@indigoai-us/hq-cli 5.288.0 → 5.290.0

package/dist/lib/lanes/store.d.ts

@@ -24,6 +24,8 @@ export interface StoreDeps {
     readdirSync: typeof fs.readdirSync;
     /** Bulk readers may provide a pre-indexed conflict-sidecar lookup. */
     conflictSidecarPathsFor?: (recordPath: string) => readonly string[];
+    /** Injectable ULID source for deterministic lane-id generation. */
+    generateLaneUlid?: (timestampMs: number) => string;
     openSync: typeof fs.openSync;
     closeSync: typeof fs.closeSync;
     fsyncSync: typeof fs.fsyncSync;
@@ -36,7 +38,7 @@ export declare function questionRecordPath(hqRoot: string, questionId: string):
 export declare function pendingMarkerPath(hqRoot: string, questionId: string): string;
 export declare function sanitizeHostComponent(hostname: string): string;
 /** Collision-safe across machines: ULID plus a host component. */
-export declare function mintLaneId(deps?: Pick<StoreDeps, "now" | "hostname">): string;
+export declare function mintLaneId(deps?: Pick<StoreDeps, "now" | "hostname"> & Partial<Pick<StoreDeps, "generateLaneUlid">>): string;
 export declare function mintQuestionId(deps?: Pick<StoreDeps, "now" | "hostname">): string;
 export declare function appendCappedHistory<T>(history: readonly T[], entry: T, cap?: number): T[];
 export declare function parseLaneRecord(raw: unknown, filePath?: string): LaneRecord;
@@ -52,7 +54,7 @@ export declare function mergeLaneRecords(live: LaneRecord, sidecars: readonly La
 export declare function mergeQuestionRecords(live: QuestionRecord, sidecars: readonly QuestionRecord[]): QuestionRecord;
 export declare function tryReadLane(hqRoot: string, laneId: string, deps?: StoreDeps): LaneRecord | null;
 export declare function readLane(hqRoot: string, laneId: string, deps?: StoreDeps): LaneRecord;
-/** Reads every lane while scanning the lane directory for conflict sidecars once. */
+/** Reads all lanes, indexing sidecars once and sorting by creation time then id. */
 export declare function readAllLanes(hqRoot: string, deps?: StoreDeps): LaneRecord[];
 export declare function tryReadQuestion(hqRoot: string, questionId: string, deps?: StoreDeps): QuestionRecord | null;
 export declare function readQuestion(hqRoot: string, questionId: string, deps?: StoreDeps): QuestionRecord;

package/dist/lib/lanes/store.js

@@ -67,7 +67,8 @@ export function sanitizeHostComponent(hostname) {
 /** Collision-safe across machines: ULID plus a host component. */
 export function mintLaneId(deps = defaultStoreDeps()) {
     const host = sanitizeHostComponent(deps.hostname());
-    return `${generateUlid(deps.now().getTime())}_${host}`;
+    const timestampMs = deps.now().getTime();
+    return `${(deps.generateLaneUlid ?? generateUlid)(timestampMs)}_${host}`;
 }
 export function mintQuestionId(deps = defaultStoreDeps()) {
     const host = sanitizeHostComponent(deps.hostname());
@@ -532,26 +533,44 @@ export function parseLaneRecord(raw, filePath) {
         const details = raw.queued_details;
         if (details === null || typeof details !== "object" || Array.isArray(details) ||
             typeof details.reason !== "string") {
-            throw new LaneSchemaError("queued_details must describe a worker_profile_changed queue reason", {
+            throw new LaneSchemaError("queued_details must describe a supported queue condition", {
                 path: filePath,
                 field: "queued_details",
             });
         }
         const detailsRecord = details;
-        if (detailsRecord.reason !== "worker_profile_changed" ||
-            (detailsRecord.expected_hash !== null && typeof detailsRecord.expected_hash !== "string") ||
-            typeof detailsRecord.actual_hash !== "string" || detailsRecord.actual_hash === "" ||
-            typeof detailsRecord.recovery_command !== "string" || detailsRecord.recovery_command.trim() === "") {
-            throw new LaneSchemaError("queued_details must describe a worker_profile_changed queue reason", {
-                path: filePath,
-                field: "queued_details",
-            });
+        if (detailsRecord.reason === "worker_profile_changed") {
+            if ((detailsRecord.expected_hash !== null && typeof detailsRecord.expected_hash !== "string") ||
+                typeof detailsRecord.actual_hash !== "string" || detailsRecord.actual_hash === "" ||
+                typeof detailsRecord.recovery_command !== "string" || detailsRecord.recovery_command.trim() === "") {
+                throw new LaneSchemaError("queued_details must describe a worker_profile_changed queue reason", {
+                    path: filePath,
+                    field: "queued_details",
+                });
+            }
+            if (raw.queued_reason !== "worker_profile_changed") {
+                throw new LaneSchemaError("queued_details requires queued_reason worker_profile_changed", {
+                    path: filePath,
+                    field: "queued_details",
+                    queued_reason: raw.queued_reason,
+                });
+            }
+        }
+        else if (detailsRecord.reason === "outpost_dispatch_unknown") {
+            if (raw.state !== "queued" ||
+                detailsRecord.outcome_unknown !== true ||
+                (detailsRecord.command_id !== null &&
+                    (typeof detailsRecord.command_id !== "string" || detailsRecord.command_id.trim() === ""))) {
+                throw new LaneSchemaError("queued_details must describe an unknown Outpost dispatch on a queued lane", {
+                    path: filePath,
+                    field: "queued_details",
+                });
+            }
         }
-        if (raw.queued_reason !== "worker_profile_changed") {
-            throw new LaneSchemaError("queued_details requires queued_reason worker_profile_changed", {
+        else {
+            throw new LaneSchemaError("queued_details must describe a supported queue condition", {
                 path: filePath,
                 field: "queued_details",
-                queued_reason: raw.queued_reason,
             });
         }
     }
@@ -1160,7 +1179,7 @@ export function readLane(hqRoot, laneId, deps = defaultStoreDeps()) {
         throw new LaneNotFoundError("lane", laneId);
     return record;
 }
-/** Reads every lane while scanning the lane directory for conflict sidecars once. */
+/** Reads all lanes, indexing sidecars once and sorting by creation time then id. */
 export function readAllLanes(hqRoot, deps = defaultStoreDeps()) {
     const laneIds = listLaneIds(hqRoot, deps);
     if (laneIds.length === 0)
@@ -1194,7 +1213,10 @@ export function readAllLanes(hqRoot, deps = defaultStoreDeps()) {
         ...deps,
         conflictSidecarPathsFor: (recordPath) => sidecarsByRecord.get(path.basename(recordPath)) ?? [],
     };
-    return laneIds.map((laneId) => readLane(hqRoot, laneId, indexedDeps));
+    return laneIds
+        .map((laneId) => readLane(hqRoot, laneId, indexedDeps))
+        .sort((a, b) => Date.parse(a.created_at) - Date.parse(b.created_at) ||
+        a.lane_id.localeCompare(b.lane_id));
 }
 export function tryReadQuestion(hqRoot, questionId, deps = defaultStoreDeps()) {
     const filePath = questionRecordPath(hqRoot, questionId);

package/dist/lib/lanes/types.d.ts

@@ -175,12 +175,16 @@ export declare const LANE_PROVIDERS: readonly ["claude", "codex", "grok"];
 export type LaneProvider = (typeof LANE_PROVIDERS)[number];
 export declare const QUEUED_REASONS: readonly ["cap", "provider_cap", "account_cap", "profile_cap", "queue_position", "throttle", "provider_binary_missing", "account_retry", "worker_profile_changed"];
 export type QueuedReason = (typeof QUEUED_REASONS)[number];
-export interface QueuedDetails {
+export type QueuedDetails = {
     reason: "worker_profile_changed";
     expected_hash: string | null;
     actual_hash: string;
     recovery_command: string;
-}
+} | {
+    reason: "outpost_dispatch_unknown";
+    outcome_unknown: true;
+    command_id: string | null;
+};
 export declare function isQueuedReason(value: unknown): value is QueuedReason;
 export declare const HOST_KINDS: readonly ["local", "outpost"];
 export type HostKind = (typeof HOST_KINDS)[number];

package/dist/lib/lanes/types.js

@@ -231,7 +231,7 @@ export const LANE_FIELD_WRITERS = {
     last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], model_source: ["creator", "spawn", "command"], effort: ["creator", "spawn", "command"], effort_source: ["creator", "spawn", "command"], fast_mode: ["spawn"],
     last_message_at: ["command"], status_gate: ["spawn", "watcher"], status_gate_history: ["watcher"], blocker_freshness_state: ["watcher"], kr_freshness_state: ["watcher"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],
     overdue: ["reconcile"], overdue_at: ["reconcile"], last_host_report_at: ["watcher", "spawn", "reconcile"], stalled: ["watcher"], stalled_at: ["watcher"], stalled_reason: ["watcher"],
-    admitted_reason: ["command", "reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], stop_history: ["command"], settings_history: ["command"], pending_settings: ["command", "spawn"], interrupted_at: ["command", "watcher", "reconcile"], terminal_details: ["command", "spawn", "watcher", "reconcile"],
+    admitted_reason: ["command", "reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], stop_history: ["command", "reconcile"], settings_history: ["command"], pending_settings: ["command", "spawn"], interrupted_at: ["command", "watcher", "reconcile"], terminal_details: ["command", "spawn", "watcher", "reconcile"],
     quota_reset_at: ["watcher", "reconcile"], model_quota_marker: ["watcher", "reconcile"], outpost_command_id: ["command"],
     provider_session_id: ["watcher", "command", "spawn"], provider_session_id_absent: ["watcher", "command"], provider_home_at_spawn: ["spawn"], last_resume: ["spawn"], last_run_usage: ["watcher"], last_run_usage_at: ["watcher"], envelope_repair: ["watcher", "reconcile"], envelope_validation_errors: ["watcher"], last_progress_event_at: ["watcher"],
 };

package/dist/utils/self-update.d.ts

@@ -56,6 +56,7 @@
  * Opt-outs: `HQ_NO_UPDATE_CHECK=1` (the shared knob that also silences
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
+import * as fs from "node:fs";
 import { type RunningInstall, type UpdateResult } from "./version-gate.js";
 import { type RestartDaemonResult } from "../lib/mesh/live/daemon/install.js";
 /**
@@ -136,6 +137,8 @@ export interface SelfUpdateDeps {
     currentVersion?: string;
     fetchLatest?: () => Promise<string | null>;
     resolveInstall?: () => RunningInstall;
+    /** Same-filesystem install rename, injectable for rollback tests. */
+    renamePath?: typeof fs.renameSync;
     runner?: (cmd: string, args: string[], env?: NodeJS.ProcessEnv) => UpdateResult;
     reexec?: (argv: string[], env: NodeJS.ProcessEnv) => number | null;
     acquireLock?: () => (() => void) | null;

package/dist/utils/self-update.js

@@ -57,10 +57,13 @@
  * version-check), `hq rescue --no-self-update`, and the re-exec guard env.
  */
 import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
 import semver from "semver";
 import chalk from "chalk";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, checkUpdateConvergence, isLocalDependencyInstall, isPrefixWritable, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, checkUpdateConvergence, derivePnpmHome, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, isPrefixWritable, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, } from "./version-gate.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
 import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
@@ -71,6 +74,211 @@ import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install
 export const REEXEC_GUARD_ENV = "HQ_RESCUE_SELF_UPDATED";
 const REGISTRY_URL = `https://registry.npmjs.org/${encodeURIComponent(CLI_NAME)}/latest`;
 const FETCH_TIMEOUT_MS = 3_000;
+/**
+ * Move the working CLI package beside itself before asking the package manager
+ * to replace it. If the move is unavailable, the caller proceeds without
+ * rollback protection. pnpm's .pnpm package tree is immutable store content,
+ * so only its selecting public link is moved.
+ */
+function findPnpmPublicLink(packageRoot) {
+    const home = derivePnpmHome({ manager: "pnpm", prefix: null, packageRoot });
+    if (!home)
+        return null;
+    let resolvedPackageRoot;
+    let storeVersions;
+    try {
+        resolvedPackageRoot = fs.realpathSync(packageRoot);
+        storeVersions = fs.readdirSync(path.join(home, "global"));
+    }
+    catch {
+        return null;
+    }
+    const packageSegments = CLI_NAME.split("/");
+    for (const storeVersion of storeVersions) {
+        const storeRoot = path.join(home, "global", storeVersion);
+        const candidates = [path.join(storeRoot, "node_modules", ...packageSegments)];
+        if (/^v\d+$/.test(storeVersion)) {
+            try {
+                for (const hash of fs.readdirSync(storeRoot)) {
+                    candidates.push(path.join(storeRoot, hash, "node_modules", ...packageSegments));
+                }
+            }
+            catch {
+                // Ignore inaccessible pnpm store versions and try the remaining roots.
+            }
+        }
+        for (const candidate of candidates) {
+            if (candidate === packageRoot)
+                continue;
+            try {
+                if (!fs.lstatSync(candidate).isSymbolicLink())
+                    continue;
+                if (fs.realpathSync(candidate) !== resolvedPackageRoot)
+                    continue;
+                return { path: candidate, target: fs.readlinkSync(candidate) };
+            }
+            catch {
+                // A missing or dangling candidate is not the public link for this install.
+            }
+        }
+    }
+    return null;
+}
+function isPathInside(candidate, parent) {
+    const relative = path.relative(path.resolve(parent), path.resolve(candidate));
+    return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function isInsideNodeModules(candidate) {
+    const segments = path.resolve(candidate).replace(/\\/g, "/").split("/").filter(Boolean);
+    const index = process.platform === "win32"
+        ? segments.map((segment) => segment.toLowerCase()).lastIndexOf("node_modules")
+        : segments.lastIndexOf("node_modules");
+    return index >= 0 && index < segments.length - 1;
+}
+function isRecognizedGlobalInstall(install, packageRoot) {
+    if (!isInsideNodeModules(packageRoot))
+        return false;
+    if (install.manager === "pnpm")
+        return isPnpmManagedPackageDir(packageRoot, true);
+    if (install.manager === "bun")
+        return isBunManagedPackageDir(packageRoot);
+    if (!install.prefix)
+        return false;
+    const globalNodeModules = process.platform === "win32"
+        ? path.join(install.prefix, "node_modules")
+        : path.join(install.prefix, "lib", "node_modules");
+    return isPathInside(packageRoot, globalNodeModules);
+}
+function snapshotPathsAreSafe(snapshot) {
+    const paths = [
+        snapshot.installPath,
+        snapshot.backupPath,
+        snapshot.movedPath,
+        snapshot.resolvedTarget,
+        snapshot.publicLinkPath,
+    ].filter((value) => value !== undefined);
+    return paths.every(isInsideNodeModules);
+}
+function snapshotInstall(install, renamePath = fs.renameSync) {
+    const packageRoot = install.packageRoot;
+    if (!packageRoot)
+        return null;
+    let movedPath;
+    let backupPath;
+    let didMove = false;
+    try {
+        const entry = fs.lstatSync(packageRoot);
+        let sourcePath = packageRoot;
+        let symlinkTarget;
+        let resolvedTarget;
+        if (entry.isSymbolicLink()) {
+            symlinkTarget = fs.readlinkSync(packageRoot);
+            resolvedTarget = fs.realpathSync(packageRoot);
+            sourcePath = resolvedTarget;
+        }
+        else if (!entry.isDirectory()) {
+            return null;
+        }
+        // The running package root can be a source checkout (for example `npm
+        // link` or `node dist/...`). Only recognized global layouts are safe to
+        // move; the package manager update itself still proceeds without rollback.
+        if (!isRecognizedGlobalInstall(install, sourcePath))
+            return null;
+        const publicLink = install.manager === "pnpm" && !entry.isSymbolicLink()
+            ? findPnpmPublicLink(packageRoot)
+            : null;
+        if (!fs.statSync(sourcePath).isDirectory())
+            return null;
+        // pnpm's .pnpm tree contains the package store. Moving a package directory
+        // out of that tree can invalidate pnpm's global project, so back up only
+        // the public link that selects the running store package.
+        const isPnpmStorePath = sourcePath.split(path.sep).includes(".pnpm");
+        const backupKind = install.manager === "pnpm" && isPnpmStorePath ? "pnpm-public-link" : "package";
+        const pnpmPublicLinkPath = publicLink?.path ?? (entry.isSymbolicLink() ? packageRoot : undefined);
+        if (backupKind === "pnpm-public-link" && !pnpmPublicLinkPath)
+            return null;
+        movedPath = backupKind === "pnpm-public-link" ? pnpmPublicLinkPath : sourcePath;
+        backupPath = path.join(path.dirname(movedPath), `.hq-cli-backup-${process.pid}-${randomBytes(8).toString("hex")}`);
+        renamePath(movedPath, backupPath);
+        didMove = true;
+        return {
+            installPath: packageRoot,
+            backupPath,
+            movedPath: backupKind === "pnpm-public-link" ? pnpmPublicLinkPath : sourcePath,
+            backupKind,
+            symlinkTarget,
+            resolvedTarget,
+            publicLinkPath: backupKind === "pnpm-public-link" ? pnpmPublicLinkPath : publicLink?.path,
+            publicLinkTarget: backupKind === "pnpm-public-link"
+                ? publicLink?.target ?? symlinkTarget
+                : publicLink?.target,
+        };
+    }
+    catch {
+        if (didMove && movedPath && backupPath) {
+            try {
+                fs.renameSync(backupPath, movedPath);
+            }
+            catch {
+                // The update may proceed without rollback if the move cannot be undone.
+            }
+        }
+        return null;
+    }
+}
+function restoreInstall(snapshot, renamePath = fs.renameSync) {
+    if (!snapshotPathsAreSafe(snapshot)) {
+        reportFailedRestore(snapshot);
+        return false;
+    }
+    try {
+        if (snapshot.backupKind === "pnpm-public-link") {
+            const publicLinkPath = snapshot.publicLinkPath ?? snapshot.movedPath;
+            fs.rmSync(publicLinkPath, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(publicLinkPath), { recursive: true });
+            renamePath(snapshot.backupPath, publicLinkPath);
+            return true;
+        }
+        fs.rmSync(snapshot.installPath, { recursive: true, force: true });
+        if (snapshot.symlinkTarget !== undefined && snapshot.resolvedTarget !== undefined) {
+            fs.rmSync(snapshot.resolvedTarget, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(snapshot.resolvedTarget), { recursive: true });
+            renamePath(snapshot.backupPath, snapshot.resolvedTarget);
+            fs.mkdirSync(path.dirname(snapshot.installPath), { recursive: true });
+            const target = process.platform === "win32" ? snapshot.resolvedTarget : snapshot.symlinkTarget;
+            fs.symlinkSync(target, snapshot.installPath, process.platform === "win32" ? "junction" : "dir");
+        }
+        else {
+            fs.mkdirSync(path.dirname(snapshot.installPath), { recursive: true });
+            renamePath(snapshot.backupPath, snapshot.installPath);
+        }
+        if (snapshot.publicLinkPath && snapshot.publicLinkTarget !== undefined) {
+            fs.rmSync(snapshot.publicLinkPath, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(snapshot.publicLinkPath), { recursive: true });
+            fs.symlinkSync(snapshot.publicLinkTarget, snapshot.publicLinkPath, process.platform === "win32" ? "junction" : "dir");
+        }
+        return true;
+    }
+    catch {
+        reportFailedRestore(snapshot);
+        return false;
+    }
+}
+function discardInstallSnapshot(snapshot) {
+    if (!snapshotPathsAreSafe(snapshot)) {
+        console.error(chalk.yellow(`⚠ Could not remove the hq-cli install backup at ${snapshot.backupPath}.`));
+        return;
+    }
+    try {
+        fs.rmSync(snapshot.backupPath, { recursive: true, force: true });
+    }
+    catch {
+        console.error(chalk.yellow(`⚠ Could not remove the hq-cli install backup at ${snapshot.backupPath}.`));
+    }
+}
+function reportFailedRestore(snapshot) {
+    console.error(chalk.yellow(`⚠ Could not restore the previous hq-cli install; its backup is at ${snapshot.backupPath}.`));
+}
 /** npm `latest` for this package, or null on any failure (offline, 5xx, bad body). */
 async function fetchLatestVersion() {
     try {
@@ -209,6 +417,11 @@ async function updateAndReexec(argv, flavor, known, deps) {
     const releaseLock = flavor.lock ? (deps.acquireLock ?? acquireUpdateLock)() : () => { };
     if (!releaseLock)
         return { action: "skipped", latest };
+    const renamePath = deps.renamePath ?? fs.renameSync;
+    const installSnapshot = snapshotInstall(install, renamePath);
+    if (!installSnapshot) {
+        console.error(chalk.dim("  No backup could be made for this hq-cli install; proceeding without rollback protection."));
+    }
     let result;
     const plan = buildSelfUpdatePlan(install);
     // A pnpm global install needs PNPM_HOME to find its global bin dir. A
@@ -219,6 +432,7 @@ async function updateAndReexec(argv, flavor, known, deps) {
     // regardless of the parent environment. No-op for npm/bun and when the
     // parent already sets PNPM_HOME.
     const updateEnv = pnpmUpdateEnv(install, env);
+    let restoredAfterFailure = false;
     try {
         console.error(chalk.dim(`Updating hq-cli ${current} → ${latest}…`));
         const defaultRunner = flavor.verbose ? runUpdateCommand : runUpdateQuiet;
@@ -230,11 +444,26 @@ async function updateAndReexec(argv, flavor, known, deps) {
             updateEnv === undefined
                 ? runner(plan.cmd, plan.args)
                 : runner(plan.cmd, plan.args, updateEnv);
+        if (!result.ok && installSnapshot) {
+            restoredAfterFailure = restoreInstall(installSnapshot, renamePath);
+            if (restoredAfterFailure)
+                discardInstallSnapshot(installSnapshot);
+        }
+    }
+    catch (error) {
+        if (installSnapshot) {
+            if (restoreInstall(installSnapshot, renamePath))
+                discardInstallSnapshot(installSnapshot);
+        }
+        throw error;
     }
     finally {
         releaseLock();
     }
     if (!result.ok) {
+        if (restoredAfterFailure) {
+            console.error(chalk.dim("  The previous hq-cli install was restored."));
+        }
         // The one case that still warrants the old yellow banner: we could not get
         // the user onto the new version, so they need to know it exists and how to
         // install it by hand.
@@ -259,6 +488,8 @@ async function updateAndReexec(argv, flavor, known, deps) {
         console.error(chalk.dim(`  Continuing the ${flavor.noun} on ${current}.`));
         return { action: "update-failed", latest };
     }
+    if (installSnapshot)
+        discardInstallSnapshot(installSnapshot);
     // Read-your-writes: a "successful" `npm install -g` proves only that the
     // prefix was rewritten, NOT that the `hq` this user's PATH resolves is the
     // copy we just wrote. When a ghost/shadowing install keeps winning PATH

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.288.0",
+  "version": "5.290.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {