@indigoai-us/hq-cli 5.345.108 → 5.345.110

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.345.110] — 2026-10-13
+- The bundled sync runner now uses hq-cloud 6.18.69, which compacts the sync-state write-ahead log into a snapshot once the log grows past a size-scaled ratio of the snapshot, so large companies stop accumulating oversized sync-state files.
+- Remove the three policy-family shell rollback copies after the native route's clean release soak. `hq core policy age-report`, `policy retire`, and `policy frontmatter` now use the native route regardless of the retained `core-native-policy` flag, which still gates `knowledge-prefs`.
+
+## [5.345.109] — 2026-10-13
+- `hq` commands no longer fail with "The HQ CLI package is being updated" while
+  the desktop app updates the CLI. They wait for the update (up to 4 minutes,
+  `HQ_CLI_UPDATE_WAIT_MS` to tune) and, if the install changed underneath them,
+  re-run once from the new version.
+
 ## [5.345.108] — 2026-10-13
 - On macOS, `hq` reads your sign-in from the Keychain copy kept by the desktop app and uses whichever of the Keychain and `~/.hq/cognito-tokens.json` is newer (hq-cloud 6.18.67). macOS asks once for access; if you deny it, `hq` keeps using the file until you run `hq auth keychain --retry`.
 

package/dist/commands/core-policy.d.ts

@@ -1,4 +1,5 @@
 import type { Command } from 'commander';
+import { policyValidatorDiagnostic } from '../lib/policy-validator.js';
 import { type FrontmatterResult } from './core-policy-frontmatter.js';
 export type CorePolicyResult = {
     code: number;
@@ -7,7 +8,9 @@ export type CorePolicyResult = {
 };
 export declare function runPolicyAgeReport(args: readonly string[], root: string, env?: NodeJS.ProcessEnv, nowEpoch?: number, platform?: NodeJS.Platform): CorePolicyResult;
 export declare function runPolicyFrontmatter(args: readonly string[], cwd: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): FrontmatterResult;
-export declare function runPolicyRetire(args: readonly string[], root: string, cwd: string, env?: NodeJS.ProcessEnv, now?: Date): CorePolicyResult;
+export declare function runPolicyRetire(args: readonly string[], root: string, cwd: string, env?: NodeJS.ProcessEnv, now?: Date, dependencies?: {
+    validatePolicy?: typeof policyValidatorDiagnostic;
+}): CorePolicyResult;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */
 export declare function runPolicyFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;
 export declare function registerCorePolicyCommand(core: Command): void;

package/dist/commands/core-policy.js

@@ -4,14 +4,15 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { policyValidatorDiagnostic } from '../lib/policy-validator.js';
-import { resolveLiveRoot, resolveBundledAsset } from '../utils/hq-roots.js';
-import { runBundledScript } from '../utils/run-bundled-script.js';
+import { packageRoot, resolveLiveRoot } from '../utils/hq-roots.js';
 import { describeCoreCommand } from './core-command-catalog.js';
 import { runPolicyFrontmatter as runPolicyFrontmatterImpl } from './core-policy-frontmatter.js';
 import { awkCannotOpenFileDiagnostic } from '../lib/core-utils/awk-diagnostics.js';
-const POLICY_AGE_REPORT_ASSET = 'core/scripts/policy-age-report.sh';
-const POLICY_RETIRE_ASSET = 'core/scripts/policy-retire.sh';
-const POLICY_FRONTMATTER_ASSET = 'core/scripts/read-policy-frontmatter.sh';
+const POLICY_AGE_REPORT_SCRIPT = 'core/scripts/policy-age-report.sh';
+const POLICY_RETIRE_SCRIPT = 'core/scripts/policy-retire.sh';
+function formerScriptPath(relativePath) {
+    return path.join(packageRoot(), 'assets/scaffold', relativePath);
+}
 const AGE_HELP = [
     '# hq-core: public',
     '# policy-age-report.sh — measure policy usage and flag retirement candidates',
@@ -389,7 +390,7 @@ function bashTestGreaterOrEqual(left, right, scriptPath, line, platform) {
     return { value: BigInt(left) >= parsed, stderr: '' };
 }
 export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Math.floor(Date.now() / 1000), platform = process.platform) {
-    const parsed = parseAgeOptions(args, resolveBundledAsset(POLICY_AGE_REPORT_ASSET));
+    const parsed = parseAgeOptions(args, formerScriptPath(POLICY_AGE_REPORT_SCRIPT));
     if (parsed.kind === 'help')
         return policyResult(0, AGE_HELP);
     if (parsed.kind === 'error')
@@ -448,13 +449,13 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             const singleIncident = ['user-correction', 'session-learning', 'back-pressure-failure'].includes(source) && (version || '1') === '1';
             const classes = [];
             if (fired === 0) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 173, platform);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, formerScriptPath(POLICY_AGE_REPORT_SCRIPT), 173, platform);
                 stderr += comparison.stderr;
                 if (comparison.value && usage.anyFiles)
                     classes.push('never-fired');
             }
             if (fired > 0) {
-                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 174, platform);
+                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, formerScriptPath(POLICY_AGE_REPORT_SCRIPT), 174, platform);
                 stderr += comparison.stderr;
                 if (comparison.value)
                     classes.push('dormant');
@@ -464,7 +465,7 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             if (refs.renamed.length > 0)
                 classes.push('renamed-refs');
             if (singleIncident) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 178, platform);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, formerScriptPath(POLICY_AGE_REPORT_SCRIPT), 178, platform);
                 stderr += comparison.stderr;
                 if (comparison.value && fired <= 1)
                     classes.push('single-incident-old');
@@ -625,7 +626,7 @@ function rewriteStatus(content, status, reason, by, now) {
     }
     return Buffer.concat(output);
 }
-function setPolicyStatus(filePath, status, reason, by, env, now, cwd = process.cwd()) {
+function setPolicyStatus(filePath, status, reason, by, env, now, cwd = process.cwd(), validatePolicy = policyValidatorDiagnostic) {
     const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
     let content;
     try {
@@ -639,7 +640,7 @@ function setPolicyStatus(filePath, status, reason, by, env, now, cwd = process.c
     if (!firstLine(content)?.toString('latin1').startsWith('---')) {
         return { ok: false, error: `policy-retire: ${filePath} has no frontmatter\n` };
     }
-    const diagnostic = policyValidatorDiagnostic(content.toString('utf8'), resolvedPath, env);
+    const diagnostic = validatePolicy(content.toString('utf8'), resolvedPath, env);
     if (diagnostic !== undefined) {
         // Bash command substitution in policy-retire.sh strips all trailing newlines
         // from the validator output before printf adds its single final newline.
@@ -929,8 +930,8 @@ function fromReport(options, root, cwd, env, now) {
         stdout += `policy-retire: ${selected} would be retired [${options.className}] (add --yes)\n`;
     return policyResult(0, stdout, stderr);
 }
-export function runPolicyRetire(args, root, cwd, env = process.env, now = new Date()) {
-    const parsed = parseRetireOptions(args, resolveBundledAsset(POLICY_RETIRE_ASSET), env);
+export function runPolicyRetire(args, root, cwd, env = process.env, now = new Date(), dependencies = {}) {
+    const parsed = parseRetireOptions(args, formerScriptPath(POLICY_RETIRE_SCRIPT), env);
     if (parsed.kind === 'help')
         return policyResult(0, RETIRE_HELP);
     if (parsed.kind === 'error')
@@ -946,14 +947,14 @@ export function runPolicyRetire(args, root, cwd, env = process.env, now = new Da
     if (file === undefined)
         return policyResult(3, '', `policy-retire: no policy found for '${options.target}'\n`);
     if (options.restore) {
-        const updated = setPolicyStatus(file, 'active', '', options.by, env, now, cwd);
+        const updated = setPolicyStatus(file, 'active', '', options.by, env, now, cwd, dependencies.validatePolicy);
         if (!updated.ok)
             return policyResult(1, '', updated.error);
         return policyResult(0, `policy-retire: restored ${displayPolicyPath(file, root)}\n`);
     }
     if (!options.reason)
         return policyResult(2, '', 'policy-retire: --reason is required\n');
-    const updated = setPolicyStatus(file, 'retired', options.reason, options.by, env, now, cwd);
+    const updated = setPolicyStatus(file, 'retired', options.reason, options.by, env, now, cwd, dependencies.validatePolicy);
     if (!updated.ok)
         return policyResult(1, '', updated.error);
     return policyResult(0, `policy-retire: retired ${displayPolicyPath(file, root)} — ${options.reason}\n`);
@@ -983,7 +984,7 @@ export function runPolicyFast(args, _stdin, cwd, hqRoot, commandName) {
 }
 export function registerCorePolicyCommand(core) {
     const group = core.command('policy').description('Policy maintenance commands');
-    const register = (name, asset, summary, rootKind) => {
+    const register = (name, summary, rootKind) => {
         const command = group
             .command(name)
             .description(summary)
@@ -991,47 +992,24 @@ export function registerCorePolicyCommand(core) {
             .allowExcessArguments()
             .helpOption(false)
             .argument('[args...]', 'arguments passed through to the scaffold command');
-        describeCoreCommand(command, { execution: 'native', asset, root: rootKind });
+        describeCoreCommand(command, { execution: 'native', root: rootKind });
         return command;
     };
-    const ageReport = register('age-report', POLICY_AGE_REPORT_ASSET, 'Report policy usage and retirement candidates', 'live');
+    const ageReport = register('age-report', 'Report policy usage and retirement candidates', 'live');
     ageReport.action(async (args = [], _options, command) => {
         const operands = command.args.length > 0 ? command.args : args;
-        const { coreNativePolicyEnabled } = await import('./core-native-policy-flag.js');
-        if (!await coreNativePolicyEnabled()) {
-            const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
-            const result = runBundledScript({ asset: POLICY_AGE_REPORT_ASSET, args: operands, cwd: process.cwd(), hqRoot: root });
-            if (result.code !== 0)
-                process.exitCode = result.code;
-            return;
-        }
         const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
         writeResult(runPolicyAgeReport(operands, root));
     });
-    const retire = register('retire', POLICY_RETIRE_ASSET, 'Retire or restore a policy', 'live');
+    const retire = register('retire', 'Retire or restore a policy', 'live');
     retire.action(async (args = [], _options, command) => {
         const operands = command.args.length > 0 ? command.args : args;
-        const { coreNativePolicyEnabled } = await import('./core-native-policy-flag.js');
-        if (!await coreNativePolicyEnabled()) {
-            const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
-            const result = runBundledScript({ asset: POLICY_RETIRE_ASSET, args: operands, cwd: process.cwd(), hqRoot: root });
-            if (result.code !== 0)
-                process.exitCode = result.code;
-            return;
-        }
         const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
         writeResult(runPolicyRetire(operands, root, process.cwd()));
     });
-    const frontmatter = register('frontmatter', POLICY_FRONTMATTER_ASSET, 'Extract policy frontmatter', 'cwd');
+    const frontmatter = register('frontmatter', 'Extract policy frontmatter', 'cwd');
     frontmatter.action(async (args = [], _options, command) => {
         const operands = command.args.length > 0 ? command.args : args;
-        const { coreNativePolicyEnabled } = await import('./core-native-policy-flag.js');
-        if (!await coreNativePolicyEnabled()) {
-            const result = runBundledScript({ asset: POLICY_FRONTMATTER_ASSET, args: operands, cwd: process.cwd() });
-            if (result.code !== 0)
-                process.exitCode = result.code;
-            return;
-        }
         writeResult(runPolicyFrontmatter(operands, process.cwd()));
     });
 }

package/dist/commands/core.js

@@ -306,17 +306,12 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/secret-patterns.sh", root: "live", summary: "Secret-pattern library sourced by the delegate rollback shells" },
     // Native knowledge-prefs retains its own shell companion until its family PR.
     { asset: "core/scripts/knowledge-prefs.sh", root: "live", summary: "Rollback companion for native knowledge-prefs" },
-    // Rollback companions for the default-off native knowledge and policy routes.
-    // policy-retire also runs the scaffold validator in-process when native, but
-    // its bundled shell fallback needs both helper assets at these exact paths.
-    { asset: "core/scripts/policy-age-report.sh", root: "live", summary: "Rollback companion for native policy age-report" },
-    { asset: "core/scripts/policy-retire.sh", root: "live", summary: "Rollback companion for native policy retire" },
-    { asset: "core/scripts/read-policy-frontmatter.sh", root: "cwd", summary: "Rollback companion for native policy frontmatter" },
+    // Retained policy helpers used by the policy validator and trigger tooling.
     { asset: "core/scripts/eval-trigger.sh", root: "live", summary: "Trigger grammar helper used by the policy validator companion" },
     { asset: "core/scripts/migrate-policy-triggers.sh", root: "live", summary: "Rollback shell for native migrate-policy-triggers" },
     { asset: "core/scripts/register-project.sh", root: "live", summary: "Rollback shell for native register-project" },
     { asset: "core/scripts/work-mesh-live-rebind.sh", root: "live", summary: "Rollback shell for native work-mesh-live-rebind" },
-    { asset: ".claude/hooks/validate-policy-frontmatter.sh", root: "live", summary: "Policy validator companion used by policy-retire rollback" },
+    { asset: ".claude/hooks/validate-policy-frontmatter.sh", root: "live", summary: "Hook-time policy frontmatter validator" },
     // Wave 2a handoff shells remain bundled as the default-off rollback path.
     { asset: "core/scripts/handoff-finalize.sh", root: "live", summary: "Rollback shell for native handoff finalize" },
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },

package/dist/fast-scaffold.js

@@ -372,11 +372,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-policy.js",
         exportName: "runPolicyFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-policy",
-        asset: "core/scripts/read-policy-frontmatter.sh",
         root: "cwd",
-        shellCwd: "caller",
-        shellHqRoot: "none",
     },
     {
         name: "policy age-report",
@@ -384,11 +380,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-policy.js",
         exportName: "runPolicyFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-policy",
-        asset: "core/scripts/policy-age-report.sh",
         root: "live",
-        shellCwd: "caller",
-        shellHqRoot: "live",
     },
     {
         name: "policy retire",
@@ -396,11 +388,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-policy.js",
         exportName: "runPolicyFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-policy",
-        asset: "core/scripts/policy-retire.sh",
         root: "live",
-        shellCwd: "caller",
-        shellHqRoot: "live",
     },
     {
         name: "knowledge-prefs",