@indigoai-us/hq-cli 5.192.2 → 5.193.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.193.0] — 2026-09-25
+
+### Fixed
+
+- `hq secrets set` now handles a closed stdin descriptor during terminal cleanup.
+
+### Improved
+
+- Sentry reports for failed skill-wrapper replacement now include bounded ownership-state tags.
+
 ## [5.192.2] — 2026-09-25
 
 ### Fixed

package/dist/commands/secrets.js

@@ -188,12 +188,23 @@ function promptSecretInteractively() {
         let value = "";
         process.stdin.setEncoding("utf8");
         const cleanup = () => {
-            if (process.stdin.isTTY) {
-                process.stdin.setRawMode(false);
+            try {
+                if (process.stdin.isTTY) {
+                    try {
+                        process.stdin.setRawMode(false);
+                    }
+                    catch (error) {
+                        if (error?.code !== "EBADF") {
+                            throw error;
+                        }
+                    }
+                }
+            }
+            finally {
+                process.stdin.removeListener("data", onData);
+                process.stdin.removeListener("end", onEnd);
+                process.stdin.pause();
             }
-            process.stdin.removeListener("data", onData);
-            process.stdin.removeListener("end", onEnd);
-            process.stdin.pause();
         };
         const onEnd = () => {
             cleanup();

package/dist/lib/company-skill-wrapper.d.ts

@@ -1,4 +1,13 @@
 import * as fs from "node:fs";
+export interface CompanySkillWrapperOwnershipDiagnostics {
+    kind: "directory" | "symlink" | "file" | "other";
+    bridgeState: "all_live" | "partial" | "none" | "empty" | "not_applicable";
+    markerState: "bound" | "missing" | "invalid" | "unbound" | "unavailable" | "not_applicable";
+    linkTarget: "company_skills" | "outside_company_skills" | "unavailable" | "not_applicable";
+    platform: "win32" | "darwin" | "linux" | "other";
+    nameEncoding: "percent_encoded" | "literal";
+}
+export declare function companySkillWrapperSentryTagsFor(error: unknown): Record<string, string> | undefined;
 export interface SurfaceCompanySkillInput {
     hqRoot: string;
     companySlug: string;

