@indigoai-us/hq-cli 5.207.0 → 5.209.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [5.209.0] — 2026-09-26
+
+### Added
+
+- Behind the off-by-default `checkpoint.ontology.grok-backend` flag, `hq core checkpoint --backend auto` tries grok first for the payload company and falls back to the usual order when grok is missing or crashed last time. The detached ontology plan reads the flag and records it in the company state directory, so the foreground checkpoint makes no network call; a flag change applies from the checkpoint after the next plan.
+- Behind the off-by-default `checkpoint.ontology.ignore-annotations` flag, the checkpoint ontology plan gives the model a copy of each knowledge input without the old cloud annotator's `entities:` front-matter list and entity links, which were mostly wrong and which the model copied.
+
+## [5.208.0] — 2026-09-26
+
+### Fixed
+
+- `hq lanes accounts set-home` and `login` accept `--company <slug|uid>` and
+  scope the host-account-home flag read to that company.
+- The `hq daemon` updater now installs new hq-cloud patch releases. It looks up the newest release in the bundled major version and installs that exact version. Before, `npm install` with a version range kept an installed copy that already matched the range, so the updater stayed on 6.18.1 after 6.18.2 was published. A failed lookup is reported as a failed update and installs nothing.
+
 ## [5.207.0] — 2026-09-26
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -8172,6 +8172,9 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [{
                 readonly flags: "--host <hostname>";
                 readonly description: "Host key (defaults to this host's hostname)";
+            }, {
+                readonly flags: "--company <slug|uid>";
+                readonly description: "Company scope for the host-account-home flag";
             }, {
                 readonly flags: "--json";
                 readonly description: "JSON on stdout (always)";
@@ -8195,6 +8198,9 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [{
                 readonly flags: "--home <path>";
                 readonly description: "Account home directory";
+            }, {
+                readonly flags: "--company <slug|uid>";
+                readonly description: "Company scope for the host-account-home flag";
             }, {
                 readonly flags: "--device-auth";
                 readonly description: "Use Codex device authentication instead of localhost callback";

package/dist/command-catalog.generated.js

@@ -10571,6 +10571,10 @@ export const COMMAND_CATALOG = [
                                 "flags": "--host <hostname>",
                                 "description": "Host key (defaults to this host's hostname)"
                             },
+                            {
+                                "flags": "--company <slug|uid>",
+                                "description": "Company scope for the host-account-home flag"
+                            },
                             {
                                 "flags": "--json",
                                 "description": "JSON on stdout (always)"
@@ -10601,6 +10605,10 @@ export const COMMAND_CATALOG = [
                                 "flags": "--home <path>",
                                 "description": "Account home directory"
                             },
+                            {
+                                "flags": "--company <slug|uid>",
+                                "description": "Company scope for the host-account-home flag"
+                            },
                             {
                                 "flags": "--device-auth",
                                 "description": "Use Codex device authentication instead of localhost callback"

package/dist/commands/core-checkpoint.d.ts

@@ -71,9 +71,17 @@ export declare function writeStamps(liveRoot: string, sessionId: string | undefi
  * claude session keeps using claude and a codex session keeps using codex
  * (same-engine continuity), then the fallback priority claude -> codex -> grok
  * for whatever the caller is not. Deterministic and env-only, so it is unit
- * tested directly.
+ * tested directly. `preferGrok` (the company's grok-backend flag) puts grok
+ * ahead of that order and leaves the rest as the fallback.
  */
-export declare function autoBackendPreference(): SpawnableBackend[];
+export declare function autoBackendPreference(preferGrok?: boolean): SpawnableBackend[];
+/**
+ * Whether the payload company's last ontology plan recorded
+ * checkpoint.ontology.grok-backend as on. Reads only the local state file the
+ * detached sibling writes, so a foreground checkpoint never waits on the flag
+ * registry; a flag change takes effect from the checkpoint after the next plan.
+ */
+export declare function companyPrefersGrok(liveRoot: string, companySlug: string | null | undefined): boolean;
 /**
  * Whether the maintenance sibling may run at all. The process environment wins
  * over the settings file, so a one-off `HQ_CHECKPOINT_AGENT=0 hq core

