@indigoai-us/hq-cli 5.323.0 → 5.325.0

package/CHANGELOG.md

@@ -2,8 +2,18 @@
 
 ## [Unreleased]
 
-## [5.323.0] — 2026-10-02
+## [5.325.0] — 2026-10-02
+- Match Bash pathname expansion in native derive-trigger-facts when a glob has missing suffixes, a trailing slash, or symlink path components.
+
+## [5.324.0] — 2026-10-02
+- Keep the bundled shell runner out of native fast-route startup and defer timeout-guard flag snapshot imports until a timeout would block.
+- Reuse the parsed fast-route entry when dispatching the selected command.
 - Add native `hq core derive-trigger-facts` on the fast route behind the default-off `core-native-hook-helpers` flag.
+- Feedback reports can include the current cached hq-cli release when the default-off `feedback.latest-version` flag is enabled.
+- Added flag-gated global Anywhere installation, company linking, and hqd daemon commands.
+- Added flag-gated Anywhere daemon operations, doctor checks, and update convergence.
+- `hq-auth-refresh` accepts `--min-validity-seconds` or `HQ_AUTH_MIN_VALIDITY_SECONDS`; values above 1800 seconds use the resolver's 1800-second cache margin.
+- `hq db provision` now says remote databases are not available yet, instead of printing the server adapter error.
 
 ## [5.322.0] — 2026-10-02
 - Add an opt-in, default-off CLI prompt for solo companies to invite a teammate after a work-bearing sync.

package/dist/bin/hq-auth-refresh.d.ts

@@ -14,6 +14,10 @@ import "../node-preflight.js";
 import { acquireCurrentPackageUseLease } from "../utils/package-use-lease.js";
 import "../node-network-compat.js";
 import type { refreshCachedSession } from "../utils/cognito-session.js";
-export declare function runAuthRefresh(refreshSession?: typeof refreshCachedSession): Promise<number>;
+type RefreshSession = (options?: {
+    minValiditySeconds?: number;
+}) => ReturnType<typeof refreshCachedSession>;
+export declare function runAuthRefresh(refreshSession?: RefreshSession): Promise<number>;
 export declare function startAuthRefresh(acquireLease?: typeof acquireCurrentPackageUseLease): Promise<number>;
+export {};
 //# sourceMappingURL=hq-auth-refresh.d.ts.map

package/dist/bin/hq-auth-refresh.js

@@ -17,12 +17,44 @@ import { acquireCurrentPackageUseLease } from "../utils/package-use-lease.js";
 import "../node-network-compat.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
+const MIN_VALIDITY_FLAG = "--min-validity-seconds";
+function parseMinimumValiditySeconds(argv, env) {
+    let raw;
+    let fromFlag = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg === MIN_VALIDITY_FLAG) {
+            raw = argv[index + 1];
+            fromFlag = true;
+            if (!raw || raw.startsWith("--")) {
+                throw new Error(`${MIN_VALIDITY_FLAG} requires a non-negative integer`);
+            }
+            break;
+        }
+        if (arg.startsWith(`${MIN_VALIDITY_FLAG}=`)) {
+            raw = arg.slice(MIN_VALIDITY_FLAG.length + 1);
+            fromFlag = true;
+            break;
+        }
+    }
+    if (!fromFlag)
+        raw = env.HQ_AUTH_MIN_VALIDITY_SECONDS || undefined;
+    if (raw === undefined)
+        return undefined;
+    const value = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isSafeInteger(value)) {
+        throw new Error("minimum token validity must be a non-negative integer");
+    }
+    // Values above the provider's cache margin are clamped by cognito-session.
+    return value;
+}
 export async function runAuthRefresh(refreshSession) {
     const { finishSentrySession, Sentry } = await import("../sentry.js");
     const { refreshCachedSession: refresh } = await import("../utils/cognito-session.js");
     let exitCode = 1;
     try {
-        const result = await (refreshSession ?? refresh)();
+        const minValiditySeconds = parseMinimumValiditySeconds(process.argv.slice(2), process.env);
+        const result = await (refreshSession ?? refresh)(minValiditySeconds === undefined ? {} : { minValiditySeconds });
         if (result.refreshed) {
             exitCode = 0;
         }

