@indigoai-us/hq-cli 5.300.0 → 5.302.0

package/dist/utils/version-gate.js

@@ -28,7 +28,6 @@
  * to silence both check + gate).
  */
 import { spawnSync } from "node:child_process";
-import { installPathCompatibilityEnabled } from "../lib/install-path-compatibility-flag.js";
 import { buildSpawnPlan, quoteForWindowsShell } from "./windows-spawn.js";
 import { accessSync, closeSync, constants as fsConstants, copyFileSync, existsSync, mkdtempSync, openSync, readdirSync, realpathSync, readFileSync, rmSync, } from "node:fs";
 import os from "node:os";
@@ -106,8 +105,7 @@ function findPackageRootForExecutable(bin) {
             path.join(storeRoot, "node_modules", ...packageSegments),
         ];
         // pnpm v11 adds a hash between its global store version and node_modules.
-        // Its `vN` layout remains subject to the existing compatibility gate unless
-        // PNPM_HOME itself authorizes the global root via isPnpmManagedPackageDir.
+        // Its documented `vN` global layout is recognized unconditionally below.
         if (/^v\d+$/.test(storeVersion)) {
             try {
                 for (const hash of readdirSync(storeRoot)) {
@@ -122,7 +120,7 @@ function findPackageRootForExecutable(bin) {
             const packageRoot = findCliPackageRoot(candidate);
             if (packageRoot &&
                 samePath(packageRoot, candidate) &&
-                isPnpmManagedPackageDir(packageRoot, installPathCompatibilityEnabled())) {
+                isPnpmManagedPackageDir(packageRoot, true)) {
                 return packageRoot;
             }
         }
@@ -145,7 +143,7 @@ function samePath(left, right) {
         : a === b;
 }
 function globalInstallManagerForPath(bin, packageRoot) {
-    if (isPnpmManagedPackageDir(packageRoot, installPathCompatibilityEnabled())) {
+    if (isPnpmManagedPackageDir(packageRoot, true)) {
         return "pnpm";
     }
     if (isBunManagedPackageDir(packageRoot))
@@ -209,13 +207,13 @@ function pnpmHomeGlobalRoot() {
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir = false) {
+export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir = true) {
     const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
     const segments = normalized.split("/").filter(Boolean);
     // pnpm through v10 uses `global/<digits>`; pnpm v11+ uses
-    // `global/v<major>`. Keep the newer form behind the default-off rollout
-    // flag, and require a documented version segment so `global/next` or a
-    // `v11` directory elsewhere cannot be mistaken for a global install.
+    // `global/v<major>`. Recognize both documented layouts, and require a
+    // version segment so `global/next` or a `v11` directory elsewhere cannot be
+    // mistaken for a global install.
     for (let i = 0; i < segments.length - 1; i += 1) {
         if (segments[i] !== "global")
             continue;
@@ -355,7 +353,7 @@ export function resolveRunningInstall() {
         const packageRoot = findRunningPackageRoot();
         if (!packageRoot)
             return { manager: "npm", prefix: null, packageRoot: null };
-        if (isPnpmManagedPackageDir(packageRoot, installPathCompatibilityEnabled())) {
+        if (isPnpmManagedPackageDir(packageRoot, true)) {
             return { manager: "pnpm", prefix: null, packageRoot };
         }
         if (isBunManagedPackageDir(packageRoot)) {
@@ -639,10 +637,51 @@ export { buildSpawnPlan, quoteForWindowsShell };
  * protection silently disappearing.
  */
 export function inOwnProcessGroup(options) {
-    return { ...options, detached: true };
+    return { ...options, detached: true, windowsHide: true };
 }
 /** Tail of captured installer stderr kept to explain a failure. */
 const INSTALL_DETAIL_MAX_CHARS = 400;
+const KNOWN_NPM_UPDATE_ERROR_CODES = new Set([
+    "E404",
+    "EACCES",
+    "EAI_AGAIN",
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "ENOTFOUND",
+    "EPERM",
+    "ETARGET",
+    "ETIMEDOUT",
+]);
+function knownNpmUpdateErrorCode(stderr) {
+    const escape = String.fromCharCode(0x1b);
+    const plainStderr = stderr.replace(new RegExp(`${escape}\\[[0-9;]*m`, "g"), "");
+    const match = /^[ \t]*npm[ \t]+(?:ERR!|error)[ \t]+code[ \t]+([A-Z0-9_]{1,32})[ \t]*$/im.exec(plainStderr);
+    const code = match?.[1]?.toUpperCase();
+    return code && KNOWN_NPM_UPDATE_ERROR_CODES.has(code) ? code : undefined;
+}
+function readKnownNpmDiagnosticCode(filename) {
+    if (!existsSync(filename))
+        return undefined;
+    try {
+        const contents = readFileSync(filename, "utf-8").trim();
+        if (KNOWN_NPM_UPDATE_ERROR_CODES.has(contents))
+            return contents;
+        return knownNpmUpdateErrorCode(contents);
+    }
+    catch (error) {
+        const code = error &&
+            typeof error === "object" &&
+            "code" in error &&
+            typeof error.code === "string" &&
+            /^[A-Z0-9_]{1,32}$/.test(error.code)
+            ? error.code
+            : error instanceof Error
+                ? "Error"
+                : "UnknownError";
+        console.error(chalk.yellow(`Could not read update diagnostic output (${code}).`));
+        return undefined;
+    }
+}
 /** Give a package-manager update ample time without letting it wedge every CLI call. */
 const DEFAULT_UPDATE_TIMEOUT_MS = 30 * 60 * 1_000;
 /** Node clamps longer timer delays to 1ms, so accepting them would invert the deadline. */
@@ -753,9 +792,12 @@ export function openInstallOutput(verbose, isTty = process.stdout.isTTY === true
         const dir = mkdtempSync(path.join(os.tmpdir(), "hq-cli-install-"));
         const timeoutMarker = path.join(dir, "timed-out");
         const errorMarker = path.join(dir, "spawn-error.json");
+        const diagnosticMarker = path.join(dir, "npm-error-code");
         return {
             stdio: ["ignore", "inherit", "inherit"],
             stderrTail: () => "",
+            diagnosticCode: () => readKnownNpmDiagnosticCode(diagnosticMarker),
+            diagnosticMarker,
             timeoutMarker,
             errorMarker,
             timedOut: () => existsSync(timeoutMarker),
@@ -786,6 +828,7 @@ export function openInstallOutput(verbose, isTty = process.stdout.isTTY === true
                 return "";
             }
         },
+        diagnosticCode: () => readKnownNpmDiagnosticCode(errPath),
         timeoutMarker: timeoutPath,
         errorMarker: errorPath,
         timedOut: () => existsSync(timeoutPath),
@@ -827,6 +870,7 @@ export function runSupervisedUpdateCommand(cmd, args, output, env) {
                 reapMs: UPDATE_REAP_GRACE_MS,
                 timeoutMarker: output.timeoutMarker,
                 errorMarker: output.errorMarker,
+                diagnosticMarker: output.diagnosticMarker,
             }),
         ], inOwnProcessGroup({
             stdio: output.stdio,
@@ -863,6 +907,8 @@ export function runSupervisedUpdateCommand(cmd, args, output, env) {
             const captured = output.stderrTail();
             return {
                 ok: false,
+                diagnosticCode: output.diagnosticCode(),
+                failureKind: "package_manager_exit",
                 detail: captured || `exit ${result.status ?? "signal"}`,
             };
         }
@@ -1214,6 +1260,7 @@ function attemptRequiredUpdate(decision, deps, install) {
     const command = decision.updateCommand;
     const isManagedOutsideNpm = install.manager !== "npm";
     const prefix = install.prefix;
+    const stagedNpmPrefix = Boolean(!isManagedOutsideNpm && prefix && /\s/.test(prefix));
     const runner = deps.runner ?? runUpdateCommand;
     // Resolve the concrete install argv once so the sudo fallback below can re-run
     // the EXACT same command under elevation.
@@ -1250,8 +1297,20 @@ function attemptRequiredUpdate(decision, deps, install) {
     }
     else if (prefix) {
         console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
-        console.error(chalk.dim(`  Running: npm ${primaryArgs.join(" ")}`));
-        result = performUpdateCommand("npm", primaryArgs, runner);
+        if (stagedNpmPrefix) {
+            console.error(chalk.dim("  Building in a space-free temporary prefix before activation."));
+            const installStaged = deps.installNpmPackageStaged;
+            if (!installStaged) {
+                result = { ok: false, detail: "staged npm installer was not loaded" };
+            }
+            else {
+                result = installStaged(prefix, LATEST_PACKAGE_SPEC, runner);
+            }
+        }
+        else {
+            console.error(chalk.dim(`  Running: npm ${primaryArgs.join(" ")}`));
+            result = performUpdateCommand("npm", primaryArgs, runner);
+        }
     }
     else {
         console.error(chalk.dim(`  Running: ${command}`));
@@ -1267,7 +1326,7 @@ function attemptRequiredUpdate(decision, deps, install) {
     // artifacts and retry the install ONCE. Guarded on `cleaned.length > 0` so a
     // plain EACCES on an otherwise-healthy prefix falls straight through to the
     // sudo retry below without a redundant reinstall attempt.
-    if (!result.ok && result.code !== "ETIMEDOUT" && prefix) {
+    if (!result.ok && result.code !== "ETIMEDOUT" && prefix && !stagedNpmPrefix) {
         const cleaner = deps.cleanStale ?? cleanStalePartialInstall;
         const cleaned = cleaner(prefix);
         if (cleaned.length > 0) {
@@ -1292,7 +1351,8 @@ function attemptRequiredUpdate(decision, deps, install) {
         !result.ok &&
         result.code !== "ETIMEDOUT" &&
         primaryCmd &&
-        !isManagedOutsideNpm) {
+        !isManagedOutsideNpm &&
+        !stagedNpmPrefix) {
         console.error(chalk.dim(`  Update failed unprivileged; retrying with: sudo -n ${primaryCmd} ${primaryArgs.join(" ")}`));
         const sudoResult = performUpdateCommand("sudo", ["-n", primaryCmd, ...primaryArgs], runner);
         if (sudoResult.ok)
@@ -1358,9 +1418,16 @@ export async function enforceVersionGate(onUpdateRecommended, options = {}) {
     // neither downstream path repeats it.
     const install = resolveRunningInstall();
     if (decision.updateRequired) {
+        // Load the staged installer only for the uncommon spaced npm-prefix path.
+        // The version gate is imported during every CLI startup, including native
+        // fast routes, so eagerly importing this filesystem-heavy module adds cost
+        // to commands that never update.
+        const installNpmPackageStaged = install.manager === "npm" && install.prefix && /\s/.test(install.prefix)
+            ? (await import("./staged-npm-install.js")).installNpmPackageStaged
+            : undefined;
         // Exits the process, EXCEPT when another updater holds the shared update
         // lock — then it returns and the CLI continues on the current version.
-        enforceUpdateRequired(decision, { resolveInstall: () => install });
+        enforceUpdateRequired(decision, { resolveInstall: () => install, installNpmPackageStaged });
         return "continue";
     }
     if (decision.updateRecommended) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.300.0",
+  "version": "5.302.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -25,7 +25,7 @@
     "build": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",
     "prepublishOnly": "npm run build",
     "pretypecheck": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.typetest.json",
     "gen:scan-golden": "node scripts/generate-scan-packages-table.mjs > src/utils/__fixtures__/scan-packages.generated-block.sh",
     "gen:command-catalog": "tsc && node scripts/generate-command-catalog.mjs",
     "lint": "eslint .",

package/dist/lib/install-path-compatibility-flag.d.ts

@@ -1,9 +0,0 @@
-export declare const INSTALL_PATH_COMPATIBILITY_FLAG = "cli.install-path-compatibility";
-export declare const INSTALL_PATH_COMPATIBILITY_FALLBACK = false;
-/**
- * Read the default-off rollout flag from the process snapshot. Missing,
- * unreadable, or not-yet-loaded registry state keeps the compatibility fixes
- * disabled until the operator enables a canary.
- */
-export declare function installPathCompatibilityEnabled(): boolean;
-//# sourceMappingURL=install-path-compatibility-flag.d.ts.map

package/dist/lib/install-path-compatibility-flag.js

@@ -1,12 +0,0 @@
-import { resolveProcessFlagGate } from "./flag-registry.js";
-export const INSTALL_PATH_COMPATIBILITY_FLAG = "cli.install-path-compatibility";
-export const INSTALL_PATH_COMPATIBILITY_FALLBACK = false;
-/**
- * Read the default-off rollout flag from the process snapshot. Missing,
- * unreadable, or not-yet-loaded registry state keeps the compatibility fixes
- * disabled until the operator enables a canary.
- */
-export function installPathCompatibilityEnabled() {
-    return resolveProcessFlagGate(INSTALL_PATH_COMPATIBILITY_FLAG, {}, () => INSTALL_PATH_COMPATIBILITY_FALLBACK);
-}
-//# sourceMappingURL=install-path-compatibility-flag.js.map