package/dist/lib/company-skill-wrapper.js

@@ -62,20 +62,6 @@ function symlinkTarget(linkPath) {
 function generatedMarkerPath(wrapperPath) {
     return path.join(path.dirname(wrapperPath), WRAPPER_MARKER_DIR, `${path.basename(wrapperPath)}.json`);
 }
-function hasBoundGeneratedMarker(wrapperPath, companySlug) {
-    try {
-        const marker = JSON.parse(fs.readFileSync(generatedMarkerPath(wrapperPath), "utf8"));
-        const wrapper = fs.lstatSync(wrapperPath);
-        return (marker.version === 2 &&
-            marker.companySlug === companySlug &&
-            marker.wrapperDev === wrapper.dev &&
-            marker.wrapperIno === wrapper.ino &&
-            marker.wrapperBirthtimeMs === wrapper.birthtimeMs);
-    }
-    catch {
-        return false;
-    }
-}
 function writeGeneratedMarker(wrapperPath, companySlug, skillSlug) {
     const markerPath = generatedMarkerPath(wrapperPath);
     try {
@@ -104,21 +90,116 @@ function removeGeneratedMarker(wrapperPath) {
         // never sufficient to surface content on its own.
     }
 }
-function isGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug) {
+const COMPANY_SKILL_WRAPPER_DIAGNOSTICS = Symbol("company-skill-wrapper-diagnostics");
+function companySkillWrapperOwnershipError(wrapperPath, diagnostics) {
+    const error = new Error(`Cannot replace '${wrapperPath}' because it is not an HQ-generated skill wrapper.`);
+    Object.defineProperty(error, COMPANY_SKILL_WRAPPER_DIAGNOSTICS, {
+        value: diagnostics,
+    });
+    return error;
+}
+export function companySkillWrapperSentryTagsFor(error) {
+    if (!(error instanceof Error))
+        return undefined;
+    const diagnostics = error[COMPANY_SKILL_WRAPPER_DIAGNOSTICS];
+    if (!diagnostics)
+        return undefined;
+    return {
+        hq_cli_skill_wrapper_kind: diagnostics.kind,
+        hq_cli_skill_wrapper_bridge_state: diagnostics.bridgeState,
+        hq_cli_skill_wrapper_marker_state: diagnostics.markerState,
+        hq_cli_skill_wrapper_link_target: diagnostics.linkTarget,
+        hq_cli_skill_wrapper_platform: diagnostics.platform,
+        hq_cli_skill_wrapper_name_encoding: diagnostics.nameEncoding,
+    };
+}
+function inspectGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug) {
     const companySkillsRoot = path.join(hqRoot, "companies", companySlug, "skills");
-    const wrapperTarget = symlinkTarget(wrapperPath);
-    if (wrapperTarget)
-        return isWithin(companySkillsRoot, wrapperTarget);
-    const wrapper = lstat(wrapperPath);
-    if (!wrapper?.isDirectory())
-        return false;
+    const wrapperEntry = lstat(wrapperPath);
+    if (wrapperEntry?.isSymbolicLink()) {
+        const target = symlinkTarget(wrapperPath);
+        const linkTarget = target === undefined
+            ? "unavailable"
+            : isWithin(companySkillsRoot, target)
+                ? "company_skills"
+                : "outside_company_skills";
+        return {
+            owned: linkTarget === "company_skills",
+            diagnostics: {
+                kind: "symlink",
+                bridgeState: "not_applicable",
+                markerState: "not_applicable",
+                linkTarget,
+            },
+        };
+    }
+    if (!wrapperEntry?.isDirectory()) {
+        return {
+            owned: false,
+            diagnostics: {
+                kind: wrapperEntry?.isFile() ? "file" : "other",
+                bridgeState: "not_applicable",
+                markerState: "not_applicable",
+                linkTarget: "not_applicable",
+            },
+        };
+    }
     const entries = fs.readdirSync(wrapperPath).filter((entry) => !entry.startsWith("."));
-    const containsOnlyLiveBridges = (entries.length > 0 &&
-        entries.every((entry) => {
-            const target = symlinkTarget(path.join(wrapperPath, entry));
-            return target !== undefined && isWithin(companySkillsRoot, target);
-        }));
-    return containsOnlyLiveBridges || hasBoundGeneratedMarker(wrapperPath, companySlug);
+    const liveBridgeCount = entries.reduce((count, entry) => {
+        const target = symlinkTarget(path.join(wrapperPath, entry));
+        return count + (target !== undefined && isWithin(companySkillsRoot, target) ? 1 : 0);
+    }, 0);
+    const bridgeState = entries.length === 0
+        ? "empty"
+        : liveBridgeCount === entries.length
+            ? "all_live"
+            : liveBridgeCount > 0
+                ? "partial"
+                : "none";
+    const markerState = generatedMarkerState(wrapperPath, companySlug);
+    return {
+        owned: bridgeState === "all_live" || markerState === "bound",
+        diagnostics: {
+            kind: "directory",
+            bridgeState,
+            markerState,
+            linkTarget: "not_applicable",
+        },
+    };
+}
+function isGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug) {
+    return inspectGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug).owned;
+}
+function generatedMarkerState(wrapperPath, companySlug) {
+    let markerContents;
+    try {
+        markerContents = fs.readFileSync(generatedMarkerPath(wrapperPath), "utf8");
+    }
+    catch (error) {
+        return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT"
+            ? "missing"
+            : "unavailable";
+    }
+    let marker;
+    try {
+        marker = JSON.parse(markerContents);
+    }
+    catch {
+        return "invalid";
+    }
+    try {
+        const wrapper = fs.lstatSync(wrapperPath);
+        return marker.version === 2 &&
+            marker.companySlug === companySlug &&
+            marker.wrapperDev === wrapper.dev &&
+            marker.wrapperIno === wrapper.ino &&
+            marker.wrapperBirthtimeMs === wrapper.birthtimeMs
+            ? "bound"
+            : "unbound";
+    }
+    catch {
+        return "unavailable";
+    }
 }
 function isGeneratedLegacyEntry(legacyPath, sourceDir, skillFile) {
     const target = symlinkTarget(legacyPath);
@@ -224,8 +305,19 @@ export function surfaceCompanySkill(input) {
         const backupPath = `${stagingPath}.previous`;
         let previousMoved = false;
         if (currentWrapper) {
-            if (!isGeneratedNamespacedWrapper(wrapperPath, input.hqRoot, input.companySlug)) {
-                throw new Error(`Cannot replace '${wrapperPath}' because it is not an HQ-generated skill wrapper.`);
+            const ownership = inspectGeneratedNamespacedWrapper(wrapperPath, input.hqRoot, input.companySlug);
+            if (!ownership.owned) {
+                const runtimePlatform = process.platform;
+                const platform = win32
+                    ? "win32"
+                    : runtimePlatform === "darwin" || runtimePlatform === "linux"
+                        ? runtimePlatform
+                        : "other";
+                throw companySkillWrapperOwnershipError(wrapperPath, {
+                    ...ownership.diagnostics,
+                    platform,
+                    nameEncoding: win32 ? "percent_encoded" : "literal",
+                });
             }
             renameEntry(wrapperPath, backupPath);
             previousMoved = true;

package/dist/sentry.js

@@ -5,6 +5,7 @@ import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
+import { companySkillWrapperSentryTagsFor } from "./lib/company-skill-wrapper.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { incompleteInstallCaptureContext, incompleteInstallMessage, } from "./utils/incomplete-install-error.js";
 import { installTreeTornSentryTagsFor, sentryFingerprintFor, sentryMcpCollisionContextFor, } from "./utils/sentry-fingerprint.js";
@@ -84,6 +85,10 @@ export function epipeAwareBeforeSend(event, hint) {
         if (fingerprint)
             event.fingerprint = fingerprint;
     }
+    const skillWrapperTags = companySkillWrapperSentryTagsFor(hint?.originalException);
+    if (skillWrapperTags) {
+        event.tags = { ...event.tags, ...skillWrapperTags };
+    }
     const installTreeTags = installTreeTornSentryTagsFor(hint?.originalException);
     if (installTreeTags) {
         event.tags = { ...event.tags, ...installTreeTags };

package/dist/utils/contribution-table.d.ts

@@ -99,5 +99,5 @@ export declare const CONTRIBUTION_KEYS: ContributionKey[];
  */
 export declare function payloadFor(key: ContributionKey, item: string): string;
 /** Keys whose contributions are wired by a host symlink (skip `merge` rows). */
-export declare const SYMLINK_KEYS: ("workers" | "mcp" | "knowledge" | "skills" | "commands" | "hooks" | "policies" | "scripts")[];
+export declare const SYMLINK_KEYS: ("workers" | "mcp" | "skills" | "knowledge" | "commands" | "hooks" | "policies" | "scripts")[];
 //# sourceMappingURL=contribution-table.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.192.2",
+  "version": "5.193.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {