@indigoai-us/hq-cli 5.327.0 → 5.328.0

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [5.328.0] — 2026-10-02
+- Keep successful JSON responses readable if vault API plan-limit inspection cannot reconstruct its buffered response.
+- Fixed bundled scaffold checks that could misclassify matching records when `grep -q` closed a pipe under `pipefail`.
+- Keep `hq mcp serve` initialization lightweight by avoiding the full flag registry and network-family compatibility setup.
+
 ## [5.327.0] — 2026-10-02
 - Reduce hook-time startup imports for repo-run-registry and isolate hook-helper handlers from sibling modules.
 - Keep package-root Sentry diagnostics off the fast-route import path unless root diagnostics are needed.

package/assets/scaffold/core/scripts/hq-dm-bind.sh

@@ -329,7 +329,7 @@ mention_line() {
 cmd_bind() {
   local ch="${1:-}"; [ -n "$ch" ] || die "bind needs a channel name (see: hq channels)"
   ch="${ch#\#}"
-  hq channels 2>/dev/null | grep -q -- "hq dm $ch " || die "no channel named '$ch' (see: hq channels)"
+  hq channels 2>/dev/null | grep -- "hq dm $ch " >/dev/null || die "no channel named '$ch' (see: hq channels)"
   bash "$SESSION_SH" set dm_channel "$ch" >/dev/null
   local sk; sk="$(latest_sk "$ch")"
   printf '%s\n' "$sk" > "$(cursor_file)"

package/assets/scaffold/core/scripts/hq-job-run.sh

@@ -323,24 +323,24 @@ classify_failure() {
   local lower
   lower="$(printf '%s' "$tail_txt" | tr '[:upper:]' '[:lower:]')"
 
-  if printf '%s' "$lower" | grep -Eq \
-    'not logged in|please log in|authentication (failed|required)|unauthorized|401|invalid.*(token|credential)|credentials? (missing|expired|invalid)|device.?code|login required'; then
+  if printf '%s' "$lower" | grep -E \
+    'not logged in|please log in|authentication (failed|required)|unauthorized|401|invalid.*(token|credential)|credentials? (missing|expired|invalid)|device.?code|login required' >/dev/null; then
     printf 'auth'
     return
   fi
-  if printf '%s' "$lower" | grep -Eq \
-    'secret.*(not found|missing|denied|not visible|not shared)|hq secrets.*(fail|error|denied)|missing vault|access denied.*secret'; then
+  if printf '%s' "$lower" | grep -E \
+    'secret.*(not found|missing|denied|not visible|not shared)|hq secrets.*(fail|error|denied)|missing vault|access denied.*secret' >/dev/null; then
     printf 'secrets'
     return
   fi
   # Avoid matching job metadata like timeout_seconds=N in the log header.
-  if printf '%s' "$lower" | grep -Eq \
-    '(^|[^_])timed out|command timed out|deadline exceeded|killed by timeout|exit[=:][[:space:]]*124\b'; then
+  if printf '%s' "$lower" | grep -E \
+    '(^|[^_])timed out|command timed out|deadline exceeded|killed by timeout|exit[=:][[:space:]]*124\b' >/dev/null; then
     printf 'timeout'
     return
   fi
-  if printf '%s' "$lower" | grep -Eq \
-    'connection (refused|reset|timed out)|network is unreachable|temporary failure|econnreset|enotfound|no space left|i/o error|transport error|dns (fail|error)|http[/ ]*(502|503|504)|statusingesterror|api unreachable'; then
+  if printf '%s' "$lower" | grep -E \
+    'connection (refused|reset|timed out)|network is unreachable|temporary failure|econnreset|enotfound|no space left|i/o error|transport error|dns (fail|error)|http[/ ]*(502|503|504)|statusingesterror|api unreachable' >/dev/null; then
     printf 'infra'
     return
   fi

package/assets/scaffold/core/scripts/ontology-audience-grant.sh

@@ -67,7 +67,7 @@ for aud in "$C"/signals/@*/_audience.yaml; do
     # attendees), so they are already company identities; emails must be members.
     case "$who" in
       prs_*|agt_*) ;;
-      *) if ! printf '%s\n' "$members" | grep -qxF "$who"; then echo "skip $who (not a member of $co)" >&2; skipped=$((skipped+1)); continue; fi ;;
+      *) if ! grep -qxF "$who" <<<"$members"; then echo "skip $who (not a member of $co)" >&2; skipped=$((skipped+1)); continue; fi ;;
     esac
     for p in $prefixes; do grant "$p" "$who"; done
   done

package/assets/scaffold/core/scripts/ontology-candidate.sh

@@ -79,7 +79,7 @@ id="$(printf '%s\n%s\n%s\n%s' "$kind" "$type" "$key" "$norm_body" | sha)"
 
 dir="$root/companies/$co/$store/_candidates/$(date -u +%Y-%m-%d)"
 # Idempotent across days: the same candidate already written (pending or done) is a no-op.
-if find "$root/companies/$co/$store/_candidates" -name "$id.md" 2>/dev/null | grep -q .; then
+if [ -n "$(find "$root/companies/$co/$store/_candidates" -name "$id.md" -print -quit 2>/dev/null)" ]; then
   echo "exists $id"; exit 0
 fi
 mkdir -p "$dir"

package/assets/scaffold/core/scripts/resolve-company.sh

@@ -65,7 +65,7 @@ SLUGS="$(
 [ -n "$SLUGS" ] || emit "" "none"
 
 is_known_slug() {
-  printf '%s\n' "$SLUGS" | grep -Fxq "$1"
+  printf '%s\n' "$SLUGS" | grep -Fx -- "$1" >/dev/null
 }
 
 prompt_slug() {

package/dist/commands/mcp-serve.js

@@ -15,7 +15,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
-import { HQ_ANYWHERE_RUNTIME_FLAG } from "./anywhere-runtime-flag.js";
+import { HQ_ANYWHERE_RUNTIME_FLAG } from "../lib/anywhere-runtime-flag-key.js";
 import { anywhereRuntimeEnabledFromSnapshot } from "../lib/anywhere-runtime-fast-flag.js";
 import { createLineSplitter, HqdClientError, hqdRequest, hqdSocketPath } from "../lib/daemon/protocol.js";
 export const MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];

package/dist/node-network-compat-fast.js

@@ -11,6 +11,10 @@ export function shouldConfigureNodeNetworkCompatibility(argv) {
     const fastCore = parseFastCore(argv);
     if (fastCore)
         return fastCore.entry.requiresNodeNetworkCompatibility === true;
+    // The MCP shim only forwards over the local hqd socket; it does not make
+    // outbound network requests and does not need the network-family patch.
+    if (argv.length === 4 && argv[2] === "mcp" && argv[3] === "serve")
+        return false;
     // The lightweight secrets route still makes vault API requests.
     if (parseSecretsEnvFastRequest(argv))
         return true;

package/dist/utils/vault-api.js

@@ -111,14 +111,20 @@ function identityLookupTimeoutMs() {
  * exits on Linux CI. Reading once + re-wrapping fully drains the stream.
  */
 async function peekPlanLimitStatus(response, options = {}) {
+    let bufferedBody;
     try {
         if (!response.ok)
             return response;
+        // Fetch forbids bodies on these statuses. Leave the original response
+        // untouched instead of consuming it and trying to reconstruct it later.
+        if ([101, 103, 204, 205, 304].includes(response.status))
+            return response;
         const ct = response.headers.get('content-type') ?? '';
         if (!ct.includes('application/json') && !ct.includes('+json')) {
             return response;
         }
         const buf = await response.arrayBuffer();
+        bufferedBody = buf;
         try {
             const text = new TextDecoder().decode(buf);
             try {
@@ -141,7 +147,16 @@ async function peekPlanLimitStatus(response, options = {}) {
     }
     catch (err) {
         // Only secret-load callers need the body-read error for offline fallback.
-        // Other endpoints retain the pre-existing best-effort peek behavior.
+        // Other endpoints retain the best-effort peek behavior only while the
+        // original body is still readable.
+        if (bufferedBody !== undefined) {
+            // Retry with safe metadata: statusText can itself make Response
+            // construction throw after the original stream has already been drained.
+            return new Response(bufferedBody, {
+                status: response.status,
+                headers: response.headers,
+            });
+        }
         if (options.throwOnBodyReadError)
             throw err;
         return response;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.327.0",
+  "version": "5.328.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {