@indigoai-us/hq-cli 5.335.1-beta.0 → 5.337.0

package/CHANGELOG.md

@@ -2,8 +2,16 @@
 
 ## [Unreleased]
 
-## [5.335.1-beta.0] — 2026-10-03
+## [5.337.0] — 2026-10-03
+- QMD index updates now share the cross-process writer lock and skip bounded SQLite contention so a later sync can catch up.
+- Self-update now checks the Windows npm prefix that stores command shims, so an unwritable prefix is detected before npm runs.
+
+## [5.336.0] — 2026-10-03
 - Client-health refresh failures now retain the bounded Cognito OAuth error class for accurate auth diagnostics.
+- Fix macOS Bash 3.2 service PATH generation when nounset is enabled.
+- Parse policy creation dates at midnight UTC and reject calendar-invalid dates consistently across the shell and native report.
+- Classify missing hidden references by basename-scoped extension siblings, and escape C1 bytes in session journal YAML on every platform.
+- Match BSD awk diagnostics for company resolution and policy frontmatter.
 - CI: Run main-push Linux ARM checks on the reserved self-hosted runner pool.
 
 ## [5.335.0] — 2026-10-03

package/assets/scaffold/core/scripts/outpost-jobs-reconcile.sh

@@ -413,7 +413,7 @@ unit_service_path() { printf '%s/hq-job-%s.service' "$UNIT_DIR" "$1"; }
 unit_timer_path() { printf '%s/hq-job-%s.timer' "$UNIT_DIR" "$1"; }
 
 normalize_service_path() {
-  local remaining="$1" entry existing normalized="" has_more seen
+  local remaining="$1" entry existing normalized="" has_more seen entry_count=0 index
   local -a entries=()
   while :; do
     if [[ "$remaining" == *:* ]]; then
@@ -428,7 +428,8 @@ normalize_service_path() {
     case "$entry" in
       /*)
         seen=0
-        for existing in "${entries[@]}"; do
+        for ((index = 0; index < entry_count; index++)); do
+          existing="${entries[index]}"
           if [ "$existing" = "$entry" ]; then
             seen=1
             break
@@ -436,12 +437,13 @@ normalize_service_path() {
         done
         if [ "$seen" -eq 0 ]; then
           entries+=("$entry")
+          entry_count=$((entry_count + 1))
         fi
         ;;
     esac
     [ "$has_more" -eq 1 ] || break
   done
-  if [ "${#entries[@]}" -gt 0 ]; then
+  if [ "$entry_count" -gt 0 ]; then
     local IFS=:
     normalized="${entries[*]}"
   fi

package/assets/scaffold/core/scripts/policy-age-report.sh

@@ -100,7 +100,12 @@ else
 fi
 
 to_epoch() { # YYYY-MM-DD -> epoch (0 on failure)
-  date -u -d "$1" +%s 2>/dev/null || date -u -j -f %Y-%m-%d "$1" +%s 2>/dev/null || echo 0
+  local epoch normalized
+  epoch="$(date -u -d "$1 00:00:00" +%s 2>/dev/null || date -u -j -f '%Y-%m-%d %H:%M:%S' "$1 00:00:00" +%s 2>/dev/null)" || { echo 0; return; }
+  [ -n "$epoch" ] || { echo 0; return; }
+  normalized="$(date -u -d "@$epoch" +%Y-%m-%d 2>/dev/null || date -u -r "$epoch" +%Y-%m-%d 2>/dev/null)" || { echo 0; return; }
+  [ "$normalized" = "$1" ] || { echo 0; return; }
+  echo "$epoch"
 }
 
 for dir in "${DIRS[@]}"; do
@@ -144,7 +149,18 @@ for dir in "${DIRS[@]}"; do
       if [ ! -e "$HQ_ROOT/$ref" ]; then
         # A sibling with the same stem (renamed extension: foo.sh -> foo.mjs) means
         # the subject still exists and the rule needs a fix, not retirement.
-        stem="${ref%.*}"
+        ref_for_stem="${ref%/}"
+        ref_basename="${ref_for_stem##*/}"
+        case "$ref_basename" in
+          .* )
+            case "${ref_basename#.}" in
+              *.*) stem="${ref_for_stem%.*}" ;;
+              *) stem="$ref_for_stem" ;;
+            esac
+            ;;
+          *.*) stem="${ref_for_stem%.*}" ;;
+          *) stem="$ref_for_stem" ;;
+        esac
         if ls "$HQ_ROOT/$stem".* >/dev/null 2>&1; then renamed="${renamed:+$renamed,}$ref"; else stale="${stale:+$stale,}$ref"; fi
       fi
     done < <(awk '/^## Rule/{r=1;next} r&&/^## /{r=0} r' "$f" \

package/assets/scaffold/core/scripts/session-journal.sh

@@ -44,15 +44,49 @@ slugify() {
 }
 
 yaml_double_quoted() {
-  local value="$1" output='"' character next codepoint hex
+  local value="$1" output='"' character next pair hex
   local LC_ALL=C index
   for ((index = 0; index < ${#value}; index++)); do
     character="${value:index:1}"
     if [[ "$character" == $'\xc2' ]] && (( index + 1 < ${#value} )); then
       next="${value:index+1:1}"
-      printf -v codepoint '%d' "'${next}"
-      if (( codepoint >= 128 && codepoint <= 159 )); then
-        printf -v hex '%04x' "$codepoint"
+      pair="$character$next"
+      case "$pair" in
+        $'\xc2\x80') hex=0080 ;;
+        $'\xc2\x81') hex=0081 ;;
+        $'\xc2\x82') hex=0082 ;;
+        $'\xc2\x83') hex=0083 ;;
+        $'\xc2\x84') hex=0084 ;;
+        $'\xc2\x85') hex=0085 ;;
+        $'\xc2\x86') hex=0086 ;;
+        $'\xc2\x87') hex=0087 ;;
+        $'\xc2\x88') hex=0088 ;;
+        $'\xc2\x89') hex=0089 ;;
+        $'\xc2\x8a') hex=008a ;;
+        $'\xc2\x8b') hex=008b ;;
+        $'\xc2\x8c') hex=008c ;;
+        $'\xc2\x8d') hex=008d ;;
+        $'\xc2\x8e') hex=008e ;;
+        $'\xc2\x8f') hex=008f ;;
+        $'\xc2\x90') hex=0090 ;;
+        $'\xc2\x91') hex=0091 ;;
+        $'\xc2\x92') hex=0092 ;;
+        $'\xc2\x93') hex=0093 ;;
+        $'\xc2\x94') hex=0094 ;;
+        $'\xc2\x95') hex=0095 ;;
+        $'\xc2\x96') hex=0096 ;;
+        $'\xc2\x97') hex=0097 ;;
+        $'\xc2\x98') hex=0098 ;;
+        $'\xc2\x99') hex=0099 ;;
+        $'\xc2\x9a') hex=009a ;;
+        $'\xc2\x9b') hex=009b ;;
+        $'\xc2\x9c') hex=009c ;;
+        $'\xc2\x9d') hex=009d ;;
+        $'\xc2\x9e') hex=009e ;;
+        $'\xc2\x9f') hex=009f ;;
+        *) hex= ;;
+      esac
+      if [[ -n "$hex" ]]; then
         output+="\\u$hex"
         index=$((index + 1))
         continue

package/dist/commands/core-policy-frontmatter.d.ts

@@ -4,5 +4,5 @@ export type FrontmatterResult = {
     stderr: Buffer;
 };
 /** Byte-preserving port of core/scripts/read-policy-frontmatter.sh. */
-export declare function runPolicyFrontmatter(args: readonly string[], cwd: string): FrontmatterResult;
+export declare function runPolicyFrontmatter(args: readonly string[], cwd: string, pathValue?: string | undefined, platform?: NodeJS.Platform): FrontmatterResult;
 //# sourceMappingURL=core-policy-frontmatter.d.ts.map

package/dist/commands/core-policy-frontmatter.js

@@ -1,8 +1,9 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { usesGnuAwk } from '../lib/core-utils/awk-diagnostics.js';
 const USAGE = Buffer.from('USAGE: read-policy-frontmatter.sh <policy-file>\n');
 /** Byte-preserving port of core/scripts/read-policy-frontmatter.sh. */
-export function runPolicyFrontmatter(args, cwd) {
+export function runPolicyFrontmatter(args, cwd, pathValue = process.env.PATH, platform = process.platform) {
     const first = args[0];
     if (first === undefined)
         return { code: 1, stdout: Buffer.alloc(0), stderr: USAGE };
@@ -18,7 +19,9 @@ export function runPolicyFrontmatter(args, cwd) {
             return {
                 code: 0,
                 stdout: Buffer.alloc(0),
-                stderr: Buffer.from(`awk: warning: command line argument \`${first}' is a directory: skipped\n`),
+                stderr: Buffer.from(usesGnuAwk(pathValue, platform)
+                    ? `awk: warning: command line argument \`${first}' is a directory: skipped\n`
+                    : ''),
             };
         }
         if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {

package/dist/commands/core-policy.d.ts

@@ -5,8 +5,8 @@ export type CorePolicyResult = {
     stdout: Buffer;
     stderr: Buffer;
 };
-export declare function runPolicyAgeReport(args: readonly string[], root: string, env?: NodeJS.ProcessEnv, nowEpoch?: number): CorePolicyResult;
-export declare function runPolicyFrontmatter(args: readonly string[], cwd: string): FrontmatterResult;
+export declare function runPolicyAgeReport(args: readonly string[], root: string, env?: NodeJS.ProcessEnv, nowEpoch?: number, platform?: NodeJS.Platform): CorePolicyResult;
+export declare function runPolicyFrontmatter(args: readonly string[], cwd: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): FrontmatterResult;
 export declare function runPolicyRetire(args: readonly string[], root: string, cwd: string, env?: NodeJS.ProcessEnv, now?: Date): CorePolicyResult;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */
 export declare function runPolicyFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;

package/dist/commands/core-policy.js

@@ -206,8 +206,11 @@ function extractRulePaths(file) {
     return [...paths].sort();
 }
 function shellReferenceStem(reference) {
-    const lastDot = reference.lastIndexOf('.');
-    return lastDot === -1 ? reference : reference.slice(0, lastDot);
+    const normalized = reference.replace(/\/$/, '');
+    const slash = normalized.lastIndexOf('/');
+    const basename = normalized.slice(slash + 1);
+    const lastDot = basename.lastIndexOf('.');
+    return lastDot <= 0 ? normalized : normalized.slice(0, slash + 1 + lastDot);
 }
 function shellLsExtensionGlobHasMatch(root, stem) {
     const patternPath = path.join(root, `${stem}.*`);
@@ -223,8 +226,8 @@ function shellLsExtensionGlobHasMatch(root, stem) {
             return false;
         throw error;
     }
-    // Bash 5.2 enables globskipdots by default, so `.*` only matches when the
-    // directory has an actual hidden entry. readdir omits `.` and `..`.
+    // The shell checks extension siblings only within the reference basename's
+    // directory, so directory dot-components never count as sibling files.
     return entries.some((entry) => entry.startsWith(literalPrefix));
 }
 function refSummary(file, root) {
@@ -260,12 +263,17 @@ function refSummary(file, root) {
     return { stale, renamed, judged: judged.length };
 }
 function epochFromDate(value) {
-    if (!value)
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(value))
         return 0;
-    const parsed = Date.parse(`${value}T00:00:00Z`);
-    if (!Number.isFinite(parsed) || new Date(parsed).toISOString().slice(0, 10) !== value)
+    const year = Number(value.slice(0, 4));
+    const month = Number(value.slice(5, 7));
+    const day = Number(value.slice(8, 10));
+    if (month < 1 || month > 12 || day < 1 || day > 31)
         return 0;
-    return Math.floor(parsed / 1000);
+    const parsed = new Date(Date.UTC(year, month - 1, day));
+    if (parsed.getUTCFullYear() !== year || parsed.getUTCMonth() + 1 !== month || parsed.getUTCDate() !== day)
+        return 0;
+    return Math.floor(parsed.getTime() / 1000);
 }
 function countLedgerRows(directory, withMtime, recursive, awkPath) {
     const counts = new Map();
@@ -380,7 +388,7 @@ function bashTestGreaterOrEqual(left, right, scriptPath, line) {
     }
     return { value: BigInt(left) >= parsed, stderr: '' };
 }
-export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Math.floor(Date.now() / 1000)) {
+export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Math.floor(Date.now() / 1000), platform = process.platform) {
     const parsed = parseAgeOptions(args, resolveBundledAsset(POLICY_AGE_REPORT_ASSET));
     if (parsed.kind === 'help')
         return policyResult(0, AGE_HELP);
@@ -440,13 +448,13 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             const singleIncident = ['user-correction', 'session-learning', 'back-pressure-failure'].includes(source) && (version || '1') === '1';
             const classes = [];
             if (fired === 0) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 157);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 173);
                 stderr += comparison.stderr;
                 if (comparison.value && usage.anyFiles)
                     classes.push('never-fired');
             }
             if (fired > 0) {
-                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 158);
+                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 174);
                 stderr += comparison.stderr;
                 if (comparison.value)
                     classes.push('dormant');
@@ -456,7 +464,7 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             if (refs.renamed.length > 0)
                 classes.push('renamed-refs');
             if (singleIncident) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 162);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 178);
                 stderr += comparison.stderr;
                 if (comparison.value && fired <= 1)
                     classes.push('single-incident-old');
@@ -496,8 +504,8 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
     }
     return policyResult(0, stdout, stderr);
 }
-export function runPolicyFrontmatter(args, cwd) {
-    return runPolicyFrontmatterImpl(args, cwd);
+export function runPolicyFrontmatter(args, cwd, env = process.env, platform = process.platform) {
+    return runPolicyFrontmatterImpl(args, cwd, env.PATH, platform);
 }
 function parseRetireOptions(args, scriptPath, env) {
     const value = {

package/dist/commands/core-resolve-company-native.js

@@ -47,7 +47,7 @@ function readManifest(filePath, fileSystem, pathValue) {
             return {
                 code: 0,
                 stdout: Buffer.from('{"company":"","source":"none"}\n'),
-                stderr: Buffer.from(awkCannotOpenFileDiagnostic(filePath, "Permission denied", 1, process.platform, pathValue)),
+                stderr: Buffer.from(awkCannotOpenFileDiagnostic(filePath, "Permission denied", 11, process.platform, pathValue)),
             };
         }
         if (code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP")

package/dist/commands/core-session-journal-native.js

@@ -202,7 +202,7 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
                 fs.writeFileSync(counter, `${readCounter(counter) + 1}\n`);
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 312);
+                reportDirectoryWriteFailure(error, 346);
             }
         });
     }
@@ -215,7 +215,7 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
                 fs.writeFileSync(counter, "0\n");
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 320);
+                reportDirectoryWriteFailure(error, 354);
             }
         });
     }

package/dist/commands/index-cmd.d.ts

@@ -21,6 +21,9 @@ export type SearchIndexDependencies = {
     singleFlightEnabled?: () => boolean;
     /** Test seams for the host load gate consulted while the embed lock is held. */
     loadGateDependencies?: LoadGateDependencies;
+    /** Test seams for the bounded wait before an index-sync write. */
+    nowMs?: () => number;
+    sleepSync?: (milliseconds: number) => void;
     writeStderr?: (text: string) => void;
 };
 export type SyncSearchIndexResult = {

package/dist/commands/index-cmd.js

@@ -1,5 +1,5 @@
 import { Option } from 'commander';
-import { deriveCollections, listRegisteredCollections, packageLocalBin, reconcileCollections, resolveQmdBin, resolveQmdHome, resolveQmdVersion, runQmd, } from '../lib/search-index/index.js';
+import { deriveCollections, listRegisteredCollections, packageLocalBin, reconcileCollections, resolveQmdBin, resolveQmdHome, resolveQmdVersion, runQmd, QmdExitError, } from '../lib/search-index/index.js';
 import { backgroundStatus, defaultBackgroundDependencies, runBackgroundLauncher, runBackgroundWorker, } from '../lib/search-index/background.js';
 import { defaultEmbedLockDependencies, runWithEmbedLock, } from '../lib/search-index/embed-lock.js';
 import { checkEmbedLoad, defaultLoadGateDependencies, recordSuccessfulEmbed, } from '../lib/search-index/load-gate.js';
@@ -22,6 +22,40 @@ const defaults = {
     runBackgroundWorker,
     backgroundStatus,
 };
+const INDEX_SYNC_LOCK_WAIT_MS = 5_000;
+const INDEX_SYNC_LOCK_POLL_MS = 100;
+const syncSleepBuffer = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function sleepSync(milliseconds) {
+    Atomics.wait(syncSleepBuffer, 0, 0, milliseconds);
+}
+function isSqliteBusy(error) {
+    return error instanceof QmdExitError &&
+        /\bSQLITE_BUSY\b|SqliteError:\s*database is locked\b/i.test(`${error.message}\n${error.stderr}`);
+}
+/** Wait for the shared writer or SQLite transaction to clear, then skip safely. */
+function runWithIndexSyncLock(home, lockDependencies, dependencies, run) {
+    const now = dependencies.nowMs ?? Date.now;
+    const sleep = dependencies.sleepSync ?? sleepSync;
+    const deadline = now() + INDEX_SYNC_LOCK_WAIT_MS;
+    const maxAttempts = Math.ceil(INDEX_SYNC_LOCK_WAIT_MS / INDEX_SYNC_LOCK_POLL_MS) + 1;
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+        try {
+            const outcome = runWithEmbedLock(home, lockDependencies, run);
+            if (outcome !== 'busy')
+                return outcome;
+        }
+        catch (error) {
+            if (isSqliteBusy(error))
+                return 'busy';
+            throw error;
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            return 'busy';
+        sleep(Math.min(INDEX_SYNC_LOCK_POLL_MS, remaining));
+    }
+    return 'busy';
+}
 /** Incrementally update qmd, embedding only when an operator explicitly asks. */
 export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
     const updateIndex = () => {
@@ -60,12 +94,12 @@ export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
         return undefined;
     };
     if (singleFlightEnabled) {
-        const outcome = runWithEmbedLock(home, lockDependencies, () => {
+        const outcome = runWithIndexSyncLock(home, lockDependencies, dependencies, () => {
             updateIndex();
             return embed ? runEmbed() : undefined;
         });
         if (outcome === 'busy') {
-            writeStderr('hq: qmd reindex is already running; skipping this pass.\n');
+            writeStderr('hq: qmd index update is busy; skipping this pass.\n');
             return { status: 'skipped', reason: 'busy' };
         }
         if (outcome === 'unavailable') {
@@ -74,7 +108,17 @@ export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
         }
         return { status: 'updated', embedded };
     }
-    updateIndex();
+    const updateOutcome = runWithIndexSyncLock(home, lockDependencies, dependencies, () => {
+        updateIndex();
+    });
+    if (updateOutcome === 'busy') {
+        writeStderr('hq: qmd index update is busy; skipping this pass.\n');
+        return { status: 'skipped', reason: 'busy' };
+    }
+    if (updateOutcome === 'unavailable') {
+        writeStderr('hq: cannot access the qmd reindex lock; skipping this pass.\n');
+        return { status: 'skipped', reason: 'unavailable' };
+    }
     if (!embed)
         return { status: 'updated', embedded: false };
     const outcome = runWithEmbedLock(home, lockDependencies, runEmbed);

package/dist/lib/core-utils/awk-diagnostics.d.ts

@@ -1,2 +1,9 @@
+/**
+ * The bundled shell companions emit awk's open-file diagnostic. GNU awk and
+ * the BSD awk shipped by macOS format that diagnostic differently. Prefer
+ * the executable selected by PATH; macOS runners can put GNU awk ahead of the
+ * system awk.
+ */
+export declare function usesGnuAwk(pathValue: string | undefined, platform: NodeJS.Platform): boolean;
 export declare function awkCannotOpenFileDiagnostic(filename: string, reason: string, sourceLine?: number, platform?: NodeJS.Platform, pathValue?: string | undefined): string;
 //# sourceMappingURL=awk-diagnostics.d.ts.map

package/dist/lib/core-utils/awk-diagnostics.js

@@ -6,7 +6,7 @@ import * as path from "node:path";
  * the executable selected by PATH; macOS runners can put GNU awk ahead of the
  * system awk.
  */
-function usesGnuAwk(pathValue, platform) {
+export function usesGnuAwk(pathValue, platform) {
     for (const directory of (pathValue ?? "/usr/bin:/bin").split(path.delimiter)) {
         if (!directory)
             continue;

package/dist/lib/core-utils/qmd-reindex-after-sync.js

@@ -122,11 +122,28 @@ export function qmdReindexAfterSync(args = [], options = {}) {
         }
         return 0;
     }
-    updateIndex();
-    if (!embed)
-        return 0;
     const lockDependencies = options.embedLockDependencies ?? defaultEmbedLockDependencies();
     const home = resolveQmdHome(lockDependencies.env);
+    try {
+        const outcome = runWithEmbedLock(home, lockDependencies, () => { updateIndex(); });
+        if (outcome === "busy") {
+            line(stderr, "hq: qmd reindex is already running; skipping this post-sync pass.");
+            return 0;
+        }
+        if (outcome === "unavailable") {
+            line(stderr, "hq: cannot access the qmd reindex lock; skipping this post-sync pass.");
+            return 0;
+        }
+    }
+    catch (error) {
+        if (error instanceof LoadGateConfigurationError)
+            line(stderr, `hq: ${error.message}`);
+        warnOnNativeStartupFailure(error);
+        /* embeddings are deferred-cost and sync must not wait on search freshness */
+        return 0;
+    }
+    if (!embed)
+        return 0;
     try {
         const outcome = runWithEmbedLock(home, lockDependencies, () => runEmbed(home, lockDependencies));
         if (outcome === "busy") {

package/dist/lib/search-index/reindex-single-flight-flag.d.ts

@@ -1,5 +1,5 @@
 export declare const QMD_REINDEX_SINGLE_FLIGHT_FLAG = "qmd.reindex-single-flight";
 export declare const QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK = false;
-/** Keep all HQ-managed QMD writers coordinated only for explicitly enabled canaries. */
+/** Keep whole update-to-embed passes single-flight only for explicitly enabled canaries. */
 export declare function qmdReindexSingleFlightEnabled(): boolean;
 //# sourceMappingURL=reindex-single-flight-flag.d.ts.map

package/dist/lib/search-index/reindex-single-flight-flag.js

@@ -1,7 +1,7 @@
 import { resolveProcessFlagGate } from "../flag-registry.js";
 export const QMD_REINDEX_SINGLE_FLIGHT_FLAG = "qmd.reindex-single-flight";
 export const QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK = false;
-/** Keep all HQ-managed QMD writers coordinated only for explicitly enabled canaries. */
+/** Keep whole update-to-embed passes single-flight only for explicitly enabled canaries. */
 export function qmdReindexSingleFlightEnabled() {
     return resolveProcessFlagGate(QMD_REINDEX_SINGLE_FLIGHT_FLAG, { fallback: QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK }, () => QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK);
 }

package/dist/utils/version-gate.d.ts

@@ -178,7 +178,7 @@ export declare function isPrefixWritable(prefix: string, access?: (target: strin
  * When one of those directories has not been created yet, check its nearest
  * existing ancestor: npm can create a child only if that ancestor is writable.
  */
-export declare function canWriteNpmInstall(prefix: string, packageRoot: string, access?: (target: string, mode: number) => void): boolean;
+export declare function canWriteNpmInstall(prefix: string, packageRoot: string, access?: (target: string, mode: number) => void, platform?: NodeJS.Platform): boolean;
 /** Claim the one local warning/report for this installed version and prefix. */
 export declare function claimNonWritableNpmPrefixNotice(install: Pick<RunningInstall, "manager" | "prefix" | "packageRoot">, fromVersion: string, homeDir?: string, kind?: "user" | "report"): boolean;
 /** Emit one path-free warning event for a handled non-writable npm prefix. */

package/dist/utils/version-gate.js

@@ -432,8 +432,8 @@ export function isPrefixWritable(prefix, access = (target, mode) => accessSync(t
  * When one of those directories has not been created yet, check its nearest
  * existing ancestor: npm can create a child only if that ancestor is writable.
  */
-export function canWriteNpmInstall(prefix, packageRoot, access = (target, mode) => accessSync(target, mode)) {
-    let nodeModulesRoot = path.join(prefix, process.platform === "win32" ? "node_modules" : "lib/node_modules");
+export function canWriteNpmInstall(prefix, packageRoot, access = (target, mode) => accessSync(target, mode), platform = process.platform) {
+    let nodeModulesRoot = path.join(prefix, platform === "win32" ? "node_modules" : "lib/node_modules");
     let cursor = path.resolve(packageRoot);
     while (true) {
         if (path.basename(cursor).toLowerCase() === "node_modules") {
@@ -446,11 +446,11 @@ export function canWriteNpmInstall(prefix, packageRoot, access = (target, mode)
         cursor = parent;
     }
     const mode = fsConstants.W_OK | fsConstants.X_OK;
-    // npm needs write access to the directories it replaces or links into. The
-    // prefix root itself need not be writable when those directories already
-    // exist; when one is missing, the nearest-existing-ancestor check below
-    // still verifies permission to create it.
-    const targets = [path.join(prefix, "bin"), nodeModulesRoot, path.dirname(packageRoot)];
+    // POSIX npm writes command shims under <prefix>/bin; Windows writes them
+    // directly under <prefix>. Check the actual shim directory alongside the
+    // package directories npm replaces or links into.
+    const shimDirectory = platform === "win32" ? prefix : path.join(prefix, "bin");
+    const targets = [shimDirectory, nodeModulesRoot, path.dirname(packageRoot)];
     return targets.every((target) => {
         let candidate = path.resolve(target);
         while (true) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.335.1-beta.0",
+  "version": "5.337.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {