@indigoai-us/hq-cli 5.345.134 → 5.345.136

package/dist/utils/cognito-session.js

@@ -25,13 +25,14 @@ import * as os from "os";
 import * as path from "path";
 import * as yaml from "js-yaml";
 import chalk from "chalk";
-import { loadCachedTokens as loadCachedTokensFromFile, isExpiring, refreshTokens, saveCachedTokens, browserLogin, detectHqCoreVersion, isMachineIdentity, getValidMachineTokens, CognitoRefreshError, accessTokenFingerprint, invalidateCachedTokensByFingerprint, } from "@indigoai-us/hq-cloud";
+import { isExpiring, refreshTokens, saveCachedTokens, browserLogin, detectHqCoreVersion, isMachineIdentity, getValidMachineTokens, CognitoRefreshError, accessTokenFingerprint, invalidateCachedTokensByFingerprint, } from "@indigoai-us/hq-cloud";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 import { daemonDir } from "../lib/mesh/live/daemon/paths.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
 import { acquireLockFileExclusively } from "./exclusive-lock.js";
 import { reportNoninteractivePersonRefreshRejection } from "./cognito-refresh-sentry.js";
-import { pickNewerSession, readKeychainTokens } from "./token-keychain.js";
+import { decodeJwtPayload, loadCachedTokens, personTokenCacheFile, readPersonTokenFile, readTokenFile, } from "./person-token-cache.js";
+export { loadCachedTokens, personTokenCacheFile, readPersonTokenFile };
 // Re-export the cached-session primitives for callers that must deliberately
 // avoid the refresh/login behavior in the higher-level helpers below.
 export { isExpiring, isMachineIdentity };
@@ -294,17 +295,6 @@ function withAlignedMachineCredsEnv(env, fn) {
         }
     }
 }
-/**
- * On-disk person Cognito cache path for `env` (`HQ_STATE_DIR` or `~/.hq`).
- * Deliberately does not use hq-cloud's `loadCachedTokens()`: after a machine
- * mint in this process, that helper returns in-memory machine tokens when the
- * person file is absent, which would falsely block the fresh-box fallback.
- */
-export function personTokenCacheFile(home = os.homedir(), env = process.env) {
-    const override = env.HQ_STATE_DIR?.trim();
-    const stateDir = override && override.length > 0 ? override : path.join(home, ".hq");
-    return path.join(stateDir, "cognito-tokens.json");
-}
 /**
  * True when a usable person Cognito cache file exists under the effective
  * `HQ_STATE_DIR` (or `~/.hq`). Presence alone keeps human commands on the
@@ -396,23 +386,6 @@ export function wantsMachineCognitoTokens(options = {}, env = process.env) {
 export function resolveCognitoTokenSource(env = process.env) {
     return wantsMachineCognitoTokens({}, env) ? "machine" : "person";
 }
-function decodeJwtPayload(token) {
-    if (!token)
-        return null;
-    const parts = token.split(".");
-    if (parts.length < 2 || !parts[1])
-        return null;
-    try {
-        const json = Buffer.from(parts[1], "base64url").toString("utf8");
-        const parsed = JSON.parse(json);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-            return null;
-        return parsed;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Refresh wrote a different Cognito subject than the active cache.
  * Callers must not fall through to browser login or machine mint — that
@@ -460,60 +433,6 @@ export function formatCognitoSubject(tokens) {
     const fromAccess = cognitoSubjectFromToken(tokens.accessToken);
     return `sub=${fromId.sub ?? fromAccess.sub ?? "-"} entityUid=${fromId.entityUid ?? fromAccess.entityUid ?? "-"}`;
 }
-function readTokenFile(file) {
-    try {
-        if (!fs.existsSync(file))
-            return null;
-        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
-        if (typeof raw.accessToken !== "string" || typeof raw.idToken !== "string")
-            return null;
-        return raw;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * The person session from the shared macOS Keychain item (see
- * ./token-keychain.ts), or null. Not read when the token file is missing:
- * no file means signed out. Machine-identity and invalidated tokens are
- * refused, the same as the file loader.
- */
-function personKeychainTokens(file, home, env, keychain = {}) {
-    if (!fs.existsSync(file))
-        return null;
-    const tokens = readKeychainTokens({ env, home, ...keychain });
-    if (!tokens)
-        return null;
-    const claims = decodeJwtPayload(tokens.idToken);
-    const entityType = claims?.["custom:entityType"];
-    if (typeof entityType === "string" && entityType.trim().length > 0)
-        return null;
-    if (fs.existsSync(`${file}.invalid.${accessTokenFingerprint(tokens.accessToken)}`))
-        return null;
-    return tokens;
-}
-/**
- * Person session for `env`: the Keychain item and the token file, the newer
- * by `expiresAt` (see ./token-keychain.ts). Does not consult hq-cloud's
- * in-memory fallback, which can surface a different session when the file
- * is missing or unreadable.
- */
-export function readPersonTokenFile(home = os.homedir(), env = process.env, keychain = {}) {
-    const file = personTokenCacheFile(home, env);
-    return pickNewerSession(personKeychainTokens(file, home, env, keychain), readTokenFile(file));
-}
-/**
- * The person's cached session: the shared Keychain item and hq-cloud's file
- * loader, the newer by `expiresAt`. Writes still go only to the file in this
- * step.
- */
-export function loadCachedTokens(env = process.env, keychain = {}) {
-    const home = os.homedir();
-    const file = personTokenCacheFile(home, env);
-    const fromFile = loadCachedTokensFromFile();
-    return pickNewerSession(personKeychainTokens(file, home, env, keychain), fromFile);
-}
 function restoreTokenFile(file, before) {
     if (before) {
         const dir = path.dirname(file);

package/dist/utils/fsync-directory.d.ts

@@ -0,0 +1,17 @@
+/** Filesystem seam for {@link fsyncDirectory} tests. */
+export interface DirectorySyncIo {
+    openSync: (file: string, flags: number) => number;
+    fsyncSync: (fd: number) => void;
+    closeSync: (fd: number) => void;
+}
+/**
+ * Flush a directory entry (a rename or a new child) to disk.
+ *
+ * Windows has no directory fsync: FlushFileBuffers on a directory handle
+ * fails, and Node reports `EPERM: operation not permitted, fsync`. NTFS
+ * journals the rename itself, so there is nothing to flush and the call is
+ * skipped on win32 (feedback_516e4427). On every other platform a failure
+ * still throws, so a POSIX stage keeps its durability check.
+ */
+export declare function fsyncDirectory(directory: string, platform?: NodeJS.Platform, io?: DirectorySyncIo): void;
+//# sourceMappingURL=fsync-directory.d.ts.map

package/dist/utils/fsync-directory.js

@@ -0,0 +1,27 @@
+import * as fs from "node:fs";
+const defaultIo = {
+    openSync: (file, flags) => fs.openSync(file, flags),
+    fsyncSync: (fd) => fs.fsyncSync(fd),
+    closeSync: (fd) => fs.closeSync(fd),
+};
+/**
+ * Flush a directory entry (a rename or a new child) to disk.
+ *
+ * Windows has no directory fsync: FlushFileBuffers on a directory handle
+ * fails, and Node reports `EPERM: operation not permitted, fsync`. NTFS
+ * journals the rename itself, so there is nothing to flush and the call is
+ * skipped on win32 (feedback_516e4427). On every other platform a failure
+ * still throws, so a POSIX stage keeps its durability check.
+ */
+export function fsyncDirectory(directory, platform = process.platform, io = defaultIo) {
+    if (platform === "win32")
+        return;
+    const fd = io.openSync(directory, fs.constants.O_RDONLY);
+    try {
+        io.fsyncSync(fd);
+    }
+    finally {
+        io.closeSync(fd);
+    }
+}
+//# sourceMappingURL=fsync-directory.js.map

package/dist/utils/person-token-cache.d.ts

@@ -0,0 +1,32 @@
+import { type CognitoTokens } from "@indigoai-us/hq-cloud";
+import { type KeychainReadOptions } from "./token-keychain.js";
+/**
+ * On-disk person Cognito cache path for `env` (`HQ_STATE_DIR` or `~/.hq`).
+ * Deliberately does not use hq-cloud's `loadCachedTokens()`: after a machine
+ * mint in this process, that helper returns in-memory machine tokens when the
+ * person file is absent, which would falsely block the fresh-box fallback.
+ */
+export declare function personTokenCacheFile(home?: string, env?: NodeJS.ProcessEnv): string;
+export declare function decodeJwtPayload(token: string | undefined): Record<string, unknown> | null;
+export declare function readTokenFile(file: string): CognitoTokens | null;
+/**
+ * The person session from the shared macOS Keychain item (see
+ * ./token-keychain.ts), or null. Not read when the token file is missing:
+ * no file means signed out. Machine-identity and invalidated tokens are
+ * refused, the same as the file loader.
+ */
+export declare function personKeychainTokens(file: string, home: string, env: NodeJS.ProcessEnv, keychain?: KeychainReadOptions): CognitoTokens | null;
+/**
+ * Person session for `env`: the Keychain item and the token file, the newer
+ * by `expiresAt` (see ./token-keychain.ts). Does not consult hq-cloud's
+ * in-memory fallback, which can surface a different session when the file
+ * is missing or unreadable.
+ */
+export declare function readPersonTokenFile(home?: string, env?: NodeJS.ProcessEnv, keychain?: KeychainReadOptions): CognitoTokens | null;
+/**
+ * The person's cached session: the shared Keychain item and hq-cloud's file
+ * loader, the newer by `expiresAt`. Writes still go only to the file in this
+ * step.
+ */
+export declare function loadCachedTokens(env?: NodeJS.ProcessEnv, keychain?: KeychainReadOptions): CognitoTokens | null;
+//# sourceMappingURL=person-token-cache.d.ts.map

package/dist/utils/person-token-cache.js

@@ -0,0 +1,95 @@
+/**
+ * The person's cached Cognito session, read from disk and the shared Keychain
+ * item without any network call. Split out of cognito-session.ts so offline
+ * callers (lane start and the handoff commits) can read the cached ID token
+ * without bundling the refresh and login clients. cognito-session.ts
+ * re-exports these readers.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { accessTokenFingerprint, loadCachedTokens as loadCachedTokensFromFile } from "@indigoai-us/hq-cloud";
+import { pickNewerSession, readKeychainTokens } from "./token-keychain.js";
+/**
+ * On-disk person Cognito cache path for `env` (`HQ_STATE_DIR` or `~/.hq`).
+ * Deliberately does not use hq-cloud's `loadCachedTokens()`: after a machine
+ * mint in this process, that helper returns in-memory machine tokens when the
+ * person file is absent, which would falsely block the fresh-box fallback.
+ */
+export function personTokenCacheFile(home = os.homedir(), env = process.env) {
+    const override = env.HQ_STATE_DIR?.trim();
+    const stateDir = override && override.length > 0 ? override : path.join(home, ".hq");
+    return path.join(stateDir, "cognito-tokens.json");
+}
+export function decodeJwtPayload(token) {
+    if (!token)
+        return null;
+    const parts = token.split(".");
+    if (parts.length < 2 || !parts[1])
+        return null;
+    try {
+        const json = Buffer.from(parts[1], "base64url").toString("utf8");
+        const parsed = JSON.parse(json);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function readTokenFile(file) {
+    try {
+        if (!fs.existsSync(file))
+            return null;
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (typeof raw.accessToken !== "string" || typeof raw.idToken !== "string")
+            return null;
+        return raw;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The person session from the shared macOS Keychain item (see
+ * ./token-keychain.ts), or null. Not read when the token file is missing:
+ * no file means signed out. Machine-identity and invalidated tokens are
+ * refused, the same as the file loader.
+ */
+export function personKeychainTokens(file, home, env, keychain = {}) {
+    if (!fs.existsSync(file))
+        return null;
+    const tokens = readKeychainTokens({ env, home, ...keychain });
+    if (!tokens)
+        return null;
+    const claims = decodeJwtPayload(tokens.idToken);
+    const entityType = claims?.["custom:entityType"];
+    if (typeof entityType === "string" && entityType.trim().length > 0)
+        return null;
+    if (fs.existsSync(`${file}.invalid.${accessTokenFingerprint(tokens.accessToken)}`))
+        return null;
+    return tokens;
+}
+/**
+ * Person session for `env`: the Keychain item and the token file, the newer
+ * by `expiresAt` (see ./token-keychain.ts). Does not consult hq-cloud's
+ * in-memory fallback, which can surface a different session when the file
+ * is missing or unreadable.
+ */
+export function readPersonTokenFile(home = os.homedir(), env = process.env, keychain = {}) {
+    const file = personTokenCacheFile(home, env);
+    return pickNewerSession(personKeychainTokens(file, home, env, keychain), readTokenFile(file));
+}
+/**
+ * The person's cached session: the shared Keychain item and hq-cloud's file
+ * loader, the newer by `expiresAt`. Writes still go only to the file in this
+ * step.
+ */
+export function loadCachedTokens(env = process.env, keychain = {}) {
+    const home = os.homedir();
+    const file = personTokenCacheFile(home, env);
+    const fromFile = loadCachedTokensFromFile();
+    return pickNewerSession(personKeychainTokens(file, home, env, keychain), fromFile);
+}
+//# sourceMappingURL=person-token-cache.js.map

package/dist/utils/vault-api.d.ts

@@ -109,7 +109,17 @@ export type CallerIdentity = {
  * {@link resolveCallerPersonUid} does. Use this where the server accepts an
  * agent principal; use `resolveCallerPersonUid` where only a person can act.
  */
-export declare function resolveCallerUid(token: string, baseUrl?: string): Promise<CallerIdentity>;
+export declare function resolveCallerUid(token: string, baseUrl?: string, opts?: {
+    signal?: AbortSignal;
+}): Promise<CallerIdentity>;
+/**
+ * Thrown when the person lookup succeeds but the caller has no person entity.
+ * This is a definitive answer, unlike a network or HTTP failure, so callers
+ * that cache lookups may remember it.
+ */
+export declare class NoPersonEntityError extends Error {
+    constructor();
+}
 /** Thrown when a person-only command runs under an agent machine identity. */
 export declare function agentIdentityUnsupportedError(agentUid: string, command?: string): Error;
 /**
@@ -120,6 +130,16 @@ export declare function agentIdentityUnsupportedError(agentUid: string, command?
 export declare function resolveCallerPersonUid(token: string, baseUrl?: string, opts?: {
     command?: string;
 }): Promise<string>;
+/**
+ * A signal that aborts when any input signal aborts, with that signal's
+ * reason. It stands in for `AbortSignal.any`, which Node only added in 20.3,
+ * so the CLI keeps working on Node 20.0. Call `dispose` once the guarded work
+ * settles to remove the listeners from the inputs.
+ */
+export declare function anySignal(signals: AbortSignal[]): {
+    signal: AbortSignal;
+    dispose: () => void;
+};
 export declare function getEntityUid(token: string, opts: {
     personal?: boolean;
     companySlug?: string;

package/dist/utils/vault-api.js

@@ -735,11 +735,22 @@ export function agentUidFromToken(token) {
  * {@link resolveCallerPersonUid} does. Use this where the server accepts an
  * agent principal; use `resolveCallerPersonUid` where only a person can act.
  */
-export async function resolveCallerUid(token, baseUrl) {
+export async function resolveCallerUid(token, baseUrl, opts = {}) {
     const agentUid = agentUidFromToken(token);
     if (agentUid)
         return { kind: 'agent', uid: agentUid };
-    return { kind: 'person', uid: await lookupCallerPersonUid(token, baseUrl) };
+    return { kind: 'person', uid: await lookupCallerPersonUid(token, baseUrl, opts.signal) };
+}
+/**
+ * Thrown when the person lookup succeeds but the caller has no person entity.
+ * This is a definitive answer, unlike a network or HTTP failure, so callers
+ * that cache lookups may remember it.
+ */
+export class NoPersonEntityError extends Error {
+    constructor() {
+        super('No person entity found for the caller. Sign in to HQ once to provision one.');
+        this.name = 'NoPersonEntityError';
+    }
 }
 /** Thrown when a person-only command runs under an agent machine identity. */
 export function agentIdentityUnsupportedError(agentUid, command) {
@@ -758,14 +769,52 @@ export async function resolveCallerPersonUid(token, baseUrl, opts = {}) {
         throw agentIdentityUnsupportedError(agentUid, opts.command);
     return lookupCallerPersonUid(token, baseUrl);
 }
+/**
+ * A signal that aborts when any input signal aborts, with that signal's
+ * reason. It stands in for `AbortSignal.any`, which Node only added in 20.3,
+ * so the CLI keeps working on Node 20.0. Call `dispose` once the guarded work
+ * settles to remove the listeners from the inputs.
+ */
+export function anySignal(signals) {
+    const controller = new AbortController();
+    const listeners = [];
+    const dispose = () => {
+        for (const [input, listener] of listeners.splice(0))
+            input.removeEventListener('abort', listener);
+    };
+    for (const input of signals) {
+        if (input.aborted) {
+            dispose();
+            controller.abort(input.reason);
+            break;
+        }
+        const listener = () => {
+            dispose();
+            controller.abort(input.reason);
+        };
+        input.addEventListener('abort', listener, { once: true });
+        listeners.push([input, listener]);
+    }
+    return { signal: controller.signal, dispose };
+}
 // Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
 // createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
-async function lookupCallerPersonUid(token, baseUrl) {
+async function lookupCallerPersonUid(token, baseUrl, signal) {
+    const timeout = AbortSignal.timeout(identityLookupTimeoutMs());
+    const combined = signal ? anySignal([timeout, signal]) : { signal: timeout, dispose: () => { } };
+    try {
+        return await lookupCallerPersonUidWith(token, baseUrl, combined.signal);
+    }
+    finally {
+        combined.dispose();
+    }
+}
+async function lookupCallerPersonUidWith(token, baseUrl, signal) {
     const res = await vaultApiFetch({
         token,
         path: '/entity/by-type/person',
         baseUrl,
-        signal: AbortSignal.timeout(identityLookupTimeoutMs()),
+        signal,
     });
     if (!res.ok) {
         if (isUnavailableSecretLoadHttpStatus(res.status)) {
@@ -776,7 +825,7 @@ async function lookupCallerPersonUid(token, baseUrl) {
     const data = (await res.json());
     const persons = (data.entities ?? []).filter((e) => e.type === 'person');
     if (persons.length === 0) {
-        throw new Error('No person entity found for the caller. Sign in to HQ once to provision one.');
+        throw new NoPersonEntityError();
     }
     persons.sort((a, b) => {
         const ac = a.createdAt ?? '';

package/dist/utils/windows-hide-default.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Default `windowsHide: true` for child processes of a background hq on Windows.
+ *
+ * A console program (node, bash, git, cygpath, claude --version) started from
+ * a process that has no console of its own gets a new, visible console
+ * window. The HQ desktop app, the sync runner and hooks start hq with piped
+ * stdio and no console, so every child hq spawned flashed a window on screen,
+ * every minute or two, all day (feedback_351a40d5). Node only hides it when a
+ * call passes `windowsHide: true`, and hq-cli has a few hundred spawn sites.
+ *
+ * When this process is on Windows and none of its standard streams is a
+ * terminal, every child_process call that does not choose `windowsHide`
+ * itself gets `windowsHide: true`. An interactive hq (any standard stream is
+ * a TTY) is left alone, so a child that shares the user's console still does.
+ */
+type ChildProcessModule = typeof import("node:child_process");
+/** child_process entry points whose options object accepts `windowsHide`. */
+export declare const WINDOWS_HIDE_FUNCTIONS: readonly ["spawn", "spawnSync", "execFile", "execFileSync", "exec", "execSync", "fork"];
+export type WindowsHideFunction = (typeof WINDOWS_HIDE_FUNCTIONS)[number];
+/**
+ * Return `args` with `windowsHide: true` in the options object of a
+ * child_process call, unless the caller set `windowsHide` either way. The
+ * input array and the caller's options object are not mutated.
+ */
+export declare function applyWindowsHideDefault(fn: WindowsHideFunction, args: readonly unknown[]): unknown[];
+/** True when none of stdin, stdout and stderr is a terminal. */
+export declare function isBackgroundProcess(isTty?: (fd: number) => boolean): boolean;
+export interface InstallWindowsHideDefaultOptions {
+    platform?: NodeJS.Platform;
+    background?: boolean;
+    /** child_process module to patch (tests pass a stand-in). */
+    childProcess?: ChildProcessModule;
+    /** Called after patching so ESM named imports see the wrapped functions. */
+    syncExports?: () => void;
+}
+/**
+ * Patch node:child_process once for this process. Returns true when the
+ * default is (now or already) in force.
+ */
+export declare function installWindowsHideDefault(options?: InstallWindowsHideDefaultOptions): boolean;
+export {};
+//# sourceMappingURL=windows-hide-default.d.ts.map

package/dist/utils/windows-hide-default.js

@@ -0,0 +1,98 @@
+/**
+ * Default `windowsHide: true` for child processes of a background hq on Windows.
+ *
+ * A console program (node, bash, git, cygpath, claude --version) started from
+ * a process that has no console of its own gets a new, visible console
+ * window. The HQ desktop app, the sync runner and hooks start hq with piped
+ * stdio and no console, so every child hq spawned flashed a window on screen,
+ * every minute or two, all day (feedback_351a40d5). Node only hides it when a
+ * call passes `windowsHide: true`, and hq-cli has a few hundred spawn sites.
+ *
+ * When this process is on Windows and none of its standard streams is a
+ * terminal, every child_process call that does not choose `windowsHide`
+ * itself gets `windowsHide: true`. An interactive hq (any standard stream is
+ * a TTY) is left alone, so a child that shares the user's console still does.
+ */
+// Only node:module is imported at load time (index.ts already loads it). This
+// module is imported on every hq start, including the hook-time fast routes,
+// so node:tty and node:util are loaded lazily and only on Windows.
+import { createRequire, syncBuiltinESMExports } from "node:module";
+/** child_process entry points whose options object accepts `windowsHide`. */
+export const WINDOWS_HIDE_FUNCTIONS = ["spawn", "spawnSync", "execFile", "execFileSync", "exec", "execSync", "fork"];
+const INSTALLED = Symbol.for("hq.windowsHideDefault.installed");
+/** Same symbol as util.promisify.custom (a registered symbol). */
+const PROMISIFY_CUSTOM = Symbol.for("nodejs.util.promisify.custom");
+const requireBuiltin = createRequire(import.meta.url);
+function defaultIsatty(fd) {
+    return requireBuiltin("node:tty").isatty(fd);
+}
+function isOptionsObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Return `args` with `windowsHide: true` in the options object of a
+ * child_process call, unless the caller set `windowsHide` either way. The
+ * input array and the caller's options object are not mutated.
+ */
+export function applyWindowsHideDefault(fn, args) {
+    const out = [...args];
+    let index;
+    if (fn === "exec" || fn === "execSync") {
+        index = 1;
+    }
+    else {
+        // (file, args?, options?, callback?): the args array is optional and may
+        // be passed as undefined/null ahead of an options object.
+        index = Array.isArray(out[1]) || (out[1] == null && out.length > 2) ? 2 : 1;
+    }
+    const current = out[index];
+    if (isOptionsObject(current)) {
+        if ("windowsHide" in current)
+            return out;
+        out[index] = { ...current, windowsHide: true };
+    }
+    else if (current == null) {
+        out[index] = { windowsHide: true };
+    }
+    else if (typeof current === "function") {
+        out.splice(index, 0, { windowsHide: true });
+    }
+    return out;
+}
+/** True when none of stdin, stdout and stderr is a terminal. */
+export function isBackgroundProcess(isTty = defaultIsatty) {
+    return !isTty(0) && !isTty(1) && !isTty(2);
+}
+/**
+ * Patch node:child_process once for this process. Returns true when the
+ * default is (now or already) in force.
+ */
+export function installWindowsHideDefault(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "win32")
+        return false;
+    if (!(options.background ?? isBackgroundProcess()))
+        return false;
+    const childProcess = options.childProcess ?? requireBuiltin("node:child_process");
+    const target = childProcess;
+    if (target[INSTALLED])
+        return true;
+    for (const name of WINDOWS_HIDE_FUNCTIONS) {
+        const original = target[name];
+        if (typeof original !== "function")
+            continue;
+        const originalFn = original;
+        const wrapped = function (...args) {
+            return originalFn.apply(this, applyWindowsHideDefault(name, args));
+        };
+        const custom = originalFn[PROMISIFY_CUSTOM];
+        if (typeof custom === "function") {
+            wrapped[PROMISIFY_CUSTOM] = (...args) => custom(...applyWindowsHideDefault(name, args));
+        }
+        target[name] = wrapped;
+    }
+    target[INSTALLED] = true;
+    (options.syncExports ?? syncBuiltinESMExports)();
+    return true;
+}
+//# sourceMappingURL=windows-hide-default.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.134",
+  "version": "5.345.136",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.71",
+    "@indigoai-us/hq-cloud": "~6.18.76",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",