@indigoai-us/hq-cli 5.345.147 → 5.345.148

package/dist/commands/pack-install.js

@@ -22,7 +22,7 @@
  *
  * Flow:
  *   1. Classify source → transport
- *   2. Fetch payload to tmpdir (npm pack | git clone | rsync)
+ *   2. Fetch payload to tmpdir (npm pack | git clone | local copy)
  *   3. Parse + validate package.yaml (10 checks from spec)
  *   4. Evaluate `conditional` predicate — skip if exits non-zero
  *   5. Confirm hooks if `contributes.hooks` non-empty (unless --allow-hooks)
@@ -38,7 +38,7 @@ import * as os from 'os';
 import * as path from 'path';
 import * as readline from 'readline';
 import { parseUserYaml } from '../utils/user-yaml-error.js';
-import { createHash, createPublicKey, verify as cryptoVerify, } from 'node:crypto';
+import { createHash, createPublicKey, randomBytes, verify as cryptoVerify, } from 'node:crypto';
 import { trustedMarketplaceSigningKey } from '../lib/pack-signing-keys.js';
 import { execFileSync, spawnSync } from 'child_process';
 import chalk from 'chalk';
@@ -51,6 +51,8 @@ import { codexTargets } from '../lib/install/codex-targets.js';
 import { readHqVersion, routeContribution, listInstalledPacks, mcpServerNameForContribution } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
+import { copyTree, removeTreeNoFollow } from '../utils/copy-tree.js';
+import { npmInvocation } from '../utils/npm-invocation.js';
 import { runResidentCommandWithPackageLease } from '../utils/resident-package-preload.js';
 import { getCompanyUid, vaultApiFetch, vaultApiFetchPublic, } from '../utils/vault-api.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
@@ -116,6 +118,18 @@ async function latestWithDiskCache(cacheKey, opts, refresh) {
 export const MARKETPLACE_PREFIX = 'marketplace:';
 /** Pinned source allowed to claim the reserved hq-anywhere pack name via its CLI alias. */
 export const PINNED_HQ_ANYWHERE_SOURCE = 'github:indigoai-us/hq-packages#packages/hq-pack-hq-anywhere';
+/**
+ * Windows path forms a user (or `os.tmpdir()`) hands to `hq install`: a drive
+ * path (`C:\packs\x`, `C:/packs/x`), a UNC path (`\\server\share\x`), or a
+ * backslash-relative path (`.\x`, `..\x`). None of these can be a registry
+ * slug, npm name or git URL, so they always mean the local transport.
+ */
+function isWindowsPathSource(source) {
+    return (/^[A-Za-z]:[\\/]/.test(source) ||
+        source.startsWith('\\\\') ||
+        source.startsWith('.\\') ||
+        source.startsWith('..\\'));
+}
 export function classify(source) {
     // US-006: marketplace:<slug>[@version] is recognized BEFORE the legacy
     // registry fallback and ahead of every other transport. The slug is resolved
@@ -144,7 +158,8 @@ export function classify(source) {
     if (source.startsWith('./') ||
         source.startsWith('../') ||
         source.startsWith('/') ||
-        source.startsWith('file:')) {
+        source.startsWith('file:') ||
+        isWindowsPathSource(source)) {
         return 'local';
     }
     // Fallback: bare slug — caller (dispatcher) routes those to legacy flow.
@@ -204,8 +219,10 @@ function fetchNpm(source, tmpDir, integrity) {
     // Use `npm pack` to grab the tarball without actually installing anything.
     // Capture output to get the produced filename. Arguments are passed as an
     // argv array — never interpolated into a shell string — so `source` cannot
-    // break out even if it contains metacharacters.
-    const out = execFileSync('npm', ['pack', '--silent', '--pack-destination', tmpDir, source], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'inherit'] });
+    // break out even if it contains metacharacters. On Windows npm is a .cmd
+    // shim, so npmInvocation runs npm-cli.js with node instead of a shell.
+    const npm = npmInvocation(['pack', '--silent', '--pack-destination', tmpDir, source]);
+    const out = execFileSync(npm.command, npm.args, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'inherit'] });
     const tarball = out.trim().split('\n').filter(Boolean).pop();
     if (!tarball) {
         throw new Error(`npm pack produced no tarball for "${source}"`);
@@ -557,7 +574,7 @@ function fetchGit(source, tmpDir, followBranch) {
         }
         payloadDir = path.join(tmpDir, 'payload');
         fs.mkdirSync(payloadDir, { recursive: true });
-        rsyncDir(subAbs, payloadDir);
+        copyPayloadDir(subAbs, payloadDir);
     }
     else {
         // Drop .git — the pack should be file content, not a nested repo
@@ -581,24 +598,17 @@ function fetchLocal(source, tmpDir) {
     }
     const payloadDir = path.join(tmpDir, 'local');
     fs.mkdirSync(payloadDir, { recursive: true });
-    rsyncDir(abs, payloadDir);
+    copyPayloadDir(abs, payloadDir);
     return { payloadDir, resolvedSource: clean };
 }
 /**
- * Invoke rsync with an argv array (no shell). Trailing slashes on the source
- * path are preserved by passing the exact strings through execFileSync.
+ * Copy a pack source directory's contents into the payload dir, skipping VCS
+ * metadata, installed dependencies and Finder files at any depth. This is the
+ * Node equivalent of the earlier `rsync -a --exclude=...` call, so it also
+ * works on Windows, which ships no rsync. Links are copied as links.
  */
-function rsyncDir(src, dest) {
-    const srcSlashed = src.endsWith('/') ? src : `${src}/`;
-    const destSlashed = dest.endsWith('/') ? dest : `${dest}/`;
-    execFileSync('rsync', [
-        '-a',
-        '--exclude=.git',
-        '--exclude=node_modules',
-        '--exclude=.DS_Store',
-        srcSlashed,
-        destSlashed,
-    ], { stdio: 'inherit' });
+function copyPayloadDir(src, dest) {
+    copyTree(src, dest, { exclude: ['.git', 'node_modules', '.DS_Store'] });
 }
 /**
  * Ask git whether <ref> resolves as a named branch or tag on <url>. Returns
@@ -1640,33 +1650,121 @@ export function installToPackages(payloadDir, pkg, hqRoot) {
     const packagesDir = path.join(hqRoot, 'core', 'packages');
     fs.mkdirSync(packagesDir, { recursive: true });
     const destDir = path.join(packagesDir, pkg.name);
-    // SECURITY/ATOMICITY (US-020): wire atomically. rsync into a sibling staging
+    // SECURITY/ATOMICITY (US-020): wire atomically. Copy into a sibling staging
     // dir on the SAME filesystem first; only swap it into the final destination
-    // once the copy fully succeeds. A failed/partial rsync therefore never
+    // once the copy fully succeeds. A failed/partial copy therefore never
     // leaves a half-wired pack dir in place (which scan-packages.sh would then
     // wire into host paths). On any error the staging dir is rolled back.
     const stagingDir = fs.mkdtempSync(path.join(packagesDir, `.${pkg.name}.staging-`));
+    let asideDir;
+    // Set when the staging dir holds the only complete copy of the new pack and
+    // must survive the cleanup below.
+    let keepStaging = false;
     try {
-        // rsync preserves modes/symlinks; argv form — no shell.
-        const srcSlashed = payloadDir.endsWith('/') ? payloadDir : `${payloadDir}/`;
-        const stagingSlashed = stagingDir.endsWith('/') ? stagingDir : `${stagingDir}/`;
-        execFileSync('rsync', ['-a', srcSlashed, stagingSlashed], { stdio: 'inherit' });
-        // Swap into place: remove any prior install, then atomic rename. The brief
-        // window between rm and rename is unavoidable with a same-name dir, but the
-        // staged copy guarantees the NEW contents are fully present before we touch
-        // the live location.
-        if (fs.existsSync(destDir)) {
-            fs.rmSync(destDir, { recursive: true, force: true });
+        // Keeps modes, mtimes and symlinks (as links) like `rsync -a`, without
+        // spawning rsync, which Windows does not ship. `finalRoot` makes Windows
+        // junction fallbacks point into destDir, where the copy ends up after the
+        // rename below, so they do not dangle once stagingDir is gone.
+        copyTree(payloadDir, stagingDir, { finalRoot: destDir });
+        // Swap into place. The prior install is renamed aside (not deleted) first,
+        // so if the second rename fails it can be put back and the old pack stays
+        // installed. The aside name is unique and not pre-created: on Windows a
+        // rename onto an existing directory fails.
+        if (lstatOrNull(destDir)) {
+            const aside = path.join(packagesDir, `.${pkg.name}.old-${process.pid}-${Date.now()}-${randomBytes(4).toString('hex')}`);
+            fs.renameSync(destDir, aside);
+            asideDir = aside;
+        }
+        try {
+            fs.renameSync(stagingDir, destDir);
+        }
+        catch (err) {
+            if (asideDir) {
+                try {
+                    fs.renameSync(asideDir, destDir);
+                    asideDir = undefined;
+                }
+                catch (restoreErr) {
+                    // Nothing is installed at destDir now. Keep both copies so either
+                    // can be moved into place by hand.
+                    keepStaging = true;
+                    throw new Error(`Could not move the new ${pkg.name} into ${destDir} (${errorMessage(err)}), and could not restore ` +
+                        `the previous install from ${asideDir} (${errorMessage(restoreErr)}). Nothing is installed at ` +
+                        `${destDir}. The previous install is at ${asideDir} and the complete new copy is at ${stagingDir}. ` +
+                        `Move one of them to ${destDir} by hand.`, { cause: err });
+                }
+            }
+            throw err;
         }
-        fs.renameSync(stagingDir, destDir);
     }
     finally {
-        if (fs.existsSync(stagingDir)) {
-            fs.rmSync(stagingDir, { recursive: true, force: true });
+        // Cleanup must never replace the error that got us here, so failures are
+        // reported and left behind rather than thrown.
+        if (!keepStaging) {
+            try {
+                removeTreeNoFollow(stagingDir);
+            }
+            catch (cleanupErr) {
+                process.stderr.write(`warning: could not remove staging dir ${stagingDir}: ${errorMessage(cleanupErr)}\n`);
+            }
+        }
+    }
+    // The new pack is in place. Links inside the old install are removed as
+    // links, never followed, so data they point at survives a reinstall.
+    if (asideDir) {
+        try {
+            removeTreeNoFollow(asideDir);
+        }
+        catch (cleanupErr) {
+            process.stderr.write(`warning: installed ${pkg.name}, but could not remove the previous install at ${asideDir}: ` +
+                `${errorMessage(cleanupErr)}. Delete it by hand.\n`);
         }
     }
+    sweepLeftovers(packagesDir, pkg.name);
     return destDir;
 }
+/**
+ * Remove `.<name>.staging-*` and `.<name>.old-*` siblings that an earlier
+ * interrupted or failed install of the same pack left behind. Runs only after
+ * a new install is in place, so a copy kept for manual recovery is not removed
+ * while nothing else is installed. Links inside are removed as links, and a
+ * failure only warns.
+ */
+function sweepLeftovers(packagesDir, name) {
+    const prefixes = [`.${name}.staging-`, `.${name}.old-`];
+    let entries;
+    try {
+        entries = fs.readdirSync(packagesDir);
+    }
+    catch (err) {
+        process.stderr.write(`warning: could not list ${packagesDir} for leftover install folders: ${errorMessage(err)}\n`);
+        return;
+    }
+    for (const entry of entries) {
+        if (!prefixes.some((prefix) => entry.startsWith(prefix)))
+            continue;
+        const leftover = path.join(packagesDir, entry);
+        try {
+            removeTreeNoFollow(leftover);
+        }
+        catch (err) {
+            process.stderr.write(`warning: could not remove leftover install folder ${leftover}: ${errorMessage(err)}\n`);
+        }
+    }
+}
+function lstatOrNull(target) {
+    try {
+        return fs.lstatSync(target);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 /**
  * Stamp the install-time `source:` into the destination package.yaml. This is
  * the only on-disk record of which `recommended_packages[].source` produced

package/dist/commands/sync-manifest.d.ts

@@ -42,17 +42,10 @@
  */
 import { Command } from "commander";
 import type { ManifestUploadTransport, RunManifestUploadPassOptions, RunManifestUploadPassResult } from "@indigoai-us/hq-cloud";
+import { MANIFEST_DISABLED_ENV, manifestUploadsDisabled } from "../lib/manifest-disabled.js";
 /** The server route the pass POSTs each chunk to. */
 export declare const MANIFEST_UPLOAD_PATH = "/v1/sync-manifest/upload";
-/**
- * The kill switch hq-cloud's pass honours. Restated locally (rather than
- * imported) for two reasons: it lives in the same unreleased module as the
- * manifest exports, and — more importantly — we must be able to read it
- * BEFORE deciding to do any work at all.
- */
-export declare const MANIFEST_DISABLED_ENV = "HQ_SYNC_MANIFEST_DISABLED";
-/** True when the kill switch is set to anything other than empty/0/false. */
-export declare function manifestUploadsDisabled(env?: NodeJS.ProcessEnv): boolean;
+export { MANIFEST_DISABLED_ENV, manifestUploadsDisabled };
 /** The literal `--scope` value that selects the personal (non-company) tree. */
 export declare const PERSONAL_SCOPE = "personal";
 /**

package/dist/commands/sync-manifest.js

@@ -51,6 +51,7 @@ import chalk from "chalk";
 // at runtime and so cost nothing here.
 import { VaultClient } from "@indigoai-us/hq-cloud";
 import { MANIFEST_MIN_HQ_CLOUD_VERSION, manifestExportsAvailable, requireManifestExports, } from "../lib/hq-cloud-manifest.js";
+import { MANIFEST_DISABLED_ENV, manifestUploadsDisabled, } from "../lib/manifest-disabled.js";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { loadClientHealthState, persistClientHealthState, } from "../utils/client-health.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
@@ -58,21 +59,9 @@ import { readActiveCompanySlug } from "./sync-mode.js";
 // ── Constants ───────────────────────────────────────────────────────────────
 /** The server route the pass POSTs each chunk to. */
 export const MANIFEST_UPLOAD_PATH = "/v1/sync-manifest/upload";
-/**
- * The kill switch hq-cloud's pass honours. Restated locally (rather than
- * imported) for two reasons: it lives in the same unreleased module as the
- * manifest exports, and — more importantly — we must be able to read it
- * BEFORE deciding to do any work at all.
- */
-export const MANIFEST_DISABLED_ENV = "HQ_SYNC_MANIFEST_DISABLED";
-/** True when the kill switch is set to anything other than empty/0/false. */
-export function manifestUploadsDisabled(env = process.env) {
-    const raw = env[MANIFEST_DISABLED_ENV];
-    if (raw === undefined)
-        return false;
-    const value = raw.trim().toLowerCase();
-    return value !== "" && value !== "0" && value !== "false";
-}
+// The kill switch lives in a leaf module so `hq doctor` can read it without
+// loading this command. Re-exported for existing importers.
+export { MANIFEST_DISABLED_ENV, manifestUploadsDisabled };
 /** The literal `--scope` value that selects the personal (non-company) tree. */
 export const PERSONAL_SCOPE = "personal";
 // ── Pure helpers ────────────────────────────────────────────────────────────

package/dist/hook-engine-path.d.ts

@@ -0,0 +1,4 @@
+/** Dependency-free routing: this command must never load the online CLI graph. */
+export declare function hookEnginePathArgs(argv: readonly string[]): string[] | null;
+export declare function runHookEnginePath(args: readonly string[]): Promise<void>;
+//# sourceMappingURL=hook-engine-path.d.ts.map

package/dist/hook-engine-path.js

@@ -0,0 +1,36 @@
+/** Dependency-free routing: this command must never load the online CLI graph. */
+export function hookEnginePathArgs(argv) {
+    if (argv[2] !== 'core')
+        return null;
+    let i = 3;
+    if (argv[i] === '--hq-root' && argv[i + 1])
+        i += 2;
+    else if (argv[i]?.startsWith('--hq-root='))
+        i++;
+    return argv[i] === 'hook-engine-path' ? argv.slice(i + 1) : null;
+}
+export async function runHookEnginePath(args) {
+    try {
+        if (args.some(arg => !['--repair', '--help', '-h'].includes(arg))) {
+            throw new Error('Usage: hq core hook-engine-path [--repair]');
+        }
+        if (args.includes('--help') || args.includes('-h')) {
+            console.log('Usage: hq core hook-engine-path [--repair]\nResolve and pin the installed native hook engine offline.');
+            return;
+        }
+        const { installHookEngine, hookEngineRequired, HOOK_ENGINE_REPAIR } = await import('./lib/hook-engine/resolve.js');
+        const binary = installHookEngine({ repair: args.includes('--repair') });
+        if (binary)
+            console.log(binary);
+        else {
+            console.error(`Native hook engine missing; ${hookEngineRequired() ? 'repair before running hooks' : 'existing bash hooks remain active'}. Repair: ${HOOK_ENGINE_REPAIR}`);
+            process.exitCode = 1;
+        }
+    }
+    catch (error) {
+        // Catch locally: the global rejection reporter imports main.js and Sentry.
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=hook-engine-path.js.map