@indigoai-us/hq-cli 5.345.148 → 5.345.150

package/dist/utils/cognito-session.js

@@ -267,6 +267,18 @@ export function isMachineCredsFileEnvSet(env = process.env) {
 export function defaultMachineCredsFile(home = os.homedir()) {
     return path.join(home, ".hq-agent", "machine-creds.json");
 }
+/**
+ * Env switch a parent process sets so a child `hq` never opens a browser
+ * sign-in. A hook-driven helper (SessionStart's refresh-vault-access) cannot
+ * complete a browser login, and a child waiting on one outlives its caller.
+ */
+export const HQ_NO_BROWSER_LOGIN_ENV = "HQ_NO_BROWSER_LOGIN";
+/** An explicit `interactive` option wins; otherwise interactive unless the env switch is "1". */
+export function resolveInteractiveLogin(options, env = process.env) {
+    if (options.interactive !== undefined)
+        return options.interactive;
+    return env[HQ_NO_BROWSER_LOGIN_ENV]?.trim() !== "1";
+}
 /**
  * Align `process.env.HQ_MACHINE_CREDS_FILE` with a (possibly synthetic) `env`
  * for the duration of `fn`, so hq-cloud's `isMachineIdentity()` sees the same
@@ -971,7 +983,7 @@ export async function ensureCognitoToken(options = {}) {
     return withTokenStateDirSection(() => ensureCognitoTokenUnserialized(options));
 }
 async function ensureCognitoTokenUnserialized(options) {
-    const interactive = options.interactive ?? true;
+    const interactive = resolveInteractiveLogin(options);
     // Machine identities (company agents) mint sessions on demand via
     // USER_PASSWORD_AUTH — no refresh-token dance, no browser. The vault API's
     // JWT authorizer accepts ID tokens, and the agent's identity claims
@@ -1062,7 +1074,7 @@ export async function ensureCognitoIdToken(options = {}) {
     return withTokenStateDirSection(() => ensureCognitoIdTokenUnserialized(options));
 }
 async function ensureCognitoIdTokenUnserialized(options) {
-    const interactive = options.interactive ?? true;
+    const interactive = resolveInteractiveLogin(options);
     if (options.signal?.aborted)
         throw options.signal.reason ?? new Error("Token acquisition was aborted");
     if (wantsMachineCognitoTokens(options)) {

package/dist/utils/hook-trust.d.ts

@@ -1,3 +1,5 @@
+import { findExecutableOnPath } from './resolve-executable.js';
+import { type SpawnPlan } from './windows-spawn.js';
 export interface CodexRpcClient {
     request(method: string, params: unknown): Promise<unknown>;
     close(): Promise<void>;
@@ -49,6 +51,13 @@ export interface RuntimeHookTrustResult {
     trusted: number;
     reason?: string;
 }
+/**
+ * How to launch Codex. npm installs Codex on Windows as a `codex.cmd` shim,
+ * which `spawn('codex')` cannot find (ENOENT) and Node refuses to run without a
+ * shell, so a bare name is resolved through PATH + PATHEXT and a batch shim is
+ * routed through the escaped cmd.exe plan.
+ */
+export declare function planCodexLaunch(executable: string, args: readonly string[], env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, find?: typeof findExecutableOnPath): SpawnPlan;
 /** Start a short-lived Codex app-server and complete its JSONL handshake. */
 export declare function createCodexAppServerClient(cwd: string, executable?: string, args?: string[]): Promise<CodexRpcClient>;
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */

package/dist/utils/hook-trust.js

@@ -8,6 +8,8 @@ import * as readline from 'node:readline';
 // read->merge->write, backup before the first byte, temp+fsync+rename commit)
 // rather than a bare readFile/writeFile pair.
 import { acquireLock, atomicReplace, backupConfig, realpathOrSelf, releaseLock, restoreFromBackup, } from '../commands/mcp-registration.js';
+import { findExecutableOnPath } from './resolve-executable.js';
+import { planResolvedCommandSpawn } from './windows-spawn.js';
 /**
  * The home directory every runtime's config is resolved under.
  *
@@ -23,6 +25,11 @@ import { acquireLock, atomicReplace, backupConfig, realpathOrSelf, releaseLock,
 export function defaultHomeDir() {
     return process.env.HOME?.trim() ? process.env.HOME : os.homedir();
 }
+const RUNTIME_LABEL = {
+    codex: 'Codex',
+    grok: 'Grok',
+    claude: 'Claude Code',
+};
 const CODEX_REQUEST_TIMEOUT_MS = 10_000;
 function errorMessage(value) {
     return value instanceof Error ? value.message : String(value);
@@ -77,11 +84,32 @@ function hqProjectHooks(hqRoot, hooks) {
         !hook.isManaged &&
         isWithin(path.resolve(hook.sourcePath), codexLayer));
 }
+/**
+ * How to launch Codex. npm installs Codex on Windows as a `codex.cmd` shim,
+ * which `spawn('codex')` cannot find (ENOENT) and Node refuses to run without a
+ * shell, so a bare name is resolved through PATH + PATHEXT and a batch shim is
+ * routed through the escaped cmd.exe plan.
+ */
+export function planCodexLaunch(executable, args, env = process.env, platform = process.platform, find = findExecutableOnPath) {
+    let command = executable;
+    if (platform === 'win32' && !path.win32.isAbsolute(executable) && !/[\\/]/.test(executable)) {
+        const resolved = find(executable, env.PATH ?? env.Path ?? '', platform, env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM');
+        if (!resolved) {
+            throw new Error(`Codex CLI not found on PATH (looked for ${executable}.exe and ${executable}.cmd); install Codex or add it to PATH, then rerun \`hq reindex\``);
+        }
+        command = resolved;
+    }
+    return planResolvedCommandSpawn(command, args, env, platform);
+}
 /** Start a short-lived Codex app-server and complete its JSONL handshake. */
 export async function createCodexAppServerClient(cwd, executable = 'codex', args = ['app-server']) {
-    const child = spawn(executable, args, {
+    const plan = planCodexLaunch(executable, args);
+    const child = spawn(plan.cmd, plan.args, {
         cwd,
         stdio: ['pipe', 'pipe', 'pipe'],
+        shell: plan.shell,
+        windowsHide: true,
+        ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
     });
     const lines = readline.createInterface({ input: child.stdout });
     const pending = new Map();
@@ -692,7 +720,7 @@ export async function trustHqRuntimeHooks(hqRoot, deps = DEFAULT_DEPS, options =
             }
         }
         else if (result.status === 'failed') {
-            console.warn(`reindex: could not trust ${result.runtime} HQ hooks: ${result.reason ?? 'unknown error'}`);
+            console.warn(`reindex: could not trust ${result.runtime} HQ hooks: ${result.reason ?? 'unknown error'}. ${RUNTIME_LABEL[result.runtime]} will not run HQ hooks until trust succeeds; fix the error above and rerun \`hq reindex\`.`);
         }
     }
     return results;

package/dist/utils/qmd-native-binding-error.js

@@ -48,7 +48,9 @@ export const QMD_NATIVE_BINDING_REMEDY = "hq's local search index can't start: i
     "not built during install. pnpm 10 skips dependency build scripts by default, " +
     "which leaves better-sqlite3 uncompiled. Approve the build and reinstall — for " +
     "a global install run `pnpm approve-builds -g better-sqlite3` (drop -g for a " +
-    "local project) — or reinstall hq with npm, then run the command again.";
+    "local project). npm 11.16 and later skip install scripts unless you opt in; reinstall with " +
+    "`npm install -g @indigoai-us/hq-cli --allow-scripts=better-sqlite3`. " +
+    "Or reinstall hq with npm, then run the command again.";
 /**
  * The text to inspect. For a QmdExitError the captured stderr/stdout is the qmd
  * process's real diagnostic; the synthesized `message` (which embeds the user's

package/dist/utils/resolve-executable.d.ts

@@ -1,2 +1,4 @@
+/** First executable file on PATH for `command` (PATHEXT-expanded on Windows), or undefined. */
+export declare function findExecutableOnPath(command: string, pathValue?: string, platform?: NodeJS.Platform, pathExt?: string): string | undefined;
 export declare function isExecutableOnPath(command: string, pathValue?: string, platform?: NodeJS.Platform, pathExt?: string): boolean;
 //# sourceMappingURL=resolve-executable.d.ts.map

package/dist/utils/resolve-executable.js

@@ -9,8 +9,9 @@ function executableCandidates(command, pathValue = process.env.PATH ?? '', platf
         : pathValue.split(platform === 'win32' ? ';' : path.delimiter).filter(Boolean).flatMap((directory) => extensions.map((extension) => path.join(directory, `${command}${extension}`)));
     return candidates;
 }
-export function isExecutableOnPath(command, pathValue = process.env.PATH ?? '', platform = process.platform, pathExt = process.env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM') {
-    return executableCandidates(command, pathValue, platform, pathExt).some((candidate) => {
+/** First executable file on PATH for `command` (PATHEXT-expanded on Windows), or undefined. */
+export function findExecutableOnPath(command, pathValue = process.env.PATH ?? '', platform = process.platform, pathExt = process.env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM') {
+    return executableCandidates(command, pathValue, platform, pathExt).find((candidate) => {
         try {
             fs.accessSync(candidate, fs.constants.X_OK);
             return fs.statSync(candidate).isFile();
@@ -20,4 +21,7 @@ export function isExecutableOnPath(command, pathValue = process.env.PATH ?? '',
         }
     });
 }
+export function isExecutableOnPath(command, pathValue = process.env.PATH ?? '', platform = process.platform, pathExt = process.env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM') {
+    return findExecutableOnPath(command, pathValue, platform, pathExt) !== undefined;
+}
 //# sourceMappingURL=resolve-executable.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.148",
+  "version": "5.345.150",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -42,7 +42,7 @@
     "check:lanes-module-cycles": "node scripts/check-lanes-module-cycles.mjs",
     "vitest": "vitest",
     "clean": "rm -rf dist",
-    "postinstall": "node scripts/install-hook-engine.mjs && node scripts/mesh-daemon-if-stale.mjs || node -e \"process.exit(0)\"",
+    "postinstall": "node scripts/install-hook-engine.mjs || node -e \"process.exit(0)\"",
     "prepare": "husky || true",
     "check:no-hermes": "bash scripts/check-no-hermes.sh",
     "prepack": "node scripts/hook-engine-manifest.mjs",
@@ -52,7 +52,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.88",
+    "@indigoai-us/hq-cloud": "~6.18.90",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.148",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.148",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.148",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.148",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.148",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.148"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.150",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.150",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.150",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.150",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.150",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.150"
   }
 }