@indigoai-us/hq-cli 5.242.0 → 5.244.0

package/dist/commands/safe-extract.d.ts

@@ -32,6 +32,7 @@
  *     actually written (we do NOT rely solely on the pre-flight scan or on the
  *     tar binary's own protections).
  */
+import { execFileSync } from 'child_process';
 export interface ExtractCaps {
     /** Max total uncompressed bytes across all entries. Default 256 MiB. */
     maxUncompressedBytes: number;
@@ -109,9 +110,13 @@ export declare function resolveContainedPath(targetDir: string, entryName: strin
 export declare function assertLinkTargetContained(packDir: string, entryAbs: string, linkTarget: string): void;
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form — never a shell string — so a hostile filename can't break out.
+ * argv form, never a shell string, keeps hostile filenames out of shell syntax.
+ * When the default-off compatibility flag is enabled, Windows drive paths use
+ * a basename relative to the archive directory. GNU tar cannot parse `C:\\...`
+ * as remote `host:path`, and Windows' bundled bsdtar accepts the same relative
+ * argv without GNU-only `--force-local`.
  */
-export declare function listTarball(tarballPath: string): TarEntry[];
+export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'useRelativeWindowsDrivePath' | 'execFileSync'>): TarEntry[];
 /**
  * Pre-flight validation against the entry headers. Enforces (a) containment of
  * every entry name under `targetDir`, (b) containment of every link target
@@ -129,6 +134,10 @@ export declare function validateEntries(entries: TarEntry[], targetDir: string,
 export declare function assertExtractContained(stagingDir: string): void;
 export interface SafeExtractOptions {
     caps?: ExtractCaps;
+    /** Test seams for platform-specific argv construction; runtime gating uses hq-flags. */
+    platform?: NodeJS.Platform;
+    useRelativeWindowsDrivePath?: boolean;
+    execFileSync?: typeof execFileSync;
     /**
      * Test seam: invoked AFTER `tar` extracts into the staging dir but BEFORE
      * the post-extract sweep / atomic rename. Throwing here simulates a failure

package/dist/commands/safe-extract.js

@@ -35,6 +35,7 @@
 import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
+import { installPathCompatibilityEnabled } from '../lib/install-path-compatibility-flag.js';
 export const DEFAULT_CAPS = {
     // A content pack is docs/skills/policies/small scripts. 256 MiB is already
     // generous; anything larger is almost certainly a bomb or a mistake.
@@ -203,18 +204,34 @@ export function assertLinkTargetContained(packDir, entryAbs, linkTarget) {
             `"${linkTarget}" -> "${resolvedTarget}", outside pack dir "${path.resolve(packDir)}".`);
     }
 }
-// ---------------------------------------------------------------------------
-// Pre-flight: list entries, enforce containment + caps WITHOUT extracting
-// ---------------------------------------------------------------------------
+function tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath) {
+    if (platform === 'win32' &&
+        useRelativeWindowsDrivePath &&
+        /^[A-Za-z]:[\\/]/.test(tarballPath)) {
+        return {
+            archiveArg: path.win32.basename(tarballPath),
+            cwd: path.win32.dirname(tarballPath),
+        };
+    }
+    return { archiveArg: tarballPath };
+}
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
- * argv form — never a shell string — so a hostile filename can't break out.
+ * argv form, never a shell string, keeps hostile filenames out of shell syntax.
+ * When the default-off compatibility flag is enabled, Windows drive paths use
+ * a basename relative to the archive directory. GNU tar cannot parse `C:\\...`
+ * as remote `host:path`, and Windows' bundled bsdtar accepts the same relative
+ * argv without GNU-only `--force-local`.
  */
-export function listTarball(tarballPath) {
-    const out = execFileSync('tar', ['-tvf', tarballPath], {
+export function listTarball(tarballPath, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? installPathCompatibilityEnabled();
+    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
+    const out = (opts.execFileSync ?? execFileSync)('tar', ['-tvf', location.archiveArg], {
         encoding: 'utf-8',
         maxBuffer: 64 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'pipe'],
+        ...(location.cwd ? { cwd: location.cwd } : {}),
     });
     return parseTarListing(out);
 }
@@ -311,8 +328,17 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
     if (fs.existsSync(finalDir)) {
         throw new Error(`safeExtractTarball: refusing to extract over existing dir "${finalDir}".`);
     }
+    // Resolve once so listing and extraction use the same archive location.
+    const platform = opts.platform ?? process.platform;
+    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? installPathCompatibilityEnabled();
+    const exec = opts.execFileSync ?? execFileSync;
+    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
     // 1. Pre-flight against headers (no bytes written yet).
-    const entries = listTarball(tarballPath);
+    const entries = listTarball(tarballPath, {
+        platform,
+        useRelativeWindowsDrivePath,
+        execFileSync: exec,
+    });
     validateEntries(entries, finalDir, caps);
     // 2. Sibling staging dir on the same filesystem so the rename is atomic.
     const parent = path.dirname(path.resolve(finalDir));
@@ -322,7 +348,10 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
         // `--no-same-owner` avoids chown surprises when run as root; argv form, no
         // shell. We deliberately re-extract here (not the pre-flight listing) and
         // re-validate after, rather than trusting tar to honor any single flag.
-        execFileSync('tar', ['-xzf', tarballPath, '-C', stagingDir, '--no-same-owner'], { stdio: 'inherit' });
+        exec('tar', ['-xzf', location.archiveArg, '-C', stagingDir, '--no-same-owner'], {
+            stdio: 'inherit',
+            ...(location.cwd ? { cwd: location.cwd } : {}),
+        });
         // 3. Independent backstop sweep over what actually landed.
         assertExtractContained(stagingDir);
         // 4. Failure-injection seam (tests).

package/dist/lib/auth-login-provider-state.d.ts

@@ -0,0 +1,8 @@
+import type { RememberedLoginProvider } from "../utils/login-provider.js";
+export declare const LOGIN_PROVIDER_STATE_FILE_NAME = "auth-login-provider.json";
+export declare function getLastLoginProviderStatePath(): string;
+/** Read only the provider preference; malformed or unknown state is ignored. */
+export declare function loadLastLoginProvider(): RememberedLoginProvider | undefined;
+/** Store only the provider name, clearing stale state when the choice is unknown. */
+export declare function storeLastLoginProvider(provider: RememberedLoginProvider | undefined): void;
+//# sourceMappingURL=auth-login-provider-state.d.ts.map

package/dist/lib/auth-login-provider-state.js

@@ -0,0 +1,63 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { personTokenCacheFile } from "../utils/cognito-session.js";
+export const LOGIN_PROVIDER_STATE_FILE_NAME = "auth-login-provider.json";
+export function getLastLoginProviderStatePath() {
+    return path.join(path.dirname(personTokenCacheFile()), LOGIN_PROVIDER_STATE_FILE_NAME);
+}
+function isRememberedProvider(value) {
+    return value === "google" || value === "microsoft";
+}
+/** Read only the provider preference; malformed or unknown state is ignored. */
+export function loadLastLoginProvider() {
+    let raw;
+    try {
+        raw = readFileSync(getLastLoginProviderStatePath(), "utf8");
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return undefined;
+        }
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const state = value;
+    const keys = Object.keys(state).sort();
+    if (keys.length !== 2
+        || keys[0] !== "lastProvider"
+        || keys[1] !== "schemaVersion"
+        || state.schemaVersion !== 1
+        || !isRememberedProvider(state.lastProvider)) {
+        return undefined;
+    }
+    return state.lastProvider;
+}
+/** Store only the provider name, clearing stale state when the choice is unknown. */
+export function storeLastLoginProvider(provider) {
+    const filePath = getLastLoginProviderStatePath();
+    if (!provider) {
+        rmSync(filePath, { force: true });
+        return;
+    }
+    const directory = path.dirname(filePath);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporaryPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        const state = { schemaVersion: 1, lastProvider: provider };
+        writeFileSync(temporaryPath, JSON.stringify(state), { mode: 0o600, flag: "wx" });
+        renameSync(temporaryPath, filePath);
+    }
+    finally {
+        rmSync(temporaryPath, { force: true });
+    }
+}
+//# sourceMappingURL=auth-login-provider-state.js.map

package/dist/lib/bot/progress.d.ts

@@ -27,9 +27,6 @@ export declare const PROGRESS_COALESCE_MS = 2000;
 export declare const PROGRESS_MIN_GAP_MS = 4000;
 export declare const WORKING_NOTICE_MS = 60000;
 export declare const WORKING_NOTICE_TEXT = "Working on it \u2014 I'll reply here when it's done.";
-/** The setup bot's heads-up, sent once when a turn runs past SETUP_WORKING_NOTICE_MS. */
-export declare const SETUP_WORKING_NOTICE_MS = 30000;
-export declare const SETUP_WORKING_NOTICE_TEXT = "This one takes a minute. I'll reply here as soon as it's done.";
 export interface ProgressPosterOptions {
     /** Post one message; resolve true when it was delivered. */
     send: (body: string) => Promise<boolean>;

package/dist/lib/bot/progress.js

@@ -27,9 +27,6 @@ export const PROGRESS_COALESCE_MS = 2_000;
 export const PROGRESS_MIN_GAP_MS = 4_000;
 export const WORKING_NOTICE_MS = 60_000;
 export const WORKING_NOTICE_TEXT = "Working on it — I'll reply here when it's done.";
-/** The setup bot's heads-up, sent once when a turn runs past SETUP_WORKING_NOTICE_MS. */
-export const SETUP_WORKING_NOTICE_MS = 30_000;
-export const SETUP_WORKING_NOTICE_TEXT = "This one takes a minute. I'll reply here as soon as it's done.";
 /** Whitespace-insensitive form used to recognise repeated text. */
 export function normalizeForCompare(text) {
     return text.replace(/\s+/g, "");

package/dist/lib/bot/run.js

@@ -57,7 +57,7 @@ import { ensureBotSessionMeta } from "./company-bind.js";
 import { readBotCredsIdentity } from "./creds.js";
 import { isProcessed, markProcessed, readInboxState } from "./inbox-state.js";
 import { clearInflight, patchInflight, readInflight, readInflightTurns, writeInflight } from "./inflight.js";
-import { containsNoReplySentinel, ProgressPoster, SETUP_WORKING_NOTICE_MS, SETUP_WORKING_NOTICE_TEXT, } from "./progress.js";
+import { containsNoReplySentinel, ProgressPoster, } from "./progress.js";
 import { splitBody } from "./split.js";
 import { createBotLogger } from "./log.js";
 import { buildSystemPrompt, introDmText, readPromptSources } from "./prompt.js";
@@ -737,12 +737,11 @@ export async function runBot(deps) {
         };
         const poster = new ProgressPoster({
             // The setup bot talks to someone new to HQ: its notes to itself never
-            // reach them, and a long step gets a heads-up instead of silence.
-            ...(isSetupBot
-                ? { dropPreToolMessages: true, workingNoticeMs: SETUP_WORKING_NOTICE_MS, workingNoticeText: SETUP_WORKING_NOTICE_TEXT }
-                : {}),
+            // reach them, and it posts no "still working" notice either — the
+            // desktop app shows that the bot is working.
+            ...(isSetupBot ? { dropPreToolMessages: true } : {}),
             ...deps.progress,
-            ...(args.workingNotice === false || silenceable ? { workingNoticeMs: 0 } : {}),
+            ...(args.workingNotice === false || silenceable || isSetupBot ? { workingNoticeMs: 0 } : {}),
             ...(silenceable ? { buffer: true } : {}),
             send: makeSendFn(args.send),
             ...(args.sendFinal ? { sendFinal: makeSendFn(args.sendFinal) } : {}),
@@ -1458,7 +1457,6 @@ export async function runBot(deps) {
             tReceived,
             send,
             sendFinal,
-            // The setup bot's own notice (SETUP_WORKING_NOTICE_TEXT) is set where the poster is built.
             silenceable: target.kind === "room" && !target.mentioned,
             ...(readDirs.length ? { readDirs } : {}),
             ...(target.kind === "room"

package/dist/lib/install-path-compatibility-flag.d.ts

@@ -0,0 +1,9 @@
+export declare const INSTALL_PATH_COMPATIBILITY_FLAG = "cli.install-path-compatibility";
+export declare const INSTALL_PATH_COMPATIBILITY_FALLBACK = false;
+/**
+ * Read the default-off rollout flag from the process snapshot. Missing,
+ * unreadable, or not-yet-loaded registry state keeps the compatibility fixes
+ * disabled until the operator enables a canary.
+ */
+export declare function installPathCompatibilityEnabled(): boolean;
+//# sourceMappingURL=install-path-compatibility-flag.d.ts.map

package/dist/lib/install-path-compatibility-flag.js

@@ -0,0 +1,12 @@
+import { resolveProcessFlagGate } from "./flag-registry.js";
+export const INSTALL_PATH_COMPATIBILITY_FLAG = "cli.install-path-compatibility";
+export const INSTALL_PATH_COMPATIBILITY_FALLBACK = false;
+/**
+ * Read the default-off rollout flag from the process snapshot. Missing,
+ * unreadable, or not-yet-loaded registry state keeps the compatibility fixes
+ * disabled until the operator enables a canary.
+ */
+export function installPathCompatibilityEnabled() {
+    return resolveProcessFlagGate(INSTALL_PATH_COMPATIBILITY_FLAG, {}, () => INSTALL_PATH_COMPATIBILITY_FALLBACK);
+}
+//# sourceMappingURL=install-path-compatibility-flag.js.map

package/dist/main.js

@@ -180,12 +180,15 @@ program.hook("preAction", async () => {
 export async function runCli() {
     const foregroundNetworkBudget = new ForegroundNetworkBudget();
     activeForegroundNetworkBudget = foregroundNetworkBudget;
-    // Begin one registry refresh without awaiting it. Every command gate reads
-    // only the client's held snapshot and falls back locally, so an offline or
-    // slow registry cannot delay command parsing or alter a command failure.
-    runGlobalNetworkLifecycle(process.argv, () => {
-        void kickFlagRegistryReadiness();
-    });
+    // Login must be usable before any identity or company is available, so do
+    // not make a pre-auth feature-flag request on this path. Other commands
+    // retain the shared asynchronous registry refresh.
+    const isAuthLogin = process.argv[2] === "auth" && process.argv[3] === "login";
+    if (!isAuthLogin) {
+        runGlobalNetworkLifecycle(process.argv, () => {
+            void kickFlagRegistryReadiness();
+        });
+    }
     // Set when a self-update re-exec'd this command on a newer CLI: the child
     // already did the work, so this process only has to carry its exit status
     // out (after the finally block's telemetry, hence not process.exit here).

package/dist/utils/cognito-session.js

@@ -29,6 +29,7 @@ import { loadCachedTokens, isExpiring, refreshTokens, saveCachedTokens, browserL
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 import { daemonDir } from "../lib/mesh/live/daemon/paths.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
+import { acquireLockFileExclusively } from "./exclusive-lock.js";
 // Re-export the cached-session primitives for callers that must deliberately
 // avoid the refresh/login behavior in the higher-level helpers below.
 export { isExpiring, isMachineIdentity, loadCachedTokens };
@@ -557,7 +558,7 @@ async function withAbortablePersonRefreshLock(signal, fn) {
         for (;;) {
             throwIfAborted(signal);
             try {
-                fs.linkSync(candidate, lockFile);
+                acquireLockFileExclusively(candidate, lockFile, stateDir);
                 held = true;
                 break;
             }

package/dist/utils/exclusive-lock.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Acquiring a lock file on a filesystem that may not do hard links.
+ *
+ * The refresh lock is a classic POSIX `link()` lock: write a candidate file,
+ * hard-link it into place, and let EEXIST mean somebody else holds it. That
+ * is atomic on a local disk and on NFS, and it is simply absent on CIFS/SMB
+ * — Azure Files returns ENOTSUP for `link()` on every call, so a bot whose
+ * agent home lives on such a share could never mint a token at all. Its
+ * probe failed every line with:
+ *
+ *     ENOTSUP: operation not supported on socket, link
+ *       '.../cognito-tokens.json.lock.candidate.48560...' -> '.../lock'
+ *
+ * An exclusive create (`open(..., O_EXCL)`) gives the same guarantee — the
+ * server refuses the second creator — and works on those shares. So the link
+ * is tried first, and a filesystem that says it cannot do links is remembered
+ * and switched to the exclusive-create path for the rest of the process.
+ *
+ * Both paths fail with EEXIST when the lock is held, so contention, stale-
+ * owner reclamation and release are unchanged for every caller.
+ */
+/** Test seam: forget what we learned about which filesystems do links. */
+export declare function resetLinkSupportCache(): void;
+/**
+ * Create `lockFile` exclusively, or throw EEXIST if it already exists.
+ *
+ * `candidate` is an already-written file holding the owner's pid; on a
+ * link-capable filesystem it becomes the lock, and otherwise its contents
+ * are written directly. Either way the lock ends up holding the same bytes.
+ */
+export declare function acquireLockFileExclusively(candidate: string, lockFile: string, dirKey: string): void;
+//# sourceMappingURL=exclusive-lock.d.ts.map

package/dist/utils/exclusive-lock.js

@@ -0,0 +1,75 @@
+/**
+ * Acquiring a lock file on a filesystem that may not do hard links.
+ *
+ * The refresh lock is a classic POSIX `link()` lock: write a candidate file,
+ * hard-link it into place, and let EEXIST mean somebody else holds it. That
+ * is atomic on a local disk and on NFS, and it is simply absent on CIFS/SMB
+ * — Azure Files returns ENOTSUP for `link()` on every call, so a bot whose
+ * agent home lives on such a share could never mint a token at all. Its
+ * probe failed every line with:
+ *
+ *     ENOTSUP: operation not supported on socket, link
+ *       '.../cognito-tokens.json.lock.candidate.48560...' -> '.../lock'
+ *
+ * An exclusive create (`open(..., O_EXCL)`) gives the same guarantee — the
+ * server refuses the second creator — and works on those shares. So the link
+ * is tried first, and a filesystem that says it cannot do links is remembered
+ * and switched to the exclusive-create path for the rest of the process.
+ *
+ * Both paths fail with EEXIST when the lock is held, so contention, stale-
+ * owner reclamation and release are unchanged for every caller.
+ */
+import * as fs from "fs";
+/**
+ * `link()` errnos that mean "this filesystem does not implement links"
+ * rather than "the link failed". EEXIST is deliberately NOT here: that is
+ * ordinary contention and the caller's own retry loop owns it.
+ */
+const LINK_UNSUPPORTED_CODES = new Set([
+    "ENOTSUP",
+    "EOPNOTSUPP",
+    "EPERM",
+    "EXDEV",
+    "EACCES",
+]);
+/**
+ * Per-process, per-directory memory of a filesystem that cannot hard-link,
+ * so the cost is one failed call rather than one per acquisition.
+ */
+const linkUnsupportedDirs = new Set();
+/** Test seam: forget what we learned about which filesystems do links. */
+export function resetLinkSupportCache() {
+    linkUnsupportedDirs.clear();
+}
+/**
+ * Create `lockFile` exclusively, or throw EEXIST if it already exists.
+ *
+ * `candidate` is an already-written file holding the owner's pid; on a
+ * link-capable filesystem it becomes the lock, and otherwise its contents
+ * are written directly. Either way the lock ends up holding the same bytes.
+ */
+export function acquireLockFileExclusively(candidate, lockFile, dirKey) {
+    if (!linkUnsupportedDirs.has(dirKey)) {
+        try {
+            fs.linkSync(candidate, lockFile);
+            return;
+        }
+        catch (error) {
+            const code = error.code ?? "";
+            // Contention is the caller's business, and an unrecognised failure is
+            // a real fault: neither one means "try the other strategy".
+            if (code === "EEXIST")
+                throw error;
+            if (!LINK_UNSUPPORTED_CODES.has(code))
+                throw error;
+            linkUnsupportedDirs.add(dirKey);
+        }
+    }
+    // O_EXCL: the create fails with EEXIST if anyone got there first, which is
+    // exactly the signal the link path produced.
+    fs.writeFileSync(lockFile, fs.readFileSync(candidate), {
+        flag: "wx",
+        mode: 0o600,
+    });
+}
+//# sourceMappingURL=exclusive-lock.js.map

package/dist/utils/login-provider.d.ts

@@ -5,7 +5,14 @@ declare const PROVIDER_TO_COGNITO_IDP: {
     readonly picker: undefined;
 };
 export type LoginProvider = keyof typeof PROVIDER_TO_COGNITO_IDP;
+export type RememberedLoginProvider = Exclude<LoginProvider, "picker">;
+export interface LoginProviderSelection {
+    config: CognitoAuthConfig;
+    providerToRemember?: RememberedLoginProvider;
+}
 export declare function parseLoginProvider(value: string | undefined): LoginProvider | undefined;
 export declare function cognitoConfigForLoginProvider(value: string | undefined): CognitoAuthConfig;
+/** Resolve CLI, environment, remembered, then first-login choice-page precedence. */
+export declare function resolveLoginProviderSelection(explicitProvider: string | undefined, env: NodeJS.ProcessEnv, rememberedProvider?: RememberedLoginProvider): LoginProviderSelection;
 export {};
 //# sourceMappingURL=login-provider.d.ts.map

package/dist/utils/login-provider.js

@@ -22,4 +22,38 @@ export function cognitoConfigForLoginProvider(value) {
         identityProvider: PROVIDER_TO_COGNITO_IDP[provider],
     };
 }
+function rememberedProviderForCognitoProvider(value) {
+    const normalized = value?.trim().toLowerCase();
+    if (normalized === "google")
+        return "google";
+    if (normalized === "microsoft" || normalized === "microsoftpersonal")
+        return "microsoft";
+    return undefined;
+}
+/** Resolve CLI, environment, remembered, then first-login choice-page precedence. */
+export function resolveLoginProviderSelection(explicitProvider, env, rememberedProvider) {
+    if (explicitProvider !== undefined) {
+        const provider = parseLoginProvider(explicitProvider);
+        return {
+            config: cognitoConfigForLoginProvider(explicitProvider),
+            ...(provider && provider !== "picker" ? { providerToRemember: provider } : {}),
+        };
+    }
+    if (env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined) {
+        const identityProvider = env.HQ_COGNITO_IDENTITY_PROVIDER.trim() || undefined;
+        return {
+            config: { ...DEFAULT_COGNITO, identityProvider },
+            ...(rememberedProviderForCognitoProvider(identityProvider)
+                ? { providerToRemember: rememberedProviderForCognitoProvider(identityProvider) }
+                : {}),
+        };
+    }
+    if (rememberedProvider) {
+        return {
+            config: cognitoConfigForLoginProvider(rememberedProvider),
+            providerToRemember: rememberedProvider,
+        };
+    }
+    return { config: cognitoConfigForLoginProvider("picker") };
+}
 //# sourceMappingURL=login-provider.js.map

package/dist/utils/version-gate.d.ts

@@ -52,8 +52,8 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * on PATH:
  *
  *   $PNPM_HOME/hq                                        <- shim on PATH
- *   $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli <- symlink
- *   $PNPM_HOME/global/5/.pnpm/@indigoai-us+hq-cli@5.61.0/node_modules/…
+ *   pnpm through v10: $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli
+ *   pnpm v11+:       $PNPM_HOME/global/v11/<hash>/node_modules/@indigoai-us/hq-cli
  *
  * Both the symlinked and the resolved (`.pnpm`) form are recognised, because
  * whether `import.meta.url` reports the link or its target depends on how node
@@ -67,7 +67,7 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export declare function isPnpmManagedPackageDir(pkgDir: string): boolean;
+export declare function isPnpmManagedPackageDir(pkgDir: string, acceptVersionPrefixedGlobalDir?: boolean): boolean;
 /** Whether the running package lives inside Bun's global install tree. */
 export declare function isBunManagedPackageDir(pkgDir: string): boolean;
 /**

package/dist/utils/version-gate.js

@@ -28,6 +28,7 @@
  * to silence both check + gate).
  */
 import { spawnSync } from "node:child_process";
+import { installPathCompatibilityEnabled } from "../lib/install-path-compatibility-flag.js";
 import { buildSpawnPlan, quoteForWindowsShell } from "./windows-spawn.js";
 import { accessSync, closeSync, constants as fsConstants, existsSync, mkdtempSync, openSync, readdirSync, readFileSync, rmSync, } from "node:fs";
 import os from "node:os";
@@ -93,8 +94,8 @@ function pnpmHomeGlobalRoot() {
  * on PATH:
  *
  *   $PNPM_HOME/hq                                        <- shim on PATH
- *   $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli <- symlink
- *   $PNPM_HOME/global/5/.pnpm/@indigoai-us+hq-cli@5.61.0/node_modules/…
+ *   pnpm through v10: $PNPM_HOME/global/5/node_modules/@indigoai-us/hq-cli
+ *   pnpm v11+:       $PNPM_HOME/global/v11/<hash>/node_modules/@indigoai-us/hq-cli
  *
  * Both the symlinked and the resolved (`.pnpm`) form are recognised, because
  * whether `import.meta.url` reports the link or its target depends on how node
@@ -108,18 +109,26 @@ function pnpmHomeGlobalRoot() {
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export function isPnpmManagedPackageDir(pkgDir) {
+export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir = false) {
     const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
     const segments = normalized.split("/").filter(Boolean);
-    // `global/<digits>` — pnpm's global root, in either the symlinked or the
-    // resolved (`.pnpm`) form, and independent of where PNPM_HOME points.
+    // pnpm through v10 uses `global/<digits>`; pnpm v11+ uses
+    // `global/v<major>`. Keep the newer form behind the default-off rollout
+    // flag, and require a documented version segment so `global/next` or a
+    // `v11` directory elsewhere cannot be mistaken for a global install.
     for (let i = 0; i < segments.length - 1; i += 1) {
-        if (segments[i] === "global" && /^\d+$/.test(segments[i + 1]))
+        if (segments[i] !== "global")
+            continue;
+        const globalDirVersion = segments[i + 1];
+        if (/^\d+$/.test(globalDirVersion))
             return true;
+        if (acceptVersionPrefixedGlobalDir && /^v\d+$/.test(globalDirVersion)) {
+            return true;
+        }
     }
-    // Belt-and-braces for a future pnpm layout whose store dir is not numeric:
-    // anything under `$PNPM_HOME/global` is global by construction. Still keyed
-    // on the `global` segment so `$PNPM_HOME/store/**` (dlx caches) stays out.
+    // PNPM_HOME/global is pnpm's configured global root by construction, so
+    // keep this fallback in both flag states. The flag above gates only the new
+    // documented global/v<major> segment match outside that configured root.
     const globalRoot = pnpmHomeGlobalRoot();
     if (globalRoot) {
         if (normalized === globalRoot || normalized.startsWith(`${globalRoot}/`)) {
@@ -246,7 +255,7 @@ export function resolveRunningInstall() {
         const packageRoot = findRunningPackageRoot();
         if (!packageRoot)
             return { manager: "npm", prefix: null, packageRoot: null };
-        if (isPnpmManagedPackageDir(packageRoot)) {
+        if (isPnpmManagedPackageDir(packageRoot, installPathCompatibilityEnabled())) {
             return { manager: "pnpm", prefix: null, packageRoot };
         }
         if (isBunManagedPackageDir(packageRoot)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.242.0",
+  "version": "5.244.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -34,6 +34,7 @@
     "test:db": "vitest run src/lib/db test/commands/db.test.ts test/commands/db-tenant-isolation.test.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
+    "check:lanes-module-cycles": "node scripts/check-lanes-module-cycles.mjs",
     "vitest": "vitest",
     "clean": "rm -rf dist",
     "postinstall": "node scripts/mesh-daemon-if-stale.mjs || true",