@indigoai-us/hq-cli 5.345.135 → 5.345.137

package/dist/lib/lanes/monitor.js

@@ -354,12 +354,24 @@ const WATCH_RUNTIME_EXECUTABLES = ["bun", "deno", "node", "nodejs", "ts-node", "
 // on the raw line, then validate whatever precedes it as an hq invocation.
 // A path form (absolute or ./, ../) is required so an unrelated leading
 // command such as "vim /tmp/hq" is not absorbed into the path.
+//
+// Package managers that install the bin through a shell shim (pnpm, some
+// volta/yarn setups) exec the runtime with the package entrypoint instead of
+// the hq symlink, so the ps line reads
+// "node .../node_modules/@indigoai-us/hq-cli/dist/index.js lanes watch ...".
+// Accept that entrypoint path as an hq executable too.
+const HQ_CLI_ENTRYPOINT_SUFFIX = "/hq-cli/dist/index.js";
 function isHqExecutablePath(candidate) {
     if (candidate === "hq")
         return true;
-    if (!/^\.{0,2}\//u.test(candidate) || path.basename(candidate) !== "hq") {
+    if (!/^\.{0,2}\//u.test(candidate))
+        return false;
+    const isHqBin = path.basename(candidate) === "hq";
+    const isHqEntrypoint = candidate
+        .replace(/\\/gu, "/")
+        .endsWith(HQ_CLI_ENTRYPOINT_SUFFIX);
+    if (!isHqBin && !isHqEntrypoint)
         return false;
-    }
     return !candidate.split(" ").some((piece) => piece.startsWith("-"));
 }
 function isHqInvocationPrefix(prefix) {

package/dist/lib/mesh/live/daemon/install.d.ts

@@ -121,6 +121,18 @@ export declare function detectPlatform(platform?: NodeJS.Platform): DaemonInstal
  * binary when both exist.
  */
 export declare function preferStableHqBinary(entry: string, platform?: DaemonInstallPlatform, existsSync?: typeof fs.existsSync): string;
+/**
+ * A path that `node <path>` can run. preferStableHqBinary maps the package
+ * entry to the npm `hq.cmd` shim on Windows, which is right for a task that
+ * launches through cmd.exe but wrong for every caller that runs
+ * `node <hqBinary>`: node parses the batch file as JavaScript and exits with
+ * "SyntaxError: Invalid or unexpected token" on `@ECHO off`
+ * (feedback_a60339e8, feedback_516e4427). Map the shim back to the package's
+ * JS entry, which sits beside it in the same npm prefix and so stays valid
+ * across `npm i -g` updates. Anything that is not a Windows command shim is
+ * returned unchanged.
+ */
+export declare function nodeRunnableHqEntry(hqBinary: string, platform?: DaemonInstallPlatform | NodeJS.Platform, existsSync?: typeof fs.existsSync): string;
 /**
  * Absolute path of the CLI entry that is executing this process.
  * realpath of argv[1] only — never a PATH lookup of `hq`.

package/dist/lib/mesh/live/daemon/install.js

@@ -299,6 +299,28 @@ export function preferStableHqBinary(entry, platform = detectPlatform(), existsS
     }
     return entry;
 }
+/** JS entry of the hq-cli package, relative to an npm global prefix. */
+const HQ_CLI_PACKAGE_ENTRY = ["node_modules", "@indigoai-us", "hq-cli", "dist", "index.js"];
+/**
+ * A path that `node <path>` can run. preferStableHqBinary maps the package
+ * entry to the npm `hq.cmd` shim on Windows, which is right for a task that
+ * launches through cmd.exe but wrong for every caller that runs
+ * `node <hqBinary>`: node parses the batch file as JavaScript and exits with
+ * "SyntaxError: Invalid or unexpected token" on `@ECHO off`
+ * (feedback_a60339e8, feedback_516e4427). Map the shim back to the package's
+ * JS entry, which sits beside it in the same npm prefix and so stays valid
+ * across `npm i -g` updates. Anything that is not a Windows command shim is
+ * returned unchanged.
+ */
+export function nodeRunnableHqEntry(hqBinary, platform = detectPlatform(), existsSync = fs.existsSync) {
+    if (platform !== "win32")
+        return hqBinary;
+    const ext = path.win32.extname(hqBinary).toLowerCase();
+    if (ext !== ".cmd" && ext !== ".bat" && ext !== ".ps1")
+        return hqBinary;
+    const entry = path.win32.join(path.win32.dirname(hqBinary), ...HQ_CLI_PACKAGE_ENTRY);
+    return existsSync(entry) ? entry : hqBinary;
+}
 /**
  * Absolute path of the CLI entry that is executing this process.
  * realpath of argv[1] only — never a PATH lookup of `hq`.

package/dist/lib/mesh/live/flush.js

@@ -22,7 +22,7 @@ import { defaultSleep, FLUSH_MAX_ATTEMPTS, fullJitterDelayMs, } from "./backoff.
 import { LOCAL_ONLY_FIELDS, stripLocalOnlyFields } from "./format-spool-line.js";
 import { enrichSessionEndEvent } from "./report-summary.js";
 import { createWorkLocationResolver, withWorkLocation, } from "./work-location.js";
-import { SESSION_EVENTS_BATCH_MAX, WRITABLE_CONTEXT_STATUSES, parseSessionEventsBatchAck, } from "./session-events-client.js";
+import { SESSION_EVENTS_BATCH_MAX, WRITABLE_CONTEXT_STATUSES, isSessionOwnerMismatch, parseSessionEventsBatchAck, SESSION_OWNER_MISMATCH, } from "./session-events-client.js";
 import { appendDeadLetterLine, appendDroppedReceipt, appendHeldLinesIfAbsent, appendSpoolLine, claimHeld, claimSpool, countDistinctHeldEvents, countJsonlLines, recoverOrphanClaims, removeClaimFile, } from "./spool.js";
 import { workMeshHeldPath, workMeshRoot } from "./paths.js";
 /** Bound a replayed session backlog so one flush cannot burst hundreds of events. */
@@ -306,7 +306,7 @@ export async function flushSessionEvents(inputDeps) {
                     v: 1,
                     sessionId,
                     dropped: remainingItems.length,
-                    reason: "untracked",
+                    reason: decision.reason,
                     at: now().toISOString(),
                 }, deps.workMeshRoot);
                 summary.dropped += remainingItems.length;
@@ -353,6 +353,22 @@ export async function flushSessionEvents(inputDeps) {
                     accountBatchSuccess(result.body, originalChunk, deps.workMeshRoot, now, summary, markDisposed);
                     continue;
                 }
+                if (!result.retryable && isSessionOwnerMismatch(result.status, result.body)) {
+                    // Another actor already reports this session (feedback_5b4683c2).
+                    // Not an error on this machine: drop the session's remaining events
+                    // with a receipt, remember the answer, and skip it from now on.
+                    const unsent = remainingItems.filter((item) => pendingRestore.has(item.event));
+                    dropOwnerMismatchedSession({
+                        sessionId,
+                        companyUid: decision.companyUid,
+                        items: unsent,
+                        deps,
+                        now,
+                        summary,
+                        markDisposed,
+                    });
+                    continue sessionLoop;
+                }
                 if (!result.retryable && result.status === 404) {
                     const rejectedProjectId = decision.projectId;
                     updateSessionState(sessionId, deps.workContextRoot, (current) => {
@@ -560,15 +576,34 @@ function accountBatchSuccess(body, originalChunk, meshRoot, now, summary, markDi
     }
     const rejectedIds = new Set();
     const at = now().toISOString();
+    let ownerMismatchDropped = 0;
     for (const row of ack.rejected) {
         const item = byId.get(row.eventId);
         if (!item)
             continue;
+        if (row.code === SESSION_OWNER_MISMATCH) {
+            ownerMismatchDropped += 1;
+            summary.dropped += 1;
+            rejectedIds.add(row.eventId);
+            markDisposed(item.event);
+            continue;
+        }
         appendDeadLetterLine(deadLetterEnvelope(item.event, row.code, row.code, at, row.code), meshRoot);
         summary.deadLettered += 1;
         rejectedIds.add(row.eventId);
         markDisposed(item.event);
     }
+    if (ownerMismatchDropped > 0) {
+        const sessionId = sessionIdOf(originalChunk[0].event);
+        appendDroppedReceipt({
+            v: 1,
+            sessionId,
+            dropped: ownerMismatchDropped,
+            reason: "owner_mismatch",
+            code: SESSION_OWNER_MISMATCH,
+            at,
+        }, meshRoot);
+    }
     const remaining = originalChunk.filter((item) => {
         const id = eventIdOf(item.event);
         return !id || !rejectedIds.has(id);
@@ -767,6 +802,26 @@ async function postPresenceLeaveIfNeeded(input) {
     });
     if (!result.ok) {
         const at = input.now().toISOString();
+        if (!result.retryable && isSessionOwnerMismatch(result.status, result.body)) {
+            // The old company says another actor owns this session, so there is no
+            // presence of ours to leave. Drop the leave events, clear the pending
+            // leave, and let the remaining events continue to the new binding.
+            dropOwnerMismatchedSession({
+                sessionId: input.sessionId,
+                companyUid: leave.companyUid,
+                items: leaveItems,
+                deps: input.deps,
+                now: input.now,
+                summary: input.summary,
+                markDisposed: input.markDisposed,
+                clearPresenceLeave: true,
+            });
+            return {
+                state: readSessionState(input.sessionId, input.deps.workContextRoot) ?? input.state,
+                items: remaining,
+                abort: false,
+            };
+        }
         if (!result.retryable) {
             for (const item of input.items) {
                 appendDeadLetterLine(deadLetterEnvelope(item.event, `HTTP_${result.status}`, result.status, at), input.deps.workMeshRoot);
@@ -843,12 +898,60 @@ function rebindUnboundSession(sessionId, items, state, deps, nowMs) {
     }
     return readSessionState(sessionId, deps.workContextRoot) ?? state;
 }
+const loggedOwnerMismatch = new Set();
+/**
+ * Drop a session's events after the server answered 403
+ * SESSION_OWNER_MISMATCH: write one dropped receipt, mark the session state so
+ * later flushes skip it without posting, and log once per session. These
+ * events never reach dead-letter, so daemon health stays clean.
+ */
+function dropOwnerMismatchedSession(input) {
+    const at = input.now().toISOString();
+    if (input.items.length > 0) {
+        appendDroppedReceipt({
+            v: 1,
+            sessionId: input.sessionId,
+            dropped: input.items.length,
+            reason: "owner_mismatch",
+            code: SESSION_OWNER_MISMATCH,
+            companyUid: input.companyUid,
+            at,
+        }, input.deps.workMeshRoot);
+    }
+    input.summary.dropped += input.items.length;
+    for (const item of input.items)
+        input.markDisposed(item.event);
+    updateSessionState(input.sessionId, input.deps.workContextRoot, (current) => {
+        if (!current)
+            return current;
+        if (input.clearPresenceLeave) {
+            const { presenceLeave: _leave, ...rest } = current;
+            return { ...rest, updatedAt: at };
+        }
+        return {
+            ...current,
+            ownerMismatch: { companyUid: input.companyUid, at },
+            updatedAt: at,
+        };
+    });
+    const key = `${input.deps.workContextRoot}\0${input.sessionId}`;
+    if (!loggedOwnerMismatch.has(key)) {
+        loggedOwnerMismatch.add(key);
+        input.deps.log?.(`work-mesh: session ${input.sessionId} is reported by another actor (403 SESSION_OWNER_MISMATCH); dropped ${input.items.length} event(s), not dead-lettered`);
+    }
+}
 function classifySession(state) {
     if (!state) {
         return { action: "hold", heldReason: "STATE_ABSENT" };
     }
     if (state.contextStatus === "untracked") {
-        return { action: "drop" };
+        return { action: "drop", reason: "untracked" };
+    }
+    // The server already told us another actor owns this session in this
+    // company; posting again would only earn another 403.
+    if (state.ownerMismatch?.companyUid &&
+        state.companyUid === state.ownerMismatch.companyUid) {
+        return { action: "drop", reason: "owner_mismatch" };
     }
     if (state.contextStatus === "needs_company") {
         return { action: "hold", heldReason: "NEEDS_COMPANY" };

package/dist/lib/mesh/live/session-events-client.d.ts

@@ -41,6 +41,15 @@ export interface SessionEventsBatchAck {
  */
 export declare function parseSessionEventsBatchAck(body: unknown): SessionEventsBatchAck | null;
 export type SessionEventsPoster = (body: SessionEventsBatchBody) => Promise<SessionEventsPostResult>;
+/**
+ * Server code for a session that another actor in the same company already
+ * reports (for example a local bot's own headless turn, picked up by the
+ * person's daemon). The server will never accept this actor's events for that
+ * session, so the flush drops them with a receipt instead of dead-lettering.
+ */
+export declare const SESSION_OWNER_MISMATCH = "SESSION_OWNER_MISMATCH";
+/** True for the 403 SESSION_OWNER_MISMATCH answer (feedback_5b4683c2). */
+export declare function isSessionOwnerMismatch(status: number, body: unknown): boolean;
 export declare function classifySessionEventsResponse(status: number, networkError?: boolean): Pick<SessionEventsPostResult, "ok" | "retryable" | "networkError">;
 /**
  * Build a poster that uses vaultApiFetch + Cognito token.

package/dist/lib/mesh/live/session-events-client.js

@@ -65,6 +65,21 @@ export function parseSessionEventsBatchAck(body) {
     }
     return { accepted, duplicates, rejected };
 }
+/**
+ * Server code for a session that another actor in the same company already
+ * reports (for example a local bot's own headless turn, picked up by the
+ * person's daemon). The server will never accept this actor's events for that
+ * session, so the flush drops them with a receipt instead of dead-lettering.
+ */
+export const SESSION_OWNER_MISMATCH = "SESSION_OWNER_MISMATCH";
+/** True for the 403 SESSION_OWNER_MISMATCH answer (feedback_5b4683c2). */
+export function isSessionOwnerMismatch(status, body) {
+    if (status !== 403)
+        return false;
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return false;
+    return body.code === SESSION_OWNER_MISMATCH;
+}
 export function classifySessionEventsResponse(status, networkError = false) {
     if (networkError || status === 0) {
         return { ok: false, retryable: true, networkError: true };

package/dist/lib/work-context/state.d.ts

@@ -117,6 +117,16 @@ export interface SessionStateFile {
         taskId?: string;
         bindingEpisodeId?: string;
     };
+    /**
+     * LOCAL-ONLY. Set when the server answered 403 SESSION_OWNER_MISMATCH for
+     * this session in `companyUid`: another actor already reports it (a local
+     * bot's own turn, a checkpoint helper). While the session stays bound to
+     * that company, flush drops its events locally instead of posting them.
+     */
+    ownerMismatch?: {
+        companyUid: string;
+        at: string;
+    };
     updatedAt: string;
 }
 /**

package/dist/lib/work-context/state.js

@@ -215,6 +215,8 @@ function projectSessionState(state) {
         out.projectHint = state.projectHint;
     if (state.presenceLeave?.companyUid)
         out.presenceLeave = state.presenceLeave;
+    if (state.ownerMismatch?.companyUid)
+        out.ownerMismatch = state.ownerMismatch;
     return out;
 }
 /**
@@ -282,6 +284,9 @@ export function mergeLocalSessionFields(next, prior, options = {}) {
     if (!out.presenceLeave && prior.presenceLeave) {
         out.presenceLeave = prior.presenceLeave;
     }
+    if (!out.ownerMismatch && prior.ownerMismatch) {
+        out.ownerMismatch = prior.ownerMismatch;
+    }
     if (out.projectId)
         out.projectHint = undefined;
     const sameBinding = prior.companyUid === out.companyUid &&

package/dist/utils/fsync-directory.d.ts

@@ -0,0 +1,17 @@
+/** Filesystem seam for {@link fsyncDirectory} tests. */
+export interface DirectorySyncIo {
+    openSync: (file: string, flags: number) => number;
+    fsyncSync: (fd: number) => void;
+    closeSync: (fd: number) => void;
+}
+/**
+ * Flush a directory entry (a rename or a new child) to disk.
+ *
+ * Windows has no directory fsync: FlushFileBuffers on a directory handle
+ * fails, and Node reports `EPERM: operation not permitted, fsync`. NTFS
+ * journals the rename itself, so there is nothing to flush and the call is
+ * skipped on win32 (feedback_516e4427). On every other platform a failure
+ * still throws, so a POSIX stage keeps its durability check.
+ */
+export declare function fsyncDirectory(directory: string, platform?: NodeJS.Platform, io?: DirectorySyncIo): void;
+//# sourceMappingURL=fsync-directory.d.ts.map

package/dist/utils/fsync-directory.js

@@ -0,0 +1,27 @@
+import * as fs from "node:fs";
+const defaultIo = {
+    openSync: (file, flags) => fs.openSync(file, flags),
+    fsyncSync: (fd) => fs.fsyncSync(fd),
+    closeSync: (fd) => fs.closeSync(fd),
+};
+/**
+ * Flush a directory entry (a rename or a new child) to disk.
+ *
+ * Windows has no directory fsync: FlushFileBuffers on a directory handle
+ * fails, and Node reports `EPERM: operation not permitted, fsync`. NTFS
+ * journals the rename itself, so there is nothing to flush and the call is
+ * skipped on win32 (feedback_516e4427). On every other platform a failure
+ * still throws, so a POSIX stage keeps its durability check.
+ */
+export function fsyncDirectory(directory, platform = process.platform, io = defaultIo) {
+    if (platform === "win32")
+        return;
+    const fd = io.openSync(directory, fs.constants.O_RDONLY);
+    try {
+        io.fsyncSync(fd);
+    }
+    finally {
+        io.closeSync(fd);
+    }
+}
+//# sourceMappingURL=fsync-directory.js.map

package/dist/utils/windows-hide-default.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Default `windowsHide: true` for child processes of a background hq on Windows.
+ *
+ * A console program (node, bash, git, cygpath, claude --version) started from
+ * a process that has no console of its own gets a new, visible console
+ * window. The HQ desktop app, the sync runner and hooks start hq with piped
+ * stdio and no console, so every child hq spawned flashed a window on screen,
+ * every minute or two, all day (feedback_351a40d5). Node only hides it when a
+ * call passes `windowsHide: true`, and hq-cli has a few hundred spawn sites.
+ *
+ * When this process is on Windows and none of its standard streams is a
+ * terminal, every child_process call that does not choose `windowsHide`
+ * itself gets `windowsHide: true`. An interactive hq (any standard stream is
+ * a TTY) is left alone, so a child that shares the user's console still does.
+ */
+type ChildProcessModule = typeof import("node:child_process");
+/** child_process entry points whose options object accepts `windowsHide`. */
+export declare const WINDOWS_HIDE_FUNCTIONS: readonly ["spawn", "spawnSync", "execFile", "execFileSync", "exec", "execSync", "fork"];
+export type WindowsHideFunction = (typeof WINDOWS_HIDE_FUNCTIONS)[number];
+/**
+ * Return `args` with `windowsHide: true` in the options object of a
+ * child_process call, unless the caller set `windowsHide` either way. The
+ * input array and the caller's options object are not mutated.
+ */
+export declare function applyWindowsHideDefault(fn: WindowsHideFunction, args: readonly unknown[]): unknown[];
+/** True when none of stdin, stdout and stderr is a terminal. */
+export declare function isBackgroundProcess(isTty?: (fd: number) => boolean): boolean;
+export interface InstallWindowsHideDefaultOptions {
+    platform?: NodeJS.Platform;
+    background?: boolean;
+    /** child_process module to patch (tests pass a stand-in). */
+    childProcess?: ChildProcessModule;
+    /** Called after patching so ESM named imports see the wrapped functions. */
+    syncExports?: () => void;
+}
+/**
+ * Patch node:child_process once for this process. Returns true when the
+ * default is (now or already) in force.
+ */
+export declare function installWindowsHideDefault(options?: InstallWindowsHideDefaultOptions): boolean;
+export {};
+//# sourceMappingURL=windows-hide-default.d.ts.map

package/dist/utils/windows-hide-default.js

@@ -0,0 +1,98 @@
+/**
+ * Default `windowsHide: true` for child processes of a background hq on Windows.
+ *
+ * A console program (node, bash, git, cygpath, claude --version) started from
+ * a process that has no console of its own gets a new, visible console
+ * window. The HQ desktop app, the sync runner and hooks start hq with piped
+ * stdio and no console, so every child hq spawned flashed a window on screen,
+ * every minute or two, all day (feedback_351a40d5). Node only hides it when a
+ * call passes `windowsHide: true`, and hq-cli has a few hundred spawn sites.
+ *
+ * When this process is on Windows and none of its standard streams is a
+ * terminal, every child_process call that does not choose `windowsHide`
+ * itself gets `windowsHide: true`. An interactive hq (any standard stream is
+ * a TTY) is left alone, so a child that shares the user's console still does.
+ */
+// Only node:module is imported at load time (index.ts already loads it). This
+// module is imported on every hq start, including the hook-time fast routes,
+// so node:tty and node:util are loaded lazily and only on Windows.
+import { createRequire, syncBuiltinESMExports } from "node:module";
+/** child_process entry points whose options object accepts `windowsHide`. */
+export const WINDOWS_HIDE_FUNCTIONS = ["spawn", "spawnSync", "execFile", "execFileSync", "exec", "execSync", "fork"];
+const INSTALLED = Symbol.for("hq.windowsHideDefault.installed");
+/** Same symbol as util.promisify.custom (a registered symbol). */
+const PROMISIFY_CUSTOM = Symbol.for("nodejs.util.promisify.custom");
+const requireBuiltin = createRequire(import.meta.url);
+function defaultIsatty(fd) {
+    return requireBuiltin("node:tty").isatty(fd);
+}
+function isOptionsObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Return `args` with `windowsHide: true` in the options object of a
+ * child_process call, unless the caller set `windowsHide` either way. The
+ * input array and the caller's options object are not mutated.
+ */
+export function applyWindowsHideDefault(fn, args) {
+    const out = [...args];
+    let index;
+    if (fn === "exec" || fn === "execSync") {
+        index = 1;
+    }
+    else {
+        // (file, args?, options?, callback?): the args array is optional and may
+        // be passed as undefined/null ahead of an options object.
+        index = Array.isArray(out[1]) || (out[1] == null && out.length > 2) ? 2 : 1;
+    }
+    const current = out[index];
+    if (isOptionsObject(current)) {
+        if ("windowsHide" in current)
+            return out;
+        out[index] = { ...current, windowsHide: true };
+    }
+    else if (current == null) {
+        out[index] = { windowsHide: true };
+    }
+    else if (typeof current === "function") {
+        out.splice(index, 0, { windowsHide: true });
+    }
+    return out;
+}
+/** True when none of stdin, stdout and stderr is a terminal. */
+export function isBackgroundProcess(isTty = defaultIsatty) {
+    return !isTty(0) && !isTty(1) && !isTty(2);
+}
+/**
+ * Patch node:child_process once for this process. Returns true when the
+ * default is (now or already) in force.
+ */
+export function installWindowsHideDefault(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "win32")
+        return false;
+    if (!(options.background ?? isBackgroundProcess()))
+        return false;
+    const childProcess = options.childProcess ?? requireBuiltin("node:child_process");
+    const target = childProcess;
+    if (target[INSTALLED])
+        return true;
+    for (const name of WINDOWS_HIDE_FUNCTIONS) {
+        const original = target[name];
+        if (typeof original !== "function")
+            continue;
+        const originalFn = original;
+        const wrapped = function (...args) {
+            return originalFn.apply(this, applyWindowsHideDefault(name, args));
+        };
+        const custom = originalFn[PROMISIFY_CUSTOM];
+        if (typeof custom === "function") {
+            wrapped[PROMISIFY_CUSTOM] = (...args) => custom(...applyWindowsHideDefault(name, args));
+        }
+        target[name] = wrapped;
+    }
+    target[INSTALLED] = true;
+    (options.syncExports ?? syncBuiltinESMExports)();
+    return true;
+}
+//# sourceMappingURL=windows-hide-default.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.135",
+  "version": "5.345.137",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.71",
+    "@indigoai-us/hq-cloud": "~6.18.76",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",