@indigoai-us/hq-cli 5.345.14 → 5.345.15

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [5.345.15] — 2026-10-06
+- Route live hook Sentry reports through the fast CLI path.
+
+- When `hq-anywhere-runtime` is enabled, `hq install --global --runtime claude --via plugin` installs the `hq` plugin from the `indigoai-us/hq-packages` Claude marketplace, and `hq install @indigoai-us/hq-anywhere` installs the Codex pack from that repository. The flag-off path refuses the HQ Anywhere alias without fetching a package source.
+
 ## [5.345.14] — 2026-10-06
 - Route frequently called native core commands through isolated fast handlers.
 - Allow lane hierarchies up to four levels and include actionable senior-chain details when depth limits refuse a create or re-parent.

package/dist/commands/core-sentry-report-fast.d.ts

@@ -1,2 +1,11 @@
-export declare function runSentryReportFast(args: readonly string[], stdin: string, _cwd: string, hqRoot: string | undefined): Promise<number | undefined>;
+import type { NodeOptions } from "@sentry/node";
+import { reportSentryEvent } from "../lib/core-utils/sentry-report.js";
+export type FastSentryReportDependencies = {
+    initSentry: (overrides?: Partial<Pick<NodeOptions, "transport">>) => void;
+    finishSentrySession: () => void;
+    flushSentry: (timeoutMs: number) => PromiseLike<boolean>;
+    addCommandBreadcrumb: () => void;
+    report: typeof reportSentryEvent;
+};
+export declare function runSentryReportFast(args: readonly string[], stdin: string, _cwd: string, hqRoot: string | undefined, _commandName?: string, _hqRootArg?: string, _worktreeScopeFixEnabled?: boolean, dependencies?: FastSentryReportDependencies): Promise<number | undefined>;
 //# sourceMappingURL=core-sentry-report-fast.d.ts.map

package/dist/commands/core-sentry-report-fast.js

@@ -1,5 +1,17 @@
+import { settleWithin } from "../utils/settle-with-timeout.js";
+import { beforeSend } from "../sentry-before-send.js";
+import { addSentryRuntimeBreadcrumb, flushSentryRuntime, finishSentryRuntimeSession, initSentryRuntime, } from "../sentry-init.js";
+import { addCommandBreadcrumb } from "../utils/command-breadcrumb.js";
 import { reportSentryEvent } from "../lib/core-utils/sentry-report.js";
-export function runSentryReportFast(args, stdin, _cwd, hqRoot) {
+const SENTRY_FINALIZATION_TIMEOUT_MS = 500;
+const defaultDependencies = {
+    initSentry: (overrides) => { initSentryRuntime(beforeSend, overrides); },
+    finishSentrySession: finishSentryRuntimeSession,
+    flushSentry: flushSentryRuntime,
+    addCommandBreadcrumb: () => addCommandBreadcrumb(process.argv.slice(2), addSentryRuntimeBreadcrumb),
+    report: reportSentryEvent,
+};
+export function runSentryReportFast(args, stdin, _cwd, hqRoot, _commandName, _hqRootArg, _worktreeScopeFixEnabled, dependencies = defaultDependencies) {
     let dryRun = false;
     let timeoutMs;
     for (let index = 0; index < args.length; index += 1) {
@@ -24,10 +36,20 @@ export function runSentryReportFast(args, stdin, _cwd, hqRoot) {
         // lightweight parser does not own. This branch emits no output.
         return Promise.resolve(undefined);
     }
-    // Live sends need main.ts's initialized Sentry transport. Keep those calls on
-    // the authoritative command graph; only side-effect-free validation is fast.
-    if (!dryRun)
-        return Promise.resolve(undefined);
-    return reportSentryEvent(stdin, { dryRun, timeoutMs, hqRoot }).then((result) => result.code);
+    if (dryRun) {
+        return dependencies.report(stdin, { dryRun: true, timeoutMs, hqRoot }).then((result) => result.code);
+    }
+    // The report command's constrained message path uses the same DSN, release,
+    // environment, repo tag, user attribution, breadcrumb hook and release-health
+    // session as main.ts. The shared initializer keeps that setup in one place;
+    // the report payload itself is a message without an exception, so the shared
+    // fleet scrubber is the effective beforeSend behavior on this path.
+    dependencies.initSentry();
+    dependencies.addCommandBreadcrumb();
+    return dependencies.report(stdin, { dryRun: false, timeoutMs, hqRoot }).then(async (result) => {
+        dependencies.finishSentrySession();
+        await settleWithin([Promise.resolve(dependencies.flushSentry(SENTRY_FINALIZATION_TIMEOUT_MS))], SENTRY_FINALIZATION_TIMEOUT_MS);
+        return result.code;
+    });
 }
 //# sourceMappingURL=core-sentry-report-fast.js.map

package/dist/commands/install-global.d.ts

@@ -21,6 +21,8 @@ export interface GlobalInstallOptions {
     via?: 'direct' | 'plugin';
     /** Local Claude Code marketplace directory (or HQ_CLAUDE_PLUGIN_MARKETPLACE). */
     marketplaceDir?: string;
+    /** GitHub repository for the published HQ plugin marketplace. */
+    marketplaceRepository?: string;
     /** Test seam for the Claude Code CLI; production uses `claude`. */
     runClaude?: (args: string[], home: string, env: NodeJS.ProcessEnv) => void;
 }
@@ -38,7 +40,7 @@ export interface ClaudePluginSource {
     pluginId: string;
 }
 /** Resolve the local marketplace source; published hosting remains an operator decision. */
-export declare function resolveClaudePluginSource(explicitDir?: string, env?: NodeJS.ProcessEnv): ClaudePluginSource;
+export declare function resolveClaudePluginSource(explicitDir?: string, env?: NodeJS.ProcessEnv, repository?: string): ClaudePluginSource;
 export { AnywhereRuntimeDisabledError as AnywhereDisabledError };
 export declare const isAnywhereEnabled: (_home: string, env?: NodeJS.ProcessEnv) => boolean;
 /** Install HQ into Claude Code user scope. Returns the files touched (or that would be). */
@@ -67,10 +69,12 @@ export interface GlobalCommandOpts {
     hqRoot?: string;
     via?: 'direct' | 'plugin';
     marketplaceDir?: string;
+    marketplaceRepository?: string;
     /** Dependency injection for tests. */
     env?: NodeJS.ProcessEnv;
     log?: (line: string) => void;
 }
+export declare function resolveInstallRoot(explicit: string | undefined): string;
 /** Entry used by `hq install --global` (wired from pkg-install.ts). */
 export declare function runInstallGlobal(opts: GlobalCommandOpts): void;
 export declare function registerUninstallCommand(program: Command): void;

package/dist/commands/install-global.js

@@ -46,9 +46,12 @@ export function hookTargetFor(hqRoot, home, daemonInstalled, env = process.env)
     return installed && daemonMatchesRoot && fs.existsSync(shimPath(hqRoot)) ? 'shim' : 'master';
 }
 /** Resolve the local marketplace source; published hosting remains an operator decision. */
-export function resolveClaudePluginSource(explicitDir, env = process.env) {
+export function resolveClaudePluginSource(explicitDir, env = process.env, repository) {
     const configured = explicitDir?.trim() || env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim();
     if (!configured) {
+        if (repository === 'indigoai-us/hq-packages') {
+            return { sourceDir: repository, marketplaceName: 'hq-packages', pluginName: 'hq', pluginId: 'hq@hq-packages' };
+        }
         throw Object.assign(new Error('Published HQ Claude plugin source is not configured; its repository/host awaits an operator decision. Pass --marketplace-dir <dir> or set HQ_CLAUDE_PLUGIN_MARKETPLACE.'), { expected: true });
     }
     const sourceDir = path.resolve(configured);
@@ -94,7 +97,9 @@ function removePluginSettings(doc, plugin, removePlugin, removeMarketplace, plug
     if (marketplaces && typeof marketplaces === 'object' && !Array.isArray(marketplaces)) {
         const entries = { ...marketplaces };
         const registration = entries[plugin.marketplaceName];
-        if (removeMarketplace && registration?.source?.source === 'directory' && registration.source.path === plugin.sourceDir)
+        const sameDirectory = registration?.source?.source === 'directory' && registration.source.path === plugin.sourceDir;
+        const sameRepository = registration?.source?.source === 'github' && registration.source.repo === plugin.sourceDir;
+        if (removeMarketplace && (sameDirectory || sameRepository))
             delete entries[plugin.marketplaceName];
         if (Object.keys(entries).length === 0)
             delete next.extraKnownMarketplaces;
@@ -278,7 +283,7 @@ export function installGlobalClaude(opts) {
         throw new AnywhereRuntimeDisabledError();
     const t = claudeTargets(home);
     const prior = readState(t);
-    const pluginSource = opts.via === 'plugin' ? resolveClaudePluginSource(opts.marketplaceDir, env) : undefined;
+    const pluginSource = opts.via === 'plugin' ? resolveClaudePluginSource(opts.marketplaceDir, env, opts.marketplaceRepository) : undefined;
     if (prior?.plugin && !pluginSource) {
         throw Object.assign(new Error('HQ is installed through a Claude plugin marketplace. Run `hq uninstall --global --runtime claude` before switching back to direct installation.'), { expected: true });
     }
@@ -312,7 +317,8 @@ export function installGlobalClaude(opts) {
     const enabledPlugins = settingsDoc.enabledPlugins;
     const knownMarketplaces = settingsDoc.extraKnownMarketplaces;
     const existingMarketplace = pluginSource ? knownMarketplaces?.[pluginSource.marketplaceName] : undefined;
-    if (pluginSource && existingMarketplace && (existingMarketplace.source?.source !== 'directory' || existingMarketplace.source.path !== pluginSource.sourceDir)) {
+    if (pluginSource && existingMarketplace && !((existingMarketplace.source?.source === 'directory' && existingMarketplace.source.path === pluginSource.sourceDir) ||
+        (existingMarketplace.source?.source === 'github' && existingMarketplace.source.repo === pluginSource.sourceDir))) {
         throw Object.assign(new Error(`Claude marketplace "${pluginSource.marketplaceName}" is already registered from a different source. Remove or rename that marketplace before installing HQ.`), { expected: true });
     }
     const hadPluginSetting = !!pluginSource && !!enabledPlugins && Object.prototype.hasOwnProperty.call(enabledPlugins, pluginSource.pluginId);
@@ -927,7 +933,7 @@ function assertRuntime(runtime) {
     }
     return r;
 }
-function resolveInstallRoot(explicit) {
+export function resolveInstallRoot(explicit) {
     const fromFlag = explicit?.trim() || process.env.HQ_ROOT?.trim();
     const root = fromFlag ? path.resolve(fromFlag) : resolveHqRoot();
     if (!root) {
@@ -948,7 +954,7 @@ export function runInstallGlobal(opts) {
         return;
     }
     const install = runtime === 'codex' ? installGlobalCodex : installGlobalClaude;
-    install({ hqRoot: resolveInstallRoot(opts.hqRoot), dryRun: opts.dryRun, via: opts.via, marketplaceDir: opts.marketplaceDir });
+    install({ hqRoot: resolveInstallRoot(opts.hqRoot), dryRun: opts.dryRun, via: opts.via, marketplaceDir: opts.marketplaceDir, marketplaceRepository: opts.marketplaceRepository });
 }
 export function registerUninstallCommand(program) {
     program

package/dist/commands/pkg-install.js

@@ -1,6 +1,7 @@
 import chalk from 'chalk';
 import { peekHqApiKey, requireApiKeyCapability, } from '../utils/resolve-vault-credential.js';
 import { MARKETPLACE_PREFIX, installPack, sourceMatchesPackPattern, } from './pack-install.js';
+import { anywhereRuntimeEnabled } from './anywhere-runtime-flag.js';
 /**
  * True when `source` installs through the marketplace — an explicit
  * `marketplace:` source, or a bare slug (which the dispatch below rewrites into
@@ -67,7 +68,15 @@ export function registerPackageInstallCommand(parent) {
                 process.exitCode = 1;
                 return;
             }
-            runInstallGlobal(opts);
+            let marketplaceDir = opts.marketplaceDir;
+            if (opts.via === 'plugin' &&
+                !marketplaceDir?.trim() &&
+                !process.env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim() &&
+                anywhereRuntimeEnabled(process.env)) {
+                runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
+                return;
+            }
+            runInstallGlobal({ ...opts, marketplaceDir });
             return;
         }
         if (!source) {
@@ -85,6 +94,19 @@ export function registerPackageInstallCommand(parent) {
             // with packs:install (hq-pro serves POST /v1/keys/listings/…/installs).
             requireApiKeyCapability('packs:install', 'hq install');
             assertApiKeyCanAuthorizeInstall(source);
+            if (source === '@indigoai-us/hq-anywhere') {
+                if (!anywhereRuntimeEnabled()) {
+                    console.error(chalk.red('Install failed:'), 'HQ Anywhere installation is disabled by the hq-anywhere-runtime flag.');
+                    process.exit(1);
+                }
+                await installPack('github:indigoai-us/hq-packages#packages/hq-pack-hq-anywhere', {
+                    company: opts.company,
+                    allowHooks: opts.allowHooks,
+                    allowMcp: opts.allowMcp,
+                    followBranch: opts.branch,
+                });
+                return;
+            }
             if (sourceMatchesPackPattern(source)) {
                 await installPack(source, {
                     company: opts.company,

package/dist/fast-scaffold.js

@@ -19,13 +19,10 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         root: "live",
         readsStdinFor: (args) => {
-            let dryRun = false;
             for (let index = 0; index < args.length; index += 1) {
                 const arg = args[index];
-                if (arg === "--dry-run") {
-                    dryRun = true;
+                if (arg === "--dry-run")
                     continue;
-                }
                 if (arg === "--timeout-ms") {
                     const value = args[index + 1];
                     if (value === undefined || value.startsWith("-"))
@@ -37,7 +34,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
                     continue;
                 return false;
             }
-            return dryRun;
+            return true;
         },
         stdinMaxBytes: 2_048,
         requiresNodeNetworkCompatibility: true,

package/dist/main.js

@@ -11,7 +11,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
 import { finishSentrySession, initSentry, Sentry } from "./sentry.js";
-import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
+import { addCommandBreadcrumb } from "./utils/command-breadcrumb.js";
 import { environmentalFsErrorMessage, filesystemErrorCaptureContext, filesystemErrorMessage, } from "./utils/environmental-error.js";
 import { syncStateLockMessage } from "./utils/sync-state-lock-error.js";
 import { networkTransportErrorMessage } from "./utils/network-transport-error.js";
@@ -191,11 +191,7 @@ export async function runCli() {
     let versionUpdateHandled = false;
     let commandParsed = false;
     try {
-        runGlobalNetworkLifecycle(process.argv, () => Sentry.addBreadcrumb({
-            category: "command",
-            message: sanitizeArgv(process.argv.slice(2)).join(" "),
-            level: "info",
-        }));
+        runGlobalNetworkLifecycle(process.argv, () => addCommandBreadcrumb(process.argv.slice(2), (breadcrumb) => Sentry.addBreadcrumb(breadcrumb)));
         // Version handling, both halves. Skipped for inspection flags
         // (`--version`, `--help`) so users debugging a broken install can still
         // introspect what they have, and silent on any failure — neither half may

package/dist/sentry-init.d.ts

@@ -0,0 +1,10 @@
+import type { NodeOptions } from "@sentry/node";
+type SentryModule = typeof import("@sentry/node");
+type SentryBreadcrumb = Parameters<SentryModule["addBreadcrumb"]>[0];
+/** Shared Sentry SDK setup for the command graph and isolated fast handlers. */
+export declare function initSentryRuntime(beforeSend: NodeOptions["beforeSend"], overrides?: Partial<Pick<NodeOptions, "transport">>, pendingBreadcrumbs?: readonly SentryBreadcrumb[]): SentryModule | undefined;
+export declare function finishSentryRuntimeSession(): void;
+export declare function addSentryRuntimeBreadcrumb(breadcrumb: SentryBreadcrumb): void;
+export declare function flushSentryRuntime(timeoutMs: number): PromiseLike<boolean>;
+export {};
+//# sourceMappingURL=sentry-init.d.ts.map

package/dist/sentry-init.js

@@ -0,0 +1,48 @@
+import { createRequire } from "node:module";
+import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
+import { CLI_VERSION } from "./cli-version.js";
+import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
+import { getCachedSentryUser } from "./utils/sentry-identity.js";
+const requireSentry = createRequire(import.meta.url);
+let sentryModule;
+function loadSentryModule() {
+    sentryModule ??= requireSentry("@sentry/node");
+    return sentryModule;
+}
+/** Shared Sentry SDK setup for the command graph and isolated fast handlers. */
+export function initSentryRuntime(beforeSend, overrides = {}, pendingBreadcrumbs = []) {
+    const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
+    if (!dsn)
+        return undefined;
+    const sdk = loadSentryModule();
+    sdk.init({
+        dsn,
+        // This async ESM hook adds large startup cost. HQ retains its explicit
+        // breadcrumbs without enabling automatic third-party instrumentation.
+        registerEsmLoaderHooks: false,
+        release: `hq-cli@${CLI_VERSION}`,
+        environment: process.env.HQ_CLI_ENV ?? "production",
+        initialScope: { tags: { repo: "hq-cli" } },
+        beforeSend,
+        beforeBreadcrumb,
+        integrations: (defaults) => defaults.filter((integration) => integration.name !== "ProcessSession"),
+        ...overrides,
+    });
+    const user = getCachedSentryUser();
+    if (user)
+        sdk.setUser(user);
+    for (const breadcrumb of pendingBreadcrumbs)
+        sdk.addBreadcrumb(breadcrumb);
+    sdk.startSession();
+    return sdk;
+}
+export function finishSentryRuntimeSession() {
+    sentryModule?.endSession();
+}
+export function addSentryRuntimeBreadcrumb(breadcrumb) {
+    sentryModule?.addBreadcrumb(breadcrumb);
+}
+export function flushSentryRuntime(timeoutMs) {
+    return sentryModule?.flush(timeoutMs) ?? Promise.resolve(true);
+}
+//# sourceMappingURL=sentry-init.js.map

package/dist/sentry.js

@@ -1,14 +1,11 @@
 import { createRequire } from "node:module";
-import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
-import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
-import { CLI_VERSION } from "./cli-version.js";
-import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
 import { companySkillWrapperSentryTagsFor } from "./lib/company-skill-wrapper.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { incompleteInstallCaptureContext, incompleteInstallMessage, } from "./utils/incomplete-install-error.js";
 import { installTreeTornSentryTagsFor, sentryFingerprintFor, sentryMcpCollisionContextFor, } from "./utils/sentry-fingerprint.js";
+import { finishSentryRuntimeSession, initSentryRuntime } from "./sentry-init.js";
 const inertSentryScope = {
     setTag: () => inertSentryScope,
     setUser: () => inertSentryScope,
@@ -17,11 +14,10 @@ const inertSentryScope = {
     setLevel: () => inertSentryScope,
     setFingerprint: () => inertSentryScope,
 };
-const requireSentry = createRequire(import.meta.url);
 let sentryModule;
 let pendingSentryBreadcrumbs = [];
 function loadSentryModule() {
-    sentryModule ??= requireSentry("@sentry/node");
+    sentryModule ??= createRequire(import.meta.url)("@sentry/node");
     return sentryModule;
 }
 /** Load the SDK through the same resolver used by the lazy Sentry facade. */
@@ -227,46 +223,13 @@ function flagRegistryWorkerMissingFileTags(error, event) {
  * exercised without an ingest request. Production callers pass nothing.
  */
 export function initSentry(overrides = {}) {
-    const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
-    if (!dsn)
+    sentryModule = initSentryRuntime(epipeAwareBeforeSend, overrides, pendingSentryBreadcrumbs);
+    if (!sentryModule)
         return;
-    const sdk = loadSentryModule();
-    sdk.init({
-        dsn,
-        // import-in-the-middle's async ESM loader makes every later CLI import
-        // substantially slower. Keep HQ's explicit breadcrumbs, but give up
-        // automatic ESM third-party instrumentation (its spans/breadcrumbs).
-        registerEsmLoaderHooks: false,
-        // CLI_VERSION reads package.json at runtime; npm_package_version is only
-        // set under `npm run`, so an installed `hq` binary would always report
-        // 0.0.0 and never match the uploaded source maps.
-        release: `hq-cli@${CLI_VERSION}`,
-        environment: process.env.HQ_CLI_ENV ?? "production",
-        initialScope: {
-            tags: { repo: "hq-cli" },
-        },
-        beforeSend: epipeAwareBeforeSend,
-        beforeBreadcrumb,
-        // HQ owns this short-lived CLI session explicitly below and closes it from
-        // main.ts. Leaving the SDK default enabled starts a competing session.
-        integrations: (defaults) => defaults.filter((integration) => integration.name !== "ProcessSession"),
-        ...overrides,
-    });
-    // Attribute events to the logged-in HQ identity (best-effort; null when not
-    // logged in). A CLI process is one user, so global setUser is correct here.
-    const user = getCachedSentryUser();
-    if (user)
-        sdk.setUser(user);
-    for (const breadcrumb of pendingSentryBreadcrumbs)
-        sdk.addBreadcrumb(breadcrumb);
     pendingSentryBreadcrumbs = [];
-    // Release health: one session per CLI run. Ended + flushed in index.ts's
-    // finally (covers every exit path). A captured error auto-marks the session
-    // "errored", so crash-free numbers per release stay accurate.
-    sdk.startSession();
 }
 /** Finish HQ's one per-invocation release-health session. */
 export function finishSentrySession() {
-    sentryModule?.endSession();
+    finishSentryRuntimeSession();
 }
 //# sourceMappingURL=sentry.js.map

package/dist/utils/command-breadcrumb.d.ts

@@ -0,0 +1,7 @@
+export type CommandBreadcrumb = {
+    category: "command";
+    message: string;
+    level: "info";
+};
+export declare function addCommandBreadcrumb(argv: readonly string[], addBreadcrumb: (breadcrumb: CommandBreadcrumb) => void): void;
+//# sourceMappingURL=command-breadcrumb.d.ts.map

package/dist/utils/command-breadcrumb.js

@@ -0,0 +1,9 @@
+import { sanitizeArgv } from "./sanitize-argv.js";
+export function addCommandBreadcrumb(argv, addBreadcrumb) {
+    addBreadcrumb({
+        category: "command",
+        message: sanitizeArgv(argv).join(" "),
+        level: "info",
+    });
+}
+//# sourceMappingURL=command-breadcrumb.js.map

package/dist/utils/feedback-diagnostics.d.ts

@@ -1,5 +1,6 @@
 import { type VersionInfo } from "./feedback-versions.js";
 import type { FeedbackLogsBlob } from "./feedback-logs.js";
+export { sanitizeArgv } from "./sanitize-argv.js";
 interface GitContext {
     branch: string | null;
     head: string | null;
@@ -37,7 +38,5 @@ export interface DiagnosticsBlob {
      */
     logs?: FeedbackLogsBlob;
 }
-export declare function sanitizeArgv(argv: string[]): string[];
 export declare function collectDiagnostics(): DiagnosticsBlob;
-export {};
 //# sourceMappingURL=feedback-diagnostics.d.ts.map

package/dist/utils/feedback-diagnostics.js

@@ -3,35 +3,8 @@ import { execFileSync } from "child_process";
 import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
 import { collectVersions } from "./feedback-versions.js";
-const SECRET_FLAGS = new Set([
-    "--token",
-    "--secret",
-    "--password",
-    "--key",
-    "--api-key",
-    "--access-token",
-    "--auth-token",
-]);
-export function sanitizeArgv(argv) {
-    const result = [];
-    for (let i = 0; i < argv.length; i++) {
-        const arg = argv[i];
-        if (arg.startsWith("--") && arg.includes("=")) {
-            const eqIdx = arg.indexOf("=");
-            const flag = arg.slice(0, eqIdx);
-            if (SECRET_FLAGS.has(flag)) {
-                result.push(`${flag}=***`);
-                continue;
-            }
-        }
-        result.push(arg);
-        if (SECRET_FLAGS.has(arg) && i + 1 < argv.length) {
-            result.push("***");
-            i++;
-        }
-    }
-    return result;
-}
+import { sanitizeArgv } from "./sanitize-argv.js";
+export { sanitizeArgv } from "./sanitize-argv.js";
 function sanitizeRemoteUrl(url) {
     return url.replace(/https?:\/\/[^@]+@/, "https://***@");
 }

package/dist/utils/sanitize-argv.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeArgv(argv: readonly string[]): string[];
+//# sourceMappingURL=sanitize-argv.d.ts.map

package/dist/utils/sanitize-argv.js

@@ -0,0 +1,30 @@
+const SECRET_FLAGS = new Set([
+    "--token",
+    "--secret",
+    "--password",
+    "--key",
+    "--api-key",
+    "--access-token",
+    "--auth-token",
+]);
+export function sanitizeArgv(argv) {
+    const result = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg.startsWith("--") && arg.includes("=")) {
+            const eqIdx = arg.indexOf("=");
+            const flag = arg.slice(0, eqIdx);
+            if (SECRET_FLAGS.has(flag)) {
+                result.push(`${flag}=***`);
+                continue;
+            }
+        }
+        result.push(arg);
+        if (SECRET_FLAGS.has(arg) && i + 1 < argv.length) {
+            result.push("***");
+            i += 1;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=sanitize-argv.js.map

package/dist/utils/scaffold-fast-import-guard.d.ts

@@ -1,2 +1,2 @@
-export declare function assertFastPathStaysCommandGraphFree(loadedModules: readonly string[], distDirectory: string, allowedCommandModules?: readonly string[]): void;
+export declare function assertFastPathStaysCommandGraphFree(loadedModules: readonly string[], distDirectory: string, allowedCommandModules?: readonly string[], allowedSentryPackageRoots?: readonly string[]): void;
 //# sourceMappingURL=scaffold-fast-import-guard.d.ts.map

package/dist/utils/scaffold-fast-import-guard.js

@@ -1,6 +1,6 @@
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-function forbiddenFastPathModules(loadedModules, distDirectory, allowedCommandModules = []) {
+function forbiddenFastPathModules(loadedModules, distDirectory, allowedCommandModules = [], allowedSentryPackageRoots = []) {
     const dist = path.resolve(distDirectory);
     const main = path.join(dist, "main.js");
     const commands = `${path.join(dist, "commands")}${path.sep}`;
@@ -9,6 +9,7 @@ function forbiddenFastPathModules(loadedModules, distDirectory, allowedCommandMo
     const fullNetworkCompat = path.join(dist, "node-network-compat.js");
     const sentryEntrypoint = path.join(dist, "sentry.js");
     const allowedCommands = new Set(allowedCommandModules.map((module) => path.resolve(module)));
+    const allowedSentryRoots = allowedSentryPackageRoots.map((module) => path.resolve(module));
     return [...new Set(loadedModules.map((loaded) => {
             if (loaded.startsWith("file:")) {
                 try {
@@ -26,13 +27,15 @@ function forbiddenFastPathModules(loadedModules, distDirectory, allowedCommandMo
         path.resolve(loaded) === coreCommand ||
         path.resolve(loaded) === fullNetworkCompat ||
         path.resolve(loaded) === sentryEntrypoint ||
-        path.resolve(loaded).includes(`${path.sep}node_modules${path.sep}@sentry${path.sep}`))
+        (path.resolve(loaded).includes(`${path.sep}node_modules${path.sep}@sentry${path.sep}`) &&
+            !allowedSentryRoots.some((root) => path.resolve(loaded) === root ||
+                path.resolve(loaded).startsWith(root + path.sep))))
         .filter((loaded) => !allowedCommands.has(path.resolve(loaded)) ||
         path.resolve(loaded) === main || path.resolve(loaded) === coreCommand)
         .sort();
 }
-export function assertFastPathStaysCommandGraphFree(loadedModules, distDirectory, allowedCommandModules = []) {
-    const forbidden = forbiddenFastPathModules(loadedModules, distDirectory, allowedCommandModules);
+export function assertFastPathStaysCommandGraphFree(loadedModules, distDirectory, allowedCommandModules = [], allowedSentryPackageRoots = []) {
+    const forbidden = forbiddenFastPathModules(loadedModules, distDirectory, allowedCommandModules, allowedSentryPackageRoots);
     if (forbidden.length > 0) {
         throw new Error(`fast core loaded forbidden command modules:\n${forbidden.join("\n")}`);
     }

package/docs/anywhere-runtime.md

@@ -80,6 +80,14 @@ resident daemon does not support the health operation, doctor falls back to
 `ping` for reachability, version and uptime, then warns that a restart is needed
 for full diagnostics.
 
+The hq-anywhere-runtime flag also gates the published Claude plugin marketplace
+and Codex pack source. When enabled, hq-cli adds the `indigoai-us/hq-packages`
+Claude marketplace and installs the `hq` plugin, or resolves the exact
+`@indigoai-us/hq-anywhere` alias to
+`github:indigoai-us/hq-packages#packages/hq-pack-hq-anywhere`. The flag-off
+path does not resolve either published source. Use `--marketplace-dir` to
+override the Claude marketplace with a local build.
+
 ## Link a repository
 
 Run `hq link <company>` from a repository to associate it with a company. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.14",
+  "version": "5.345.15",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {