@indigoai-us/hq-cli 5.342.13 → 5.342.14

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.342.14] — 2026-10-04
+- Fixed native HQ subprocess launching and job-lock command resolution on Windows.
+- Fixed Windows delegate/job shell parity while preserving embedded carriage returns and POSIX command/path bytes.
+
 ## [5.342.13] — 2026-10-04
 - Run independent core migration differential cases with bounded parallel child processes while preserving per-case reports and failures.
 

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -35,6 +35,15 @@ die()   { echo "hq-delegate-grant: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 MANIFEST="" YES=0
 while [ $# -gt 0 ]; do
   case "$1" in

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -40,6 +40,15 @@ die()   { echo "hq-delegate-send: $*" >&2; exit 1; }
 
 command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 MANIFEST="" SEND=0 HEADLINE="" NOTE=""
 while [ $# -gt 0 ]; do
   case "$1" in

package/assets/scaffold/core/scripts/hq-job-probe.sh

@@ -120,6 +120,15 @@ done
 command -v yq >/dev/null 2>&1 || die "yq is required (mikefarah/yq)"
 command -v jq >/dev/null 2>&1 || die "jq is required"
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 iso_now() {
   if [ -n "${HQ_JOB_PROBE_NOW:-}" ]; then
     printf '%s' "$HQ_JOB_PROBE_NOW"

package/assets/scaffold/core/scripts/jobs-validate.sh

@@ -40,6 +40,15 @@ command -v jq >/dev/null 2>&1 || {
   exit 2
 }
 
+# jq.exe on Windows emits CRLF data; remove only its line-ending CR bytes.
+case "${OSTYPE:-}" in
+  msys*)
+    jq() {
+      command jq "$@" | command sed -b 's/\r$//'
+    }
+    ;;
+esac
+
 [ "$#" -ge 1 ] || die_usage
 
 collect_files() {

package/dist/commands/core-delegate-w1b.js

@@ -4,6 +4,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { commandExists, isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
@@ -171,12 +172,20 @@ function parseFlags(args, allowed) {
 }
 function usage(name) { return USAGE[name] ?? ""; }
 function usageFailure(name) { err(usage(name)); return 1; }
+function bashPath(value) {
+    if (process.platform !== "win32")
+        return value;
+    const normalized = value.replaceAll("\\", "/");
+    const drivePath = /^([A-Za-z]):\/(.*)$/u.exec(normalized);
+    return drivePath ? `/${drivePath[1].toLowerCase()}/${drivePath[2]}` : normalized;
+}
 function runShellFallback(name, args, context) {
+    const root = context.root ?? context.cwd;
     const result = runBundledScript({
         asset: ASSETS[name],
         args,
         cwd: context.cwd,
-        hqRoot: context.root ?? context.cwd,
+        hqRoot: bashPath(root),
         captureOutput: true,
     });
     if (result.stdout?.length)
@@ -392,16 +401,16 @@ function runGrant(args, context) {
     if (!manifestPath)
         return fail("grant", "--manifest is required");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("grant", `manifest not found: ${manifestPath}`);
+        return fail("grant", `manifest not found: ${shellDisplayPath(manifestPath)}`);
     let manifest;
     try {
         manifest = readJsonFile(manifestPath);
     }
     catch {
-        return fail("grant", `manifest is not valid JSON: ${manifestPath}`);
+        return fail("grant", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
     }
     if (manifest === null || manifest === false)
-        return fail("grant", `manifest is not valid JSON: ${manifestPath}`);
+        return fail("grant", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
     if (!isRecord(manifest))
         return fail("grant", "manifest has no company");
     const company = jqRawPath(manifest, "company");
@@ -778,13 +787,13 @@ function runSend(args, context) {
     if (!manifestPath)
         return fail("send", "--manifest is required");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("send", `manifest not found: ${manifestPath}`);
+        return fail("send", `manifest not found: ${shellDisplayPath(manifestPath)}`);
     const manifest = jsonFile(manifestPath);
     if (!manifest)
-        return fail("send", `manifest is not valid JSON: ${manifestPath}`);
+        return fail("send", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
     if (send) {
         const publishedPath = path.join(context.root ?? context.cwd, jqRawPath(manifest, "publication.manifestPath"));
-        if (fs.existsSync(publishedPath) && fs.statSync(publishedPath).isFile() && malformedJsonFile(publishedPath)) {
+        if (malformedJsonFile(publishedPath)) {
             return runShellFallback("send", args, context);
         }
     }
@@ -894,7 +903,7 @@ function runSend(args, context) {
         }
         moveFile(stagedPrompt, prompt);
         fs.rmSync(stage, { recursive: true, force: true });
-        out(`hq-delegate-send: pickup prompt written: ${prompt}\n`);
+        out(`hq-delegate-send: pickup prompt written: ${shellDisplayPath(prompt)}\n`);
         if (!send)
             return 0;
         if (jqRawPath(manifest, "status") !== "verified")
@@ -1035,12 +1044,12 @@ function runVerify(args, context) {
     if (!manifestPath)
         return fail("verify", "--manifest is required (or --dry-run with --company/--project/--to)");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("verify", `manifest not found: ${manifestPath}`);
+        return fail("verify", `manifest not found: ${shellDisplayPath(manifestPath)}`);
     if (malformedJsonFile(manifestPath))
         return runShellFallback("verify", args, context);
     const manifest = jsonFile(manifestPath);
     if (!manifest)
-        return fail("verify", `jq: error: ${manifestPath}: Invalid JSON`);
+        return fail("verify", `jq: error: ${shellDisplayPath(manifestPath)}: Invalid JSON`);
     const lock = `${manifestPath}.send-lock`;
     try {
         fs.mkdirSync(lock);

package/dist/commands/core-delegate.d.ts

@@ -1,5 +1,6 @@
 /** Native implementations of the five `hq core delegate` shell companions. */
 import { Command } from "commander";
+import { type SpawnPlan } from "../utils/windows-spawn.js";
 export declare const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
 export type DelegateContext = {
     cwd: string;
@@ -18,6 +19,7 @@ export type CommandExistsOptions = {
     existsSync?: (candidate: string) => boolean;
 };
 export declare function commandExists(name: string, cwd?: string, options?: CommandExistsOptions): boolean;
+export declare function delegateSubprocessSpawnPlan(command: string, args: readonly string[], env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SpawnPlan;
 export declare function subprocess(command: string, args: string[], cwd: string, options?: {
     input?: Buffer | string;
     stdinFd?: number;

package/dist/commands/core-delegate.js

@@ -4,7 +4,9 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { buildCmdExeSpawnPlan, isWindowsBatchFile } from "../utils/windows-spawn.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
@@ -86,13 +88,23 @@ function commandPath(name, cwd = process.cwd(), options = {}) {
 export function commandExists(name, cwd = process.cwd(), options = {}) {
     return commandPath(name, cwd, options) !== undefined;
 }
+export function delegateSubprocessSpawnPlan(command, args, env = process.env, platform = process.platform) {
+    return isWindowsBatchFile(command, platform)
+        ? buildCmdExeSpawnPlan(command, args, env, platform)
+        : { cmd: command, args: [...args], shell: false };
+}
 export function subprocess(command, args, cwd, options = {}) {
-    const result = spawnSync(command, args, {
+    const childEnv = { ...process.env, ...options.env };
+    const resolvedCommand = process.platform === "win32" ? commandPath(command, cwd, { env: childEnv }) : undefined;
+    const spawn = resolvedCommand ? delegateSubprocessSpawnPlan(resolvedCommand, args, childEnv) : { cmd: command, args, shell: false };
+    const result = spawnSync(spawn.cmd, spawn.args, {
         cwd,
-        env: { ...process.env, ...options.env },
+        env: childEnv,
         input: options.input,
         maxBuffer: options.maxBuffer,
         encoding: "buffer",
+        shell: spawn.shell,
+        ...(spawn.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
         stdio: [options.input === undefined ? options.stdinFd ?? "inherit" : "pipe", options.stdout === "inherit" ? "inherit" : options.stdout === "ignore" ? "ignore" : "pipe", options.stderr === "pipe" ? "pipe" : options.stderr ?? "inherit"],
     });
     if (result.error) {
@@ -563,11 +575,11 @@ function existingManifest(name, args, context) {
     }
     const file = path.resolve(context.cwd, manifestArg);
     if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
-        writeErr(`${prefix} manifest not found: ${manifestArg}\n`);
+        writeErr(`${prefix} manifest not found: ${shellDisplayPath(manifestArg)}\n`);
         return { code: 1, parsed };
     }
     if (!jqValid(file)) {
-        writeErr(`${prefix} manifest is not valid JSON: ${manifestArg}\n`);
+        writeErr(`${prefix} manifest is not valid JSON: ${shellDisplayPath(manifestArg)}\n`);
         return { code: 1, parsed };
     }
     return { file, parsed, document: readJsonFile(file) };

package/dist/commands/core-job-probe-native.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
 export declare const JOB_PROBE_ASSET = "core/scripts/hq-job-probe.sh";
+export declare function displayJobFile(value: string, platform?: NodeJS.Platform): string;
+export declare function displayShellPath(value: string, platform?: NodeJS.Platform): string;
 export declare const JOB_PROBE_USAGE: string;
 export type Checks = {
     runtime: string;
@@ -30,7 +32,7 @@ export type ProbeDeps = {
     isDirectory: (file: string) => boolean;
     realpath: (file: string) => string | undefined;
     readText: (file: string) => string;
-    writeState: (file: string, body: string) => void;
+    writeState: (file: string, body: string, mode: number) => void;
     writeStderr: (line: string) => void;
     listSecrets: (company?: string) => Promise<{
         code: number;
@@ -39,6 +41,7 @@ export type ProbeDeps = {
     commandExists: (name: string) => boolean;
     fetcher: (url: string, init: RequestInit) => Promise<Response>;
 };
+export declare function hasProbeCommand(name: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform, existsSync?: (candidate: string) => boolean): boolean;
 export declare function defaultProbeDeps(root: string, env?: Record<string, string | undefined>): ProbeDeps;
 export declare function runJobProbe(argv: string[], injected?: ProbeDeps): Promise<ProbeResult>;
 export declare function registerCoreJobProbeCommand(job: Command): void;

package/dist/commands/core-job-probe-native.js

@@ -8,7 +8,21 @@ import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { coreNativeJobsEnabled } from "./core-native-jobs-flag.js";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
 export const JOB_PROBE_ASSET = "core/scripts/hq-job-probe.sh";
+export function displayJobFile(value, platform = process.platform) {
+    if (platform !== "win32")
+        return value;
+    return path.win32.resolve(value).replaceAll("\\", "/");
+}
+export function displayShellPath(value, platform = process.platform) {
+    if (platform !== "win32")
+        return value;
+    const normalized = value.replaceAll("\\", "/");
+    const drivePath = /^([A-Za-z]):\/(.*)$/u.exec(normalized);
+    return drivePath ? `/${drivePath[1].toLowerCase()}/${drivePath[2]}` : normalized;
+}
 export const JOB_PROBE_USAGE = [
     "hq-job-probe.sh — Outpost requirements probe → hq-pro jobs status (US-008).", "",
     "On the Outpost, deterministically checks a job's requirements checklist and",
@@ -79,8 +93,8 @@ const realpath = (f) => { try {
 catch {
     return undefined;
 } };
-function writeState(file, body) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, `${body}\n`, { mode: 0o600 }); try {
-    fs.chmodSync(file, 0o600);
+function writeState(file, body, mode) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, `${body}\n`, { mode }); try {
+    fs.chmodSync(file, mode);
 }
 catch { /* legacy chmod is best-effort */ } }
 function hasCommand(name, env) {
@@ -97,10 +111,29 @@ function hasCommand(name, env) {
     }
     return false;
 }
+export function hasProbeCommand(name, env, platform = process.platform, existsSync = (candidate) => { try {
+    return fs.statSync(candidate).isFile();
+}
+catch {
+    return false;
+} }) {
+    return platform === "win32"
+        ? resolveWindowsExecutable(name, env, existsSync, process.cwd()) !== null
+        : hasCommand(name, env);
+}
 function listSecrets(company) {
     // Keep the `hq secrets list` subprocess: no in-process API produces the same names-only table.
     const args = company ? ["secrets", "list", "--company", company] : ["secrets", "list", "--personal"];
-    const r = spawnSync("hq", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const executable = process.platform === "win32"
+        ? resolveWindowsExecutable("hq", process.env, (candidate) => { try {
+            return fs.statSync(candidate).isFile();
+        }
+        catch {
+            return false;
+        } }, process.cwd()) ?? "hq"
+        : "hq";
+    const plan = planResolvedCommandSpawn(executable, args, process.env);
+    const r = spawnSync(plan.cmd, plan.args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], shell: plan.shell, ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}) });
     return Promise.resolve({ code: r.status ?? (r.error ? 127 : 1), stdout: r.stdout ?? "" });
 }
 export function defaultProbeDeps(root, env = process.env) {
@@ -111,7 +144,7 @@ export function defaultProbeDeps(root, env = process.env) {
         statSize, isFile, isDirectory, realpath, readText: (f) => fs.readFileSync(f, "utf8"), writeState,
         writeStderr: (line) => process.stderr.write(line),
         listSecrets: stubs ? async () => { throw new Error("HQ_JOB_TEST_STUB blocked real hq secrets list"); } : listSecrets,
-        commandExists: (name) => hasCommand(name, env),
+        commandExists: (name) => hasProbeCommand(name, env),
         fetcher: stubs ? async () => { throw new Error("HQ_JOB_TEST_STUB blocked real network fetch"); } : (url, init) => fetch(url, init) };
 }
 const isoNow = (d) => d.env.HQ_JOB_PROBE_NOW || d.now().toISOString().replace(/\.\d{3}Z$/, "Z");
@@ -148,9 +181,21 @@ function legacyYamlParseDiagnostics(file, d) {
     // The shell evaluates each field with yq before checking the now-empty id;
     // preserve the six parser diagnostics it emits on malformed input.
     const expressions = [".id // \"\"", ".name // \"\"", ".runtime // \"\"", ".requirements.runtime // \"\"", ".requirements.company // \"\"", ".requirements.cwd // .cwd // \"\""];
-    return expressions.map((expression) => spawnSync("yq", ["-r", expression, file], {
-        cwd: d.root, env: d.env, encoding: "utf8",
-    }).stderr ?? "").join("");
+    return expressions.map((expression) => {
+        const executable = process.platform === "win32"
+            ? resolveWindowsExecutable("yq", d.env, (candidate) => { try {
+                return fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            } }, d.root) ?? "yq"
+            : "yq";
+        const plan = planResolvedCommandSpawn(executable, ["-r", expression, file], d.env);
+        return spawnSync(plan.cmd, plan.args, {
+            cwd: d.root, env: d.env, encoding: "utf8", shell: plan.shell,
+            ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+        }).stderr ?? "";
+    }).join("");
 }
 function findById(id, d) {
     let found;
@@ -240,8 +285,8 @@ function auth(runtime, d) {
     const file = runtime === "claude" ? d.env.HQ_JOB_PROBE_CLAUDE_CRED || path.join(d.home, ".claude/.credentials.json") : d.env.HQ_JOB_PROBE_CODEX_AUTH || path.join(d.home, ".codex/auth.json");
     return (d.statSize(file) ?? 0) > 0 ? "ok" : "missing";
 }
-function writeAttempt(d, id, data) { d.writeState(path.join(d.env.HQ_JOB_PROBE_STATE_DIR || path.join(d.home, ".hq/jobs/probes"), id, "last-attempt.json"), compact(data)); }
-function writeCache(d, id, readiness, source) { d.writeState(path.join(d.env.HQ_JOB_STATUS_CACHE_DIR || path.join(d.home, ".hq/jobs/status-cache"), `${id}.json`), compact({ job_id: id, readiness, updated_at: isoNow(d), source })); }
+function writeAttempt(d, id, data) { d.writeState(path.join(d.env.HQ_JOB_PROBE_STATE_DIR || path.join(d.home, ".hq/jobs/probes"), id, "last-attempt.json"), compact(data), 0o600); }
+function writeCache(d, id, readiness, source) { d.writeState(path.join(d.env.HQ_JOB_STATUS_CACHE_DIR || path.join(d.home, ".hq/jobs/status-cache"), `${id}.json`), compact({ job_id: id, readiness, updated_at: isoNow(d), source }), 0o600); }
 function resolveCwd(root, cwd, d) {
     const canon = d.realpath(root) ?? path.resolve(root), candidate = path.resolve(root, cwd), file = d.realpath(candidate) ?? candidate;
     return { file, allowed: file === canon || file.startsWith(`${canon}${path.sep}`) };
@@ -293,13 +338,13 @@ async function probeFile(file, dry, d) {
     catch (e) {
         const rawStderr = legacyYamlParseDiagnostics(file, d);
         if (rawStderr)
-            throw new Fatal(`job missing id: ${file}`, 2, "hq-job-probe", rawStderr);
+            throw new Fatal(`job missing id: ${displayShellPath(file)}`, 2, "hq-job-probe", rawStderr);
         throw new Fatal(`invalid job YAML: ${file}${e instanceof Error ? `: ${e.message}` : ""}`);
     }
     const id = scalar(job.id), name = scalar(job.name), runtime = scalar(nested(job, "requirements", "runtime")) || scalar(job.runtime);
     const company = scalar(nested(job, "requirements", "company")), cwd = scalar(nested(job, "requirements", "cwd") ?? job.cwd);
     if (!id)
-        throw new Fatal(`job missing id: ${file}`);
+        throw new Fatal(`job missing id: ${displayShellPath(file)}`);
     if (!runtime)
         throw new Fatal(`job missing runtime: ${file}`);
     const at = isoNow(d), actions = [], authState = auth(runtime, d);
@@ -411,7 +456,7 @@ async function probeFile(file, dry, d) {
             }
         }
     }
-    return { code: ingestFailed ? 3 : blocked ? 1 : 0, value: { job_id: id, name, job_file: file, readiness: finalReadiness, probed_at: at, ingest, http, dry_run: dry, checks, next_actions: finalActions } };
+    return { code: ingestFailed ? 3 : blocked ? 1 : 0, value: { job_id: id, name, job_file: displayJobFile(file), readiness: finalReadiness, probed_at: at, ingest, http, dry_run: dry, checks, next_actions: finalActions } };
 }
 function parseArgs(argv) {
     const a = [...argv];
@@ -470,7 +515,7 @@ export async function runJobProbe(argv, injected) {
             return { code: 2, stdout: "", stderr: "hq-job-probe: --all does not take a job argument\n" };
         const files = allFiles(root);
         if (!files.length)
-            return { code: 2, stdout: "", stderr: `hq-job-probe: no job YAML found under personal/jobs or companies/*/jobs in ${root}\n` };
+            return { code: 2, stdout: "", stderr: `hq-job-probe: no job YAML found under personal/jobs or companies/*/jobs in ${displayShellPath(root)}\n` };
         let code = 0;
         try {
             for (const f of files) {
@@ -500,7 +545,10 @@ export async function runJobProbe(argv, injected) {
             // then emits the ordinary not-found error after the process substitution
             // closes. Preserve both stderr lines for byte parity.
             if (x instanceof Fatal && x.message.startsWith("duplicate job id '")) {
-                return { code: x.code, stdout: "", stderr: `${x.prefix}: ${x.message}\n${x.prefix}: job id not found in registry: ${opts.target}\n` };
+                const shellMessage = process.platform === "win32"
+                    ? x.message.replace(/([A-Za-z]):[\\/]/gu, (_match, drive) => "/" + drive.toLowerCase() + "/").replaceAll("\\", "/")
+                    : x.message;
+                return { code: x.code, stdout: "", stderr: `${x.prefix}: ${shellMessage}\n${x.prefix}: job id not found in registry: ${opts.target}\n` };
             }
             return failure(x);
         }

package/dist/commands/core-job-run-native.js

@@ -2,6 +2,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawn } from "node:child_process";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
+import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
 import { fileURLToPath } from "node:url";
 import { JSON_SCHEMA, load } from "js-yaml";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
@@ -256,14 +258,24 @@ export async function spawnProcess(request) {
 }
 /** Holds the same kernel flock(2) lock used by the shell companion. */
 export async function acquireFlock(file, env = process.env) {
-    const binary = env.HQ_JOB_FLOCK_BIN || pathExecutable("flock", env);
+    const binary = env.HQ_JOB_FLOCK_BIN || (process.platform === "win32"
+        ? resolveWindowsExecutable("flock", env, (candidate) => { try {
+            return fs.statSync(candidate).isFile();
+        }
+        catch {
+            return false;
+        } }, process.cwd())
+        : pathExecutable("flock", env));
     if (!binary)
         throw new Error("Outpost/Linux requires util-linux flock(1) for serialized job runs");
     fs.mkdirSync(path.dirname(file), { recursive: true });
     return await new Promise((resolve, reject) => {
-        const child = spawn(binary, ["-x", file, process.execPath, "-e", LOCK_HOLDER], {
+        const spawnPlan = planResolvedCommandSpawn(binary, ["-x", file, process.execPath, "-e", LOCK_HOLDER], env);
+        const child = spawn(spawnPlan.cmd, spawnPlan.args, {
             env,
             stdio: ["pipe", "pipe", "pipe"],
+            shell: spawnPlan.shell,
+            ...(spawnPlan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
         });
         let stdout = "";
         let stderr = "";

package/dist/commands/core-jobs-native.js

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import { JSON_SCHEMA, load, loadAll } from "js-yaml";
 import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
@@ -972,7 +973,7 @@ function systemdQuote(value) {
 }
 function serviceUnit(root, runner, id) {
     const pathValue = systemdQuote(`PATH=${servicePathValue()}`);
-    return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nEnvironment=HQ_ROOT=${root}\nEnvironment=${pathValue}\nExecStart=${runner} --hq-root ${root} --job-id ${id}\nNice=10\n\n[Install]\nWantedBy=default.target\n`;
+    return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nEnvironment=HQ_ROOT=${root}\nEnvironment=${pathValue}\nExecStart=${shellDisplayPath(runner)} --hq-root ${root} --job-id ${id}\nNice=10\n\n[Install]\nWantedBy=default.target\n`;
 }
 function timerUnit(id, onCalendar, randomize, root) {
     return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job timer: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\n\n[Timer]\nOnCalendar=${onCalendar}\nPersistent=true\nRandomizedDelaySec=${randomize}\nUnit=hq-job-${id}.service\n\n[Install]\nWantedBy=timers.target\n`;

package/dist/commands/core-ontology-native.js

@@ -3,8 +3,10 @@ import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { runKnowledgePrefs } from "./core-knowledge-prefs.js";
 const FLAG = "core-native-ontology";
@@ -55,10 +57,23 @@ export function runOntologyNativeFast(args, _stdin, cwd, hqRoot, commandName) {
 }
 function runHq(args, output = "capture") {
     const executable = process.env.HQ_BIN || "hq";
-    const result = spawnSync(executable, args, {
+    const resolvedExecutable = process.platform === "win32" && !path.isAbsolute(executable) && !executable.includes(path.sep)
+        ? resolveWindowsExecutable(executable, process.env, (candidate) => {
+            try {
+                return fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        }, process.cwd()) ?? executable
+        : executable;
+    const plan = planResolvedCommandSpawn(resolvedExecutable, args, process.env);
+    const result = spawnSync(plan.cmd, plan.args, {
         cwd: process.cwd(),
         env: process.env,
         encoding: "utf8",
+        shell: plan.shell,
+        ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
         stdio: output === "ignore" ? ["ignore", "ignore", "ignore"] : ["ignore", "pipe", "ignore"],
     });
     return { status: result.status, stdout: typeof result.stdout === "string" ? result.stdout : "" };
@@ -522,7 +537,8 @@ export function gardenCommand(args, defaultRoot) {
                 source_ref: JSON.stringify(fm.source_ref || ""), created_at: String(fm.created_at || isoNow()),
             }, body, dryRun);
             report.signals_promoted += 1;
-            index.push({ signal_id: id, type, audience_key: key, path: path.relative(companyDir, outputFile) });
+            const outputPath = path.relative(companyDir, outputFile);
+            index.push({ signal_id: id, type, audience_key: key, path: process.platform === "win32" ? outputPath.replaceAll("\\", "/") : outputPath });
             if (key !== "company") {
                 const audienceFile = path.join(scopeDirectory, "_audience.yaml");
                 if (!fs.existsSync(audienceFile) && !dryRun) {

package/dist/commands/core-worker-share-native.js

@@ -56,7 +56,8 @@ function isRegularFile(filePath, fileSystem) {
     }
 }
 function readLink(filePath, fileSystem) {
-    return fileSystem.readlinkSync(filePath);
+    const target = fileSystem.readlinkSync(filePath);
+    return process.platform === "win32" ? target.replaceAll("\\", "/") : target;
 }
 function sameBytes(leftPath, rightPath, fileSystem) {
     try {

package/dist/lib/core-utils/shell-display-path.d.ts

@@ -0,0 +1,3 @@
+/** Render a native path with the path spelling used by the bundled Bash scripts. */
+export declare function shellDisplayPath(value: string): string;
+//# sourceMappingURL=shell-display-path.d.ts.map

package/dist/lib/core-utils/shell-display-path.js

@@ -0,0 +1,12 @@
+import * as path from "node:path";
+/** Render a native path with the path spelling used by the bundled Bash scripts. */
+export function shellDisplayPath(value) {
+    if (process.platform !== "win32")
+        return value;
+    const absolute = path.win32.resolve(value);
+    const match = /^([A-Za-z]):[\\/](.*)$/.exec(absolute);
+    if (!match?.[1] || match[2] === undefined)
+        return value;
+    return `/${match[1].toLowerCase()}/${match[2].replaceAll("\\", "/")}`;
+}
+//# sourceMappingURL=shell-display-path.js.map

package/dist/utils/run-bundled-script.d.ts

@@ -57,6 +57,8 @@ export type RunBundledScriptOptions = {
     captureOutput?: boolean;
     /** Bytes supplied on stdin. With no value, stdin is inherited as before. */
     stdin?: string | Buffer;
+    /** Optional child-process deadline for callers that need bounded script execution. */
+    timeoutMs?: number;
 };
 export type RunBundledScriptResult = {
     /** The child's exit code, or 128+signal if it was terminated by one. */

package/dist/utils/run-bundled-script.js

@@ -189,6 +189,7 @@ export function runBundledScript(opts) {
             cwd: opts.cwd,
             env,
             stdio,
+            ...(opts.timeoutMs === undefined ? {} : { timeout: opts.timeoutMs }),
             ...(opts.captureOutput ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {}),
         });
     }

package/dist/utils/windows-spawn.d.ts

@@ -47,4 +47,6 @@ export declare function isWindowsBatchFile(command: string, platform?: NodeJS.Pl
  * passed through untouched.
  */
 export declare function planCommandSpawn(command: string, args: readonly string[], platform?: NodeJS.Platform): SpawnPlan;
+/** Spawn a resolved executable, routing only Windows batch shims through the escaped cmd.exe plan. */
+export declare function planResolvedCommandSpawn(command: string, args: readonly string[], env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SpawnPlan;
 //# sourceMappingURL=windows-spawn.d.ts.map

package/dist/utils/windows-spawn.js

@@ -108,4 +108,10 @@ export function planCommandSpawn(command, args, platform = process.platform) {
         return buildSpawnPlan(command, args, platform);
     return { cmd: command, args: [...args], shell: false };
 }
+/** Spawn a resolved executable, routing only Windows batch shims through the escaped cmd.exe plan. */
+export function planResolvedCommandSpawn(command, args, env = process.env, platform = process.platform) {
+    if (isWindowsBatchFile(command, platform))
+        return buildCmdExeSpawnPlan(command, args, env, platform);
+    return { cmd: command, args: [...args], shell: false };
+}
 //# sourceMappingURL=windows-spawn.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.13",
+  "version": "5.342.14",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {