@indigoai-us/hq-cli 5.336.0 → 5.338.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.338.0] — 2026-10-03
+- Preserve policy-trigger mutual exclusion without `flock` and honor configured stale-run thresholds without `yq`.
+- Add a manual macOS VM parity workflow for checking HQ CLI behavior in Tart.
+
+## [5.337.0] — 2026-10-03
+- QMD index updates now share the cross-process writer lock and skip bounded SQLite contention so a later sync can catch up.
+- Self-update now checks the Windows npm prefix that stores command shims, so an unwritable prefix is detected before npm runs.
+
 ## [5.336.0] — 2026-10-03
 - Client-health refresh failures now retain the bounded Cognito OAuth error class for accurate auth diagnostics.
 - Fix macOS Bash 3.2 service PATH generation when nounset is enabled.

package/assets/scaffold/core/scripts/migrate-policy-triggers.sh

@@ -124,8 +124,61 @@ fi
 COOLDOWN_SECONDS="${HQ_MIGRATE_POLICY_TRIGGERS_COOLDOWN_SECONDS:-3600}"
 STAMP=""
 LOCK=""
+LOCK_FALLBACK_DIR=""
+LOCK_FALLBACK_HELD=0
+LOCK_FALLBACK_OWNER=""
+LOCK_FALLBACK_STALE_SECONDS=86400
 STATE_READY=0
 
+release_fallback_lock() {
+  [ "$LOCK_FALLBACK_HELD" = "1" ] || return 0
+  [ "$(cat "$LOCK_FALLBACK_DIR/owner" 2>/dev/null)" = "$LOCK_FALLBACK_OWNER" ] || return 0
+  rm -f "$LOCK_FALLBACK_DIR/owner" 2>/dev/null || return 0
+  rmdir "$LOCK_FALLBACK_DIR" 2>/dev/null || true
+}
+
+fallback_lock_is_stale() {
+  local lock_dir="$1" modified now age
+  modified="$(stat -c '%Y' "$lock_dir" 2>/dev/null || stat -f '%m' "$lock_dir" 2>/dev/null)"
+  case "$modified" in ''|*[!0-9]*) return 1 ;; esac
+  now="$(date -u '+%s')"
+  age=$((now - modified))
+  [ "$age" -ge "$LOCK_FALLBACK_STALE_SECONDS" ]
+}
+
+reclaim_stale_fallback_lock() {
+  local stale_dir="${LOCK_FALLBACK_DIR}.stale.$$.$RANDOM" owner_present=0 owner_value=""
+  restore_stale_dir() {
+    # Never let mv place the quarantined directory inside a replacement lock.
+    # A new holder may have created the path after our rename-aside.
+    if [ -e "$LOCK_FALLBACK_DIR" ] || [ -L "$LOCK_FALLBACK_DIR" ]; then return 1; fi
+    mv "$stale_dir" "$LOCK_FALLBACK_DIR" 2>/dev/null
+  }
+  [ -d "$LOCK_FALLBACK_DIR" ] || return 1
+  fallback_lock_is_stale "$LOCK_FALLBACK_DIR" || return 1
+  # Rename the observed lock aside atomically. Recheck the moved directory so
+  # a stale decision is never used to remove a replacement lock at the path.
+  mv "$LOCK_FALLBACK_DIR" "$stale_dir" 2>/dev/null || return 1
+  if fallback_lock_is_stale "$stale_dir"; then
+    if [ -e "$stale_dir/owner" ]; then
+      owner_present=1
+      owner_value="$(cat "$stale_dir/owner" 2>/dev/null)"
+      rm -f "$stale_dir/owner" 2>/dev/null || {
+        restore_stale_dir || true
+        return 1
+      }
+    fi
+    if rmdir "$stale_dir" 2>/dev/null; then
+      return 0
+    fi
+    if [ "$owner_present" = "1" ]; then
+      (set -o noclobber; printf '%s\n' "$owner_value" >"$stale_dir/owner") 2>/dev/null || true
+    fi
+  fi
+  restore_stale_dir || true
+  return 1
+}
+
 # Hash the resolved scope rather than using a shared per-root stamp: the
 # default scan deliberately includes tenant-specific directories.
 scope_key() {
@@ -192,12 +245,34 @@ fi
 # A scope-local advisory lock prevents concurrent SessionStart hooks from both
 # observing the same absent/stale stamp. Recheck after acquiring it because a
 # prior holder may have completed while this invocation waited to acquire it.
-if [ "$STATE_READY" = "1" ] && [ "$DRY" != "1" ] && command -v flock >/dev/null 2>&1; then
-  if ! exec 9>"$LOCK"; then
-    exit 0
-  fi
-  if ! flock -n 9; then # command -v flock checked above
-    exit 0
+if [ "$STATE_READY" = "1" ] && [ "$DRY" != "1" ]; then
+  if command -v flock >/dev/null 2>&1; then
+    if ! exec 9>"$LOCK"; then
+      exit 0
+    fi
+    if ! flock -n 9; then
+      exit 0
+    fi
+  else
+    # Atomic directory creation preserves mutual exclusion on stock macOS,
+    # which does not ship util-linux flock. An abandoned directory is only
+    # reclaimed after a 24-hour age threshold, well above this bounded scan.
+    LOCK_FALLBACK_DIR="${LOCK}.d"
+    if ! mkdir "$LOCK_FALLBACK_DIR" 2>/dev/null; then
+      if reclaim_stale_fallback_lock; then
+        mkdir "$LOCK_FALLBACK_DIR" 2>/dev/null || exit 0
+      else
+        exit 0
+      fi
+    fi
+    LOCK_FALLBACK_HELD=1
+    LOCK_FALLBACK_OWNER="$$:$RANDOM:$(date -u '+%s')"
+    if ! printf '%s\n' "$LOCK_FALLBACK_OWNER" >"$LOCK_FALLBACK_DIR/owner"; then
+      rmdir "$LOCK_FALLBACK_DIR" 2>/dev/null || true
+      LOCK_FALLBACK_HELD=0
+      exit 0
+    fi
+    trap release_fallback_lock EXIT
   fi
   if cooldown_blocks_run; then
     exit 0

package/assets/scaffold/core/scripts/repo-run-registry.sh

@@ -127,10 +127,32 @@ _is_pid_alive() {
 }
 
 _stale_minutes() {
-  if [[ -f "$ORCH_YAML" ]] && command -v yq >/dev/null 2>&1; then
-    local v
-    v=$(yq eval '.repo_coordination.stale_heartbeat_minutes // 15' "$ORCH_YAML" 2>/dev/null)
-    [[ -n "$v" && "$v" != "null" ]] && { echo "$v"; return; }
+  if [[ -f "$ORCH_YAML" ]]; then
+    if command -v yq >/dev/null 2>&1; then
+      local v
+      v=$(yq eval '.repo_coordination.stale_heartbeat_minutes // 15' "$ORCH_YAML" 2>/dev/null)
+      [[ -n "$v" && "$v" != "null" ]] && { echo "$v"; return; }
+    else
+      # Parse the one scalar this helper needs when yq is unavailable. Do not
+      # silently replace a configured timeout with the 15-minute default.
+      awk '
+        /^repo_coordination:[[:space:]]*(#.*)?$/ { in_repo=1; next }
+        in_repo && /^[^[:space:]#]/ { exit }
+        in_repo && /^[[:space:]]+stale_heartbeat_minutes:[[:space:]]*/ {
+          sub(/^[[:space:]]+stale_heartbeat_minutes:[[:space:]]*/, "")
+          sub(/[[:space:]]+#.*$/, "")
+          gsub(/^[[:space:]]+|[[:space:]]+$/, "")
+          gsub(/^["\047]|["\047]$/, "")
+          if ($0 == "" || $0 == "null" || $0 == "~") print 15
+          else if ($0 ~ /^[0-9]+$/) print $0
+          else print 15
+          found=1
+          exit
+        }
+        END { if (!found) print 15 }
+      ' "$ORCH_YAML"
+      return
+    fi
   fi
   echo 15
 }

package/dist/commands/core-migrate-policy-triggers-native.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { evaluateTrigger } from "../utils/core-eval-trigger.js";
 import { awkCannotOpenFileDiagnostic } from "../lib/core-utils/awk-diagnostics.js";
 export const MIGRATE_POLICY_TRIGGERS_ASSET = "core/scripts/migrate-policy-triggers.sh";
+const FALLBACK_LOCK_STALE_SECONDS = 24 * 60 * 60;
 const ON_LIVE = "[PreToolUse, PostToolUse, UserPromptSubmit, AssistantIntent]";
 const ON_START = "[SessionStart]";
 const TAG_STOP = new Set(("infrastructure consolidated ux safety hq hq-core hq-cli hq-packages " +
@@ -173,7 +174,7 @@ function unreadablePolicyDiagnostic(filename, error, pathValue) {
     const message = code === "EACCES" || code === "EPERM" ? "Permission denied" : "No such file or directory";
     const script = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../assets/scaffold/core/scripts/migrate-policy-triggers.sh");
     const awk = awkCannotOpenFileDiagnostic(filename, message, 1, process.platform, pathValue);
-    return `${script}: line 314: ${filename}: ${message}\n${awk.repeat(3)}`;
+    return `${script}: line 389: ${filename}: ${message}\n${awk.repeat(3)}`;
 }
 function shellGlobMd(fileSystem, directory) {
     try {
@@ -255,20 +256,141 @@ export function runMigratePolicyTriggers(args, deps) {
     if (cooldownBlocks())
         return { code: 0, stdout, stderr };
     let lockFd;
-    if (stateReady && !dryRun && executableInPath("flock", deps.env, fileSystem)) {
+    let fallbackLockDir;
+    let fallbackLockOwner;
+    const releaseFallbackLock = () => {
+        if (!fallbackLockDir)
+            return;
         try {
-            lockFd = fileSystem.openSync(lock, "w");
+            if (fileSystem.readFileSync(path.join(fallbackLockDir, "owner"), "utf8").trim() === fallbackLockOwner) {
+                fileSystem.unlinkSync(path.join(fallbackLockDir, "owner"));
+                fileSystem.rmdirSync(fallbackLockDir);
+            }
+        }
+        catch { /* preserve the lock if ownership cannot be confirmed */ }
+        fallbackLockDir = undefined;
+    };
+    const reclaimStaleFallbackLock = (directory) => {
+        const restoreQuarantined = (staleDirectory) => {
+            try {
+                fileSystem.lstatSync(directory);
+                return;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    return;
+            }
+            try {
+                fileSystem.renameSync(staleDirectory, directory);
+            }
+            catch { /* preserve the quarantine if restoration fails */ }
+        };
+        const age = (candidate) => {
+            try {
+                return Math.floor(deps.now().getTime() / 1000) - Math.floor(fileSystem.statSync(candidate).mtimeMs / 1000);
+            }
+            catch {
+                return undefined;
+            }
+        };
+        if ((age(directory) ?? -1) < FALLBACK_LOCK_STALE_SECONDS)
+            return false;
+        const staleDirectory = `${directory}.stale.${process.pid}.${Math.random().toString(16).slice(2)}`;
+        try {
+            fileSystem.renameSync(directory, staleDirectory);
         }
         catch {
-            return { code: 0, stdout, stderr };
+            return false;
         }
-        const lockResult = (deps.runFlock ?? runNonblockingFlock)(lockFd, deps.cwd, deps.env.PATH ?? "");
-        if (lockResult.error || lockResult.status !== 0) {
-            fileSystem.closeSync(lockFd);
-            return { code: 0, stdout, stderr };
+        const staleAge = age(staleDirectory);
+        if (staleAge !== undefined && staleAge >= FALLBACK_LOCK_STALE_SECONDS) {
+            let ownerBytes;
+            try {
+                ownerBytes = fileSystem.readFileSync(path.join(staleDirectory, "owner"), "utf8");
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    restoreQuarantined(staleDirectory);
+                    return false;
+                }
+            }
+            if (ownerBytes !== undefined) {
+                try {
+                    fileSystem.unlinkSync(path.join(staleDirectory, "owner"));
+                }
+                catch {
+                    restoreQuarantined(staleDirectory);
+                    return false;
+                }
+            }
+            try {
+                fileSystem.rmdirSync(staleDirectory);
+                return true;
+            }
+            catch {
+                if (ownerBytes !== undefined) {
+                    try {
+                        fileSystem.writeFileSync(path.join(staleDirectory, "owner"), ownerBytes, { encoding: "utf8", mode: 0o600, flag: "wx" });
+                    }
+                    catch { /* keep the quarantined directory rather than overwrite a changed marker */ }
+                }
+                restoreQuarantined(staleDirectory);
+                return false;
+            }
+        }
+        restoreQuarantined(staleDirectory);
+        return false;
+    };
+    if (stateReady && !dryRun) {
+        if (executableInPath("flock", deps.env, fileSystem)) {
+            try {
+                lockFd = fileSystem.openSync(lock, "w");
+            }
+            catch {
+                return { code: 0, stdout, stderr };
+            }
+            const lockResult = (deps.runFlock ?? runNonblockingFlock)(lockFd, deps.cwd, deps.env.PATH ?? "");
+            if (lockResult.error || lockResult.status !== 0) {
+                fileSystem.closeSync(lockFd);
+                return { code: 0, stdout, stderr };
+            }
+        }
+        else {
+            fallbackLockDir = `${lock}.d`;
+            try {
+                fileSystem.mkdirSync(fallbackLockDir);
+            }
+            catch {
+                if (!reclaimStaleFallbackLock(fallbackLockDir)) {
+                    fallbackLockDir = undefined;
+                    return { code: 0, stdout, stderr };
+                }
+                try {
+                    fileSystem.mkdirSync(fallbackLockDir);
+                }
+                catch {
+                    fallbackLockDir = undefined;
+                    return { code: 0, stdout, stderr };
+                }
+            }
+            fallbackLockOwner = `${process.pid}:${Math.random().toString(36).slice(2)}:${nowSeconds()}`;
+            try {
+                fileSystem.writeFileSync(path.join(fallbackLockDir, "owner"), `${fallbackLockOwner}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            }
+            catch {
+                try {
+                    fileSystem.rmdirSync(fallbackLockDir);
+                }
+                catch { /* preserve a lock if cleanup is unsafe */ }
+                fallbackLockDir = undefined;
+                fallbackLockOwner = undefined;
+                return { code: 0, stdout, stderr };
+            }
         }
         if (cooldownBlocks()) {
-            fileSystem.closeSync(lockFd);
+            if (lockFd !== undefined)
+                fileSystem.closeSync(lockFd);
+            releaseFallbackLock();
             return { code: 0, stdout, stderr };
         }
     }
@@ -363,6 +485,7 @@ export function runMigratePolicyTriggers(args, deps) {
     finally {
         if (lockFd !== undefined)
             fileSystem.closeSync(lockFd);
+        releaseFallbackLock();
     }
     return { code: errorCode, stdout, stderr };
 }

package/dist/commands/index-cmd.d.ts

@@ -21,6 +21,9 @@ export type SearchIndexDependencies = {
     singleFlightEnabled?: () => boolean;
     /** Test seams for the host load gate consulted while the embed lock is held. */
     loadGateDependencies?: LoadGateDependencies;
+    /** Test seams for the bounded wait before an index-sync write. */
+    nowMs?: () => number;
+    sleepSync?: (milliseconds: number) => void;
     writeStderr?: (text: string) => void;
 };
 export type SyncSearchIndexResult = {

package/dist/commands/index-cmd.js

@@ -1,5 +1,5 @@
 import { Option } from 'commander';
-import { deriveCollections, listRegisteredCollections, packageLocalBin, reconcileCollections, resolveQmdBin, resolveQmdHome, resolveQmdVersion, runQmd, } from '../lib/search-index/index.js';
+import { deriveCollections, listRegisteredCollections, packageLocalBin, reconcileCollections, resolveQmdBin, resolveQmdHome, resolveQmdVersion, runQmd, QmdExitError, } from '../lib/search-index/index.js';
 import { backgroundStatus, defaultBackgroundDependencies, runBackgroundLauncher, runBackgroundWorker, } from '../lib/search-index/background.js';
 import { defaultEmbedLockDependencies, runWithEmbedLock, } from '../lib/search-index/embed-lock.js';
 import { checkEmbedLoad, defaultLoadGateDependencies, recordSuccessfulEmbed, } from '../lib/search-index/load-gate.js';
@@ -22,6 +22,40 @@ const defaults = {
     runBackgroundWorker,
     backgroundStatus,
 };
+const INDEX_SYNC_LOCK_WAIT_MS = 5_000;
+const INDEX_SYNC_LOCK_POLL_MS = 100;
+const syncSleepBuffer = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function sleepSync(milliseconds) {
+    Atomics.wait(syncSleepBuffer, 0, 0, milliseconds);
+}
+function isSqliteBusy(error) {
+    return error instanceof QmdExitError &&
+        /\bSQLITE_BUSY\b|SqliteError:\s*database is locked\b/i.test(`${error.message}\n${error.stderr}`);
+}
+/** Wait for the shared writer or SQLite transaction to clear, then skip safely. */
+function runWithIndexSyncLock(home, lockDependencies, dependencies, run) {
+    const now = dependencies.nowMs ?? Date.now;
+    const sleep = dependencies.sleepSync ?? sleepSync;
+    const deadline = now() + INDEX_SYNC_LOCK_WAIT_MS;
+    const maxAttempts = Math.ceil(INDEX_SYNC_LOCK_WAIT_MS / INDEX_SYNC_LOCK_POLL_MS) + 1;
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+        try {
+            const outcome = runWithEmbedLock(home, lockDependencies, run);
+            if (outcome !== 'busy')
+                return outcome;
+        }
+        catch (error) {
+            if (isSqliteBusy(error))
+                return 'busy';
+            throw error;
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            return 'busy';
+        sleep(Math.min(INDEX_SYNC_LOCK_POLL_MS, remaining));
+    }
+    return 'busy';
+}
 /** Incrementally update qmd, embedding only when an operator explicitly asks. */
 export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
     const updateIndex = () => {
@@ -60,12 +94,12 @@ export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
         return undefined;
     };
     if (singleFlightEnabled) {
-        const outcome = runWithEmbedLock(home, lockDependencies, () => {
+        const outcome = runWithIndexSyncLock(home, lockDependencies, dependencies, () => {
             updateIndex();
             return embed ? runEmbed() : undefined;
         });
         if (outcome === 'busy') {
-            writeStderr('hq: qmd reindex is already running; skipping this pass.\n');
+            writeStderr('hq: qmd index update is busy; skipping this pass.\n');
             return { status: 'skipped', reason: 'busy' };
         }
         if (outcome === 'unavailable') {
@@ -74,7 +108,17 @@ export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
         }
         return { status: 'updated', embedded };
     }
-    updateIndex();
+    const updateOutcome = runWithIndexSyncLock(home, lockDependencies, dependencies, () => {
+        updateIndex();
+    });
+    if (updateOutcome === 'busy') {
+        writeStderr('hq: qmd index update is busy; skipping this pass.\n');
+        return { status: 'skipped', reason: 'busy' };
+    }
+    if (updateOutcome === 'unavailable') {
+        writeStderr('hq: cannot access the qmd reindex lock; skipping this pass.\n');
+        return { status: 'skipped', reason: 'unavailable' };
+    }
     if (!embed)
         return { status: 'updated', embedded: false };
     const outcome = runWithEmbedLock(home, lockDependencies, runEmbed);

package/dist/lib/core-utils/qmd-reindex-after-sync.js

@@ -122,11 +122,28 @@ export function qmdReindexAfterSync(args = [], options = {}) {
         }
         return 0;
     }
-    updateIndex();
-    if (!embed)
-        return 0;
     const lockDependencies = options.embedLockDependencies ?? defaultEmbedLockDependencies();
     const home = resolveQmdHome(lockDependencies.env);
+    try {
+        const outcome = runWithEmbedLock(home, lockDependencies, () => { updateIndex(); });
+        if (outcome === "busy") {
+            line(stderr, "hq: qmd reindex is already running; skipping this post-sync pass.");
+            return 0;
+        }
+        if (outcome === "unavailable") {
+            line(stderr, "hq: cannot access the qmd reindex lock; skipping this post-sync pass.");
+            return 0;
+        }
+    }
+    catch (error) {
+        if (error instanceof LoadGateConfigurationError)
+            line(stderr, `hq: ${error.message}`);
+        warnOnNativeStartupFailure(error);
+        /* embeddings are deferred-cost and sync must not wait on search freshness */
+        return 0;
+    }
+    if (!embed)
+        return 0;
     try {
         const outcome = runWithEmbedLock(home, lockDependencies, () => runEmbed(home, lockDependencies));
         if (outcome === "busy") {

package/dist/lib/search-index/reindex-single-flight-flag.d.ts

@@ -1,5 +1,5 @@
 export declare const QMD_REINDEX_SINGLE_FLIGHT_FLAG = "qmd.reindex-single-flight";
 export declare const QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK = false;
-/** Keep all HQ-managed QMD writers coordinated only for explicitly enabled canaries. */
+/** Keep whole update-to-embed passes single-flight only for explicitly enabled canaries. */
 export declare function qmdReindexSingleFlightEnabled(): boolean;
 //# sourceMappingURL=reindex-single-flight-flag.d.ts.map

package/dist/lib/search-index/reindex-single-flight-flag.js

@@ -1,7 +1,7 @@
 import { resolveProcessFlagGate } from "../flag-registry.js";
 export const QMD_REINDEX_SINGLE_FLIGHT_FLAG = "qmd.reindex-single-flight";
 export const QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK = false;
-/** Keep all HQ-managed QMD writers coordinated only for explicitly enabled canaries. */
+/** Keep whole update-to-embed passes single-flight only for explicitly enabled canaries. */
 export function qmdReindexSingleFlightEnabled() {
     return resolveProcessFlagGate(QMD_REINDEX_SINGLE_FLIGHT_FLAG, { fallback: QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK }, () => QMD_REINDEX_SINGLE_FLIGHT_FLAG_FALLBACK);
 }

package/dist/utils/version-gate.d.ts

@@ -178,7 +178,7 @@ export declare function isPrefixWritable(prefix: string, access?: (target: strin
  * When one of those directories has not been created yet, check its nearest
  * existing ancestor: npm can create a child only if that ancestor is writable.
  */
-export declare function canWriteNpmInstall(prefix: string, packageRoot: string, access?: (target: string, mode: number) => void): boolean;
+export declare function canWriteNpmInstall(prefix: string, packageRoot: string, access?: (target: string, mode: number) => void, platform?: NodeJS.Platform): boolean;
 /** Claim the one local warning/report for this installed version and prefix. */
 export declare function claimNonWritableNpmPrefixNotice(install: Pick<RunningInstall, "manager" | "prefix" | "packageRoot">, fromVersion: string, homeDir?: string, kind?: "user" | "report"): boolean;
 /** Emit one path-free warning event for a handled non-writable npm prefix. */

package/dist/utils/version-gate.js

@@ -432,8 +432,8 @@ export function isPrefixWritable(prefix, access = (target, mode) => accessSync(t
  * When one of those directories has not been created yet, check its nearest
  * existing ancestor: npm can create a child only if that ancestor is writable.
  */
-export function canWriteNpmInstall(prefix, packageRoot, access = (target, mode) => accessSync(target, mode)) {
-    let nodeModulesRoot = path.join(prefix, process.platform === "win32" ? "node_modules" : "lib/node_modules");
+export function canWriteNpmInstall(prefix, packageRoot, access = (target, mode) => accessSync(target, mode), platform = process.platform) {
+    let nodeModulesRoot = path.join(prefix, platform === "win32" ? "node_modules" : "lib/node_modules");
     let cursor = path.resolve(packageRoot);
     while (true) {
         if (path.basename(cursor).toLowerCase() === "node_modules") {
@@ -446,11 +446,11 @@ export function canWriteNpmInstall(prefix, packageRoot, access = (target, mode)
         cursor = parent;
     }
     const mode = fsConstants.W_OK | fsConstants.X_OK;
-    // npm needs write access to the directories it replaces or links into. The
-    // prefix root itself need not be writable when those directories already
-    // exist; when one is missing, the nearest-existing-ancestor check below
-    // still verifies permission to create it.
-    const targets = [path.join(prefix, "bin"), nodeModulesRoot, path.dirname(packageRoot)];
+    // POSIX npm writes command shims under <prefix>/bin; Windows writes them
+    // directly under <prefix>. Check the actual shim directory alongside the
+    // package directories npm replaces or links into.
+    const shimDirectory = platform === "win32" ? prefix : path.join(prefix, "bin");
+    const targets = [shimDirectory, nodeModulesRoot, path.dirname(packageRoot)];
     return targets.every((target) => {
         let candidate = path.resolve(target);
         while (true) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.336.0",
+  "version": "5.338.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {