loader ENOENT).
+        // All carry no hq-cli frames and reached the final else, filing a bare
+        // crash and an unactionable line. An incomplete install is the caller's
+        // machine, the disposition HQ-CLI-Y already established for the qmd CHILD —
+        // print the input-free reinstall remedy and skip capture. Placed with the
+        // environmental family (after the typed qmd carriers and the hq state-write
+        // carrier, before environmentalFsErrorMessage): the signatures are disjoint
+        // — ENVIRONMENTAL_FS_CODES is only ENOSPC/EDQUOT/EROFS (never
+        // ENOENT/MODULE_NOT_FOUND), no qmd carrier sets requireStack or an
+        // esm-loader frame, and the classified file must sit under
+        // <packageRoot>/node_modules — so ordering changes nothing that exists. The
+        // UNATTRIBUTABLE shapes are deliberately NOT suppressed and are captured
+        // WITH bounded context on the generic path below: an esm-loader ENOENT
+        // whose path did not survive, and a bare miss the requirer does NOT declare
+        // (a possible undeclared/peer dependency, now named in the context).
         const incompleteInstallMsg = qmdMsg || collectionMsg || terminatedMsg || llmDisabledMsg || moduleMissingMsg || storeMissingMsg || storeUnopenableMsg || queryDocumentMsg || modelDownloadMsg || workdirMissingMsg || stateWriteMsg
             ? null
             : incompleteInstallMessage(err);

package/dist/sentry.js

@@ -6,7 +6,7 @@ import { CLI_VERSION } from "./cli-version.js";
 import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
-import { incompleteInstallMessage } from "./utils/incomplete-install-error.js";
+import { incompleteInstallCaptureContext, incompleteInstallMessage, } from "./utils/incomplete-install-error.js";
 import { sentryFingerprintFor } from "./utils/sentry-fingerprint.js";
 /**
  * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
@@ -35,17 +35,33 @@ export function epipeAwareBeforeSend(event, hint) {
     // Path-independent belt for an IN-PROCESS incomplete-install module-load
     // failure — hq-cli's own globally installed tree is not intact at load time
     // (HQ-CLI-1N, a CJS relative-sibling MODULE_NOT_FOUND under its bundled
-    // node_modules; HQ-CLI-1M, an esm-loader ENOENT for a file present at resolve
-    // and gone at read). handleTopLevelError already prints the reinstall remedy
-    // for the top-level route; dropping the event here suppresses the fatal
-    // regardless of route — the unhandled-rejection boundary, the command-level
-    // captureException sites, and bin/hq-auth-refresh — mirroring the EPIPE and
-    // environmental-fs drops above. The classifier reads only structured fields
-    // and the failing file must sit under the running install's node_modules, so
-    // an hq-cli packaging fault (a dist/ miss, a bare-specifier miss) and the
+    // node_modules; HQ-CLI-1Q, a CJS BARE-specifier MODULE_NOT_FOUND the requiring
+    // third-party package's own manifest declares; HQ-CLI-1M, an esm-loader ENOENT
+    // for a file present at resolve and gone at read). handleTopLevelError already
+    // prints the reinstall remedy for the top-level route; dropping the event here
+    // suppresses the fatal regardless of route — the unhandled-rejection boundary,
+    // the command-level captureException sites, and bin/hq-auth-refresh —
+    // mirroring the EPIPE and environmental-fs drops above. The classifier reads
+    // only structured fields (plus, for the bare shape, the requiring package's
+    // own manifest) and the failing file must sit under the running install's
+    // node_modules, so an hq-cli packaging fault (a dist/ miss, or a bare miss the
+    // requirer does NOT declare — a possible undeclared/peer dependency) and the
     // path-less unattributable shape are NOT dropped here and stay captured.
     if (incompleteInstallMessage(hint?.originalException))
         return null;
+    // An incomplete-install shape that is NOT suppressed (a bare miss the requirer
+    // does not declare, or a path-less esm-loader ENOENT) should still arrive
+    // ATTRIBUTABLE on every capture route, not only the top-level boundary:
+    // handleTopLevelError in main.ts is the ONLY caller of
+    // incompleteInstallCaptureContext, so events reaching this hook directly — the
+    // unhandled-rejection integration, the command-level captureException sites,
+    // and bin/hq-auth-refresh — would otherwise survive bare. Merge the bounded
+    // context here too. Idempotent: main.ts attaches the same block on its route,
+    // and an already-present context wins the spread.
+    const installContext = incompleteInstallCaptureContext(hint?.originalException);
+    if (installContext) {
+        event.contexts = { ...installContext, ...event.contexts };
+    }
     // Group an event that survives to send by a BOUNDED machine discriminator so
     // unrelated gateway/HTTP failures stop colliding into one fungible issue
     // (HQ-CLI collision, Sentry 7642756130). Placed here — path-independent,

package/dist/utils/incomplete-install-error.d.ts

@@ -21,9 +21,9 @@ export type PackageRootResolver = () => string | null;
  * means "handle as usual (capture to Sentry)". Never throws — a resolver that
  * fails yields null.
  */
-export declare function incompleteInstallMessage(err: unknown, resolvePackageRoot?: PackageRootResolver): string | null;
-/** Bounded, scrubber-safe diagnostics for an unattributable esm-loader ENOENT. */
-export type IncompleteInstallDiagnostics = {
+export declare function incompleteInstallMessage(err: unknown, resolvePackageRoot?: PackageRootResolver, fileSystem?: Pick<typeof fs, "readFileSync">): string | null;
+/** Bounded, scrubber-safe diagnostics for an unattributable esm-loader ENOENT (HQ-CLI-1M). */
+export type IncompleteInstallEsmDiagnostics = {
     packageRoot: string;
     packageJsonExists: boolean;
     nodeModulesExists: boolean;
@@ -31,20 +31,42 @@ export type IncompleteInstallDiagnostics = {
     code: string;
 };
 /**
- * When an esm-loader ENOENT reaches the capture path WITHOUT being suppressed —
- * the exact shape the delivered HQ-CLI-1M payload arrived in, where neither the
- * exception value nor node_system_error carried a `path` — return a bounded
- * `contexts.incomplete_install` block so the next occurrence carries the
- * evidence this one lacked; otherwise return undefined (bare capture). Built
- * with the byte-capped, scrubber-safe discipline of package-root-diagnostics.ts:
- * the resolved package root and whether its package.json / node_modules exist,
- * the loader-frame marker, and the bounded errno code — never a caller argv,
- * query, or user-minted value. Never throws.
- *
- * main.ts attaches this on the generic capture path exactly as
- * qmdSpawnFailureCaptureContext already does.
+ * Bounded, scrubber-safe diagnostics for a NOT-suppressed third-party bare miss
+ * (HQ-CLI-1Q): a possible undeclared / peer-only dependency defect, made
+ * attributable — the missing package, the requiring package, and the fact that
+ * the requirer's own manifest did NOT declare it. Both names live inside
+ * hq-cli's dependency graph, so grouping cardinality stays bounded.
+ */
+export type IncompleteInstallBareDiagnostics = {
+    missingPackage: string;
+    requiringPackage: string;
+    requirerDeclaresMissing: false;
+};
+/**
+ * Both enriched shapes as a single OPEN record — every field optional so a
+ * consumer can forward either shape to Sentry without narrowing (the boundary
+ * and beforeSend only pass the block through). Every value CONSTRUCTED here is
+ * exactly one of the two strict shapes above; the looseness is only at the read
+ * boundary.
+ */
+export type IncompleteInstallDiagnostics = Partial<IncompleteInstallEsmDiagnostics & IncompleteInstallBareDiagnostics>;
+/**
+ * When an incomplete-install failure reaches the capture path WITHOUT being
+ * suppressed, return a bounded `contexts.incomplete_install` block so the next
+ * occurrence carries the evidence this one lacked; otherwise return undefined
+ * (bare capture). Two enriched shapes:
+ *   - a third-party BARE-specifier miss the requirer did not declare (HQ-CLI-1Q)
+ *     → { missingPackage, requiringPackage, requirerDeclaresMissing:false };
+ *   - an esm-loader ENOENT whose path did not survive delivery (HQ-CLI-1M) — the
+ *     shape the delivered payload arrived in, where neither the exception value
+ *     nor node_system_error carried a `path` → { packageRoot, packageJsonExists,
+ *     nodeModulesExists, esmLoaderFrame, code }.
+ * Built with the byte-capped, scrubber-safe discipline of
+ * package-root-diagnostics.ts — never a caller argv, query, or user-minted
+ * value. Never throws. main.ts attaches this on the generic capture path
+ * exactly as qmdSpawnFailureCaptureContext already does.
  */
-export declare function incompleteInstallCaptureContext(err: unknown, resolvePackageRoot?: PackageRootResolver, fileSystem?: Pick<typeof fs, "existsSync">): {
+export declare function incompleteInstallCaptureContext(err: unknown, resolvePackageRoot?: PackageRootResolver, fileSystem?: Pick<typeof fs, "existsSync"> & Partial<Pick<typeof fs, "readFileSync">>): {
     incomplete_install: IncompleteInstallDiagnostics;
 } | undefined;
 //# sourceMappingURL=incomplete-install-error.d.ts.map

package/dist/utils/incomplete-install-error.js

@@ -7,7 +7,7 @@
 // failure inside THIS process rather than a qmd child's captured stderr, which
 // is the gap HQ-CLI-Y's classifier cannot cover.
 //
-// Two shapes, one cause — a partial/interrupted global install left a file
+// Three shapes, one cause — a partial/interrupted global install left a file
 // unwritten, or a concurrent global install rewrote the running tree
 // underneath a command:
 //
@@ -19,6 +19,16 @@
 //   specifier internal to a third-party package can only be a truncated on-disk
 //   copy, never an hq-cli manifest defect.
 //
+//   HQ-CLI-1Q (Sentry 7716586928) — CJS, in-process. The SAME `import mqtt`
+//   chain, one hop further down: mqtt-packet's `parser.js` requires the BARE
+//   specifier `bl` — mqtt-packet's OWN declared transitive dependency — and it
+//   is absent inside hq-cli's bundled node_modules after a torn Windows global
+//   install. A bare miss looks like an undeclared dependency, but when the
+//   REQUIRING third-party package's own manifest declares it, its absence
+//   beside a present requirer can only be a torn install. hq-cli declares
+//   nothing about a contract between two third-party packages, so this is never
+//   an hq-cli manifest defect.
+//
 //   HQ-CLI-1M (Sentry 7714870912) — ESM load, in-process. A module that existed
 //   at RESOLVE was gone at READ (a concurrent writer rewrote the install tree),
 //   so Node's ESM loader raised `ENOENT` from getSourceSync/readFileSync/openSync
@@ -26,7 +36,7 @@
 //   ERR_MODULE_NOT_FOUND at resolve, never ENOENT at load; an ENOENT at load
 //   proves the file vanished between resolve and read.
 //
-// Both shapes carry no hq-cli frames, reach the boundary's final `else`, and —
+// All shapes carry no hq-cli frames, reach the boundary's final `else`, and —
 // before this classifier — filed a bare captureException plus an unactionable
 // `hq: <fallback>` line. The disposition is the one HQ-CLI-Y already
 // established: an incomplete install is the caller's machine, so the CLI prints
@@ -35,19 +45,26 @@
 // The gate is deliberately narrow so neither an hq-cli packaging fault nor
 // user free-text can trip it. Only structured fields are read — `code`,
 // `syscall`, `path`, `requireStack`, and the stack's loader-frame marker, plus
-// the first message line for the CJS specifier. THREE independent narrowings
+// the first message line for the CJS specifier — plus, for the bare CJS shape
+// only, the requiring package's own on-disk manifest. Independent narrowings
 // keep a genuine hq-cli defect reportable:
 //   1. The failing file must sit under `<packageRoot>/node_modules/` — a
 //      third-party file hq-cli does not author. A miss under `<packageRoot>/dist`
 //      or `/assets` is hq-cli's OWN shipped output and stays captured.
-//   2. The CJS shape additionally requires a RELATIVE specifier — a
-//      bare-specifier miss (`Cannot find module 'mqtt'`) can be an undeclared
-//      dependency (an hq-cli manifest defect) and stays captured.
+//   2. The CJS shape splits on the specifier. A RELATIVE specifier internal to
+//      a package under node_modules can only be a truncated copy (HQ-CLI-1N). A
+//      BARE PACKAGE-ROOT specifier stays captured UNLESS the requiring
+//      third-party package's own manifest declares it in its REQUIRED
+//      `dependencies` (HQ-CLI-1Q). A subpath miss (`bl/lib/x`), an
+//      optional-dependency miss (not guaranteed installed), and an undeclared or
+//      peer-only miss (`Cannot find module 'mqtt'` from a requirer that does not
+//      declare it) all stay loud — the last two enriched with both package names.
 //   3. The ESM shape additionally requires an esm-loader frame — an ordinary
 //      `fs.readFileSync` ENOENT written by hq's own code stays captured.
 import * as fs from "fs";
 import * as path from "path";
 import { packageRoot } from "./hq-roots.js";
+import { packageNameOf } from "./install-tree-torn.js";
 import { boundedDiagnosticValue } from "./package-root-diagnostics.js";
 /**
  * The actionable remedy shown to the operator. Input-free — nothing from the
@@ -72,6 +89,11 @@ const RELATIVE_SPECIFIER = /^\.\.?[\\/]/;
 const ESM_LOADER_FRAME = /node:internal[\\/]modules[\\/]esm[\\/]/;
 const ROOT_DIAGNOSTIC_BYTES = 256;
 const CODE_DIAGNOSTIC_BYTES = 32;
+// Package names live inside hq-cli's own dependency graph, so their universe is
+// bounded; the cap is a belt for a pathological requireStack, not a real limit.
+const PACKAGE_NAME_DIAGNOSTIC_BYTES = 128;
+/** The `<something>/node_modules/<something>` directory-boundary marker. */
+const NODE_MODULES_SEGMENT = "/node_modules/";
 /**
  * packageRoot() walks up from the compiled module and THROWS
  * PackageRootResolutionError when it cannot resolve. This classifier runs inside
@@ -132,6 +154,114 @@ function parseMissingSpecifier(message) {
     const match = message.match(/Cannot find module ['"]([^'"]+)['"]/);
     return match ? match[1] : null;
 }
+/**
+ * True when `specifier` is a BARE package specifier — neither a RELATIVE
+ * specifier (`./x`, `..\x`) nor an ABSOLUTE POSIX (`/x`) or Windows (`C:\x`,
+ * `\\unc`) path. Shape-based (never `process.platform`) so a reported Windows
+ * path classifies on a Linux CI runner, mirroring normalizeForCompare's win32
+ * detection.
+ */
+function isBareSpecifier(specifier) {
+    if (specifier.length === 0)
+        return false;
+    if (RELATIVE_SPECIFIER.test(specifier))
+        return false;
+    if (specifier.startsWith("/"))
+        return false; // absolute POSIX
+    if (looksWin32(specifier))
+        return false; // absolute Windows (drive letter or UNC)
+    return true;
+}
+/**
+ * True when `specifier` is a bare specifier naming a PACKAGE ROOT with no
+ * subpath — `bl` or `@scope/name`, never `bl/lib/inner.js` or `@scope/name/sub`.
+ * Only a WHOLE-package miss is a proven torn install; a subpath miss can mean the
+ * package IS installed but that one file is absent because of a version or
+ * packaging mismatch — a real defect that must stay reported, not be silenced as
+ * a torn install.
+ */
+function isBarePackageRoot(specifier) {
+    return isBareSpecifier(specifier) && specifier === packageNameOf(specifier);
+}
+/**
+ * From a file under `<root>/node_modules/…`, derive the REQUIRING package's
+ * directory and its package name, nesting- and scope-aware:
+ *   `<root>/node_modules/a/node_modules/b/index.js` → dir `…/b`,          name `b`
+ *   `<root>/node_modules/@scope/pkg/index.js`       → dir `…/@scope/pkg`, name `@scope/pkg`
+ * Keyed on the LAST `node_modules` segment so the INNERMOST (actually requiring)
+ * package is chosen, consuming two path segments for an `@scope/name` dir. The
+ * returned dir preserves the original case and is folded to `/` (Node's fs
+ * accepts `/` on every platform); the win32 shape only case-folds the SEARCH so
+ * the segment is found, never the returned value. Returns null when the path
+ * holds no usable package segment.
+ */
+function requiringPackage(requiringFile) {
+    const folded = foldSeparators(requiringFile);
+    const win = looksWin32(requiringFile);
+    const haystack = win ? folded.toLowerCase() : folded;
+    const marker = win ? NODE_MODULES_SEGMENT.toLowerCase() : NODE_MODULES_SEGMENT;
+    const lastNm = haystack.lastIndexOf(marker);
+    if (lastNm === -1)
+        return null;
+    const prefixEnd = lastNm + NODE_MODULES_SEGMENT.length;
+    const prefix = folded.slice(0, prefixEnd); // `…/node_modules/`, original case
+    const rest = folded
+        .slice(prefixEnd)
+        .split("/")
+        .filter((segment) => segment.length > 0);
+    if (rest.length === 0)
+        return null;
+    const take = rest[0].startsWith("@") ? 2 : 1;
+    if (rest.length < take)
+        return null;
+    const name = rest.slice(0, take).join("/");
+    return { dir: prefix + name, name };
+}
+/** True when `deps` is an object carrying `packageName` as an OWN key. */
+function declaresDependency(deps, packageName) {
+    return (typeof deps === "object" &&
+        deps !== null &&
+        Object.prototype.hasOwnProperty.call(deps, packageName));
+}
+/**
+ * Whether the third-party package that REQUIRED `requiringFile` declares
+ * `packageName` in its own REQUIRED `dependencies` — the decisive discriminator
+ * for Shape C (HQ-CLI-1Q). A correct install of a package that declares a
+ * REQUIRED dependency ALWAYS writes it, so its absence beside a present requirer
+ * can only be a torn install. `optionalDependencies` are deliberately EXCLUDED:
+ * they are not guaranteed installed (`npm install --omit optional`, or a
+ * tolerated optional-install failure), so a missing optional package can be a
+ * persistent, expected omission — not a torn install — and must stay captured. A
+ * peer-only / undeclared / hoisting assumption is likewise NOT declared here.
+ * Fails CLOSED: an unresolved dir, an unreadable or invalid-JSON manifest, or a
+ * non-object dependency map all return false. Never throws — every fs and
+ * JSON.parse call is individually guarded. Reached only after the cheap
+ * in-memory narrowings of Shape C pass, so at most one small manifest read per
+ * process.
+ */
+function requirerDeclaresDependency(requiringFile, packageName, fileSystem) {
+    const requirer = requiringPackage(requiringFile);
+    if (!requirer)
+        return false;
+    let raw;
+    try {
+        raw = fileSystem.readFileSync(`${requirer.dir}/package.json`, "utf-8");
+    }
+    catch {
+        return false;
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(raw);
+    }
+    catch {
+        return false;
+    }
+    if (manifest === null || typeof manifest !== "object")
+        return false;
+    const record = manifest;
+    return declaresDependency(record.dependencies, packageName);
+}
 /** True when `stack` carries a Node ESM loader frame. */
 function hasEsmLoaderFrame(stack) {
     return typeof stack === "string" && ESM_LOADER_FRAME.test(stack);
@@ -161,7 +291,7 @@ function isEsmLoaderEnoent(err) {
  * means "handle as usual (capture to Sentry)". Never throws — a resolver that
  * fails yields null.
  */
-export function incompleteInstallMessage(err, resolvePackageRoot = safePackageRoot) {
+export function incompleteInstallMessage(err, resolvePackageRoot = safePackageRoot, fileSystem = fs) {
     if (err === null || typeof err !== "object")
         return null;
     const record = err;
@@ -172,16 +302,36 @@ export function incompleteInstallMessage(err, resolvePackageRoot = safePackageRo
     if (!root)
         return null;
     if (code === "MODULE_NOT_FOUND") {
-        // Shape A (CJS, HQ-CLI-1N): a RELATIVE specifier internal to a package under
-        // the running install's node_modules can only be a truncated on-disk copy.
         const requireStack = record.requireStack;
         if (!Array.isArray(requireStack) || typeof requireStack[0] !== "string") {
             return null;
         }
+        const requiringFile = requireStack[0];
         const specifier = parseMissingSpecifier(record.message);
-        if (specifier === null || !RELATIVE_SPECIFIER.test(specifier))
+        if (specifier === null)
+            return null;
+        // Shape A (CJS, HQ-CLI-1N) — UNCHANGED: a RELATIVE specifier internal to a
+        // package under the running install's node_modules can only be a truncated
+        // on-disk copy. Kept byte-for-byte so 1N cannot regress.
+        if (RELATIVE_SPECIFIER.test(specifier)) {
+            return isUnderNodeModules(requiringFile, root)
+                ? INCOMPLETE_INSTALL_REMEDY
+                : null;
+        }
+        // Shape C (CJS, HQ-CLI-1Q): a BARE PACKAGE-ROOT specifier missing from UNDER
+        // the running install's node_modules is a torn install ONLY when the
+        // REQUIRING third-party package's own manifest declares it in its required
+        // `dependencies`. A subpath specifier (`bl/lib/inner.js`) is excluded — the
+        // package may be present and only that file gone to a version mismatch — and
+        // an absolute-path specifier is neither relative nor bare, so both stay
+        // captured. The manifest read is the ONLY filesystem access here and is
+        // reached only after the cheap in-memory narrowings above — a combination
+        // that cannot occur on a healthy run — so a healthy event never touches disk.
+        if (!isBarePackageRoot(specifier))
+            return null;
+        if (!isUnderNodeModules(requiringFile, root))
             return null;
-        return isUnderNodeModules(requireStack[0], root)
+        return requirerDeclaresDependency(requiringFile, specifier, fileSystem)
             ? INCOMPLETE_INSTALL_REMEDY
             : null;
     }
@@ -197,27 +347,80 @@ export function incompleteInstallMessage(err, resolvePackageRoot = safePackageRo
         ? INCOMPLETE_INSTALL_REMEDY
         : null;
 }
+/** A readFileSync surface, defaulting to the real fs when the caller injects none. */
+function readFileFrom(fileSystem) {
+    return { readFileSync: fileSystem.readFileSync ?? fs.readFileSync };
+}
 /**
- * When an esm-loader ENOENT reaches the capture path WITHOUT being suppressed —
- * the exact shape the delivered HQ-CLI-1M payload arrived in, where neither the
- * exception value nor node_system_error carried a `path` — return a bounded
- * `contexts.incomplete_install` block so the next occurrence carries the
- * evidence this one lacked; otherwise return undefined (bare capture). Built
- * with the byte-capped, scrubber-safe discipline of package-root-diagnostics.ts:
- * the resolved package root and whether its package.json / node_modules exist,
- * the loader-frame marker, and the bounded errno code — never a caller argv,
- * query, or user-minted value. Never throws.
- *
- * main.ts attaches this on the generic capture path exactly as
- * qmdSpawnFailureCaptureContext already does.
+ * When a third-party BARE-specifier CJS miss UNDER the running install's
+ * node_modules reached the capture path WITHOUT being suppressed (HQ-CLI-1Q) —
+ * i.e. the requiring package did NOT declare it, so it is a possible undeclared
+ * or peer-only dependency defect — return a bounded `incomplete_install` block
+ * naming both packages so the next occurrence is attributable instead of bare;
+ * otherwise undefined. The suppression decision is delegated to
+ * incompleteInstallMessage against the SAME injected filesystem, so a declared
+ * (torn-install) miss is never double-attributed here. Never throws.
+ */
+function bareSpecifierCaptureContext(err, resolvePackageRoot, fileSystem) {
+    if (err === null || typeof err !== "object")
+        return undefined;
+    const record = err;
+    if (record.code !== "MODULE_NOT_FOUND")
+        return undefined;
+    const requireStack = record.requireStack;
+    if (!Array.isArray(requireStack) || typeof requireStack[0] !== "string")
+        return undefined;
+    const requiringFile = requireStack[0];
+    const specifier = parseMissingSpecifier(record.message);
+    // Only a WHOLE-package bare miss is attributed here, matching the classifier's
+    // Shape C gate: a subpath miss is a version/packaging defect, not "the package
+    // is missing", so naming the package would misattribute it.
+    if (specifier === null || !isBarePackageRoot(specifier))
+        return undefined;
+    const root = resolveRootSafely(resolvePackageRoot);
+    if (!root || !isUnderNodeModules(requiringFile, root))
+        return undefined;
+    // Suppressed (the requirer declares it) → printed-and-skipped, never captured.
+    if (incompleteInstallMessage(err, resolvePackageRoot, readFileFrom(fileSystem)) !== null) {
+        return undefined;
+    }
+    return {
+        incomplete_install: {
+            missingPackage: boundedDiagnosticValue(specifier, PACKAGE_NAME_DIAGNOSTIC_BYTES),
+            requiringPackage: boundedDiagnosticValue(requiringPackage(requiringFile)?.name ?? "<unresolved>", PACKAGE_NAME_DIAGNOSTIC_BYTES),
+            requirerDeclaresMissing: false,
+        },
+    };
+}
+/**
+ * When an incomplete-install failure reaches the capture path WITHOUT being
+ * suppressed, return a bounded `contexts.incomplete_install` block so the next
+ * occurrence carries the evidence this one lacked; otherwise return undefined
+ * (bare capture). Two enriched shapes:
+ *   - a third-party BARE-specifier miss the requirer did not declare (HQ-CLI-1Q)
+ *     → { missingPackage, requiringPackage, requirerDeclaresMissing:false };
+ *   - an esm-loader ENOENT whose path did not survive delivery (HQ-CLI-1M) — the
+ *     shape the delivered payload arrived in, where neither the exception value
+ *     nor node_system_error carried a `path` → { packageRoot, packageJsonExists,
+ *     nodeModulesExists, esmLoaderFrame, code }.
+ * Built with the byte-capped, scrubber-safe discipline of
+ * package-root-diagnostics.ts — never a caller argv, query, or user-minted
+ * value. Never throws. main.ts attaches this on the generic capture path
+ * exactly as qmdSpawnFailureCaptureContext already does.
  */
 export function incompleteInstallCaptureContext(err, resolvePackageRoot = safePackageRoot, fileSystem = fs) {
+    // (A) HQ-CLI-1Q — the not-suppressed third-party bare miss, made attributable.
+    const bare = bareSpecifierCaptureContext(err, resolvePackageRoot, fileSystem);
+    if (bare)
+        return bare;
+    // (B) HQ-CLI-1M — the path-less esm-loader ENOENT, unchanged.
     if (!isEsmLoaderEnoent(err))
         return undefined;
     // Only instrument what we did NOT already confidently suppress: a path under
     // node_modules is classified and printed above, never captured.
-    if (incompleteInstallMessage(err, resolvePackageRoot) !== null)
+    if (incompleteInstallMessage(err, resolvePackageRoot, readFileFrom(fileSystem)) !== null) {
         return undefined;
+    }
     const record = err;
     const root = resolveRootSafely(resolvePackageRoot);
     const code = typeof record.code === "string" ? record.code : "";

package/dist/utils/people.d.ts

@@ -22,6 +22,9 @@ export interface PersonRecord {
     name: string;
     /** Contact email, when recorded. */
     email?: string;
+    /** Canonical identity from authoritative company membership, never local YAML. */
+    personUid?: string;
+    companyUid?: string;
     /** "internal" (team member) | "external" (client, vendor, …). */
     type?: string;
     /** Role/title inside (or relative to) the company. */

package/dist/utils/registry-client.d.ts

@@ -31,11 +31,6 @@ export interface EntitlementEntry {
 export interface EntitlementListResponse {
     entitlements: EntitlementEntry[];
 }
-export interface EntitlementCheckResponse {
-    entitled: boolean;
-    tier?: string;
-    expires_at?: string;
-}
 export interface DownloadResponse {
     url: string;
     sha256: string;
@@ -59,7 +54,6 @@ export declare class RegistryClient {
     }): Promise<PackageListResponse>;
     getPackage(slug: string): Promise<PackageResponse>;
     getMyEntitlements(): Promise<EntitlementListResponse>;
-    checkEntitlement(slug: string): Promise<EntitlementCheckResponse>;
     getDownloadUrl(slug: string, version?: string): Promise<DownloadResponse>;
 }
 //# sourceMappingURL=registry-client.d.ts.map

package/dist/utils/registry-client.js

@@ -88,9 +88,6 @@ export class RegistryClient {
             auth: true,
         });
     }
-    async checkEntitlement(slug) {
-        return this.request('GET', `/entitlements/${encodeURIComponent(slug)}`, { auth: true });
-    }
     async getDownloadUrl(slug, version) {
         const params = new URLSearchParams();
         if (version)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.109.5",
-  "description": "HQ by Indigo management CLI — modules and cloud sync",
+  "version": "5.109.7",
+  "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
     "hq": "dist/index.js",
@@ -26,7 +26,8 @@
     "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "vitest": "vitest",
     "clean": "rm -rf dist",
-    "prepare": "husky || true"
+    "prepare": "husky || true",
+    "check:no-hermes": "bash scripts/check-no-hermes.sh"
   },
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",