@indigoai-us/hq-cli 5.345.155 → 5.345.159

package/dist/utils/package-use-lease.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { utimes } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -152,6 +152,29 @@ export function packageUseLeaseDirectory(prefix, stateDirectory = packageUseStat
 function packageUseUpdateRequestPath(prefix, stateDirectory) {
     return path.join(packageUseLeaseDirectory(prefix, stateDirectory), UPDATE_REQUEST);
 }
+// os.uptime() has whole-second resolution, so allow a small margin before
+// calling a request older than the current boot.
+const BOOT_TIME_MARGIN_MS = 5_000;
+/**
+ * An update request is stale when it was written before the current boot (its
+ * pid may have been reused by an unrelated process since), or when its pid is
+ * gone (ESRCH) or belongs to another user (EPERM). The updater always runs as
+ * the same user as the CLI, so a pid we may not signal is not our updater.
+ */
+function updateRequestIsStale(requestPath, pid) {
+    const bootTimeMs = Date.now() - os.uptime() * 1000;
+    if (statSync(requestPath).mtimeMs < bootTimeMs - BOOT_TIME_MARGIN_MS)
+        return true;
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ESRCH" || code === "EPERM")
+            return true;
+    }
+    return false;
+}
 function waitForUpdateRequest(requestPath, timeoutMs, notify = null) {
     const started = Date.now();
     let notified = false;
@@ -163,14 +186,9 @@ function waitForUpdateRequest(requestPath, timeoutMs, notify = null) {
             if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) {
                 throw new Error("invalid update request");
             }
-            try {
-                process.kill(pid, 0);
-            }
-            catch (error) {
-                if (error.code === "ESRCH") {
-                    rmSync(requestPath, { force: true });
-                    return;
-                }
+            if (updateRequestIsStale(requestPath, pid)) {
+                rmSync(requestPath, { force: true });
+                return;
             }
         }
         catch (error) {

package/dist/utils/version-gate.d.ts

@@ -499,7 +499,14 @@ interface EnforceUpdateDeps {
      */
     checkConvergence?: (targetVersion: string) => boolean | void;
     installNpmPackageStaged?: typeof import("./staged-npm-install.js").installNpmPackageStaged;
+    /** Global `hq` paths tried when the running copy is a local dependency. */
+    globalHqCandidates?: () => string[];
+    probeVersion?: (bin: string) => string | null;
+    realpath?: (p: string) => string | null;
+    execGlobalHq?: (bin: string, args: string[], env: NodeJS.ProcessEnv) => number | null;
 }
+/** Set on the child when the gate hands a command to a global `hq`. */
+export declare const GATE_GLOBAL_REEXEC_ENV = "HQ_GATE_REEXEC_GLOBAL";
 /**
  * Hard enforcement when the server says we're below `minVersion`. Print a
  * red banner, take the machine-wide update lock, attempt the update, then

package/dist/utils/version-gate.js

@@ -1692,6 +1692,66 @@ function installedHqEntryPoint(install) {
         return null;
     }
 }
+/** Set on the child when the gate hands a command to a global `hq`. */
+export const GATE_GLOBAL_REEXEC_ENV = "HQ_GATE_REEXEC_GLOBAL";
+const DEFAULT_GLOBAL_HQ_CANDIDATES = ["/usr/bin/hq", "/usr/local/bin/hq", "/opt/homebrew/bin/hq"];
+function realpathOrNull(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+function spawnGlobalHq(bin, args, env) {
+    const result = spawnSync(bin, args, { stdio: "inherit", env });
+    if (result.error)
+        return null;
+    if (result.status !== null)
+        return result.status;
+    return 1;
+}
+/**
+ * When the running copy is a local dependency the gate cannot update it. If a
+ * global `hq` outside that copy reports a version at or above `minVersion`
+ * (and newer than this one), run the user's command with it and return its
+ * exit code. Returns null when there is no such binary, when the global run
+ * could not start, or when this process was itself started by this hand-off.
+ */
+function execNewerGlobalHq(decision, install, deps) {
+    if ((deps.platform ?? process.platform) === "win32")
+        return null;
+    if (process.env[GATE_GLOBAL_REEXEC_ENV] === "1")
+        return null;
+    const realpath = deps.realpath ?? realpathOrNull;
+    const probe = deps.probeVersion ?? probeCliVersion;
+    const runningRoot = install.packageRoot ? realpath(install.packageRoot) ?? install.packageRoot : null;
+    const candidates = deps.globalHqCandidates?.() ?? DEFAULT_GLOBAL_HQ_CANDIDATES;
+    for (const candidate of candidates) {
+        const resolved = realpath(candidate);
+        if (!resolved)
+            continue;
+        // A global shim that resolves into the running copy is the same old code.
+        if (runningRoot && (resolved === runningRoot || resolved.startsWith(`${runningRoot}${path.sep}`)))
+            continue;
+        const version = probe(candidate);
+        if (!version || !semver.valid(version))
+            continue;
+        if (!semver.gte(version, decision.minVersion) || !isNewerVersion(version, CLI_VERSION)) {
+            console.error(chalk.dim(`  Global ${candidate} is ${version}, also below ${decision.minVersion}; not using it.`));
+            continue;
+        }
+        console.error(chalk.dim(`  Running this command with the global ${candidate} (${version}) instead.`));
+        const code = (deps.execGlobalHq ?? spawnGlobalHq)(candidate, process.argv.slice(2), {
+            ...process.env,
+            [GATE_GLOBAL_REEXEC_ENV]: "1",
+        });
+        if (code !== null)
+            return code;
+        console.error(chalk.dim(`  Could not start ${candidate}.`));
+    }
+    return null;
+}
 /**
  * Hard enforcement when the server says we're below `minVersion`. Print a
  * red banner, take the machine-wide update lock, attempt the update, then
@@ -1730,6 +1790,12 @@ function enforceUpdateRequired(decision, deps = {}) {
     // Say what to fix and stop; do NOT spend an install.
     if (isLocalDependencyInstall(install)) {
         console.error(chalk.red(`  This copy is a local dependency, not a global install: ${install.packageRoot}`));
+        // A shadowing copy (a stale ~/.local/bin shim, a project dependency) must
+        // never run, but a newer global `hq` on the same machine can run the
+        // user's command instead of failing it.
+        const handedOff = execNewerGlobalHq(decision, install, deps);
+        if (handedOff !== null)
+            process.exit(handedOff);
         console.error(chalk.dim("  Self-update cannot replace it — an install would land where this copy is never loaded from, and the gate would fire again on the next run."));
         console.error(chalk.dim(`  Update the project that owns it (e.g. \`pnpm update ${CLI_NAME}\` in its root, or remove the stale dependency), or invoke the global \`hq\` instead.`));
         process.exit(75);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.155",
+  "version": "5.345.159",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -52,7 +52,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.91",
+    "@indigoai-us/hq-cloud": "6.18.97",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.155",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.155",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.155",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.155",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.155",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.155"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.159",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.159",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.159",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.159",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.159",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.159"
   }
 }