package/dist/command-catalog.generated.d.ts

@@ -96,10 +96,10 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly description: "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.";
         readonly aliases: readonly [];
         readonly hidden: false;
-        readonly usage: "[options] <source>";
+        readonly usage: "[options] [source]";
         readonly arguments: readonly [{
             readonly name: "source";
-            readonly required: true;
+            readonly required: false;
             readonly variadic: false;
         }];
         readonly options: readonly [{
@@ -114,6 +114,18 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--branch";
             readonly description: "Follow a ref instead of SHA-pinning (git content-pack flow)";
+        }, {
+            readonly flags: "--global";
+            readonly description: "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)";
+        }, {
+            readonly flags: "--runtime <runtime>";
+            readonly description: "Runtime for --global (claude | codex)";
+        }, {
+            readonly flags: "--dry-run";
+            readonly description: "With --global: print every file and config diff without writing";
+        }, {
+            readonly flags: "--hq-root <dir>";
+            readonly description: "With --global: HQ checkout to install from (default: walk up from cwd)";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -368,10 +380,10 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly description: "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.";
     readonly aliases: readonly [];
     readonly hidden: false;
-    readonly usage: "[options] <source>";
+    readonly usage: "[options] [source]";
     readonly arguments: readonly [{
         readonly name: "source";
-        readonly required: true;
+        readonly required: false;
         readonly variadic: false;
     }];
     readonly options: readonly [{
@@ -386,6 +398,18 @@ export declare const COMMAND_CATALOG: readonly [{
     }, {
         readonly flags: "--branch";
         readonly description: "Follow a ref instead of SHA-pinning (git content-pack flow)";
+    }, {
+        readonly flags: "--global";
+        readonly description: "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)";
+    }, {
+        readonly flags: "--runtime <runtime>";
+        readonly description: "Runtime for --global (claude | codex)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "With --global: print every file and config diff without writing";
+    }, {
+        readonly flags: "--hq-root <dir>";
+        readonly description: "With --global: HQ checkout to install from (default: walk up from cwd)";
     }];
     readonly subcommands: readonly [];
 }, {
@@ -839,6 +863,79 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly description: "Also report this company's workspace plan state (Starter nag)";
     }];
     readonly subcommands: readonly [];
+}, {
+    readonly name: "link";
+    readonly description: "Link this folder (or its git remote) to an HQ company";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options] [company]";
+    readonly arguments: readonly [{
+        readonly name: "company";
+        readonly required: false;
+        readonly variadic: false;
+    }];
+    readonly options: readonly [{
+        readonly flags: "--path <dir>";
+        readonly description: "Folder to link (default: current directory)";
+    }, {
+        readonly flags: "--list";
+        readonly description: "Print every linked folder";
+    }, {
+        readonly flags: "--json";
+        readonly description: "Print JSON output";
+    }, {
+        readonly flags: "--seed-manifest <hqRoot>";
+        readonly description: "Seed entries from an HQ companies/manifest.yaml";
+    }];
+    readonly subcommands: readonly [];
+}, {
+    readonly name: "unlink";
+    readonly description: "Remove the HQ company link for this folder";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options]";
+    readonly arguments: readonly [];
+    readonly options: readonly [{
+        readonly flags: "--path <dir>";
+        readonly description: "Folder to unlink (default: current directory)";
+    }];
+    readonly subcommands: readonly [];
+}, {
+    readonly name: "uninstall";
+    readonly description: "Remove the HQ global install from an agent runtime (use with --global)";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options]";
+    readonly arguments: readonly [];
+    readonly options: readonly [{
+        readonly flags: "--global";
+        readonly description: "Reverse `hq install --global`";
+    }, {
+        readonly flags: "--runtime <runtime>";
+        readonly description: "Runtime to uninstall from (claude | codex)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "Print what would change without writing";
+    }, {
+        readonly flags: "--hq-root <dir>";
+        readonly description: "HQ checkout (only needed when install state is missing)";
+    }];
+    readonly subcommands: readonly [];
+}, {
+    readonly name: "resolve-company";
+    readonly description: "Print the HQ company linked to this folder (never guesses)";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options]";
+    readonly arguments: readonly [];
+    readonly options: readonly [{
+        readonly flags: "--path <dir>";
+        readonly description: "Folder to resolve (default: current directory)";
+    }, {
+        readonly flags: "--json";
+        readonly description: "Print JSON output";
+    }];
+    readonly subcommands: readonly [];
 }, {
     readonly name: "version";
     readonly description: "Show HQ, CLI, and latest hq-core versions";
@@ -9828,6 +9925,25 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Run as a child of this app (only \"desktop\"), which has handed sync over to the daemon";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "call";
+        readonly description: "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <op>";
+        readonly arguments: readonly [{
+            readonly name: "op";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json <args>";
+            readonly description: "Request args as a JSON object";
+        }, {
+            readonly flags: "--timeout <ms>";
+            readonly description: "Give up after this many milliseconds";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "status";
         readonly description: "Show the machine type and each service's state";
@@ -10000,7 +10116,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "restart";
-        readonly description: "Restart one service, or every running service";
+        readonly description: "Restart one service, every service, or the daemon process";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] [unit]";
@@ -10009,7 +10125,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly required: false;
             readonly variadic: false;
         }];
-        readonly options: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--daemon";
+            readonly description: "Restart the supervisor process itself";
+        }];
         readonly subcommands: readonly [];
     }, {
         readonly name: "trigger";

package/dist/command-catalog.generated.js

@@ -101,11 +101,11 @@ export const COMMAND_CATALOG = [
                 "description": "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.",
                 "aliases": [],
                 "hidden": false,
-                "usage": "[options] <source>",
+                "usage": "[options] [source]",
                 "arguments": [
                     {
                         "name": "source",
-                        "required": true,
+                        "required": false,
                         "variadic": false
                     }
                 ],
@@ -125,6 +125,22 @@ export const COMMAND_CATALOG = [
                     {
                         "flags": "--branch",
                         "description": "Follow a ref instead of SHA-pinning (git content-pack flow)"
+                    },
+                    {
+                        "flags": "--global",
+                        "description": "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)"
+                    },
+                    {
+                        "flags": "--runtime <runtime>",
+                        "description": "Runtime for --global (claude | codex)"
+                    },
+                    {
+                        "flags": "--dry-run",
+                        "description": "With --global: print every file and config diff without writing"
+                    },
+                    {
+                        "flags": "--hq-root <dir>",
+                        "description": "With --global: HQ checkout to install from (default: walk up from cwd)"
                     }
                 ],
                 "subcommands": []
@@ -465,11 +481,11 @@ export const COMMAND_CATALOG = [
         "description": "Install a package. Sources: bare slug (registry, Cognito-gated), @scope/name[@ver] (npm pack), git URL[#ref], or local path.",
         "aliases": [],
         "hidden": false,
-        "usage": "[options] <source>",
+        "usage": "[options] [source]",
         "arguments": [
             {
                 "name": "source",
-                "required": true,
+                "required": false,
                 "variadic": false
             }
         ],
@@ -489,6 +505,22 @@ export const COMMAND_CATALOG = [
             {
                 "flags": "--branch",
                 "description": "Follow a ref instead of SHA-pinning (git content-pack flow)"
+            },
+            {
+                "flags": "--global",
+                "description": "Install HQ into an agent runtime at user scope (requires the hq-anywhere-runtime flag)"
+            },
+            {
+                "flags": "--runtime <runtime>",
+                "description": "Runtime for --global (claude | codex)"
+            },
+            {
+                "flags": "--dry-run",
+                "description": "With --global: print every file and config diff without writing"
+            },
+            {
+                "flags": "--hq-root <dir>",
+                "description": "With --global: HQ checkout to install from (default: walk up from cwd)"
             }
         ],
         "subcommands": []
@@ -1073,6 +1105,100 @@ export const COMMAND_CATALOG = [
         ],
         "subcommands": []
     },
+    {
+        "name": "link",
+        "description": "Link this folder (or its git remote) to an HQ company",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options] [company]",
+        "arguments": [
+            {
+                "name": "company",
+                "required": false,
+                "variadic": false
+            }
+        ],
+        "options": [
+            {
+                "flags": "--path <dir>",
+                "description": "Folder to link (default: current directory)"
+            },
+            {
+                "flags": "--list",
+                "description": "Print every linked folder"
+            },
+            {
+                "flags": "--json",
+                "description": "Print JSON output"
+            },
+            {
+                "flags": "--seed-manifest <hqRoot>",
+                "description": "Seed entries from an HQ companies/manifest.yaml"
+            }
+        ],
+        "subcommands": []
+    },
+    {
+        "name": "unlink",
+        "description": "Remove the HQ company link for this folder",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options]",
+        "arguments": [],
+        "options": [
+            {
+                "flags": "--path <dir>",
+                "description": "Folder to unlink (default: current directory)"
+            }
+        ],
+        "subcommands": []
+    },
+    {
+        "name": "uninstall",
+        "description": "Remove the HQ global install from an agent runtime (use with --global)",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options]",
+        "arguments": [],
+        "options": [
+            {
+                "flags": "--global",
+                "description": "Reverse `hq install --global`"
+            },
+            {
+                "flags": "--runtime <runtime>",
+                "description": "Runtime to uninstall from (claude | codex)"
+            },
+            {
+                "flags": "--dry-run",
+                "description": "Print what would change without writing"
+            },
+            {
+                "flags": "--hq-root <dir>",
+                "description": "HQ checkout (only needed when install state is missing)"
+            }
+        ],
+        "subcommands": []
+    },
+    {
+        "name": "resolve-company",
+        "description": "Print the HQ company linked to this folder (never guesses)",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options]",
+        "arguments": [],
+        "options": [
+            {
+                "flags": "--path <dir>",
+                "description": "Folder to resolve (default: current directory)"
+            },
+            {
+                "flags": "--json",
+                "description": "Print JSON output"
+            }
+        ],
+        "subcommands": []
+    },
     {
         "name": "version",
         "description": "Show HQ, CLI, and latest hq-core versions",
@@ -12661,6 +12787,31 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "call",
+                "description": "Send one request to hqd (policy.check, journal.append, memory.get, memory.put, mesh.presence, …) and print the result as JSON",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <op>",
+                "arguments": [
+                    {
+                        "name": "op",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json <args>",
+                        "description": "Request args as a JSON object"
+                    },
+                    {
+                        "flags": "--timeout <ms>",
+                        "description": "Give up after this many milliseconds"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "status",
                 "description": "Show the machine type and each service's state",
@@ -12879,7 +13030,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "restart",
-                "description": "Restart one service, or every running service",
+                "description": "Restart one service, every service, or the daemon process",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] [unit]",
@@ -12890,7 +13041,12 @@ export const COMMAND_CATALOG = [
                         "variadic": false
                     }
                 ],
-                "options": [],
+                "options": [
+                    {
+                        "flags": "--daemon",
+                        "description": "Restart the supervisor process itself"
+                    }
+                ],
                 "subcommands": []
             },
             {

package/dist/command-registration-plan.d.ts

@@ -177,6 +177,30 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/whoami.js";
     readonly exportName: "registerWhoamiCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "link";
+    readonly parent: "program";
+    readonly module: "./commands/link.js";
+    readonly exportName: "registerLinkCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "unlink";
+    readonly parent: "program";
+    readonly module: "./commands/link.js";
+    readonly exportName: "registerUnlinkCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "uninstall";
+    readonly parent: "program";
+    readonly module: "./commands/install-global.js";
+    readonly exportName: "registerUninstallCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "resolve-company";
+    readonly parent: "program";
+    readonly module: "./commands/link.js";
+    readonly exportName: "registerResolveCompanyCommand";
 }, {
     readonly type: "registrar";
     readonly root: "version";

package/dist/command-registration-plan.js

@@ -32,6 +32,10 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "login", parent: "program", module: "./commands/login.js", exportName: "registerLoginCommand" },
     { type: "registrar", root: "logout", parent: "program", module: "./commands/logout.js", exportName: "registerLogoutCommand" },
     { type: "registrar", root: "whoami", parent: "program", module: "./commands/whoami.js", exportName: "registerWhoamiCommand" },
+    { type: "registrar", root: "link", parent: "program", module: "./commands/link.js", exportName: "registerLinkCommand" },
+    { type: "registrar", root: "unlink", parent: "program", module: "./commands/link.js", exportName: "registerUnlinkCommand" },
+    { type: "registrar", root: "uninstall", parent: "program", module: "./commands/install-global.js", exportName: "registerUninstallCommand" },
+    { type: "registrar", root: "resolve-company", parent: "program", module: "./commands/link.js", exportName: "registerResolveCompanyCommand" },
     { type: "registrar", root: "version", parent: "program", module: "./commands/version.js", exportName: "registerVersionCommand" },
     { type: "registrar", root: "auth", parent: "program", module: "./commands/auth.js", exportName: "registerAuthCommands" },
     { type: "registrar", root: "secrets", parent: "program", module: "./commands/secrets.js", exportName: "registerSecretsCommand" },

package/dist/commands/anywhere-runtime-flag.d.ts

@@ -0,0 +1,9 @@
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+export declare const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+export declare class AnywhereRuntimeDisabledError extends Error {
+    readonly expected: true;
+    constructor();
+}
+export declare function anywhereRuntimeEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function requireAnywhereRuntime(): void;
+//# sourceMappingURL=anywhere-runtime-flag.d.ts.map

package/dist/commands/anywhere-runtime-flag.js

@@ -0,0 +1,22 @@
+import { resolveFlagGate, resolveProcessFlagGate } from "../lib/flag-registry.js";
+/** hq-flags key for the staged HQ Anywhere runtime. The registry default is off. */
+export const HQ_ANYWHERE_RUNTIME_FLAG = "hq-anywhere-runtime";
+export class AnywhereRuntimeDisabledError extends Error {
+    expected = true;
+    constructor() {
+        super("HQ Anywhere is not enabled. Enable the hq-anywhere-runtime flag to use this command.");
+        this.name = "AnywhereRuntimeDisabledError";
+    }
+}
+export function anywhereRuntimeEnabled(env = process.env) {
+    const fallback = () => false;
+    const lookup = { fallback: false };
+    return env === process.env
+        ? resolveProcessFlagGate(HQ_ANYWHERE_RUNTIME_FLAG, lookup, fallback)
+        : resolveFlagGate(undefined, HQ_ANYWHERE_RUNTIME_FLAG, lookup, fallback, env);
+}
+export function requireAnywhereRuntime() {
+    if (!anywhereRuntimeEnabled())
+        throw new AnywhereRuntimeDisabledError();
+}
+//# sourceMappingURL=anywhere-runtime-flag.js.map

package/dist/commands/core-derive-trigger-facts-native.js

@@ -62,22 +62,50 @@ function globSegmentMatches(pattern, value) {
         return false;
     }
 }
+function filesystemPath(candidate, cwd) {
+    const value = candidate || ".";
+    return path.isAbsolute(value) ? value : `${cwd}${path.sep}${value}`;
+}
+function isDirectoryPath(candidate, cwd) {
+    try {
+        return fs.statSync(filesystemPath(candidate, cwd)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function pathEntryExists(candidate, cwd) {
+    try {
+        fs.lstatSync(filesystemPath(candidate, cwd));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function expandBashGlob(token, cwd) {
     if (!hasGlobPattern(token))
         return [token];
     const absolute = token.startsWith(path.sep);
+    const trailingSlash = token.endsWith(path.sep);
     const parts = token.split(path.sep).filter((part, index) => !(absolute && index === 0));
+    if (trailingSlash)
+        parts.pop();
     let candidates = [absolute ? path.sep : ""];
     let matchedPattern = false;
-    for (const part of parts) {
+    for (const [index, part] of parts.entries()) {
         if (!hasGlobPattern(part)) {
             candidates = candidates.map((parent) => !parent ? part : parent === path.sep ? `${path.sep}${part}` : `${parent}${path.sep}${part}`);
+            if (matchedPattern) {
+                const needsDirectory = index < parts.length - 1 || trailingSlash;
+                candidates = candidates.filter((candidate) => needsDirectory ? isDirectoryPath(candidate, cwd) : pathEntryExists(candidate, cwd));
+            }
             continue;
         }
         matchedPattern = true;
         const expanded = [];
         for (const parent of candidates) {
-            const directory = absolute ? (parent || path.sep) : path.resolve(cwd, parent || ".");
+            const directory = filesystemPath(parent || ".", cwd);
             let names;
             try {
                 names = fs.readdirSync(directory).sort();
@@ -97,7 +125,13 @@ function expandBashGlob(token, cwd) {
             return [token];
         candidates = expanded;
     }
-    return matchedPattern ? candidates : [token];
+    if (trailingSlash) {
+        candidates = candidates
+            .filter((candidate) => isDirectoryPath(candidate, cwd))
+            .map((candidate) => candidate.endsWith(path.sep) ? candidate : `${candidate}${path.sep}`)
+            .sort();
+    }
+    return matchedPattern && candidates.length > 0 ? candidates : [token];
 }
 function bashUnquotedWords(facts, cwd) {
     return facts.join(" ").split(/[\t\n ]+/).filter(Boolean).flatMap((word) => expandBashGlob(word, cwd));