@indigoai-us/hq-cli 5.241.0 → 5.243.0

package/dist/commands/safe-extract.d.ts

@@ -32,6 +32,7 @@
  *     actually written (we do NOT rely solely on the pre-flight scan or on the
  *     tar binary's own protections).
  */
+import { execFileSync } from 'child_process';
 export interface ExtractCaps {
     /** Max total uncompressed bytes across all entries. Default 256 MiB. */
     maxUncompressedBytes: number;
@@ -109,9 +110,13 @@ export declare function resolveContainedPath(targetDir: string, entryName: strin
 export declare function assertLinkTargetContained(packDir: string, entryAbs: string, linkTarget: string): void;
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form — never a shell string — so a hostile filename can't break out.
+ * argv form, never a shell string, keeps hostile filenames out of shell syntax.
+ * When the default-off compatibility flag is enabled, Windows drive paths use
+ * a basename relative to the archive directory. GNU tar cannot parse `C:\\...`
+ * as remote `host:path`, and Windows' bundled bsdtar accepts the same relative
+ * argv without GNU-only `--force-local`.
  */
-export declare function listTarball(tarballPath: string): TarEntry[];
+export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'useRelativeWindowsDrivePath' | 'execFileSync'>): TarEntry[];
 /**
  * Pre-flight validation against the entry headers. Enforces (a) containment of
  * every entry name under `targetDir`, (b) containment of every link target
@@ -129,6 +134,10 @@ export declare function validateEntries(entries: TarEntry[], targetDir: string,
 export declare function assertExtractContained(stagingDir: string): void;
 export interface SafeExtractOptions {
     caps?: ExtractCaps;
+    /** Test seams for platform-specific argv construction; runtime gating uses hq-flags. */
+    platform?: NodeJS.Platform;
+    useRelativeWindowsDrivePath?: boolean;
+    execFileSync?: typeof execFileSync;
     /**
      * Test seam: invoked AFTER `tar` extracts into the staging dir but BEFORE
      * the post-extract sweep / atomic rename. Throwing here simulates a failure

package/dist/commands/safe-extract.js

@@ -35,6 +35,7 @@
 import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
+import { installPathCompatibilityEnabled } from '../lib/install-path-compatibility-flag.js';
 export const DEFAULT_CAPS = {
     // A content pack is docs/skills/policies/small scripts. 256 MiB is already
     // generous; anything larger is almost certainly a bomb or a mistake.
@@ -203,18 +204,34 @@ export function assertLinkTargetContained(packDir, entryAbs, linkTarget) {
             `"${linkTarget}" -> "${resolvedTarget}", outside pack dir "${path.resolve(packDir)}".`);
     }
 }
-// ---------------------------------------------------------------------------
-// Pre-flight: list entries, enforce containment + caps WITHOUT extracting
-// ---------------------------------------------------------------------------
+function tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath) {
+    if (platform === 'win32' &&
+        useRelativeWindowsDrivePath &&
+        /^[A-Za-z]:[\\/]/.test(tarballPath)) {
+        return {
+            archiveArg: path.win32.basename(tarballPath),
+            cwd: path.win32.dirname(tarballPath),
+        };
+    }
+    return { archiveArg: tarballPath };
+}
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form — never a shell string — so a hostile filename can't break out.
+ * argv form, never a shell string, keeps hostile filenames out of shell syntax.
+ * When the default-off compatibility flag is enabled, Windows drive paths use
+ * a basename relative to the archive directory. GNU tar cannot parse `C:\\...`
+ * as remote `host:path`, and Windows' bundled bsdtar accepts the same relative
+ * argv without GNU-only `--force-local`.
  */
-export function listTarball(tarballPath) {
-    const out = execFileSync('tar', ['-tvf', tarballPath], {
+export function listTarball(tarballPath, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? installPathCompatibilityEnabled();
+    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
+    const out = (opts.execFileSync ?? execFileSync)('tar', ['-tvf', location.archiveArg], {
         encoding: 'utf-8',
         maxBuffer: 64 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'pipe'],
+        ...(location.cwd ? { cwd: location.cwd } : {}),
     });
     return parseTarListing(out);
 }
@@ -311,8 +328,17 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
     if (fs.existsSync(finalDir)) {
         throw new Error(`safeExtractTarball: refusing to extract over existing dir "${finalDir}".`);
     }
+    // Resolve once so listing and extraction use the same archive location.
+    const platform = opts.platform ?? process.platform;
+    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? installPathCompatibilityEnabled();
+    const exec = opts.execFileSync ?? execFileSync;
+    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
     // 1. Pre-flight against headers (no bytes written yet).
-    const entries = listTarball(tarballPath);
+    const entries = listTarball(tarballPath, {
+        platform,
+        useRelativeWindowsDrivePath,
+        execFileSync: exec,
+    });
     validateEntries(entries, finalDir, caps);
     // 2. Sibling staging dir on the same filesystem so the rename is atomic.
     const parent = path.dirname(path.resolve(finalDir));
@@ -322,7 +348,10 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
         // `--no-same-owner` avoids chown surprises when run as root; argv form, no
         // shell. We deliberately re-extract here (not the pre-flight listing) and
         // re-validate after, rather than trusting tar to honor any single flag.
-        execFileSync('tar', ['-xzf', tarballPath, '-C', stagingDir, '--no-same-owner'], { stdio: 'inherit' });
+        exec('tar', ['-xzf', location.archiveArg, '-C', stagingDir, '--no-same-owner'], {
+            stdio: 'inherit',
+            ...(location.cwd ? { cwd: location.cwd } : {}),
+        });
         // 3. Independent backstop sweep over what actually landed.
         assertExtractContained(stagingDir);
         // 4. Failure-injection seam (tests).

package/dist/lib/auth-login-provider-state.d.ts

@@ -0,0 +1,8 @@
+import type { RememberedLoginProvider } from "../utils/login-provider.js";
+export declare const LOGIN_PROVIDER_STATE_FILE_NAME = "auth-login-provider.json";
+export declare function getLastLoginProviderStatePath(): string;
+/** Read only the provider preference; malformed or unknown state is ignored. */
+export declare function loadLastLoginProvider(): RememberedLoginProvider | undefined;
+/** Store only the provider name, clearing stale state when the choice is unknown. */
+export declare function storeLastLoginProvider(provider: RememberedLoginProvider | undefined): void;
+//# sourceMappingURL=auth-login-provider-state.d.ts.map

package/dist/lib/auth-login-provider-state.js

@@ -0,0 +1,63 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { personTokenCacheFile } from "../utils/cognito-session.js";
+export const LOGIN_PROVIDER_STATE_FILE_NAME = "auth-login-provider.json";
+export function getLastLoginProviderStatePath() {
+    return path.join(path.dirname(personTokenCacheFile()), LOGIN_PROVIDER_STATE_FILE_NAME);
+}
+function isRememberedProvider(value) {
+    return value === "google" || value === "microsoft";
+}
+/** Read only the provider preference; malformed or unknown state is ignored. */
+export function loadLastLoginProvider() {
+    let raw;
+    try {
+        raw = readFileSync(getLastLoginProviderStatePath(), "utf8");
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return undefined;
+        }
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const state = value;
+    const keys = Object.keys(state).sort();
+    if (keys.length !== 2
+        || keys[0] !== "lastProvider"
+        || keys[1] !== "schemaVersion"
+        || state.schemaVersion !== 1
+        || !isRememberedProvider(state.lastProvider)) {
+        return undefined;
+    }
+    return state.lastProvider;
+}
+/** Store only the provider name, clearing stale state when the choice is unknown. */
+export function storeLastLoginProvider(provider) {
+    const filePath = getLastLoginProviderStatePath();
+    if (!provider) {
+        rmSync(filePath, { force: true });
+        return;
+    }
+    const directory = path.dirname(filePath);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporaryPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        const state = { schemaVersion: 1, lastProvider: provider };
+        writeFileSync(temporaryPath, JSON.stringify(state), { mode: 0o600, flag: "wx" });
+        renameSync(temporaryPath, filePath);
+    }
+    finally {
+        rmSync(temporaryPath, { force: true });
+    }
+}
+//# sourceMappingURL=auth-login-provider-state.js.map

package/dist/lib/install-path-compatibility-flag.d.ts

@@ -0,0 +1,9 @@
+export declare const INSTALL_PATH_COMPATIBILITY_FLAG = "cli.install-path-compatibility";
+export declare const INSTALL_PATH_COMPATIBILITY_FALLBACK = false;
+/**
+ * Read the default-off rollout flag from the process snapshot. Missing,
+ * unreadable, or not-yet-loaded registry state keeps the compatibility fixes
+ * disabled until the operator enables a canary.
+ */
+export declare function installPathCompatibilityEnabled(): boolean;
+//# sourceMappingURL=install-path-compatibility-flag.d.ts.map

package/dist/lib/install-path-compatibility-flag.js

@@ -0,0 +1,12 @@
+import { resolveProcessFlagGate } from "./flag-registry.js";
+export const INSTALL_PATH_COMPATIBILITY_FLAG = "cli.install-path-compatibility";
+export const INSTALL_PATH_COMPATIBILITY_FALLBACK = false;
+/**
+ * Read the default-off rollout flag from the process snapshot. Missing,
+ * unreadable, or not-yet-loaded registry state keeps the compatibility fixes
+ * disabled until the operator enables a canary.
+ */
+export function installPathCompatibilityEnabled() {
+    return resolveProcessFlagGate(INSTALL_PATH_COMPATIBILITY_FLAG, {}, () => INSTALL_PATH_COMPATIBILITY_FALLBACK);
+}
+//# sourceMappingURL=install-path-compatibility-flag.js.map

package/dist/lib/lanes/dropbox.d.ts

@@ -10,13 +10,12 @@
 import * as fs from "node:fs";
 import { probeProviderCompactionsSince } from "./compaction.js";
 import { tryReadLane } from "./store.js";
-import { type LaneCompanyRef, type LaneRecord, type LaneState, type QuestionRecord } from "./types.js";
+import { type LaneRecord, type LaneState, type QuestionRecord } from "./types.js";
 export declare const DROPBOX_DIR = "dropbox";
 export declare const INBOX_NAME = "inbox.jsonl";
 export declare const DRAINING_DIR = "draining";
 export declare const DELIVERED_DIR = "delivered";
 export declare const INFLIGHT_DIR = "inflight";
-export { LANE_MESSAGE_COMPACTION_REPLAY_FLAG } from "./message-replay.js";
 export interface DropboxMessage {
     at?: string;
     message_id?: string;
@@ -59,10 +58,6 @@ export interface LaneDrainHookInput {
     hook_event_name?: string;
 }
 export interface RunDrainHookDeps {
-    readFlag?: (flag: string, options: {
-        company?: LaneCompanyRef | null;
-        env: NodeJS.ProcessEnv;
-    }) => Promise<boolean>;
     readLane?: typeof tryReadLane;
     probeCompactionsSince?: typeof probeProviderCompactionsSince;
 }

package/dist/lib/lanes/dropbox.js

@@ -12,8 +12,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { probeProviderCompactionsSince, providerTranscriptSize, } from "./compaction.js";
 import { LanesError } from "./errors.js";
-import { readLanesRegistryFlag } from "./registry-flag.js";
-import { LANE_MESSAGE_COMPACTION_REPLAY_FLAG, MESSAGE_COMPACTION_REPLAY_NOTE, MESSAGE_REPLAY_STATE_NAME, } from "./message-replay.js";
+import { MESSAGE_COMPACTION_REPLAY_NOTE, MESSAGE_REPLAY_STATE_NAME, } from "./message-replay.js";
 import { LANES_RUNS_REL, readProcStarttime } from "./spawn.js";
 import { tryReadLane } from "./store.js";
 export const DROPBOX_DIR = "dropbox";
@@ -21,7 +20,6 @@ export const INBOX_NAME = "inbox.jsonl";
 export const DRAINING_DIR = "draining";
 export const DELIVERED_DIR = "delivered";
 export const INFLIGHT_DIR = "inflight";
-export { LANE_MESSAGE_COMPACTION_REPLAY_FLAG } from "./message-replay.js";
 function defaultDrainDeps() {
     return {
         mkdirSync: fs.mkdirSync.bind(fs),
@@ -492,8 +490,8 @@ function readReplayState(filePath, turnId) {
         (state.flag_enabled !== undefined && typeof state.flag_enabled !== "boolean")) {
         throw new LanesError("message_replay_state_invalid", `Replay state ${filePath} does not match the current provider turn`);
     }
-    // Older state files persisted this per-turn cache. Accept it, but remove it
-    // before the next write so the flag is refreshed for every compaction.
+    // Older state files persisted the removed per-turn flag. Accept it, but
+    // remove it before the next write so the stale cache does not live on.
     delete state.flag_enabled;
     return state;
 }
@@ -602,12 +600,9 @@ export async function runDrainHook(env, input = {}, deps = {}) {
                             }
                             else if (delta.count > 0) {
                                 state.last_compaction_marker += delta.count;
-                                const flagEnabled = await (deps.readFlag ?? readLanesRegistryFlag)(LANE_MESSAGE_COMPACTION_REPLAY_FLAG, { company: lane.company, env });
-                                if (flagEnabled) {
-                                    replayed = deliveredMessagesForTurn(hqRoot, laneId, turnId);
-                                    if (replayed.length > 0)
-                                        replayNote = MESSAGE_COMPACTION_REPLAY_NOTE;
-                                }
+                                replayed = deliveredMessagesForTurn(hqRoot, laneId, turnId);
+                                if (replayed.length > 0)
+                                    replayNote = MESSAGE_COMPACTION_REPLAY_NOTE;
                             }
                         }
                     }

package/dist/lib/lanes/message-replay.d.ts

@@ -1,4 +1,3 @@
-export declare const LANE_MESSAGE_COMPACTION_REPLAY_FLAG = "lanes.message-compaction-replay";
 export declare const MESSAGE_REPLAY_STATE_NAME = "message-compaction-replay.json";
 export declare const MESSAGE_COMPACTION_REPLAY_NOTE = "These messages were delivered before a context compaction and still apply.";
 export interface MessageReplayState {

package/dist/lib/lanes/message-replay.js

@@ -1,4 +1,3 @@
-export const LANE_MESSAGE_COMPACTION_REPLAY_FLAG = "lanes.message-compaction-replay";
 export const MESSAGE_REPLAY_STATE_NAME = "message-compaction-replay.json";
 export const MESSAGE_COMPACTION_REPLAY_NOTE = "These messages were delivered before a context compaction and still apply.";
 //# sourceMappingURL=message-replay.js.map

package/dist/main.js

@@ -180,12 +180,15 @@ program.hook("preAction", async () => {
 export async function runCli() {
     const foregroundNetworkBudget = new ForegroundNetworkBudget();
     activeForegroundNetworkBudget = foregroundNetworkBudget;
-    // Begin one registry refresh without awaiting it. Every command gate reads
-    // only the client's held snapshot and falls back locally, so an offline or
-    // slow registry cannot delay command parsing or alter a command failure.
-    runGlobalNetworkLifecycle(process.argv, () => {
-        void kickFlagRegistryReadiness();
-    });
+    // Login must be usable before any identity or company is available, so do
+    // not make a pre-auth feature-flag request on this path. Other commands
+    // retain the shared asynchronous registry refresh.
+    const isAuthLogin = process.argv[2] === "auth" && process.argv[3] === "login";
+    if (!isAuthLogin) {
+        runGlobalNetworkLifecycle(process.argv, () => {
+            void kickFlagRegistryReadiness();
+        });
+    }
     // Set when a self-update re-exec'd this command on a newer CLI: the child
     // already did the work, so this process only has to carry its exit status
     // out (after the finally block's telemetry, hence not process.exit here).

package/dist/utils/login-provider.d.ts

@@ -5,7 +5,14 @@ declare const PROVIDER_TO_COGNITO_IDP: {
     readonly picker: undefined;
 };
 export type LoginProvider = keyof typeof PROVIDER_TO_COGNITO_IDP;
+export type RememberedLoginProvider = Exclude<LoginProvider, "picker">;
+export interface LoginProviderSelection {
+    config: CognitoAuthConfig;
+    providerToRemember?: RememberedLoginProvider;
+}
 export declare function parseLoginProvider(value: string | undefined): LoginProvider | undefined;
 export declare function cognitoConfigForLoginProvider(value: string | undefined): CognitoAuthConfig;
+/** Resolve CLI, environment, remembered, then first-login choice-page precedence. */
+export declare function resolveLoginProviderSelection(explicitProvider: string | undefined, env: NodeJS.ProcessEnv, rememberedProvider?: RememberedLoginProvider): LoginProviderSelection;
 export {};
 //# sourceMappingURL=login-provider.d.ts.map

package/dist/utils/login-provider.js

@@ -22,4 +22,38 @@ export function cognitoConfigForLoginProvider(value) {
         identityProvider: PROVIDER_TO_COGNITO_IDP[provider],
     };
 }
+function rememberedProviderForCognitoProvider(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (normalized === "google")
+        return "google";
+    if (normalized === "microsoft" || normalized === "microsoftpersonal")
+        return "microsoft";
+    return undefined;
+}
+/** Resolve CLI, environment, remembered, then first-login choice-page precedence. */
+export function resolveLoginProviderSelection(explicitProvider, env, rememberedProvider) {
+    if (explicitProvider !== undefined) {
+        const provider = parseLoginProvider(explicitProvider);
+        return {
+            config: cognitoConfigForLoginProvider(explicitProvider),
+            ...(provider && provider !== "picker" ? { providerToRemember: provider } : {}),
+        };
+    }
+    if (env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined) {
+        const identityProvider = env.HQ_COGNITO_IDENTITY_PROVIDER.trim() || undefined;
+        return {
+            config: { ...DEFAULT_COGNITO, identityProvider },
+            ...(rememberedProviderForCognitoProvider(identityProvider)
+                ? { providerToRemember: rememberedProviderForCognitoProvider(identityProvider) }
+                : {}),
+        };
+    }
+    if (rememberedProvider) {
+        return {
+            config: cognitoConfigForLoginProvider(rememberedProvider),
+            providerToRemember: rememberedProvider,
+        };
+    }
+    return { config: cognitoConfigForLoginProvider("picker") };
+}
 //# sourceMappingURL=login-provider.js.map

package/dist/utils/version-gate.d.ts

@@ -52,8 +52,8 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * on PATH:
  *
  *   $PNPM_HOME/hq                                        <- shim on PATH
- *   $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli <- symlink
- *   $PNPM_HOME/global/5/.pnpm/@indigoai-us+hq-cli@5.61.0/node_modules/…
+ *   pnpm through v10: $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli
+ *   pnpm v11+:       $PNPM_HOME/global/v11/<hash>/node_modules/@indigoai-us/hq-cli
  *
  * Both the symlinked and the resolved (`.pnpm`) form are recognised, because
  * whether `import.meta.url` reports the link or its target depends on how node
@@ -67,7 +67,7 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export declare function isPnpmManagedPackageDir(pkgDir: string): boolean;
+export declare function isPnpmManagedPackageDir(pkgDir: string, acceptVersionPrefixedGlobalDir?: boolean): boolean;
 /** Whether the running package lives inside Bun's global install tree. */
 export declare function isBunManagedPackageDir(pkgDir: string): boolean;
 /**

package/dist/utils/version-gate.js

@@ -28,6 +28,7 @@
  * to silence both check + gate).
  */
 import { spawnSync } from "node:child_process";
+import { installPathCompatibilityEnabled } from "../lib/install-path-compatibility-flag.js";
 import { buildSpawnPlan, quoteForWindowsShell } from "./windows-spawn.js";
 import { accessSync, closeSync, constants as fsConstants, existsSync, mkdtempSync, openSync, readdirSync, readFileSync, rmSync, } from "node:fs";
 import os from "node:os";
@@ -93,8 +94,8 @@ function pnpmHomeGlobalRoot() {
  * on PATH:
  *
  *   $PNPM_HOME/hq                                        <- shim on PATH
- *   $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli <- symlink
- *   $PNPM_HOME/global/5/.pnpm/@indigoai-us+hq-cli@5.61.0/node_modules/…
+ *   pnpm through v10: $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli
+ *   pnpm v11+:       $PNPM_HOME/global/v11/<hash>/node_modules/@indigoai-us/hq-cli
  *
  * Both the symlinked and the resolved (`.pnpm`) form are recognised, because
  * whether `import.meta.url` reports the link or its target depends on how node
@@ -108,18 +109,26 @@ function pnpmHomeGlobalRoot() {
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export function isPnpmManagedPackageDir(pkgDir) {
+export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir = false) {
     const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
     const segments = normalized.split("/").filter(Boolean);
-    // `global/<digits>` — pnpm's global root, in either the symlinked or the
-    // resolved (`.pnpm`) form, and independent of where PNPM_HOME points.
+    // pnpm through v10 uses `global/<digits>`; pnpm v11+ uses
+    // `global/v<major>`. Keep the newer form behind the default-off rollout
+    // flag, and require a documented version segment so `global/next` or a
+    // `v11` directory elsewhere cannot be mistaken for a global install.
     for (let i = 0; i < segments.length - 1; i += 1) {
-        if (segments[i] === "global" && /^\d+$/.test(segments[i + 1]))
+        if (segments[i] !== "global")
+            continue;
+        const globalDirVersion = segments[i + 1];
+        if (/^\d+$/.test(globalDirVersion))
             return true;
+        if (acceptVersionPrefixedGlobalDir && /^v\d+$/.test(globalDirVersion)) {
+            return true;
+        }
     }
-    // Belt-and-braces for a future pnpm layout whose store dir is not numeric:
-    // anything under `$PNPM_HOME/global` is global by construction. Still keyed
-    // on the `global` segment so `$PNPM_HOME/store/**` (dlx caches) stays out.
+    // PNPM_HOME/global is pnpm's configured global root by construction, so
+    // keep this fallback in both flag states. The flag above gates only the new
+    // documented global/v<major> segment match outside that configured root.
     const globalRoot = pnpmHomeGlobalRoot();
     if (globalRoot) {
         if (normalized === globalRoot || normalized.startsWith(`${globalRoot}/`)) {
@@ -246,7 +255,7 @@ export function resolveRunningInstall() {
         const packageRoot = findRunningPackageRoot();
         if (!packageRoot)
             return { manager: "npm", prefix: null, packageRoot: null };
-        if (isPnpmManagedPackageDir(packageRoot)) {
+        if (isPnpmManagedPackageDir(packageRoot, installPathCompatibilityEnabled())) {
             return { manager: "pnpm", prefix: null, packageRoot };
         }
         if (isBunManagedPackageDir(packageRoot)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.241.0",
+  "version": "5.243.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -34,6 +34,7 @@
     "test:db": "vitest run src/lib/db test/commands/db.test.ts test/commands/db-tenant-isolation.test.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
+    "check:lanes-module-cycles": "node scripts/check-lanes-module-cycles.mjs",
     "vitest": "vitest",
     "clean": "rm -rf dist",
     "postinstall": "node scripts/mesh-daemon-if-stale.mjs || true",