@indigoai-us/hq-cli 5.342.9 → 5.342.11

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.342.11] — 2026-10-04
+- Release the CLI package-use lease before interactive login waits after resident modules preload.
+- Show the cached version update nudge after interactive commands when a newer cached release remains and its feature flag is enabled; avoid waiting for registry readiness when there is no nudge to show or repeating guidance after the updater already reported its result.
+
+## [5.342.10] — 2026-10-04
+- Attach bounded status, gateway error-class, and integrations subcommand tags to captured gateway faults.
+
 ## [5.342.9] — 2026-10-04
 - Child wrappers now release their package-use lease after startup modules are preloaded, so long-running child processes do not block CLI updates.
 - Keep nested HQ child leases and materialize core-job post-exit helpers before releasing the parent package lease.

package/dist/commands/auth.js

@@ -14,6 +14,8 @@
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
  */
+import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
+import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
 import * as fs from "node:fs";
 import { open, realpath } from "node:fs/promises";
 import path from "node:path";
@@ -231,6 +233,7 @@ export function registerAuthCommands(program) {
                 }
             }
             const selection = resolveLoginProviderSelection(options.provider, process.env, rememberedProvider);
+            await releasePackageUseLeaseAfterResidentPreload(() => preloadResidentPackageModules("auth-login"), reportResidentPackagePreloadFailure, releaseCurrentPackageUseLease);
             const tokens = await browserLogin(selection.config);
             try {
                 storeLastLoginProvider(providerFromIdToken(tokens.idToken) ?? selection.providerToRemember);

package/dist/commands/integrations-core.d.ts

@@ -150,6 +150,8 @@ export declare class IntegrationsCliError extends Error {
      * fingerprint as anything but the finite allowlist in sentry-fingerprint.ts.
      */
     readonly rpcCode?: number;
+    /** Fixed vocabulary for the integrations subcommand that called the gateway. */
+    readonly gatewaySubcommand?: "tools_list" | "tools_call" | "other";
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
      * refused to register HQ automatically. The provider must register the exact
@@ -164,6 +166,7 @@ export declare class IntegrationsCliError extends Error {
         status?: number;
         oauthProtected?: boolean;
         rpcCode?: number;
+        gatewaySubcommand?: "tools_list" | "tools_call" | "other";
         redirectUri?: string;
     });
 }

package/dist/commands/integrations-core.js

@@ -55,6 +55,8 @@ export class IntegrationsCliError extends Error {
      * fingerprint as anything but the finite allowlist in sentry-fingerprint.ts.
      */
     rpcCode;
+    /** Fixed vocabulary for the integrations subcommand that called the gateway. */
+    gatewaySubcommand;
     /**
      * HQ's own OAuth callback URL, carried on the errors that say a provider
      * refused to register HQ automatically. The provider must register the exact
@@ -75,6 +77,8 @@ export class IntegrationsCliError extends Error {
             this.oauthProtected = opts.oauthProtected;
         if (opts.rpcCode !== undefined)
             this.rpcCode = opts.rpcCode;
+        if (opts.gatewaySubcommand !== undefined)
+            this.gatewaySubcommand = opts.gatewaySubcommand;
         if (opts.redirectUri !== undefined) {
             Object.defineProperty(this, "redirectUri", {
                 value: opts.redirectUri,
@@ -175,6 +179,18 @@ const EXPECTED_GATEWAY_ERROR_CODES = new Set([-32003, -32602, -32050]);
 function isExpectedGatewayError(code) {
     return code != null && EXPECTED_GATEWAY_ERROR_CODES.has(code);
 }
+function expectedGatewayErrorFallback(code) {
+    switch (code) {
+        case -32003:
+            return "You do not have access to this integration. Ask its owner to share it with you.";
+        case -32602:
+            return "The integration rejected this request. Check the tool name and arguments.";
+        case -32050:
+            return "The connected provider could not complete this request. Wait a moment and try again.";
+        default:
+            return undefined;
+    }
+}
 // A 401 from ANY integration-gateway vault call means the caller's HQ session
 // is expired or missing — an expected auth state fixed by `hq login`, not an
 // hq-cli defect. Raise the same typed AuthError the vault company-resolution
@@ -399,7 +415,18 @@ export async function resolveConnection(token, companyUid, app, opts, recoveryOp
     }
     return selectConnection(connections, opts);
 }
+function gatewaySubcommandFor(params) {
+    const name = params.name;
+    if (typeof name !== "string")
+        return "other";
+    if (name.endsWith(".mcp.tools.list"))
+        return "tools_list";
+    if (name.endsWith(".mcp.tools.call"))
+        return "tools_call";
+    return "other";
+}
 export async function callGateway(token, params, idempotencyKey) {
+    const gatewaySubcommand = gatewaySubcommandFor(params);
     const deadline = Date.now() + ASYNC_GATEWAY_DEADLINE_MS;
     const res = await vaultApiFetch({
         token,
@@ -414,6 +441,7 @@ export async function callGateway(token, params, idempotencyKey) {
     });
     const message = (await res.json().catch(() => null));
     let terminalMessage = message;
+    let terminalStatus = res.status;
     if (res.status === 202) {
         const accepted = message;
         const jobId = accepted && typeof accepted.jobId === "string" ? accepted.jobId : "";
@@ -427,7 +455,9 @@ export async function callGateway(token, params, idempotencyKey) {
         if (!idempotencyKey) {
             throw new IntegrationsCliError(`Integration gateway accepted async job ${jobId} without an idempotency key.`, { expected: false, status: 202 });
         }
-        terminalMessage = await pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, deadline);
+        const terminal = await pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, deadline);
+        terminalMessage = terminal.message;
+        terminalStatus = terminal.status;
     }
     if (res.status !== 202 && (!res.ok || !terminalMessage)) {
         raiseIfUnauthorized(res);
@@ -437,7 +467,7 @@ export async function callGateway(token, params, idempotencyKey) {
         // reaches the Sentry fingerprint's HTTP bucket instead of colliding under
         // default grouping. Same reasoning as raiseForResponse, which already sets
         // `status`. This does not change the `expected` decision above.
-        throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`, { expected: isClientError(res.status), status: res.status });
+        throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`, { expected: isClientError(res.status), status: res.status, gatewaySubcommand });
     }
     if (terminalMessage?.error) {
         // The gateway's error text is minted UPSTREAM (hq-pro, the integration
@@ -449,8 +479,11 @@ export async function callGateway(token, params, idempotencyKey) {
         // no-op. This preserves PR #298's user-visible diagnostic; it only makes
         // it safe on the newly-expected path.
         throw new IntegrationsCliError(redactErrorText(terminalMessage.error.message ?? "") ||
+            expectedGatewayErrorFallback(terminalMessage.error.code) ||
             "Integration gateway returned an error.", {
             expected: isExpectedGatewayError(terminalMessage.error.code),
+            status: terminalStatus,
+            gatewaySubcommand,
             // Carry the protocol code to the capture site as a bounded grouping
             // discriminator (HQ-CLI collision, Sentry 7642756130). This does not
             // alter the `expected` decision above; it only labels the error.
@@ -518,7 +551,7 @@ async function pollAsyncGatewayJob(token, companyUid, jobId, idempotencyKey, dea
             if (!hasJsonRpcOutcome) {
                 throw new IntegrationsCliError(`Integration job ${jobId} returned an invalid JSON-RPC response.`, { expected: false });
             }
-            return response;
+            return { message: response, status: res.status };
         }
         if (poll.status !== "pending") {
             throw new IntegrationsCliError(`Integration job ${jobId} returned unknown status '${String(poll.status)}'.`, { expected: true });

package/dist/commands/login.js

@@ -1,6 +1,8 @@
 /**
  * hq login — opens browser for Cognito auth.
  */
+import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
+import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
@@ -30,6 +32,15 @@ export function registerLoginCommand(program) {
         .option('--provider <provider>', 'OAuth provider to use: google, microsoft, or picker')
         .action(async (options) => {
         let accessToken;
+        let packageUseLeaseReleased = false;
+        const releaseForInteractiveWait = async () => {
+            if (packageUseLeaseReleased)
+                return;
+            await releasePackageUseLeaseAfterResidentPreload(async () => {
+                await preloadResidentPackageModules("login");
+                packageUseLeaseReleased = true;
+            }, reportResidentPackagePreloadFailure, releaseCurrentPackageUseLease);
+        };
         try {
             const existing = loadCachedTokens();
             if (existing && !isExpiring(existing, 120)) {
@@ -38,6 +49,7 @@ export function registerLoginCommand(program) {
                 accessToken = existing.accessToken;
             }
             else {
+                await releaseForInteractiveWait();
                 console.log('Opening browser for authentication...');
                 const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
                 const who = peekIdToken(tokens.idToken).email ?? 'HQ';
@@ -63,6 +75,7 @@ export function registerLoginCommand(program) {
                     .join("\n");
                 const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
                 try {
+                    await releaseForInteractiveWait();
                     const answer = await rl.question(`Choose this device's default company:\n${choices}\nSelection: `);
                     const selected = activation.memberships[Number.parseInt(answer, 10) - 1];
                     if (selected) {

package/dist/lib/flag-registry.js

@@ -47,6 +47,7 @@ let refreshCompletion = Promise.resolve();
 let completeRefresh = null;
 let refreshWorker = null;
 let refreshCompanyUid;
+let refreshHasCompanyContext = false;
 let refreshPendingSnapshot = null;
 let refreshSentry;
 /** Wait briefly for the current company refresh to persist or report completion. */
@@ -144,13 +145,12 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     completeRefresh = null;
     refreshWorker = null;
     refreshCompanyUid = companyUid;
+    refreshHasCompanyContext = Boolean(companyUid || company.companySlug);
     refreshPendingSnapshot = null;
     refreshSentry = sentry;
-    if (companyUid || company.companySlug) {
-        refreshCompletion = new Promise((resolve) => {
-            completeRefresh = resolve;
-        });
-    }
+    refreshCompletion = new Promise((resolve) => {
+        completeRefresh = resolve;
+    });
     const finishRefresh = () => {
         completeRefresh?.();
         completeRefresh = null;
@@ -220,6 +220,10 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
                     refreshPendingSnapshot = null;
                     finishRefresh();
                 }
+                else if (!refreshHasCompanyContext) {
+                    refreshPendingSnapshot = null;
+                    finishRefresh();
+                }
             }
             else {
                 finishRefresh();
@@ -316,6 +320,7 @@ export function _resetFlagRegistryForTests() {
     completeRefresh = null;
     refreshWorker = null;
     refreshCompanyUid = undefined;
+    refreshHasCompanyContext = false;
     refreshPendingSnapshot = null;
     refreshSentry = undefined;
 }

package/dist/main.js

@@ -41,16 +41,17 @@ import { DEFAULT_COGNITO, isMachineIdentity, loadMachineCachedTokens, } from "./
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
 import { canOfferTeamUpgrade, formatPlanGateError, offerTeamUpgrade, offerUpgradeLink, planGateErrorFromVaultError, } from "./utils/plan-gate-error.js";
 import { upgradeToTeam } from "./utils/team-upgrade.js";
-import { printVersionAndNudge, refreshVersionCache, staleAgainstCachedLatest, } from "./utils/version-check.js";
-import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
+import { printCachedVersionNudge, printVersionAndNudge, refreshVersionCache, staleAgainstCachedLatest, } from "./utils/version-check.js";
+import { enforceVersionGate, isLocalDependencyInstall, resolveRunningInstall, shouldSkipGate, } from "./utils/version-gate.js";
 import { autoUpdateAndReexec } from "./utils/self-update.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { findLazyCommand, registerCommandCatalog } from "./lazy-commands.js";
 import { emitCliFirstSyncNextStepOutcome, emitCliLimitNoticeEngagement, emitCliLimitNoticeExposure, emitCliInviteNudgeEvent, emitCliSessionStarted, emitPlanLimitInviteTeammateExposure, isCliLimitResourceKind, queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, takeFirstSyncStepOutcomes, takeCliLimitNoticeEngagements, takeCliLimitNoticeExposures, takeCliInviteNudgeEvents, takePlanLimitInviteTeammateExposures, maybeShowFirstSyncNextStep, } from "./utils/cli-telemetry.js";
 import { reportCliClientHealthInvocation } from "./utils/client-health.js";
 import { settleWithin } from "./utils/settle-with-timeout.js";
+import { isVersionRequest } from "./version-request.js";
 import { emitPlanLimitNag } from "./lib/plan-limit-nag.js";
-import { kickFlagRegistryReadiness } from "./lib/flag-registry.js";
+import { kickFlagRegistryReadiness, waitForFlagRegistryRefresh, } from "./lib/flag-registry.js";
 import { isPackageRootResolutionError, packageRootCaptureContext, } from "./utils/package-root-diagnostics.js";
 import { registerCommandsWithRecovery } from "./startup-registration.js";
 import { releasePackageUseLeaseAfterCommandLoad } from "./utils/package-use-lease.js";
@@ -185,6 +186,8 @@ export async function runCli() {
     // out (after the finally block's telemetry, hence not process.exit here).
     let reexecStatus = null;
     let versionNudgeHandled = false;
+    let versionUpdateHandled = false;
+    let commandParsed = false;
     try {
         runGlobalNetworkLifecycle(process.argv, () => Sentry.addBreadcrumb({
             category: "command",
@@ -209,6 +212,9 @@ export async function runCli() {
                 return "continue";
             const gate = (await foregroundNetworkBudget.waitFor(VERSION_GATE_FOREGROUND_WAIT_MS, FINALIZATION_FOREGROUND_WAIT_MS, (timeoutMs) => enforceVersionGate(async (decision) => {
                 const outcome = await autoUpdateAndReexec(process.argv, decision.latestVersion);
+                if (outcome.action === "update-failed" || outcome.action === "updated-no-reexec") {
+                    versionUpdateHandled = true;
+                }
                 if (outcome.action === "reexec")
                     reexecStatus = outcome.reexecStatus ?? 0;
                 return outcome.action === "reexec";
@@ -218,6 +224,9 @@ export async function runCli() {
             const cachedLatest = staleAgainstCachedLatest();
             if (cachedLatest) {
                 const outcome = await autoUpdateAndReexec(process.argv, cachedLatest);
+                if (outcome.action === "update-failed" || outcome.action === "updated-no-reexec") {
+                    versionUpdateHandled = true;
+                }
                 if (outcome.action === "reexec") {
                     reexecStatus = outcome.reexecStatus ?? 0;
                     return "reexec";
@@ -264,6 +273,7 @@ export async function runCli() {
         }
         await releasePackageUseLeaseAfterCommandLoad(process.argv);
         await program.parseAsync();
+        commandParsed = true;
         maybeShowFirstSyncNextStep();
     }
     catch (err) {
@@ -287,10 +297,26 @@ export async function runCli() {
             const inviteTeammateExposureFlushes = takePlanLimitInviteTeammateExposures().map((companyUid) => emitPlanLimitInviteTeammateExposure(companyUid, releaseHealthTimeoutMs));
             const limitNoticeExposureFlushes = takeCliLimitNoticeExposures().map((exposure) => emitCliLimitNoticeExposure(exposure, releaseHealthTimeoutMs));
             const limitNoticeEngagementFlushes = takeCliLimitNoticeEngagements().map((engagement) => emitCliLimitNoticeEngagement(engagement, releaseHealthTimeoutMs));
+            const commandArgs = process.argv.slice(2);
+            const canShowCachedVersionNudge = commandParsed &&
+                !versionNudgeHandled &&
+                !versionUpdateHandled &&
+                process.stdout.isTTY === true &&
+                !commandArgs.includes("--json") &&
+                !isVersionRequest(process.argv) &&
+                !shouldSkipGate(process.argv) &&
+                !isLocalDependencyInstall(resolveRunningInstall());
+            const cachedVersionNudge = canShowCachedVersionNudge && staleAgainstCachedLatest() !== null
+                ? (async () => {
+                    await waitForFlagRegistryRefresh(releaseHealthTimeoutMs);
+                    await printCachedVersionNudge(process.stderr);
+                })()
+                : undefined;
             await settleWithin([
                 ...(versionNudgeHandled
                     ? []
                     : [refreshVersionCache({ timeoutMs: releaseHealthTimeoutMs })]),
+                ...(cachedVersionNudge ? [cachedVersionNudge] : []),
                 Sentry.flush(releaseHealthTimeoutMs),
                 ...firstSyncOutcomeFlushes,
                 ...inviteNudgeOutcomeFlushes,
@@ -335,6 +361,39 @@ function qmdSpawnFailureCaptureContext(err) {
         return undefined;
     return { contexts: { qmd_spawn_failure: diagnostics } };
 }
+const GATEWAY_RPC_CODE_TAGS = new Map([
+    [-32603, "internal_error"],
+    [-32009, "conflict"],
+    [-32003, "unauthorized"],
+    [-32602, "invalid_params"],
+    [-32050, "provider_error"],
+]);
+function integrationsGatewayCaptureContext(err) {
+    if (err === null || typeof err !== "object")
+        return undefined;
+    const record = err;
+    const subcommand = record.gatewaySubcommand;
+    if (subcommand === undefined)
+        return undefined;
+    const subcommandTag = subcommand === "tools_list" || subcommand === "tools_call"
+        ? subcommand
+        : "other";
+    const status = record.status;
+    const statusTag = typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599
+        ? String(status)
+        : status === undefined ? "unknown" : "other";
+    const rpcCode = record.rpcCode;
+    const codeTag = typeof rpcCode === "number" && Number.isInteger(rpcCode)
+        ? GATEWAY_RPC_CODE_TAGS.get(rpcCode) ?? "other"
+        : rpcCode === undefined ? "missing" : "other";
+    return {
+        tags: {
+            integration_gateway_status: statusTag,
+            integration_gateway_code: codeTag,
+            integration_subcommand: subcommandTag,
+        },
+    };
+}
 /** Classify a top-level failure without making the CLI process boundary opaque to tests. */
 export async function handleTopLevelError(err, deps = defaultTopLevelErrorDependencies) {
     // A typed plan gate, or an hq-cloud vault error carrying a plan-limit
@@ -853,9 +912,11 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
             const spawnContext = qmdSpawnFailureCaptureContext(err);
             const installContext = incompleteInstallCaptureContext(err);
             const qmdContext = qmdExitCaptureContext(err);
-            if (spawnContext || installContext || qmdContext) {
+            const gatewayContext = integrationsGatewayCaptureContext(err);
+            if (spawnContext || installContext || qmdContext || gatewayContext) {
                 deps.sentry.captureException(err, {
                     ...qmdContext,
+                    ...(gatewayContext ? { tags: gatewayContext.tags } : {}),
                     ...((spawnContext || installContext)
                         ? { contexts: { ...spawnContext?.contexts, ...installContext } }
                         : {}),

package/dist/utils/resident-package-preload.d.ts

@@ -1,4 +1,4 @@
-export type ResidentPackagePath = "bot" | "mcp" | "daemon" | "childWrapper" | "coreJobRun";
+export type ResidentPackagePath = "auth-login" | "bot" | "childWrapper" | "coreJobRun" | "login" | "mcp" | "daemon";
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export declare const RESIDENT_PACKAGE_MODULES: Record<ResidentPackagePath, readonly string[]>;
 export declare class ResidentPackagePreloadError extends Error {

package/dist/utils/resident-package-preload.js

@@ -1,5 +1,23 @@
 /** Package imports reachable lazily from each resident command's runtime graph. */
 export const RESIDENT_PACKAGE_MODULES = {
+    login: [
+        "../lib/mesh/api.js",
+        "../lib/work-context/config.js",
+        "../lib/work-context/default-company.js",
+        "../lib/work-context/paths.js",
+        "../lib/plan-limit-nag.js",
+        "../utils/plan-gate-error.js",
+        "../sentry.js",
+        "open",
+    ],
+    "auth-login": [
+        "../lib/auth-login-provider-state.js",
+        "../lib/daemon/mcp-oauth.js",
+        "../lib/plan-limit-nag.js",
+        "../utils/plan-gate-error.js",
+        "../sentry.js",
+        "open",
+    ],
     bot: [
         "../lib/flag-registry.js",
         "../commands/access.js",
@@ -24,6 +42,30 @@ export const RESIDENT_PACKAGE_MODULES = {
     ],
 };
 const LOADERS = {
+    login: [
+        () => import("../lib/mesh/api.js"),
+        () => import("../lib/work-context/config.js"),
+        () => import("../lib/work-context/default-company.js"),
+        () => import("../lib/work-context/paths.js"),
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("open"),
+    ],
+    "auth-login": [
+        () => import("../lib/auth-login-provider-state.js"),
+        () => import("../lib/daemon/mcp-oauth.js"),
+        () => import("../lib/plan-limit-nag.js"),
+        () => import("../utils/plan-gate-error.js"),
+        async () => {
+            const { preloadSentrySdk } = await import("../sentry.js");
+            preloadSentrySdk();
+        },
+        () => import("open"),
+    ],
     bot: [
         () => import("../lib/flag-registry.js"),
         () => import("../commands/access.js"),

package/dist/utils/version-gate.js

@@ -37,6 +37,7 @@ import { fileURLToPath } from "node:url";
 import chalk from "chalk";
 import semver from "semver";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
+import { isVersionRequest } from "../version-request.js";
 import { Sentry } from "../sentry.js";
 import { isCliTelemetryDisabled } from "./cli-telemetry.js";
 import { DEFAULT_VAULT_API_URL } from "./cognito-session.js";
@@ -315,11 +316,6 @@ export function isLocalDependencyPackageDir(pkgDir, platform = process.platform)
     // `<dir>/lib/node_modules` while the `.bin` shim keeps resolving
     // `<dir>/node_modules`.
     //
-    // Windows is the exception and must keep the old behaviour: its global
-    // layout is `<prefix>\node_modules` with no `lib` segment, so the same test
-    // would misread a genuine global install as local.
-    if (platform === "win32")
-        return false;
     const segments = pkgDir
         .replace(/\\/g, "/")
         .replace(/\/+$/, "")
@@ -328,6 +324,23 @@ export function isLocalDependencyPackageDir(pkgDir, platform = process.platform)
     const nodeModulesIndex = segments.lastIndexOf("node_modules");
     if (nodeModulesIndex <= 0)
         return false;
+    if (platform === "win32") {
+        const prefix = segments.slice(0, nodeModulesIndex).join("/");
+        const normalize = (value) => value.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+        const configuredPrefix = process.env.npm_config_prefix ?? process.env.NPM_CONFIG_PREFIX;
+        if (configuredPrefix && normalize(configuredPrefix) === normalize(prefix))
+            return false;
+        const appData = process.env.APPDATA;
+        const defaultPrefix = appData
+            ? path.join(appData, "npm")
+            : path.join(os.homedir(), "AppData", "Roaming", "npm");
+        if (normalize(defaultPrefix) === normalize(prefix))
+            return false;
+        const pathEntries = (process.env.PATH ?? "").split(";");
+        if (pathEntries.some((entry) => normalize(entry) === normalize(prefix)))
+            return false;
+        return true;
+    }
     return segments[nodeModulesIndex - 1] !== "lib";
 }
 export function isLocalDependencyInstall(install, platform = process.platform) {
@@ -1588,12 +1601,11 @@ export async function enforceVersionGate(onUpdateRecommended, options = {}) {
  * force-upgraded.
  */
 export function shouldSkipGate(argv) {
-    return argv.some((a) => a === "--version" ||
+    return isVersionRequest(argv) || argv.some((a) => a === "--version" ||
         a === "-V" ||
         a === "-v" ||
         a === "--help" ||
-        a === "-h" ||
-        a === "version");
+        a === "-h");
 }
 export const __test__ = {
     CLIENT_ID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.342.9",
+  "version": "5.342.11",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {