@indigoai-us/hq-cli 5.342.4 → 5.342.6

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [5.342.6] — 2026-10-04
+- Add `hq mesh project member add` to add an active company member to a project.
+
+- With `cli.company-errors-sdk-warning` enabled, `hq people` now scopes to a sole cloud membership when the local company manifest is missing.
+- Run the package-use lease macOS and Windows checks on pull requests only when lease inputs change, while retaining both checks on main pushes.
+- Keep `hq secrets env --company <slug>` on the lightweight fast route when the company option follows `env`.
+
+## [5.342.5] — 2026-10-04
+
+- Keep pnpm v11 global install detection and Windows drive-path tar extraction unconditional; remove their legacy opt-outs.
+
+- Pass explicit hook stdin to bundled shell companions through a real pipe on Windows.
+- Run the paired fast-route benchmark only when its executable or build inputs change.
+- Limit `hq mcp serve` resident preloads to its request handler modules; hosted MCP client dependencies remain in the daemon process.
+- Keep a bot's local identity config aligned with reissued credentials during `hq bot restore --all`, preventing heartbeat identity drift.
+
 ## [5.342.4] — 2026-10-04
 
 ## [5.342.3] — 2026-10-04

package/dist/command-catalog.generated.d.ts

@@ -9296,6 +9296,48 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "member";
+            readonly description: "Manage project members";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: true;
+            readonly usage: "[options] [command]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [{
+                readonly name: "add";
+                readonly description: "Add an active company member to a project";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <projectId> <personUid>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "projectId";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }, {
+                    readonly name: "personUid";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--company <slug|uid>";
+                    readonly description: "Company slug or cloud uid";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "Print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }];
         }];
     }, {
         readonly name: "doctor";

package/dist/command-catalog.generated.js

@@ -11271,6 +11271,57 @@ export const COMMAND_CATALOG = [
                             }
                         ],
                         "subcommands": []
+                    },
+                    {
+                        "name": "member",
+                        "description": "Manage project members",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": true,
+                        "usage": "[options] [command]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [],
+                        "subcommands": [
+                            {
+                                "name": "add",
+                                "description": "Add an active company member to a project",
+                                "aliases": [],
+                                "hidden": false,
+                                "helpOption": true,
+                                "helpCommand": false,
+                                "usage": "[options] <projectId> <personUid>",
+                                "helpText": [],
+                                "arguments": [
+                                    {
+                                        "name": "projectId",
+                                        "required": true,
+                                        "variadic": false,
+                                        "description": ""
+                                    },
+                                    {
+                                        "name": "personUid",
+                                        "required": true,
+                                        "variadic": false,
+                                        "description": ""
+                                    }
+                                ],
+                                "options": [
+                                    {
+                                        "flags": "--company <slug|uid>",
+                                        "description": "Company slug or cloud uid",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--json",
+                                        "description": "Print machine-readable JSON",
+                                        "hidden": false
+                                    }
+                                ],
+                                "subcommands": []
+                            }
+                        ]
                     }
                 ]
             },

package/dist/commands/bot.js

@@ -1656,6 +1656,7 @@ async function repairLocalBot(name, api, bot, daemon) {
     catch (err) {
         throw credentialError(err, name);
     }
+    writeBotConfig(dir, { ...config, agentUid: bot.agentUid });
     writeBotCreds(dir, {
         username: reissued.identity.cognitoUsername,
         secret: reissued.identity.secret,

package/dist/commands/core-derive-trigger-facts-command.js

@@ -15,11 +15,14 @@ export function registerCoreDeriveTriggerFactsCommand(core) {
         .action(async (args = [], _options, commandContext) => {
         if (!await coreNativeHookHelpersEnabled()) {
             const root = liveRoot();
+            const stdin = process.platform === "win32" ? await readStdin() : undefined;
             const result = runBundledScript({
                 asset: DERIVE_TRIGGER_FACTS_ASSET,
                 args: commandContext.args.length ? commandContext.args : args,
                 cwd: root,
                 hqRoot: root,
+                msysScriptPath: process.platform === "win32",
+                ...(stdin !== undefined ? { stdin } : {}),
             });
             if (result.code !== 0)
                 process.exit(result.code);
@@ -44,4 +47,10 @@ export function registerCoreDeriveTriggerFactsCommand(core) {
     });
     describeCoreCommand(command, { execution: "native", asset: DERIVE_TRIGGER_FACTS_ASSET, root: "live" });
 }
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
 //# sourceMappingURL=core-derive-trigger-facts-command.js.map

package/dist/commands/mesh.js

@@ -13,7 +13,7 @@ import { CLI_VERSION } from "../cli-version.js";
 import chalk from "chalk";
 import { ensureCognitoToken, isExpiring, isMachineIdentity, loadCachedTokens, } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
-import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { STORY_STATUSES, appendThreadEvent, addProjectMember, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard, boardStoryStatus, formatStoryStatusChanges, mergeProjectStories, prdSyncEventsThatChangeBoard, } from "../lib/mesh/project-board.js";
 import { mapSourceStoryStatus } from "../lib/mesh/story-status.js";
 import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.js";
@@ -461,6 +461,17 @@ async function runProjectRegister(projectId, opts) {
     }
     console.log(`Work mesh: project ${registration.projectId} registered (${boardState}; channel ${registration.channelId} ${registration.channelCreated ? "created" : "bound"})`);
 }
+async function runProjectMemberAdd(projectId, personUid, opts) {
+    const { token, company } = await withCompany(opts);
+    const result = await addProjectMember(token, company.companyUid, projectId, personUid);
+    if (opts.json) {
+        console.log(JSON.stringify({ action: "project.member.add", ...result }, null, 2));
+        return;
+    }
+    console.log(result.added
+        ? `Work mesh: added ${personUid} to project ${projectId}`
+        : `Work mesh: ${personUid} is already a member of project ${projectId}`);
+}
 async function runProjectEnsure(projectId, opts) {
     if (!opts.storiesFile?.trim())
         fail("`--stories-file <prd.json>` is required.");
@@ -1910,6 +1921,14 @@ export function registerMeshCommand(program) {
         .option("--channel <channelId>", "Bind the project to an existing company or project channel")
         .option("--json", "Print machine-readable JSON")
         .action((projectId, opts) => wrap(() => runProjectRegister(projectId, opts))());
+    project
+        .command("member")
+        .description("Manage project members")
+        .command("add <projectId> <personUid>")
+        .description("Add an active company member to a project")
+        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
+        .option("--json", "Print machine-readable JSON")
+        .action((projectId, personUid, opts) => wrap(() => runProjectMemberAdd(projectId, personUid, opts))());
     mesh
         .command("doctor")
         .description("Warm ~/.hq/work-mesh/cache from hq-pro (directory, inbox, pair DMs). Not `hq doctor`.")

package/dist/commands/people.d.ts

@@ -18,7 +18,7 @@ export type FetchPeopleRoster = (hqRoot: string, companySlug: string) => Promise
 interface PeopleCommandDeps {
     fetchRoster?: FetchPeopleRoster;
     /** Test seam for the shared active-membership ambiguity resolver. */
-    resolveMissingManifestMemberships?: () => Promise<void>;
+    resolveMissingManifestMemberships?: () => Promise<string | void>;
     companySelectionGuidanceEnabled?: () => boolean;
 }
 interface PeopleLookupOpts {

package/dist/commands/people.js

@@ -122,12 +122,16 @@ async function resolvePeopleCompanySlug(hqRoot, explicit, localOnly, deps) {
             const resolveMemberships = deps.resolveMissingManifestMemberships ??
                 (async () => {
                     const token = await ensureCognitoToken();
-                    await getCompanyUid(token, undefined);
+                    return getCompanyUid(token, undefined);
                 });
             // The shared resolver throws members-style guidance for multiple active
-            // companies. A single membership cannot provide a local slug without a
-            // manifest, so preserve the existing missing-manifest error in that case.
-            await resolveMemberships();
+            // companies. With no manifest, its sole-membership UID is also a valid
+            // scope for the people roster and company directory.
+            const membershipCompany = await resolveMemberships();
+            if (message.includes("companies/manifest.yaml not found") &&
+                typeof membershipCompany === "string") {
+                return membershipCompany;
+            }
         }
         throw error;
     }

package/dist/commands/safe-extract.d.ts

@@ -111,12 +111,11 @@ export declare function assertLinkTargetContained(packDir: string, entryAbs: str
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
  * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths use a basename relative to the archive directory by
- * default. GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows'
- * bundled bsdtar accepts the same relative argv without GNU-only `--force-local`.
- * Callers can still explicitly opt out with `useRelativeWindowsDrivePath: false`.
+ * Windows drive paths always use a basename relative to the archive directory.
+ * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
+ * bsdtar accepts the same relative argv without GNU-only `--force-local`.
  */
-export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'useRelativeWindowsDrivePath' | 'execFileSync'>): TarEntry[];
+export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'execFileSync'>): TarEntry[];
 /**
  * Pre-flight validation against the entry headers. Enforces (a) containment of
  * every entry name under `targetDir`, (b) containment of every link target
@@ -134,9 +133,8 @@ export declare function validateEntries(entries: TarEntry[], targetDir: string,
 export declare function assertExtractContained(stagingDir: string): void;
 export interface SafeExtractOptions {
     caps?: ExtractCaps;
-    /** Test seams for platform-specific argv construction; runtime gating uses hq-flags. */
+    /** Test seam for platform-specific argv construction. */
     platform?: NodeJS.Platform;
-    useRelativeWindowsDrivePath?: boolean;
     execFileSync?: typeof execFileSync;
     /**
      * Test seam: invoked AFTER `tar` extracts into the staging dir but BEFORE

package/dist/commands/safe-extract.js

@@ -203,10 +203,8 @@ export function assertLinkTargetContained(packDir, entryAbs, linkTarget) {
             `"${linkTarget}" -> "${resolvedTarget}", outside pack dir "${path.resolve(packDir)}".`);
     }
 }
-function tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath) {
-    if (platform === 'win32' &&
-        useRelativeWindowsDrivePath &&
-        /^[A-Za-z]:[\\/]/.test(tarballPath)) {
+function tarballArgvLocation(tarballPath, platform) {
+    if (platform === 'win32' && /^[A-Za-z]:[\\/]/.test(tarballPath)) {
         return {
             archiveArg: path.win32.basename(tarballPath),
             cwd: path.win32.dirname(tarballPath),
@@ -217,15 +215,13 @@ function tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath)
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
  * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths use a basename relative to the archive directory by
- * default. GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows'
- * bundled bsdtar accepts the same relative argv without GNU-only `--force-local`.
- * Callers can still explicitly opt out with `useRelativeWindowsDrivePath: false`.
+ * Windows drive paths always use a basename relative to the archive directory.
+ * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
+ * bsdtar accepts the same relative argv without GNU-only `--force-local`.
  */
 export function listTarball(tarballPath, opts = {}) {
     const platform = opts.platform ?? process.platform;
-    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? true;
-    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
+    const location = tarballArgvLocation(tarballPath, platform);
     const out = (opts.execFileSync ?? execFileSync)('tar', ['-tvf', location.archiveArg], {
         encoding: 'utf-8',
         maxBuffer: 64 * 1024 * 1024,
@@ -329,13 +325,11 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
     }
     // Resolve once so listing and extraction use the same archive location.
     const platform = opts.platform ?? process.platform;
-    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? true;
     const exec = opts.execFileSync ?? execFileSync;
-    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
+    const location = tarballArgvLocation(tarballPath, platform);
     // 1. Pre-flight against headers (no bytes written yet).
     const entries = listTarball(tarballPath, {
         platform,
-        useRelativeWindowsDrivePath,
         execFileSync: exec,
     });
     validateEntries(entries, finalDir, caps);

package/dist/fast-scaffold.js

@@ -343,6 +343,24 @@ export function parseSecretsEnvFastRequest(argv) {
         const arg = argv[index];
         if (arg === "-h" || arg === "--help" || arg === "--")
             return null;
+        // Commander accepts the parent secrets scope option after the `env`
+        // subcommand too. Keep that valid spelling on the fast route.
+        if (arg === "--company") {
+            const value = argv[index + 1];
+            if (!value || value.startsWith("-") || hasPersonalScope)
+                return null;
+            scope.company = value;
+            index += 2;
+            continue;
+        }
+        if (arg?.startsWith("--company=")) {
+            const value = arg.slice("--company=".length);
+            if (!value || hasPersonalScope)
+                return null;
+            scope.company = value;
+            index += 1;
+            continue;
+        }
         let option;
         let value;
         if (arg === "--only" || arg === "--script" || arg === "--script-id") {

package/dist/lib/bot/run.js

@@ -540,7 +540,7 @@ export async function runBot(deps) {
                         configuredAgentUid: config.agentUid,
                         ...(err.tokenAgentUid ? { tokenAgentUid: err.tokenAgentUid } : {}),
                         agentUidSource: deps.agentUidSource ?? "config_file",
-                        credsSource: deps.credsSource ?? "default",
+                        credsSource: deps.credsSource ?? "explicit",
                     });
                     break;
                 }

package/dist/lib/mesh/api.d.ts

@@ -154,6 +154,13 @@ export declare function patchStoryStatus(token: string, companyUid: string, proj
 }>;
 /** Read the full durable Board view before preparing a replacement PUT. */
 export declare function getProjectView(token: string, companyUid: string, projectId: string): Promise<MeshProjectView>;
+/** Add an active company member to the project's Work Mesh channel. */
+export declare function addProjectMember(token: string, companyUid: string, projectId: string, personUid: string): Promise<{
+    ok: true;
+    projectId: string;
+    personUid: string;
+    added: boolean;
+}>;
 /** Replace a project's durable Board view and keep the local project cache current. */
 export declare function putProjectView(token: string, companyUid: string, projectId: string, input: {
     name?: string;

package/dist/lib/mesh/api.js

@@ -465,6 +465,14 @@ export async function getProjectView(token, companyUid, projectId) {
         throw new Error("Work mesh returned an invalid project view");
     return projectViewFromResponse(view, companyUid, projectId);
 }
+/** Add an active company member to the project's Work Mesh channel. */
+export async function addProjectMember(token, companyUid, projectId, personUid) {
+    const result = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, { method: "PUT", body: { operation: "add-member", companyUid, personUid } }));
+    if (result?.ok !== true || typeof result.added !== "boolean") {
+        throw new Error("Work mesh returned an invalid project membership result");
+    }
+    return { ok: true, projectId, personUid, added: result.added };
+}
 /** Replace a project's durable Board view and keep the local project cache current. */
 export async function putProjectView(token, companyUid, projectId, input) {
     const { expectedVersion, ...document } = input;

package/dist/utils/resident-package-preload.js

@@ -1,19 +1,7 @@
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export const RESIDENT_PACKAGE_MODULES = {
     bot: ["../lib/flag-registry.js", "../commands/access.js", "../sentry.js", "open"],
-    mcp: [
-        "../lib/mcp/tools.js",
-        "../lib/mcp/prompts.js",
-        "../utils/cognito-session.js",
-        "../lib/daemon/mcp-oauth.js",
-        "../commands/access.js",
-        "../lib/flag-registry.js",
-        "@modelcontextprotocol/sdk/client/index.js",
-        "@modelcontextprotocol/sdk/client/streamableHttp.js",
-        "../sentry.js",
-        "open",
-        "./staged-npm-install.js",
-    ],
+    mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js"],
 };
 const LOADERS = {
     bot: [
@@ -25,15 +13,6 @@ const LOADERS = {
     mcp: [
         () => import("../lib/mcp/tools.js"),
         () => import("../lib/mcp/prompts.js"),
-        () => import("../utils/cognito-session.js"),
-        () => import("../lib/daemon/mcp-oauth.js"),
-        () => import("../commands/access.js"),
-        () => import("../lib/flag-registry.js"),
-        () => import("@modelcontextprotocol/sdk/client/index.js"),
-        () => import("@modelcontextprotocol/sdk/client/streamableHttp.js"),
-        () => import("../sentry.js"),
-        () => import("open"),
-        () => import("./staged-npm-install.js"),
     ],
 };
 export class ResidentPackagePreloadError extends Error {

package/dist/utils/run-bundled-script.js

@@ -168,8 +168,8 @@ export function runBundledScript(opts) {
     try {
         if (opts.stdin !== undefined) {
             // Some scaffold scripts reopen /dev/stdin by pathname. Node's spawnSync
-            // input pipe cannot be reopened through /dev/stdin on Linux, so capture
-            // mode supplies a private regular file descriptor to preserve that ABI.
+            // input pipe cannot be reopened through /dev/stdin on Git Bash or Linux,
+            // so supply a private regular file descriptor to preserve that ABI.
             const sharedMemory = process.platform === "linux" && fs.existsSync("/dev/shm")
                 ? "/dev/shm"
                 : os.tmpdir();

package/dist/utils/self-update.js

@@ -372,7 +372,7 @@ function isRecognizedGlobalInstall(install, packageRoot) {
     if (!isInsideNodeModules(packageRoot))
         return false;
     if (install.manager === "pnpm")
-        return isPnpmManagedPackageDir(packageRoot, true);
+        return isPnpmManagedPackageDir(packageRoot);
     if (install.manager === "bun")
         return isBunManagedPackageDir(packageRoot);
     if (!install.prefix)

package/dist/utils/version-gate.d.ts

@@ -70,7 +70,7 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export declare function isPnpmManagedPackageDir(pkgDir: string, acceptVersionPrefixedGlobalDir?: boolean): boolean;
+export declare function isPnpmManagedPackageDir(pkgDir: string): boolean;
 /** Whether the running package lives inside Bun's global install tree. */
 export declare function isBunManagedPackageDir(pkgDir: string): boolean;
 /**

package/dist/utils/version-gate.js

@@ -128,7 +128,7 @@ function findPackageRootForExecutable(bin) {
             const packageRoot = findCliPackageRoot(candidate);
             if (packageRoot &&
                 samePath(packageRoot, candidate) &&
-                isPnpmManagedPackageDir(packageRoot, true)) {
+                isPnpmManagedPackageDir(packageRoot)) {
                 return packageRoot;
             }
         }
@@ -151,7 +151,7 @@ function samePath(left, right) {
         : a === b;
 }
 function globalInstallManagerForPath(bin, packageRoot) {
-    if (isPnpmManagedPackageDir(packageRoot, true)) {
+    if (isPnpmManagedPackageDir(packageRoot)) {
         return "pnpm";
     }
     if (isBunManagedPackageDir(packageRoot))
@@ -215,7 +215,7 @@ function pnpmHomeGlobalRoot() {
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir = true) {
+export function isPnpmManagedPackageDir(pkgDir) {
     const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
     const segments = normalized.split("/").filter(Boolean);
     // pnpm through v10 uses `global/<digits>`; pnpm v11+ uses
@@ -228,13 +228,11 @@ export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir =
         const globalDirVersion = segments[i + 1];
         if (/^\d+$/.test(globalDirVersion))
             return true;
-        if (acceptVersionPrefixedGlobalDir && /^v\d+$/.test(globalDirVersion)) {
+        if (/^v\d+$/.test(globalDirVersion))
             return true;
-        }
     }
-    // PNPM_HOME/global is pnpm's configured global root by construction, so
-    // keep this fallback in both flag states. The flag above gates only the new
-    // documented global/v<major> segment match outside that configured root.
+    // PNPM_HOME/global is pnpm's configured global root by construction, even
+    // when the version segment is not one of the documented numeric forms.
     const globalRoot = pnpmHomeGlobalRoot();
     if (globalRoot) {
         if (normalized === globalRoot || normalized.startsWith(`${globalRoot}/`)) {
@@ -361,7 +359,7 @@ export function resolveRunningInstall() {
         const packageRoot = findRunningPackageRoot();
         if (!packageRoot)
             return { manager: "npm", prefix: null, packageRoot: null };
-        if (isPnpmManagedPackageDir(packageRoot, true)) {
+        if (isPnpmManagedPackageDir(packageRoot)) {
             return { manager: "pnpm", prefix: null, packageRoot };
         }
         if (isBunManagedPackageDir(packageRoot)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.4",
+  "version": "5.342.6",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {