@indigoai-us/hq-cli 5.13.0 → 5.14.0

package/CHANGELOG.md

@@ -2,6 +2,89 @@
 
 ## [Unreleased]
 
+## [5.14.0] — 2026-05-14
+
+### Changed
+
+- **`hq sync now` and `hq sync push --all` no longer delete vault files
+  this machine never owned.** `propagateDeletes: true` in the underlying
+  `share()` engine now defaults to `propagateDeletePolicy: "owned-only"`
+  — only journal entries with `direction: "up"` (paths this machine
+  previously uploaded) are eligible for remote `DeleteObject`. This
+  closes two reproducer-grade failure modes:
+  - A behind machine running `sync now` for the first time would erase
+    peer uploads from the vault because its push-then-pull ordering
+    interpreted "local missing → propagate delete" before the pull leg
+    fetched the new content.
+  - A machine with stricter local ignore rules (older HQ layout,
+    custom `.hqignore`) would erase paths that lived in the vault but
+    were filtered out of its local walk — the next push concluded the
+    user had deleted them.
+
+  Path-scoped pushes (`hq sync push <path>...`) are unaffected — they
+  never opted into `propagateDeletes` to begin with. Set
+  `propagateDeletePolicy: "all"` via the `share()` library API to opt
+  back into the legacy any-direction behaviour; there is no CLI flag
+  for that today.
+
+### Fixed
+
+- **`hq --version` and the update-check banner now read from
+  `package.json` at runtime instead of a hardcoded literal.** Two stale
+  literals (`src/index.ts` → `5.12.4`, `src/cli-version.ts` →
+  `5.12.1`) had been drifting across the 5.12.x and 5.13.x releases.
+  They're now sourced from the same place the npm tarball is, so they
+  stay accurate by construction.
+
+- **Filter-symmetry guard on `propagateDeletes`.** `computeDeletePlan`
+  now intersects the journal-based delete candidates with the same
+  `createIgnoreFilter(hqRoot)` predicate the pull leg uses. Paths the
+  current ignore filter would reject are never delete-propagated, even
+  if they appear in the journal. Pairs with the `direction` guard
+  above: a path is delete-eligible only when (a) the journal records
+  us as its uploader AND (b) the ignore filter accepts it AND (c) the
+  local file is missing.
+
+### Added (developer-facing)
+
+- **`ShareOptions.propagateDeletePolicy: "owned-only" | "all"`** on
+  the `share()` library export. Defaults to `"owned-only"` whenever
+  `propagateDeletes: true`. The `sync-runner` (Tauri menubar) and
+  `hq sync now` / `hq sync push --all` (CLI) all inherit the safer
+  default automatically.
+
+- **Cross-package pre-publish smoke test
+  (`.github/workflows/publish.yml`).** Between hq-cloud and hq-cli
+  publishes, the workflow installs each consumer in an isolated tmpdir
+  — using the workspace tarball when the consumer's package.json
+  version is new, or fetching `name@version` from npm when it is
+  already published — and boots the binary with `--version`. The boot
+  exercises the full module-load graph; transitive `@indigoai-us/*`
+  resolution goes through the npm registry (matching what a customer
+  install would see). Catches the v5.13.0 failure mode — a consumer
+  imports a producer symbol that the published producer doesn't yet
+  export — before the broken package reaches consumers.
+  Notably the smoke runs for already-published consumers too: a
+  producer bump earlier in the same workflow can retroactively break
+  consumers via caret-range transitive resolution, so the consumer's
+  bytes being immutable does NOT mean its runtime behaviour is locked.
+  Bypass: set repo variable `WORKFLOW_ALLOW_BROKEN_PUBLISH=1`
+  (audited via the workflow log).
+
+## [5.13.1] — 2026-05-14
+
+### Fixed
+
+- **Republish hq-cli alongside `@indigoai-us/hq-cloud@5.16.0` to ship the
+  `computePersonalVaultPaths` helper.** `5.13.0` imported the new helper
+  from hq-cloud, but the publish workflow's idempotent skip-if-already-on-npm
+  gate suppressed the hq-cloud republish (its `package.json` still said
+  5.15.0). The runtime resolution of `^5.1.0` then pulled the older
+  hq-cloud, and every `hq` invocation crashed with `SyntaxError: ... does
+  not provide an export named 'computePersonalVaultPaths'`. 5.13.1 carries
+  no source delta; it bumps the version so the workflow republishes and
+  forces hq-cloud@5.16.0 to ship alongside.
+
 ## [5.13.0] — 2026-05-14
 
 ### Added

package/dist/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "5.12.1";
+export declare const CLI_VERSION: string;
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli-version.js

@@ -1,5 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f65738b2-fa67-5b68-a0c8-c73fba12c6c5")}catch(e){}}();
-export const CLI_VERSION = "5.12.1";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9d613278-0268-5da9-a6d0-f1b4f15d405a")}catch(e){}}();
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+const here = path.dirname(fileURLToPath(import.meta.url));
+const pkgPath = path.resolve(here, "..", "package.json");
+const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+export const CLI_VERSION = pkg.version;
 //# sourceMappingURL=cli-version.js.map
-//# debugId=f65738b2-fa67-5b68-a0c8-c73fba12c6c5
+//# debugId=9d613278-0268-5da9-a6d0-f1b4f15d405a

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="56a9367e-c800-55df-9c55-44274965648e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9cc0bf93-9c18-53aa-addd-954425115886")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -31,6 +31,7 @@ import { registerMembersCommand } from "./commands/members.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
+import { CLI_VERSION } from "./cli-version.js";
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes the pipe early.
 const onPipeError = (err) => {
     if (err.code === "EPIPE") {
@@ -46,7 +47,7 @@ const program = new Command();
 program
     .name("hq")
     .description("HQ management CLI — modules, packages, and cloud sync")
-    .version("5.12.4");
+    .version(CLI_VERSION);
 // Module management subcommand group
 const modulesCmd = program
     .command("modules")
@@ -119,4 +120,4 @@ registerFeedbackCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=56a9367e-c800-55df-9c55-44274965648e
+//# debugId=9cc0bf93-9c18-53aa-addd-954425115886

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.13.0",
+  "version": "5.14.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/cli-version.ts

@@ -1 +1,9 @@
-export const CLI_VERSION = "5.12.1";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const pkgPath = path.resolve(here, "..", "package.json");
+const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as { version: string };
+
+export const CLI_VERSION: string = pkg.version;

package/src/index.ts

@@ -34,6 +34,7 @@ import {
   maybeWarnNewVersion,
   refreshVersionCache,
 } from "./utils/version-check.js";
+import { CLI_VERSION } from "./cli-version.js";
 
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes the pipe early.
 const onPipeError = (err: NodeJS.ErrnoException): void => {
@@ -53,7 +54,7 @@ const program = new Command();
 program
   .name("hq")
   .description("HQ management CLI — modules, packages, and cloud sync")
-  .version("5.12.4");
+  .version(CLI_VERSION);
 
 // Module management subcommand group
 const modulesCmd = program