package/dist/commands/core-checkpoint.js

@@ -15,6 +15,8 @@ import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { peekIdToken } from "../utils/id-token.js";
 import { toHqStateWriteError } from "../utils/hq-state-write-error.js";
 import { checkpointStampWriteErrorFor, isCheckpointStampWriteError, } from "../utils/checkpoint-stamp-write-error.js";
+import { readBackendPreference } from "../lib/checkpoint-ontology/plan.js";
+import { resolveOntologyCompany } from "../lib/checkpoint-ontology/company.js";
 const DEFAULT_TRIGGER = "stop-gate";
 const BACKENDS = new Set(["auto", "claude", "codex", "grok", "none"]);
 // Pinned by operator directive 2026-09-15; change defaults here deliberately.
@@ -672,13 +674,34 @@ function callerBackend() {
  * claude session keeps using claude and a codex session keeps using codex
  * (same-engine continuity), then the fallback priority claude -> codex -> grok
  * for whatever the caller is not. Deterministic and env-only, so it is unit
- * tested directly.
+ * tested directly. `preferGrok` (the company's grok-backend flag) puts grok
+ * ahead of that order and leaves the rest as the fallback.
  */
-export function autoBackendPreference() {
+export function autoBackendPreference(preferGrok = false) {
     const caller = callerBackend();
-    if (!caller)
-        return [...FALLBACK_BACKEND_ORDER];
-    return [caller, ...FALLBACK_BACKEND_ORDER.filter((name) => name !== caller)];
+    const order = caller
+        ? [caller, ...FALLBACK_BACKEND_ORDER.filter((name) => name !== caller)]
+        : [...FALLBACK_BACKEND_ORDER];
+    return preferGrok ? ["grok", ...order.filter((name) => name !== "grok")] : order;
+}
+/**
+ * Whether the payload company's last ontology plan recorded
+ * checkpoint.ontology.grok-backend as on. Reads only the local state file the
+ * detached sibling writes, so a foreground checkpoint never waits on the flag
+ * registry; a flag change takes effect from the checkpoint after the next plan.
+ */
+export function companyPrefersGrok(liveRoot, companySlug) {
+    const resolved = resolveOntologyCompany(liveRoot, companySlug);
+    if (!resolved.ok)
+        return false;
+    try {
+        return readBackendPreference(liveRoot, resolved.company);
+    }
+    catch (error) {
+        // A damaged state file must not stop the checkpoint; the usual order applies.
+        printError(`checkpoint: ignoring unreadable backend preference for ${resolved.company.slug}: ${error.message}`);
+        return false;
+    }
 }
 function settingsEnvValue(liveRoot, key) {
     // settings.local.json wins, matching Claude Code's own merge order.
@@ -767,12 +790,12 @@ function assertKnownBackend(requested) {
         usage(`checkpoint: unknown backend: ${value}`);
     return value;
 }
-function resolveBackend(requested, liveRoot) {
+function resolveBackend(requested, liveRoot, company) {
     const value = assertKnownBackend(requested);
     // An explicitly named backend is honoured as given; only `auto` shops around.
     if (value !== "auto")
         return value;
-    const available = autoBackendPreference().filter((name) => backendOnPath(name) && backendResponds(name));
+    const available = autoBackendPreference(companyPrefersGrok(liveRoot, company)).filter((name) => backendOnPath(name) && backendResponds(name));
     if (available.length === 0)
         return "none";
     const crashed = crashedBackends(path.join(liveRoot, "workspace", "checkpoints", "sibling"));
@@ -1073,7 +1096,7 @@ function runCheckpoint(options, command, group) {
     const siblingOptOut = options.agent === false || !siblingEnabledBySetting(liveRoot);
     // Validated even when nothing will spawn, so `--backend bogus` is still an error.
     const requestedBackend = assertKnownBackend(options.backend);
-    const backend = siblingOptOut ? "none" : resolveBackend(requestedBackend, liveRoot);
+    const backend = siblingOptOut ? "none" : resolveBackend(requestedBackend, liveRoot, input.company);
     const now = new Date();
     const threadId = `T-${formatTimestamp(now)}-auto-${summarySlug(input.summary)}`;
     const threadPath = path.join(liveRoot, "workspace", "threads", `${threadId}.json`);

package/dist/commands/lanes.d.ts

@@ -35,6 +35,8 @@ export interface LanesCommandDeps {
     now?: () => Date;
     hostname?: () => string;
     resolveCompany?: (company?: string) => Promise<LaneCompanyRef>;
+    /** Membership-backed explicit company selection for account-home writers. */
+    resolveActiveCompany?: (company: string) => Promise<LaneCompanyRef | null>;
     listOutpostIds?: () => Promise<string[]>;
     readOutpostIdentity?: () => OutpostIdentity;
     spawnLogin?: (opts: {

package/dist/commands/lanes.js

@@ -30,7 +30,9 @@ import { BALANCE_MOVABLE_STATES, CLAUDE_ACCOUNT_BALANCE_FLAG, accountLoadsForRep
 import { parseUserYaml } from "../utils/user-yaml-error.js";
 import { backfillOutpostIdentityMarker as backfillOutpostIdentityMarkerImpl, createOutpostIdentityMarkerIfMissing, validateOutpostIdentityId, } from "../lib/lanes/outpost-identity.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
-import { openMeshTransport } from "../lib/mesh/client.js";
+import { resolveActiveMembershipCompany } from "../lib/mesh/api.js";
+import { openMeshTransport, requireToken } from "../lib/mesh/client.js";
+import { CompanySelectionError } from "../utils/company-selection-error.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
@@ -88,11 +90,18 @@ function defaultLaneOutpostQuestionVisibilityEnabled(company, env) {
 function defaultLaneHostScopedAccountHomesEnabled(company, env) {
     return readLanesRegistryFlag(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, { company, env });
 }
-async function hostScopedAccountHomesEnabled(ctx) {
+async function hostScopedAccountHomesEnabled(ctx, company) {
     const localOverride = readLocalOverride(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, ctx.env);
     if (localOverride !== null)
         return localOverride;
-    return ctx.laneHostScopedAccountHomesEnabled(await ctx.resolveCompany());
+    return ctx.laneHostScopedAccountHomesEnabled(company ?? await ctx.resolveCompany());
+}
+async function resolveSelectedAccountHomeCompany(ctx, selector) {
+    const company = await ctx.resolveActiveCompany(selector);
+    if (!company) {
+        throw new CompanySelectionError(`No unique active company membership for ${selector}. Pass an active company UID with --company.`);
+    }
+    return company;
 }
 function withoutProviderHome(value) {
     if (Array.isArray(value))
@@ -158,6 +167,12 @@ async function defaultResolveCompany(company) {
     const { company: mesh } = await openMeshTransport({ company });
     return { slug: mesh.companySlug, uid: mesh.companyUid };
 }
+async function defaultResolveActiveCompany(company) {
+    const membership = await resolveActiveMembershipCompany(await requireToken(), company);
+    return membership
+        ? { slug: membership.companySlug, uid: membership.companyUid }
+        : null;
+}
 function defaultOutpostsClient() {
     return createOutpostsClient({
         transport: vaultApiFetch,
@@ -243,6 +258,7 @@ function resolveDeps(deps = {}) {
         now: deps.now ?? (() => new Date()),
         hostname: deps.hostname ?? (() => os.hostname()),
         resolveCompany: deps.resolveCompany ?? defaultResolveCompany,
+        resolveActiveCompany: deps.resolveActiveCompany ?? defaultResolveActiveCompany,
         listOutpostIds: deps.listOutpostIds ?? defaultListOutpostIds,
         readOutpostIdentity: deps.readOutpostIdentity ?? (() => readOutpostIdentity()),
         spawnLogin: deps.spawnLogin ?? defaultSpawnLogin,
@@ -7922,8 +7938,11 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     if (opts.home !== undefined && !requestedHome) {
         throw new LanesError("invalid_account_home", "--home must be a non-empty path", { provider, account: id });
     }
+    const company = opts.company !== undefined
+        ? await resolveSelectedAccountHomeCompany(ctx, opts.company)
+        : undefined;
     const hostScopedWriterEnabled = registeredAccount !== undefined && requestedHome !== undefined
-        ? await hostScopedAccountHomesEnabled(ctx)
+        ? await hostScopedAccountHomesEnabled(ctx, company)
         : false;
     const homeRaw = requestedHome ??
         (registeredAccount !== undefined
@@ -8017,7 +8036,10 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     printJson({ ok: true, action: "accounts.login", account: status });
 }
 async function runAccountsSetHome(ctx, providerRaw, accountIdRaw, homeRaw, opts) {
-    if (!(await hostScopedAccountHomesEnabled(ctx))) {
+    const company = opts.company !== undefined
+        ? await resolveSelectedAccountHomeCompany(ctx, opts.company)
+        : undefined;
+    if (!(await hostScopedAccountHomesEnabled(ctx, company))) {
         throw new LanesError("host_scoped_account_homes_disabled", "Setting a host-specific account home requires the lanes.host-scoped-account-homes flag", { flag: LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG });
     }
     const callerCwd = ctx.callerCwd();
@@ -8689,6 +8711,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<account-id>", "Existing account id")
         .argument("<path>", "Home directory for this host")
         .option("--host <hostname>", "Host key (defaults to this host's hostname)")
+        .option("--company <slug|uid>", "Company scope for the host-account-home flag")
         .option("--json", "JSON on stdout (always)")
         .action(wrap(async (provider, accountId, home, opts) => {
         await runAccountsSetHome(ctx, provider, accountId, home, opts);
@@ -8699,6 +8722,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<provider>", "claude | codex | grok")
         .argument("<account-id>", "Open-ended account id")
         .option("--home <path>", "Account home directory")
+        .option("--company <slug|uid>", "Company scope for the host-account-home flag")
         .option("--device-auth", "Use Codex device authentication instead of localhost callback")
         .action(wrap(async (provider, accountId, opts) => {
         await runAccountsLogin(ctx, provider, accountId, opts);

package/dist/lib/checkpoint-ontology/plan.d.ts

@@ -12,6 +12,13 @@ import { type OntologyCompany } from "./company.js";
 export declare const ONTOLOGY_FLAG = "checkpoint.ontology";
 export declare const SHARED_INPUTS_FLAG = "checkpoint.ontology.shared-inputs";
 export declare const COMPANY_BRIEF_FLAG = "checkpoint.ontology.company-brief";
+export declare const IGNORE_ANNOTATIONS_FLAG = "checkpoint.ontology.ignore-annotations";
+/**
+ * With `--backend auto`, `hq core checkpoint` tries grok first for this
+ * company. Read here, in the detached sibling, and recorded in the company's
+ * state directory, so the foreground checkpoint makes no network call.
+ */
+export declare const GROK_BACKEND_FLAG = "checkpoint.ontology.grok-backend";
 export declare const PLAN_FILE = "ontology-plan.json";
 export declare const CANDIDATES_FILE = "ontology-candidates.json";
 export declare const REPORT_FILE = "ontology-report.json";
@@ -59,6 +66,8 @@ export interface PlanInput {
     } | null;
     /** For signals: `entity_refs` items with no entity file yet. */
     missing_refs?: string[];
+    /** Run-directory-relative copy of `path` with annotator entity lists removed; same line numbers. */
+    read_path?: string;
 }
 export interface OntologyPlan {
     schema: typeof PLAN_SCHEMA;
@@ -112,9 +121,13 @@ export type PlanOutcome = {
     planPath: string;
     companyBrief?: CompanyBriefResult;
 };
+export declare const READ_PATH_INSTRUCTION = "When an input has read_path, read that file (relative to the run directory) instead of path, with the same line range. It is the same text with an older annotator's entity lists and entity links removed.";
 export declare function ledgerPath(hqRoot: string, company: OntologyCompany): string;
 export declare function readLedger(hqRoot: string, company: OntologyCompany): Ledger | null;
 export declare function writeLedger(hqRoot: string, company: OntologyCompany, ledger: Ledger): void;
+export declare function backendPreferencePath(hqRoot: string, company: OntologyCompany): string;
+/** The grok-backend flag value the last plan recorded; false when no plan has recorded one. */
+export declare function readBackendPreference(hqRoot: string, company: OntologyCompany): boolean;
 /** Company-relative paths of the payload's touched files that are inside this company. */
 export declare function sessionTouched(hqRoot: string, company: OntologyCompany, files: unknown): Set<string>;
 /** 1-based line ranges, each at most `chunkTokens` tokens (bytes / 4). */
@@ -130,4 +143,13 @@ export declare function refreshLedger(company: OntologyCompany, existing: Ledger
 };
 /** Plan this run. Never throws for a skip; returns the reason instead. */
 export declare function planOntologyRun(options: PlanOptions): Promise<PlanOutcome>;
+/**
+ * The cloud annotator wrote an `entities:` list into knowledge front matter and
+ * `[[ontology/entities/...]]` links into the text. Most are wrong, and a model
+ * told to ignore them still copies them (design section 18), so the model reads
+ * a copy without them. The list's lines are blanked rather than removed so the
+ * plan's line ranges still hold; a link becomes its label, or its last path
+ * segment. Returns null when the text has neither.
+ */
+export declare function stripAnnotations(text: string): string | null;
 //# sourceMappingURL=plan.d.ts.map

package/dist/lib/checkpoint-ontology/plan.js

@@ -16,6 +16,13 @@ import { buildEntityIndex, listKnowledgeFiles, listSignalFiles, readSignal } fro
 export const ONTOLOGY_FLAG = "checkpoint.ontology";
 export const SHARED_INPUTS_FLAG = "checkpoint.ontology.shared-inputs";
 export const COMPANY_BRIEF_FLAG = "checkpoint.ontology.company-brief";
+export const IGNORE_ANNOTATIONS_FLAG = "checkpoint.ontology.ignore-annotations";
+/**
+ * With `--backend auto`, `hq core checkpoint` tries grok first for this
+ * company. Read here, in the detached sibling, and recorded in the company's
+ * state directory, so the foreground checkpoint makes no network call.
+ */
+export const GROK_BACKEND_FLAG = "checkpoint.ontology.grok-backend";
 export const PLAN_FILE = "ontology-plan.json";
 export const CANDIDATES_FILE = "ontology-candidates.json";
 export const REPORT_FILE = "ontology-report.json";
@@ -27,6 +34,7 @@ export const BUDGET = {
     maxTokens: 60_000,
     chunkTokens: 12_000,
 };
+export const READ_PATH_INSTRUCTION = "When an input has read_path, read that file (relative to the run directory) instead of path, with the same line range. It is the same text with an older annotator's entity lists and entity links removed.";
 const CANDIDATE_INSTRUCTIONS = [
     `Write ${CANDIDATES_FILE} in the run directory as {"schema":"${CANDIDATES_SCHEMA}","candidates":[...]} and nothing else.`,
     "Each candidate: {input, type, name, aliases, confidence, evidence}. input is one of this plan's input ids; type is person, project, company or concept; name is the entity's full proper name; aliases are other names the input uses for it (at most 5); confidence is 0 to 1; evidence is a short quote from the input.",
@@ -61,6 +69,26 @@ export function writeLedger(hqRoot, company, ledger) {
     const target = ledgerPath(hqRoot, company);
     safeWriteFile(hqRoot, [stateRoot(hqRoot, company)], target, `${JSON.stringify(ledger, null, 2)}\n`);
 }
+export function backendPreferencePath(hqRoot, company) {
+    return path.join(stateRoot(hqRoot, company), "backend.json");
+}
+/** The grok-backend flag value the last plan recorded; false when no plan has recorded one. */
+export function readBackendPreference(hqRoot, company) {
+    let raw;
+    try {
+        raw = fs.readFileSync(backendPreferencePath(hqRoot, company), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+    return JSON.parse(raw)?.prefer_grok === true;
+}
+function recordBackendPreference(hqRoot, company, preferGrok) {
+    const target = backendPreferencePath(hqRoot, company);
+    safeWriteFile(hqRoot, [stateRoot(hqRoot, company)], target, `${JSON.stringify({ prefer_grok: preferGrok })}\n`);
+}
 /** Company-relative paths of the payload's touched files that are inside this company. */
 export function sessionTouched(hqRoot, company, files) {
     const out = new Set();
@@ -172,13 +200,18 @@ export async function planOntologyRun(options) {
     if (!resolution.ok)
         return { status: "skipped", reason: resolution.reason };
     const company = resolution.company;
-    if (!(await options.readFlag(ONTOLOGY_FLAG, company)))
+    if (!(await options.readFlag(ONTOLOGY_FLAG, company))) {
+        // A preference recorded while the ontology was on must not outlive it.
+        fs.rmSync(backendPreferencePath(hqRoot, company), { force: true });
         return { status: "skipped", reason: "flag off" };
+    }
     const sharedInputs = await options.readFlag(SHARED_INPUTS_FLAG, company);
     // Before the ledger, so a nothing-changed plan still records the brief.
     const companyBrief = (await options.readFlag(COMPANY_BRIEF_FLAG, company))
         ? writeCompanyBrief(hqRoot, company, options.now ?? new Date())
         : undefined;
+    const ignoreAnnotations = await options.readFlag(IGNORE_ANNOTATIONS_FLAG, company);
+    recordBackendPreference(hqRoot, company, await options.readFlag(GROK_BACKEND_FLAG, company));
     const touched = sessionTouched(hqRoot, company, payload.files);
     const { ledger, firstRun } = refreshLedger(company, readLedger(hqRoot, company), touched, sharedInputs);
     const pending = Object.entries(ledger.entries)
@@ -192,9 +225,16 @@ export async function planOntologyRun(options) {
             remaining += 1;
             continue;
         }
-        const lines = fs.readFileSync(path.join(company.dir, rel), "utf8").split("\n");
+        const text = fs.readFileSync(path.join(company.dir, rel), "utf8");
+        const lines = text.split("\n");
         const chunks = chunkLines(lines.join("\n"), BUDGET.chunkTokens);
         const kind = rel.startsWith("signals/") ? "signal" : "knowledge";
+        const cleaned = ignoreAnnotations && kind === "knowledge" ? stripAnnotations(text) : null;
+        const readPath = cleaned === null ? null : path.join(READ_COPY_DIR, rel);
+        if (readPath !== null) {
+            fs.mkdirSync(path.dirname(path.join(runDir, readPath)), { recursive: true });
+            fs.writeFileSync(path.join(runDir, readPath), cleaned);
+        }
         let index = entry.next_chunk ?? 0;
         for (; index < chunks.length; index += 1) {
             const [start, end] = chunks[index];
@@ -212,6 +252,7 @@ export async function planOntologyRun(options) {
                 lines: chunks.length > 1 ? [start, end] : null,
                 chunk: chunks.length > 1 ? { index, count: chunks.length } : null,
                 ...(kind === "signal" ? { missing_refs: missingRefs(company.dir, rel) } : {}),
+                ...(readPath !== null ? { read_path: readPath } : {}),
             });
             tokens += cost;
         }
@@ -267,13 +308,47 @@ export async function planOntologyRun(options) {
             planned_tokens: tokens,
         },
         candidates_file: CANDIDATES_FILE,
-        instructions: CANDIDATE_INSTRUCTIONS,
+        instructions: inputs.some((input) => input.read_path)
+            ? [...CANDIDATE_INSTRUCTIONS.slice(0, 3), READ_PATH_INSTRUCTION, ...CANDIDATE_INSTRUCTIONS.slice(3)]
+            : CANDIDATE_INSTRUCTIONS,
     };
     fs.mkdirSync(runDir, { recursive: true });
     const planPath = path.join(runDir, PLAN_FILE);
     fs.writeFileSync(planPath, `${JSON.stringify(plan, null, 2)}\n`);
     return companyBrief ? { status: "planned", plan, planPath, companyBrief } : { status: "planned", plan, planPath };
 }
+const READ_COPY_DIR = "ontology-inputs";
+/**
+ * The cloud annotator wrote an `entities:` list into knowledge front matter and
+ * `[[ontology/entities/...]]` links into the text. Most are wrong, and a model
+ * told to ignore them still copies them (design section 18), so the model reads
+ * a copy without them. The list's lines are blanked rather than removed so the
+ * plan's line ranges still hold; a link becomes its label, or its last path
+ * segment. Returns null when the text has neither.
+ */
+export function stripAnnotations(text) {
+    let out = text;
+    const front = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+    if (front && /^entities:/m.test(front[1])) {
+        let inList = false;
+        const body = front[1]
+            .split("\n")
+            .map((line) => {
+            if (/^entities:/.test(line))
+                inList = true;
+            else if (inList && /^\S/.test(line))
+                inList = false;
+            return inList ? "" : line;
+        })
+            .join("\n");
+        const start = text.indexOf("\n") + 1;
+        out = text.slice(0, start) + body + text.slice(start + front[1].length);
+    }
+    out = out
+        .replace(/\[\[ontology\/entities\/[^\]|\n]*\|([^\]\n]*)\]\]/g, "$1")
+        .replace(/\[\[ontology\/entities\/(?:[^\]\n]*\/)?([^\]/\n]*)\]\]/g, "$1");
+    return out === text ? null : out;
+}
 const SESSION_TEXT_MAX_BYTES = 8_000;
 /** The session summary, decisions and learnings from the payload, capped. */
 function sessionContent(payload) {

package/dist/lib/daemon/hq-cloud.d.ts

@@ -31,8 +31,21 @@ export interface HqCloudRunners {
     sessionHost: string | null;
 }
 export declare function hqCloudRunners(root: string, exists?: (p: string) => boolean): HqCloudRunners;
-/** Install the newest release of the bundled major version, never older than the bundled copy. */
-export declare function hqCloudInstallCommand(prefix: string, bundledVersion: string, platform?: NodeJS.Platform, pinnedVersion?: string): {
+/**
+ * Ask npm for every release of the bundled major version, no older than the
+ * bundled copy. The updater installs the newest one exactly: `npm install` with
+ * a range keeps an installed copy that already satisfies it, so a range alone
+ * never moves 6.18.1 to 6.18.2.
+ */
+export declare function hqCloudLatestCommand(bundledVersion: string, platform?: NodeJS.Platform): {
+    file: string;
+    args: string[];
+    shell: boolean;
+};
+/** The newest release in `npm view --json` output with the bundled major version, never older than it. */
+export declare function latestSameMajor(npmViewJson: string, bundledVersion: string): string | null;
+/** Install one exact hq-cloud version into the updater's folder. */
+export declare function hqCloudInstallCommand(prefix: string, version: string, platform?: NodeJS.Platform): {
     file: string;
     args: string[];
     shell: boolean;
@@ -48,6 +61,17 @@ export interface HqCloudUpdateOutcome {
     to: string | null;
     detail?: string;
 }
+export interface NpmRunResult {
+    status: number | null;
+    stdout?: string | null;
+    stderr?: string | null;
+    error?: Error;
+}
+export interface UpdateHqCloudDeps {
+    run?: (file: string, args: string[], shell: boolean, env: NodeJS.ProcessEnv) => NpmRunResult;
+    bundled?: HqCloudCopy | null;
+    platform?: NodeJS.Platform;
+}
 /** Install or update the updater's copy, as this (the login) user. */
-export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv): HqCloudUpdateOutcome;
+export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv, deps?: UpdateHqCloudDeps): HqCloudUpdateOutcome;
 //# sourceMappingURL=hq-cloud.d.ts.map

package/dist/lib/daemon/hq-cloud.js

@@ -61,18 +61,45 @@ export function hqCloudRunners(root, exists = fs.existsSync) {
         sessionHost: bin("outpost-session-host.js"),
     };
 }
-/** Install the newest release of the bundled major version, never older than the bundled copy. */
-export function hqCloudInstallCommand(prefix, bundledVersion, platform = process.platform, pinnedVersion) {
+/**
+ * Ask npm for every release of the bundled major version, no older than the
+ * bundled copy. The updater installs the newest one exactly: `npm install` with
+ * a range keeps an installed copy that already satisfies it, so a range alone
+ * never moves 6.18.1 to 6.18.2.
+ */
+export function hqCloudLatestCommand(bundledVersion, platform = process.platform) {
+    const plan = buildSpawnPlan("npm", ["view", `${HQ_CLOUD_PACKAGE}@^${bundledVersion}`, "version", "--json"], platform);
+    return { file: plan.cmd, args: plan.args, shell: plan.shell };
+}
+/** The newest release in `npm view --json` output with the bundled major version, never older than it. */
+export function latestSameMajor(npmViewJson, bundledVersion) {
+    const b = parseVersion(bundledVersion);
+    if (!b)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(npmViewJson);
+    }
+    catch {
+        return null;
+    }
+    const versions = typeof parsed === "string" ? [parsed] : Array.isArray(parsed) ? parsed : [];
+    let best = null;
+    for (const text of versions) {
+        if (typeof text !== "string" || !/^\d+\.\d+\.\d+$/.test(text))
+            continue;
+        const v = parseVersion(text);
+        if (v[0] !== b[0] || newer(b, v))
+            continue;
+        if (!best || newer(v, best.v))
+            best = { text, v };
+    }
+    return best?.text ?? null;
+}
+/** Install one exact hq-cloud version into the updater's folder. */
+export function hqCloudInstallCommand(prefix, version, platform = process.platform) {
     // npm is a .cmd on Windows and needs the shell, so every argument is quoted for it.
-    const plan = buildSpawnPlan("npm", [
-        "install",
-        "--prefix",
-        prefix,
-        "--no-audit",
-        "--no-fund",
-        "--omit=dev",
-        `${HQ_CLOUD_PACKAGE}@${pinnedVersion ?? `^${bundledVersion}`}`,
-    ], platform);
+    const plan = buildSpawnPlan("npm", ["install", "--prefix", prefix, "--no-audit", "--no-fund", "--omit=dev", `${HQ_CLOUD_PACKAGE}@${version}`], platform);
     return { file: plan.cmd, args: plan.args, shell: plan.shell };
 }
 export function readHqCloudCopy(root) {
@@ -99,10 +126,26 @@ export function currentHqCloud(daemonRoot) {
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
     return pickHqCloud(bundledHqCloud(), readHqCloudCopy(managedHqCloudRoot(daemonRoot)), (copy) => hqCloudRunners(copy.root).syncRunner !== null, pinnedVersion);
 }
+function runNpm(file, args, shell, env) {
+    return spawnSync(file, args, {
+        encoding: "utf8",
+        env,
+        timeout: 10 * 60_000,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        shell,
+    });
+}
+function npmFailure(r) {
+    const tail = `${r.stderr ?? ""}\n${r.stdout ?? ""}`.trim().split("\n").slice(-3).join(" ").slice(0, 400);
+    return tail || (r.error ? r.error.message : `npm exited ${r.status ?? "by signal"}`);
+}
 /** Install or update the updater's copy, as this (the login) user. */
-export function updateManagedHqCloud(daemonRoot, env) {
+export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
+    const run = deps.run ?? runNpm;
+    const platform = deps.platform ?? process.platform;
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
-    const bundled = bundledHqCloud();
+    const bundled = deps.bundled !== undefined ? deps.bundled : bundledHqCloud();
     const from = currentHqCloud(daemonRoot)?.version ?? null;
     if (!bundled)
         return { ok: false, from, to: null, detail: "this CLI install has no bundled hq-cloud to match" };
@@ -113,19 +156,22 @@ export function updateManagedHqCloud(daemonRoot, env) {
     catch (err) {
         return { ok: false, from, to: null, detail: `could not create ${prefix}: ${err instanceof Error ? err.message : String(err)}` };
     }
-    const cmd = hqCloudInstallCommand(prefix, bundled.version, process.platform, pinnedVersion);
-    const r = spawnSync(cmd.file, cmd.args, {
-        encoding: "utf8",
-        env,
-        timeout: 10 * 60_000,
-        stdio: ["ignore", "pipe", "pipe"],
-        windowsHide: true,
-        shell: cmd.shell,
-    });
-    if (r.status !== 0) {
-        const tail = `${r.stderr ?? ""}\n${r.stdout ?? ""}`.trim().split("\n").slice(-3).join(" ").slice(0, 400);
-        return { ok: false, from, to: null, detail: tail || (r.error ? r.error.message : `npm exited ${r.status ?? "by signal"}`) };
+    let version = pinnedVersion;
+    if (!version) {
+        const view = hqCloudLatestCommand(bundled.version, platform);
+        const r = run(view.file, view.args, view.shell, env);
+        if (r.status !== 0)
+            return { ok: false, from, to: null, detail: `could not look up the newest hq-cloud: ${npmFailure(r)}` };
+        const latest = latestSameMajor(r.stdout ?? "", bundled.version);
+        if (!latest) {
+            return { ok: false, from, to: null, detail: `npm listed no hq-cloud release at or above ${bundled.version} in the same major version` };
+        }
+        version = latest;
     }
+    const cmd = hqCloudInstallCommand(prefix, version, platform);
+    const r = run(cmd.file, cmd.args, cmd.shell, env);
+    if (r.status !== 0)
+        return { ok: false, from, to: null, detail: npmFailure(r) };
     return { ok: true, from, to: currentHqCloud(daemonRoot)?.version ?? null };
 }
 //# sourceMappingURL=hq-cloud.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.207.0",
+  "version": "5.209.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {