@indigoai-us/hq-cli 5.258.0 → 5.259.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.259.0] — 2026-09-28
+
+### Fixed
+
+- The checkpoint stop gate now recognizes path-qualified `hq core checkpoint`
+  commands without treating lookalike text as a checkpoint.
+- `hq doctor --live-runtimes` now invokes Windows npm shims through their `.cmd`
+  entry points.
+
 ## [5.258.0] — 2026-09-28
 
 ### Fixed

package/assets/scaffold/core/scripts/checkpoint-stop-gate.sh

@@ -350,7 +350,11 @@ exec 3>&2
       else ""
       end;
     def checkpoint_command:
-      test("(^|[;&|(\\s])(command\\s+)?([A-Za-z_][A-Za-z0-9_]*=[^\\s]*\\s+)*hq\\s+core\\s+checkpoint(\\s|$)");
+      # Match the actual command at a shell command boundary. A whitespace
+      # boundary alone would accept `echo hq core checkpoint`; allow only the
+      # shell wrappers and environment assignments that can invoke hq itself.
+      # Quoted assignment values and executable paths may contain spaces.
+      test("(^\\s*|[;&|()]\\s*|\\n\\s*)(?:(?:command|exec)\\s+)?(?:env\\s+)?([A-Za-z_][A-Za-z0-9_]*=(?:\"(?:\\\\.|[^\"\\\\])*\"|\\u0027[^\\u0027]*\\u0027|[^\\s;&|()]*)\\s+)*(?:(?:command|exec|env)\\s+)?(\"[^\"]*[/\\\\]hq\"|[^\\s;&|()]*[/\\\\]hq|hq)\\s+core\\s+checkpoint(\\s|$)");
     def strip_quoted:
       # Remove quoted spans so flag text inside a --summary value (e.g.
       # --summary "investigated --gate-probe behavior") is never mistaken for
@@ -362,12 +366,21 @@ exec 3>&2
     def checkpoint_flag($flag):
       strip_quoted | test("(^|\\s)" + $flag + "(\\s|$)");
     def pure_checkpoint:
-      # The command is ONLY a checkpoint invocation (optional env-assignment
-      # prefix, no other command joined by a separator). A compound call like
-      # `git status; hq core checkpoint --idle` did other work in the same
-      # tool call, so its exemptions must not apply.
-      strip_quoted
-      | test("^\\s*(command\\s+)?([A-Za-z_][A-Za-z0-9_]*=[^\\s]*\\s+)*hq\\s+core\\s+checkpoint([\\s][^;&|\n]*)?$");
+      # The command is ONLY a checkpoint invocation (recognized wrappers and
+      # env assignments are allowed, but no other command may be joined by a
+      # separator). A compound call like `git status; hq core checkpoint
+      # --idle` did other work in the same tool call, so its exemptions do not
+      # apply.
+      # Normalize a quoted or path-qualified executable to hq before
+      # stripping quoted argument values, so a path with spaces still gets
+      # the same --idle exemptions.
+      (capture("^(?<prefix>\\s*(?:(?:command|exec)\\s+)?(?:env\\s+)?([A-Za-z_][A-Za-z0-9_]*=(?:\"(?:\\\\.|[^\"\\\\])*\"|\\u0027[^\\u0027]*\\u0027|[^\\s;&|()]*)\\s+)*(?:(?:command|exec|env)\\s+)?)(?<executable>\"[^\"]*[/\\\\]hq\"|[^\\s;&|()]*[/\\\\]hq|hq)(?<tail>\\s+core\\s+checkpoint(?:\\s+[^;&|\n]*)?)$")? // false) as $parts
+      | if $parts == false then false
+        else
+          ($parts.prefix + "hq" + $parts.tail)
+          | strip_quoted
+          | test("^\\s*(?:(?:command|exec)\\s+)?(?:env\\s+)?([A-Za-z_][A-Za-z0-9_]*=(?:\"(?:\\\\.|[^\"\\\\])*\"|\\u0027[^\\u0027]*\\u0027|[^\\s;&|()]*)\\s+)*(?:(?:command|exec|env)\\s+)?hq\\s+core\\s+checkpoint([\\s][^;&|\n]*)?$")
+        end;
     def gate_feedback_user:
       # This gate surfaces its own Stop feedback as a synthetic user row. That
       # row is a turn boundary for the checkpoint requirement, but NOT for

package/dist/lib/doctor/checks/runtime-health.d.ts

@@ -80,6 +80,8 @@ export interface RuntimeHealthDeps {
     execProbe?: (file: string, args: string[], timeoutMs: number) => Promise<ProbeOutcome>;
     /** Per-probe timeout. Default {@link DEFAULT_PROBE_TIMEOUT_MS}. */
     probeTimeoutMs?: number;
+    /** Runtime platform override for the spawn plan (normally process.platform). */
+    platform?: NodeJS.Platform;
 }
 /**
  * The AI-runtime-health check family entry. Presence checks always run; the

package/dist/lib/doctor/checks/runtime-health.js

@@ -29,6 +29,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { planCommandSpawn } from "../../../utils/windows-spawn.js";
 /** The id of the AI-runtime-health family. */
 export const RUNTIMES_FAMILY_ID = "runtimes";
 /** Common id prefix for every result this family emits. */
@@ -101,7 +102,8 @@ export async function checkRuntimeHealth(context, deps = {}) {
 async function runRuntimeChecks(context, deps) {
     const resolved = {
         resolveBinary: deps.resolveBinary ?? resolveOnPath,
-        execProbe: deps.execProbe ?? defaultExecProbe,
+        execProbe: deps.execProbe ??
+            ((file, args, timeoutMs) => defaultExecProbe(file, args, timeoutMs, deps.platform ?? process.platform)),
         timeoutMs: deps.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS,
         live: context.liveRuntimes === true,
     };
@@ -268,11 +270,19 @@ export function resolveOnPath(binary) {
  * CLI that reads piped stdin in non-TTY mode — blocks forever on a pipe that
  * never reaches EOF, which turns every probe into a timeout.
  */
-function defaultExecProbe(file, args, timeoutMs) {
+function defaultExecProbe(file, args, timeoutMs, platform) {
     return new Promise((resolve) => {
-        const child = spawn(file, args, {
+        const command = platform === "win32" && !/\.(?:cmd|bat|exe|com)$/i.test(file)
+            ? `${file}.cmd`
+            : file;
+        const plan = planCommandSpawn(command, args, platform);
+        const child = spawn(plan.cmd, plan.args, {
             cwd: os.tmpdir(),
             stdio: ["ignore", "pipe", "pipe"],
+            shell: plan.shell,
+            ...(plan.windowsVerbatimArguments === undefined
+                ? {}
+                : { windowsVerbatimArguments: plan.windowsVerbatimArguments }),
         });
         const cap = 1024 * 1024;
         let stdout = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.258.0",
+  "version": "5.259.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {