@indigoai-us/hq-cli 5.342.5 → 5.342.7

package/CHANGELOG.md

@@ -2,7 +2,20 @@
 
 ## [Unreleased]
 
+## [5.342.7] — 2026-10-04
+- Batch policy frontmatter reads into one `hq core policy frontmatter` invocation while preserving single-file output.
+
+## [5.342.6] — 2026-10-04
+- Add `hq mesh project member add` to add an active company member to a project.
+
+- With `cli.company-errors-sdk-warning` enabled, `hq people` now scopes to a sole cloud membership when the local company manifest is missing.
+- Run the package-use lease macOS and Windows checks on pull requests only when lease inputs change, while retaining both checks on main pushes.
+- Keep `hq secrets env --company <slug>` on the lightweight fast route when the company option follows `env`.
+
 ## [5.342.5] — 2026-10-04
+
+- Keep pnpm v11 global install detection and Windows drive-path tar extraction unconditional; remove their legacy opt-outs.
+
 - Pass explicit hook stdin to bundled shell companions through a real pipe on Windows.
 - Run the paired fast-route benchmark only when its executable or build inputs change.
 - Limit `hq mcp serve` resident preloads to its request handler modules; hosted MCP client dependencies remain in the daemon process.

package/assets/scaffold/core/scripts/read-policy-frontmatter.sh

@@ -2,6 +2,7 @@
 # read-policy-frontmatter.sh — Extract YAML frontmatter from a policy file
 #
 # Usage: bash core/scripts/read-policy-frontmatter.sh <policy-file>
+#        bash core/scripts/read-policy-frontmatter.sh <policy-file> <policy-file> ...
 #
 # Returns only the YAML frontmatter block (between the first two --- markers),
 # skipping the policy body. Used by /startwork, /plan, /brainstorm, /run commands
@@ -20,13 +21,19 @@ if [ $# -lt 1 ]; then
   exit 1
 fi
 
-FILE="$1"
+INDEX=0
+for FILE in "$@"; do
+  if [ ! -r "$FILE" ]; then
+    echo "ERROR: File not readable: $FILE" >&2
+    exit 1
+  fi
 
-if [ ! -r "$FILE" ]; then
-  echo "ERROR: File not readable: $FILE" >&2
-  exit 1
-fi
+  if [ "$INDEX" -gt 0 ]; then
+    printf '\n# --- policy-file: %s ---\n' "$FILE"
+  fi
+  INDEX=$((INDEX + 1))
 
-# Extract frontmatter: lines between first two --- markers.
-# c counts --- markers; print lines only while inside the frontmatter (c==1).
-awk '/^---$/{c++; next} c==1' "$FILE"
+  # Extract frontmatter: lines between first two --- markers.
+  # c counts --- markers; print lines only while inside the frontmatter (c==1).
+  awk '/^---$/{c++; next} c==1' "$FILE"
+done

package/dist/command-catalog.generated.d.ts

@@ -9296,6 +9296,48 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "member";
+            readonly description: "Manage project members";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: true;
+            readonly usage: "[options] [command]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [{
+                readonly name: "add";
+                readonly description: "Add an active company member to a project";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <projectId> <personUid>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "projectId";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }, {
+                    readonly name: "personUid";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--company <slug|uid>";
+                    readonly description: "Company slug or cloud uid";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "Print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }];
         }];
     }, {
         readonly name: "doctor";

package/dist/command-catalog.generated.js

@@ -11271,6 +11271,57 @@ export const COMMAND_CATALOG = [
                             }
                         ],
                         "subcommands": []
+                    },
+                    {
+                        "name": "member",
+                        "description": "Manage project members",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": true,
+                        "usage": "[options] [command]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [],
+                        "subcommands": [
+                            {
+                                "name": "add",
+                                "description": "Add an active company member to a project",
+                                "aliases": [],
+                                "hidden": false,
+                                "helpOption": true,
+                                "helpCommand": false,
+                                "usage": "[options] <projectId> <personUid>",
+                                "helpText": [],
+                                "arguments": [
+                                    {
+                                        "name": "projectId",
+                                        "required": true,
+                                        "variadic": false,
+                                        "description": ""
+                                    },
+                                    {
+                                        "name": "personUid",
+                                        "required": true,
+                                        "variadic": false,
+                                        "description": ""
+                                    }
+                                ],
+                                "options": [
+                                    {
+                                        "flags": "--company <slug|uid>",
+                                        "description": "Company slug or cloud uid",
+                                        "hidden": false
+                                    },
+                                    {
+                                        "flags": "--json",
+                                        "description": "Print machine-readable JSON",
+                                        "hidden": false
+                                    }
+                                ],
+                                "subcommands": []
+                            }
+                        ]
                     }
                 ]
             },

package/dist/commands/core-policy-frontmatter.js

@@ -2,37 +2,58 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { usesGnuAwk } from '../lib/core-utils/awk-diagnostics.js';
 const USAGE = Buffer.from('USAGE: read-policy-frontmatter.sh <policy-file>\n');
+const MULTI_FILE_SEPARATOR = (file) => Buffer.from(`\n# --- policy-file: ${file} ---\n`);
 /** Byte-preserving port of core/scripts/read-policy-frontmatter.sh. */
 export function runPolicyFrontmatter(args, cwd, pathValue = process.env.PATH, platform = process.platform) {
-    const first = args[0];
-    if (first === undefined)
+    if (args.length === 0)
         return { code: 1, stdout: Buffer.alloc(0), stderr: USAGE };
-    const filePath = path.isAbsolute(first) ? first : path.resolve(cwd, first);
-    let source;
-    try {
-        fs.accessSync(filePath, fs.constants.R_OK);
-        source = fs.readFileSync(filePath);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === 'EISDIR') {
-            return {
-                code: 0,
-                stdout: Buffer.alloc(0),
-                stderr: Buffer.from(usesGnuAwk(pathValue, platform)
-                    ? `awk: warning: command line argument \`${first}' is a directory: skipped\n`
-                    : ''),
-            };
+    const output = [];
+    const diagnostics = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const file = args[index];
+        const filePath = path.isAbsolute(file) ? file : path.resolve(cwd, file);
+        try {
+            fs.accessSync(filePath, fs.constants.R_OK);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {
+                return {
+                    code: 1,
+                    stdout: Buffer.concat(output),
+                    stderr: Buffer.concat([...diagnostics, Buffer.from(`ERROR: File not readable: ${file}\n`)]),
+                };
+            }
+            throw error;
         }
-        if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {
-            return {
-                code: 1,
-                stdout: Buffer.alloc(0),
-                stderr: Buffer.from(`ERROR: File not readable: ${first}\n`),
-            };
+        if (index > 0)
+            output.push(MULTI_FILE_SEPARATOR(file));
+        let source;
+        try {
+            source = fs.readFileSync(filePath);
         }
-        throw error;
+        catch (error) {
+            const code = error.code;
+            if (code === 'EISDIR') {
+                if (usesGnuAwk(pathValue, platform)) {
+                    diagnostics.push(Buffer.from(`awk: warning: command line argument \`${file}' is a directory: skipped\n`));
+                }
+                continue;
+            }
+            if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {
+                return {
+                    code: 1,
+                    stdout: Buffer.concat(output),
+                    stderr: Buffer.concat([...diagnostics, Buffer.from(`ERROR: File not readable: ${file}\n`)]),
+                };
+            }
+            throw error;
+        }
+        output.push(extractFrontmatter(source, platform));
     }
+    return { code: 0, stdout: Buffer.concat(output), stderr: Buffer.concat(diagnostics) };
+}
+function extractFrontmatter(source, platform) {
     const output = [];
     let markers = 0;
     let start = 0;
@@ -53,6 +74,6 @@ export function runPolicyFrontmatter(args, cwd, pathValue = process.env.PATH, pl
             break;
         start = end + 1;
     }
-    return { code: 0, stdout: Buffer.concat(output), stderr: Buffer.alloc(0) };
+    return Buffer.concat(output);
 }
 //# sourceMappingURL=core-policy-frontmatter.js.map

package/dist/commands/mesh.js

@@ -13,7 +13,7 @@ import { CLI_VERSION } from "../cli-version.js";
 import chalk from "chalk";
 import { ensureCognitoToken, isExpiring, isMachineIdentity, loadCachedTokens, } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
-import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { STORY_STATUSES, appendThreadEvent, addProjectMember, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard, boardStoryStatus, formatStoryStatusChanges, mergeProjectStories, prdSyncEventsThatChangeBoard, } from "../lib/mesh/project-board.js";
 import { mapSourceStoryStatus } from "../lib/mesh/story-status.js";
 import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.js";
@@ -461,6 +461,17 @@ async function runProjectRegister(projectId, opts) {
     }
     console.log(`Work mesh: project ${registration.projectId} registered (${boardState}; channel ${registration.channelId} ${registration.channelCreated ? "created" : "bound"})`);
 }
+async function runProjectMemberAdd(projectId, personUid, opts) {
+    const { token, company } = await withCompany(opts);
+    const result = await addProjectMember(token, company.companyUid, projectId, personUid);
+    if (opts.json) {
+        console.log(JSON.stringify({ action: "project.member.add", ...result }, null, 2));
+        return;
+    }
+    console.log(result.added
+        ? `Work mesh: added ${personUid} to project ${projectId}`
+        : `Work mesh: ${personUid} is already a member of project ${projectId}`);
+}
 async function runProjectEnsure(projectId, opts) {
     if (!opts.storiesFile?.trim())
         fail("`--stories-file <prd.json>` is required.");
@@ -1910,6 +1921,14 @@ export function registerMeshCommand(program) {
         .option("--channel <channelId>", "Bind the project to an existing company or project channel")
         .option("--json", "Print machine-readable JSON")
         .action((projectId, opts) => wrap(() => runProjectRegister(projectId, opts))());
+    project
+        .command("member")
+        .description("Manage project members")
+        .command("add <projectId> <personUid>")
+        .description("Add an active company member to a project")
+        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
+        .option("--json", "Print machine-readable JSON")
+        .action((projectId, personUid, opts) => wrap(() => runProjectMemberAdd(projectId, personUid, opts))());
     mesh
         .command("doctor")
         .description("Warm ~/.hq/work-mesh/cache from hq-pro (directory, inbox, pair DMs). Not `hq doctor`.")

package/dist/commands/people.d.ts

@@ -18,7 +18,7 @@ export type FetchPeopleRoster = (hqRoot: string, companySlug: string) => Promise
 interface PeopleCommandDeps {
     fetchRoster?: FetchPeopleRoster;
     /** Test seam for the shared active-membership ambiguity resolver. */
-    resolveMissingManifestMemberships?: () => Promise<void>;
+    resolveMissingManifestMemberships?: () => Promise<string | void>;
     companySelectionGuidanceEnabled?: () => boolean;
 }
 interface PeopleLookupOpts {

package/dist/commands/people.js

@@ -122,12 +122,16 @@ async function resolvePeopleCompanySlug(hqRoot, explicit, localOnly, deps) {
             const resolveMemberships = deps.resolveMissingManifestMemberships ??
                 (async () => {
                     const token = await ensureCognitoToken();
-                    await getCompanyUid(token, undefined);
+                    return getCompanyUid(token, undefined);
                 });
             // The shared resolver throws members-style guidance for multiple active
-            // companies. A single membership cannot provide a local slug without a
-            // manifest, so preserve the existing missing-manifest error in that case.
-            await resolveMemberships();
+            // companies. With no manifest, its sole-membership UID is also a valid
+            // scope for the people roster and company directory.
+            const membershipCompany = await resolveMemberships();
+            if (message.includes("companies/manifest.yaml not found") &&
+                typeof membershipCompany === "string") {
+                return membershipCompany;
+            }
         }
         throw error;
     }

package/dist/commands/safe-extract.d.ts

@@ -111,12 +111,11 @@ export declare function assertLinkTargetContained(packDir: string, entryAbs: str
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
  * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths use a basename relative to the archive directory by
- * default. GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows'
- * bundled bsdtar accepts the same relative argv without GNU-only `--force-local`.
- * Callers can still explicitly opt out with `useRelativeWindowsDrivePath: false`.
+ * Windows drive paths always use a basename relative to the archive directory.
+ * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
+ * bsdtar accepts the same relative argv without GNU-only `--force-local`.
  */
-export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'useRelativeWindowsDrivePath' | 'execFileSync'>): TarEntry[];
+export declare function listTarball(tarballPath: string, opts?: Pick<SafeExtractOptions, 'platform' | 'execFileSync'>): TarEntry[];
 /**
  * Pre-flight validation against the entry headers. Enforces (a) containment of
  * every entry name under `targetDir`, (b) containment of every link target
@@ -134,9 +133,8 @@ export declare function validateEntries(entries: TarEntry[], targetDir: string,
 export declare function assertExtractContained(stagingDir: string): void;
 export interface SafeExtractOptions {
     caps?: ExtractCaps;
-    /** Test seams for platform-specific argv construction; runtime gating uses hq-flags. */
+    /** Test seam for platform-specific argv construction. */
     platform?: NodeJS.Platform;
-    useRelativeWindowsDrivePath?: boolean;
     execFileSync?: typeof execFileSync;
     /**
      * Test seam: invoked AFTER `tar` extracts into the staging dir but BEFORE

package/dist/commands/safe-extract.js

@@ -203,10 +203,8 @@ export function assertLinkTargetContained(packDir, entryAbs, linkTarget) {
             `"${linkTarget}" -> "${resolvedTarget}", outside pack dir "${path.resolve(packDir)}".`);
     }
 }
-function tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath) {
-    if (platform === 'win32' &&
-        useRelativeWindowsDrivePath &&
-        /^[A-Za-z]:[\\/]/.test(tarballPath)) {
+function tarballArgvLocation(tarballPath, platform) {
+    if (platform === 'win32' && /^[A-Za-z]:[\\/]/.test(tarballPath)) {
         return {
             archiveArg: path.win32.basename(tarballPath),
             cwd: path.win32.dirname(tarballPath),
@@ -217,15 +215,13 @@ function tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath)
 /**
  * List a gzip-compressed tarball's entries via `tar -tvf` (no extraction).
  * argv form, never a shell string, keeps hostile filenames out of shell syntax.
- * Windows drive paths use a basename relative to the archive directory by
- * default. GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows'
- * bundled bsdtar accepts the same relative argv without GNU-only `--force-local`.
- * Callers can still explicitly opt out with `useRelativeWindowsDrivePath: false`.
+ * Windows drive paths always use a basename relative to the archive directory.
+ * GNU tar cannot parse `C:\\...` as remote `host:path`, and Windows' bundled
+ * bsdtar accepts the same relative argv without GNU-only `--force-local`.
  */
 export function listTarball(tarballPath, opts = {}) {
     const platform = opts.platform ?? process.platform;
-    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? true;
-    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
+    const location = tarballArgvLocation(tarballPath, platform);
     const out = (opts.execFileSync ?? execFileSync)('tar', ['-tvf', location.archiveArg], {
         encoding: 'utf-8',
         maxBuffer: 64 * 1024 * 1024,
@@ -329,13 +325,11 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
     }
     // Resolve once so listing and extraction use the same archive location.
     const platform = opts.platform ?? process.platform;
-    const useRelativeWindowsDrivePath = opts.useRelativeWindowsDrivePath ?? true;
     const exec = opts.execFileSync ?? execFileSync;
-    const location = tarballArgvLocation(tarballPath, platform, useRelativeWindowsDrivePath);
+    const location = tarballArgvLocation(tarballPath, platform);
     // 1. Pre-flight against headers (no bytes written yet).
     const entries = listTarball(tarballPath, {
         platform,
-        useRelativeWindowsDrivePath,
         execFileSync: exec,
     });
     validateEntries(entries, finalDir, caps);

package/dist/fast-scaffold.js

@@ -343,6 +343,24 @@ export function parseSecretsEnvFastRequest(argv) {
         const arg = argv[index];
         if (arg === "-h" || arg === "--help" || arg === "--")
             return null;
+        // Commander accepts the parent secrets scope option after the `env`
+        // subcommand too. Keep that valid spelling on the fast route.
+        if (arg === "--company") {
+            const value = argv[index + 1];
+            if (!value || value.startsWith("-") || hasPersonalScope)
+                return null;
+            scope.company = value;
+            index += 2;
+            continue;
+        }
+        if (arg?.startsWith("--company=")) {
+            const value = arg.slice("--company=".length);
+            if (!value || hasPersonalScope)
+                return null;
+            scope.company = value;
+            index += 1;
+            continue;
+        }
         let option;
         let value;
         if (arg === "--only" || arg === "--script" || arg === "--script-id") {

package/dist/lib/mesh/api.d.ts

@@ -154,6 +154,13 @@ export declare function patchStoryStatus(token: string, companyUid: string, proj
 }>;
 /** Read the full durable Board view before preparing a replacement PUT. */
 export declare function getProjectView(token: string, companyUid: string, projectId: string): Promise<MeshProjectView>;
+/** Add an active company member to the project's Work Mesh channel. */
+export declare function addProjectMember(token: string, companyUid: string, projectId: string, personUid: string): Promise<{
+    ok: true;
+    projectId: string;
+    personUid: string;
+    added: boolean;
+}>;
 /** Replace a project's durable Board view and keep the local project cache current. */
 export declare function putProjectView(token: string, companyUid: string, projectId: string, input: {
     name?: string;

package/dist/lib/mesh/api.js

@@ -465,6 +465,14 @@ export async function getProjectView(token, companyUid, projectId) {
         throw new Error("Work mesh returned an invalid project view");
     return projectViewFromResponse(view, companyUid, projectId);
 }
+/** Add an active company member to the project's Work Mesh channel. */
+export async function addProjectMember(token, companyUid, projectId, personUid) {
+    const result = asRecord(await meshJson(token, `/v1/work-mesh/projects/${encodeURIComponent(projectId)}`, { method: "PUT", body: { operation: "add-member", companyUid, personUid } }));
+    if (result?.ok !== true || typeof result.added !== "boolean") {
+        throw new Error("Work mesh returned an invalid project membership result");
+    }
+    return { ok: true, projectId, personUid, added: result.added };
+}
 /** Replace a project's durable Board view and keep the local project cache current. */
 export async function putProjectView(token, companyUid, projectId, input) {
     const { expectedVersion, ...document } = input;

package/dist/utils/self-update.js

@@ -372,7 +372,7 @@ function isRecognizedGlobalInstall(install, packageRoot) {
     if (!isInsideNodeModules(packageRoot))
         return false;
     if (install.manager === "pnpm")
-        return isPnpmManagedPackageDir(packageRoot, true);
+        return isPnpmManagedPackageDir(packageRoot);
     if (install.manager === "bun")
         return isBunManagedPackageDir(packageRoot);
     if (!install.prefix)

package/dist/utils/version-gate.d.ts

@@ -70,7 +70,7 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export declare function isPnpmManagedPackageDir(pkgDir: string, acceptVersionPrefixedGlobalDir?: boolean): boolean;
+export declare function isPnpmManagedPackageDir(pkgDir: string): boolean;
 /** Whether the running package lives inside Bun's global install tree. */
 export declare function isBunManagedPackageDir(pkgDir: string): boolean;
 /**

package/dist/utils/version-gate.js

@@ -128,7 +128,7 @@ function findPackageRootForExecutable(bin) {
             const packageRoot = findCliPackageRoot(candidate);
             if (packageRoot &&
                 samePath(packageRoot, candidate) &&
-                isPnpmManagedPackageDir(packageRoot, true)) {
+                isPnpmManagedPackageDir(packageRoot)) {
                 return packageRoot;
             }
         }
@@ -151,7 +151,7 @@ function samePath(left, right) {
         : a === b;
 }
 function globalInstallManagerForPath(bin, packageRoot) {
-    if (isPnpmManagedPackageDir(packageRoot, true)) {
+    if (isPnpmManagedPackageDir(packageRoot)) {
         return "pnpm";
     }
     if (isBunManagedPackageDir(packageRoot))
@@ -215,7 +215,7 @@ function pnpmHomeGlobalRoot() {
  * i.e. the gate would re-fire and re-install globally on every subsequent run.
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
-export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir = true) {
+export function isPnpmManagedPackageDir(pkgDir) {
     const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
     const segments = normalized.split("/").filter(Boolean);
     // pnpm through v10 uses `global/<digits>`; pnpm v11+ uses
@@ -228,13 +228,11 @@ export function isPnpmManagedPackageDir(pkgDir, acceptVersionPrefixedGlobalDir =
         const globalDirVersion = segments[i + 1];
         if (/^\d+$/.test(globalDirVersion))
             return true;
-        if (acceptVersionPrefixedGlobalDir && /^v\d+$/.test(globalDirVersion)) {
+        if (/^v\d+$/.test(globalDirVersion))
             return true;
-        }
     }
-    // PNPM_HOME/global is pnpm's configured global root by construction, so
-    // keep this fallback in both flag states. The flag above gates only the new
-    // documented global/v<major> segment match outside that configured root.
+    // PNPM_HOME/global is pnpm's configured global root by construction, even
+    // when the version segment is not one of the documented numeric forms.
     const globalRoot = pnpmHomeGlobalRoot();
     if (globalRoot) {
         if (normalized === globalRoot || normalized.startsWith(`${globalRoot}/`)) {
@@ -361,7 +359,7 @@ export function resolveRunningInstall() {
         const packageRoot = findRunningPackageRoot();
         if (!packageRoot)
             return { manager: "npm", prefix: null, packageRoot: null };
-        if (isPnpmManagedPackageDir(packageRoot, true)) {
+        if (isPnpmManagedPackageDir(packageRoot)) {
             return { manager: "pnpm", prefix: null, packageRoot };
         }
         if (isBunManagedPackageDir(packageRoot)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.5",
+  "version": "5.342.7",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {