@indigoai-us/hq-cli 5.342.4 → 5.342.5

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.342.5] — 2026-10-04
+- Pass explicit hook stdin to bundled shell companions through a real pipe on Windows.
+- Run the paired fast-route benchmark only when its executable or build inputs change.
+- Limit `hq mcp serve` resident preloads to its request handler modules; hosted MCP client dependencies remain in the daemon process.
+- Keep a bot's local identity config aligned with reissued credentials during `hq bot restore --all`, preventing heartbeat identity drift.
+
 ## [5.342.4] — 2026-10-04
 
 ## [5.342.3] — 2026-10-04

package/dist/commands/bot.js

@@ -1656,6 +1656,7 @@ async function repairLocalBot(name, api, bot, daemon) {
     catch (err) {
         throw credentialError(err, name);
     }
+    writeBotConfig(dir, { ...config, agentUid: bot.agentUid });
     writeBotCreds(dir, {
         username: reissued.identity.cognitoUsername,
         secret: reissued.identity.secret,

package/dist/commands/core-derive-trigger-facts-command.js

@@ -15,11 +15,14 @@ export function registerCoreDeriveTriggerFactsCommand(core) {
         .action(async (args = [], _options, commandContext) => {
         if (!await coreNativeHookHelpersEnabled()) {
             const root = liveRoot();
+            const stdin = process.platform === "win32" ? await readStdin() : undefined;
             const result = runBundledScript({
                 asset: DERIVE_TRIGGER_FACTS_ASSET,
                 args: commandContext.args.length ? commandContext.args : args,
                 cwd: root,
                 hqRoot: root,
+                msysScriptPath: process.platform === "win32",
+                ...(stdin !== undefined ? { stdin } : {}),
             });
             if (result.code !== 0)
                 process.exit(result.code);
@@ -44,4 +47,10 @@ export function registerCoreDeriveTriggerFactsCommand(core) {
     });
     describeCoreCommand(command, { execution: "native", asset: DERIVE_TRIGGER_FACTS_ASSET, root: "live" });
 }
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
 //# sourceMappingURL=core-derive-trigger-facts-command.js.map

package/dist/lib/bot/run.js

@@ -540,7 +540,7 @@ export async function runBot(deps) {
                         configuredAgentUid: config.agentUid,
                         ...(err.tokenAgentUid ? { tokenAgentUid: err.tokenAgentUid } : {}),
                         agentUidSource: deps.agentUidSource ?? "config_file",
-                        credsSource: deps.credsSource ?? "default",
+                        credsSource: deps.credsSource ?? "explicit",
                     });
                     break;
                 }

package/dist/utils/resident-package-preload.js

@@ -1,19 +1,7 @@
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export const RESIDENT_PACKAGE_MODULES = {
     bot: ["../lib/flag-registry.js", "../commands/access.js", "../sentry.js", "open"],
-    mcp: [
-        "../lib/mcp/tools.js",
-        "../lib/mcp/prompts.js",
-        "../utils/cognito-session.js",
-        "../lib/daemon/mcp-oauth.js",
-        "../commands/access.js",
-        "../lib/flag-registry.js",
-        "@modelcontextprotocol/sdk/client/index.js",
-        "@modelcontextprotocol/sdk/client/streamableHttp.js",
-        "../sentry.js",
-        "open",
-        "./staged-npm-install.js",
-    ],
+    mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js"],
 };
 const LOADERS = {
     bot: [
@@ -25,15 +13,6 @@ const LOADERS = {
     mcp: [
         () => import("../lib/mcp/tools.js"),
         () => import("../lib/mcp/prompts.js"),
-        () => import("../utils/cognito-session.js"),
-        () => import("../lib/daemon/mcp-oauth.js"),
-        () => import("../commands/access.js"),
-        () => import("../lib/flag-registry.js"),
-        () => import("@modelcontextprotocol/sdk/client/index.js"),
-        () => import("@modelcontextprotocol/sdk/client/streamableHttp.js"),
-        () => import("../sentry.js"),
-        () => import("open"),
-        () => import("./staged-npm-install.js"),
     ],
 };
 export class ResidentPackagePreloadError extends Error {

package/dist/utils/run-bundled-script.js

@@ -168,8 +168,8 @@ export function runBundledScript(opts) {
     try {
         if (opts.stdin !== undefined) {
             // Some scaffold scripts reopen /dev/stdin by pathname. Node's spawnSync
-            // input pipe cannot be reopened through /dev/stdin on Linux, so capture
-            // mode supplies a private regular file descriptor to preserve that ABI.
+            // input pipe cannot be reopened through /dev/stdin on Git Bash or Linux,
+            // so supply a private regular file descriptor to preserve that ABI.
             const sharedMemory = process.platform === "linux" && fs.existsSync("/dev/shm")
                 ? "/dev/shm"
                 : os.tmpdir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.4",
+  "version": "5.342.5",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {