@indigoai-us/hq-cli 5.345.159 → 5.345.161

package/dist/lib/bot/runtime/types.d.ts

@@ -146,6 +146,14 @@ export interface BotRuntime {
     resolveBinary?(env: NodeJS.ProcessEnv, cwd?: string, platform?: NodeJS.Platform): string;
     /** Optional full prompt stream sent through stdin instead of argv. */
     stdinInput?(input: RuntimeTurnInput): string | undefined;
+    /**
+     * Optional: runtime-specific defaults layered onto the turn's environment
+     * (per-tool safety defaults the CLI honours, for example). Applied in
+     * `runRuntimeTurn` on top of the env that `turnEnv` in run.ts built from
+     * the bot's identity rules; it only adds runtime keys and never changes
+     * who the turn acts as. Pure; must not mutate `env`.
+     */
+    runtimeEnv?(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
     /** Optional bidirectional process protocol for this runtime. */
     spawnProtocol?(input: RuntimeTurnInput): SpawnProtocol | undefined;
     /** Build the argv for one turn. Pure. */

package/dist/lib/db/control-plane.d.ts

@@ -1,3 +1,4 @@
+import { type UsagePause } from "../billing/usage-pause.js";
 /**
  * Control-plane client for remote vault DB (US-009).
  * Injectable fetch for tests — never logs response bodies that might hold secrets.
@@ -167,5 +168,9 @@ export type ControlPlaneHttpError = Error & {
     status?: number;
     code?: string;
     reason?: string;
+    /** The 402 usage pause (hq-pro `usagePause`), when the server sent one. */
+    usagePause?: UsagePause;
+    /** The body's customer sentence (`message`), when it sent one. */
+    serverMessage?: string;
 };
 //# sourceMappingURL=control-plane.d.ts.map

package/dist/lib/db/control-plane.js

@@ -1,4 +1,5 @@
 import { planGateErrorFromPayload } from "../../utils/plan-gate-error.js";
+import { usagePauseFromBody } from "../billing/usage-pause.js";
 // Provision may allocate remote resources, so allow two minutes and never retry.
 const DB_PROVISION_TIMEOUT_MS = 120_000;
 // Status is a read-only probe; 15 seconds is longer than its normal response time.
@@ -195,6 +196,8 @@ function httpError(label, status, text) {
     let msg = `${label} failed (${status})`;
     let code;
     let reason;
+    let usagePause = null;
+    let serverMessage;
     try {
         const j = JSON.parse(text);
         if (typeof j.error === "string")
@@ -203,6 +206,9 @@ function httpError(label, status, text) {
             code = j.code;
         if (typeof j.reason === "string")
             reason = j.reason;
+        if (typeof j.message === "string" && j.message.trim())
+            serverMessage = j.message.trim();
+        usagePause = usagePauseFromBody(j);
     }
     catch {
         /* keep */
@@ -213,6 +219,10 @@ function httpError(label, status, text) {
         err.code = code;
     if (reason)
         err.reason = reason;
+    if (usagePause)
+        err.usagePause = usagePause;
+    if (serverMessage)
+        err.serverMessage = serverMessage;
     return err;
 }
 function personalHttpError(label, status, text) {

package/dist/lib/doctor/checks/ps1-shims.d.ts

@@ -0,0 +1,21 @@
+import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
+export declare const PS1_SHIM_FAMILY_ID = "cli-ps1-shim";
+export declare const PS1_SHIM_CHECK_ID = "cli-ps1-shim.blocked-by-policy";
+export interface Ps1ShimCheckDeps {
+    platform: NodeJS.Platform;
+    /** The npm prefix holding `hq.cmd`, or null when hq is not an npm global install. */
+    binDir: () => string | null;
+    /** The npm-generated hq-cli `.ps1` launchers present in the prefix. */
+    findShims: (dir: string) => string[];
+    /** The effective PowerShell execution policy, or null when it could not be read. */
+    readPolicy: () => string | null;
+}
+/**
+ * Windows: npm writes `hq.ps1` next to `hq.cmd`, and PowerShell prefers the
+ * `.ps1`. Under a policy that blocks unsigned scripts (the Windows client
+ * default) `hq` then fails with UnauthorizedAccess. This check only reads:
+ * it never changes the execution policy.
+ */
+export declare const ps1ShimsFamily: CheckFamily;
+export declare function checkPs1Shims(_context: CheckContext, deps?: Ps1ShimCheckDeps): CheckResult[];
+//# sourceMappingURL=ps1-shims.d.ts.map

package/dist/lib/doctor/checks/ps1-shims.js

@@ -0,0 +1,82 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { npmShimDir } from "../../windows/user-path.js";
+import { findHqCliPs1Shims, policyBlocksUnsignedScripts, readExecutionPolicy } from "../../windows/ps1-shims.js";
+export const PS1_SHIM_FAMILY_ID = "cli-ps1-shim";
+export const PS1_SHIM_CHECK_ID = "cli-ps1-shim.blocked-by-policy";
+const defaultDeps = {
+    platform: process.platform,
+    binDir: () => npmShimDir(process.argv[1], fs.existsSync),
+    findShims: (dir) => findHqCliPs1Shims(dir),
+    readPolicy: () => readExecutionPolicy(),
+};
+const REMEDIATION = "Run `hq.cmd doctor --fix` (or `hq.cmd install --global`) to remove the hq .ps1 launchers. " +
+    "Until then, type `hq.cmd` instead of `hq` in PowerShell. Your execution policy is not changed.";
+/**
+ * Windows: npm writes `hq.ps1` next to `hq.cmd`, and PowerShell prefers the
+ * `.ps1`. Under a policy that blocks unsigned scripts (the Windows client
+ * default) `hq` then fails with UnauthorizedAccess. This check only reads:
+ * it never changes the execution policy.
+ */
+export const ps1ShimsFamily = {
+    id: PS1_SHIM_FAMILY_ID,
+    title: "hq PowerShell launchers",
+    run: (context) => Promise.resolve(checkPs1Shims(context)),
+};
+export function checkPs1Shims(_context, deps = defaultDeps) {
+    const dir = deps.platform === "win32" ? deps.binDir() : null;
+    if (!dir) {
+        return [
+            {
+                status: "NA",
+                checkId: PS1_SHIM_CHECK_ID,
+                message: "Not a Windows npm global install, so there are no hq PowerShell launchers to check.",
+            },
+        ];
+    }
+    const shims = deps.findShims(dir);
+    if (shims.length === 0) {
+        return [
+            {
+                status: "PASS",
+                checkId: PS1_SHIM_CHECK_ID,
+                target: dir,
+                message: `No hq .ps1 launchers in ${dir}; PowerShell runs hq.cmd.`,
+            },
+        ];
+    }
+    const names = shims.map((file) => path.win32.basename(file)).join(", ");
+    const policy = deps.readPolicy();
+    if (policy === null) {
+        return [
+            {
+                status: "UNKNOWN",
+                checkId: PS1_SHIM_CHECK_ID,
+                target: shims[0],
+                message: `Found ${names} in ${dir} but could not read the PowerShell execution policy. If \`hq\` fails with UnauthorizedAccess, use \`hq.cmd\`.`,
+                remediation: REMEDIATION,
+            },
+        ];
+    }
+    if (!policyBlocksUnsignedScripts(policy)) {
+        return [
+            {
+                status: "PASS",
+                checkId: PS1_SHIM_CHECK_ID,
+                target: shims[0],
+                message: `${names} can run under the ${policy} execution policy.`,
+            },
+        ];
+    }
+    return [
+        {
+            status: "WARN",
+            checkId: PS1_SHIM_CHECK_ID,
+            target: shims[0],
+            message: `PowerShell runs ${names} for \`hq\`, and the ${policy} execution policy blocks it, so \`hq\` fails with UnauthorizedAccess.`,
+            details: { policy, shims },
+            remediation: REMEDIATION,
+        },
+    ];
+}
+//# sourceMappingURL=ps1-shims.js.map

package/dist/lib/doctor/fix/apply.d.ts

@@ -17,7 +17,10 @@
  *      execute bit, add a hook id to the gate profiles it is missing from,
  *      re-register a script present on disk, or pull a company or personal
  *      vault whose local tree exists but whose journal is stale — and NEVER
- *      rewrites a hook body or deletes a file. Classification is owned by
+ *      rewrites a hook body or deletes a file, with one scoped exception: on
+ *      Windows, `remove-ps1-shims` deletes npm-generated hq-cli `.ps1`
+ *      launchers (and only files whose content is that shim) from the npm
+ *      prefix, outside the HQ tree. Classification is owned by
  *      {@link deriveRemediation};
  *      a content-drift finding is manual-only and simply never appears in the
  *      fixable set.
@@ -38,6 +41,7 @@ import { type SpawnSyncReturns } from "node:child_process";
 import type { CheckResult, DoctorStatus } from "../types.js";
 import { type GateProfile } from "../hook-gate-profiles.js";
 import { type FixClass } from "./remediation.js";
+import { type RemovePs1ShimsResult } from "../../windows/ps1-shims.js";
 import { type RefreshSyncOutcome } from "./refresh-sync-outcome.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
 export declare const HOOK_CONFIG_DIRS: readonly [".claude", ".codex", ".grok"];
@@ -109,6 +113,12 @@ export interface ApplyFixesOptions {
         from: string | null;
         to: string;
     } | null;
+    /**
+     * Removal used by the `remove-ps1-shims` class: delete npm's hq-cli `.ps1`
+     * launchers from the given npm prefix (Windows only; other files and the
+     * execution policy are left alone). Tests inject a stub.
+     */
+    removePs1Shims?: (dir: string) => RemovePs1ShimsResult;
 }
 /** One company or personal vault the `refresh-sync` class will pull. */
 export interface RefreshSyncTarget {
@@ -311,6 +321,8 @@ export declare function defaultRewriteBotNodePath(name: string): {
     from: string;
     to: string;
 } | null;
+/** Default `remove-ps1-shims` repair: Windows only, a no-op elsewhere. */
+export declare function defaultRemovePs1Shims(dir: string): RemovePs1ShimsResult;
 /**
  * An hq path a bot may be pointed at unattended: an installed package entry
  * or its stable shim, never a worktree or one-off build that happens to be

package/dist/lib/doctor/fix/apply.js

@@ -17,7 +17,10 @@
  *      execute bit, add a hook id to the gate profiles it is missing from,
  *      re-register a script present on disk, or pull a company or personal
  *      vault whose local tree exists but whose journal is stale — and NEVER
- *      rewrites a hook body or deletes a file. Classification is owned by
+ *      rewrites a hook body or deletes a file, with one scoped exception: on
+ *      Windows, `remove-ps1-shims` deletes npm-generated hq-cli `.ps1`
+ *      launchers (and only files whose content is that shim) from the npm
+ *      prefix, outside the HQ tree. Classification is owned by
  *      {@link deriveRemediation};
  *      a content-drift finding is manual-only and simply never appears in the
  *      fixable set.
@@ -44,6 +47,7 @@ import { parseHookGateProfiles, requiredMissingProfiles, } from "../hook-gate-pr
 import { createBackup } from "./backup.js";
 import { removeStrayGateEntries } from "../stray-gate-entries.js";
 import { deriveRemediation } from "./remediation.js";
+import { HQ_CLI_BINS, removeHqCliPs1Shims } from "../../windows/ps1-shims.js";
 import { botDir } from "../../bot/paths.js";
 import { readBotConfig } from "../../bot/config.js";
 import { buildBotDaemonPaths, installedDaemonHqBinary, repairBotDaemonIfStale, rewriteBotDaemonNodePath, } from "../../bot/daemon.js";
@@ -197,6 +201,7 @@ export async function applyFixes(options) {
     };
     const rewriteBotNodePath = options.rewriteBotNodePath ?? defaultRewriteBotNodePath;
     const repairBotHqBinary = options.repairBotHqBinary ?? defaultRepairBotHqBinary;
+    const removePs1Shims = options.removePs1Shims ?? defaultRemovePs1Shims;
     // 2. Collect findings, then plan each newly unlocked allowlisted repair.
     //    Identity is deliberately the check id + target pair: an unsuccessful
     //    repair must not be applied repeatedly in one invocation.
@@ -238,7 +243,7 @@ export async function applyFixes(options) {
             const rem = deriveRemediation(result);
             if (!rem?.autoFixable)
                 continue;
-            const plan = planFix(hqRoot, result, rem, refreshSync, rewriteBotNodePath, repairBotHqBinary, refreshManifest);
+            const plan = planFix(hqRoot, result, rem, refreshSync, rewriteBotNodePath, repairBotHqBinary, refreshManifest, removePs1Shims);
             if (!plan)
                 continue;
             const key = JSON.stringify([plan.checkId, plan.target]);
@@ -683,8 +688,10 @@ export function uncommittedHookConfigChanges(hqRoot) {
 }
 // --- Fix planning --------------------------------------------------------------
 /** Build the concrete plan for one auto-fixable finding, or null if unplannable. */
-function planFix(hqRoot, result, rem, refreshSync, rewriteBotNodePath = defaultRewriteBotNodePath, repairBotHqBinary = defaultRepairBotHqBinary, refreshManifest = defaultRefreshManifest) {
+function planFix(hqRoot, result, rem, refreshSync, rewriteBotNodePath = defaultRewriteBotNodePath, repairBotHqBinary = defaultRepairBotHqBinary, refreshManifest = defaultRefreshManifest, removePs1Shims = defaultRemovePs1Shims) {
     switch (rem.fixClass) {
+        case "remove-ps1-shims":
+            return planRemovePs1Shims(result, rem, removePs1Shims);
         case "bot-node-path":
             return planBotNodePath(result, rem, rewriteBotNodePath);
         case "bot-hq-binary":
@@ -753,6 +760,34 @@ function planBotHqBinary(result, rem, repair) {
         postStatus: (results) => results.find((entry) => entry.checkId === result.checkId)?.status ?? null,
     };
 }
+/** Remove npm's hq-cli `.ps1` launchers so PowerShell falls back to `hq.cmd`. */
+function planRemovePs1Shims(result, rem, remove) {
+    const dir = rem.fixTarget;
+    if (!dir)
+        return null;
+    let failure;
+    return {
+        checkId: result.checkId,
+        fixClass: "remove-ps1-shims",
+        target: dir,
+        relpath: "",
+        preview: Object.keys(HQ_CLI_BINS).map((bin) => `  - ${path.win32.join(dir, `${bin}.ps1`)}`).join("\n") +
+            "\n      only npm's hq-cli launchers are removed; hq.cmd stays and the execution policy is not changed",
+        summary: "remove hq .ps1 launchers",
+        apply: () => {
+            const outcome = remove(dir);
+            failure = outcome.failed.length > 0 ? outcome.failed.map((entry) => entry.reason).join("; ") : undefined;
+        },
+        postStatus: (results) => results.find((entry) => entry.checkId === result.checkId)?.status ?? null,
+        failureReason: () => failure,
+    };
+}
+/** Default `remove-ps1-shims` repair: Windows only, a no-op elsewhere. */
+export function defaultRemovePs1Shims(dir) {
+    if (process.platform !== "win32")
+        return { removed: [], kept: [], failed: [] };
+    return removeHqCliPs1Shims(dir);
+}
 /** Real launchctl for the `bot-hq-binary` reload; a failure is a non-ok result. */
 const doctorLaunchctl = (args) => {
     const r = spawnSync("launchctl", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });

package/dist/lib/doctor/fix/remediation.d.ts

@@ -35,6 +35,14 @@
  *                         and hashes); it never writes the HQ tree. A company
  *                         scope whose slug did not resolve locally stays
  *                         manual-only.
+ *   - `remove-ps1-shims` — Windows only: delete the npm-generated `hq.ps1` /
+ *                         `hq-auth-refresh.ps1` launchers from the npm prefix
+ *                         when the PowerShell execution policy blocks them.
+ *                         `hq.cmd` stays and PowerShell falls back to it. The
+ *                         removal only touches files whose content is npm's
+ *                         hq-cli shim (see `lib/windows/ps1-shims.ts`); the
+ *                         execution policy is never changed. This is the one
+ *                         scoped exception to the no-delete rule below.
  *
  * EVERYTHING else — content drift between platform copies, a missing script, a
  * missing Codex counterpart, an unquoted `$CLAUDE_PROJECT_DIR`, a stale
@@ -46,7 +54,7 @@
  */
 import type { CheckResult } from "../types.js";
 /** The allowlisted safe repair classes `--fix` is permitted to apply. */
-export type FixClass = "executable-bit" | "gate-profile" | "remove-stray-gate-entries" | "refresh-sync" | "refresh-manifest" | "bot-node-path" | "bot-hq-binary";
+export type FixClass = "executable-bit" | "gate-profile" | "remove-stray-gate-entries" | "refresh-sync" | "refresh-manifest" | "bot-node-path" | "bot-hq-binary" | "remove-ps1-shims";
 /**
  * A finding's structured remediation. `autoFixable`, `action`, and `command`
  * are the `--json` surface (AC1); `fixTarget`/`fixClass` are the internal handle

package/dist/lib/doctor/fix/remediation.js

@@ -35,6 +35,14 @@
  *                         and hashes); it never writes the HQ tree. A company
  *                         scope whose slug did not resolve locally stays
  *                         manual-only.
+ *   - `remove-ps1-shims` — Windows only: delete the npm-generated `hq.ps1` /
+ *                         `hq-auth-refresh.ps1` launchers from the npm prefix
+ *                         when the PowerShell execution policy blocks them.
+ *                         `hq.cmd` stays and PowerShell falls back to it. The
+ *                         removal only touches files whose content is npm's
+ *                         hq-cli shim (see `lib/windows/ps1-shims.ts`); the
+ *                         execution policy is never changed. This is the one
+ *                         scoped exception to the no-delete rule below.
  *
  * EVERYTHING else — content drift between platform copies, a missing script, a
  * missing Codex counterpart, an unquoted `$CLAUDE_PROJECT_DIR`, a stale
@@ -44,6 +52,7 @@
  * content-drift finding is manual-only, because that boundary is load-bearing:
  * deciding which of two diverged copies is correct needs human judgement.
  */
+import * as path from "node:path";
 import { isCompanyJournalSlug, isSafeCompanySlug, isPersonalJournalSlug, journalSlugFromCheckId, } from "../checks/sync-health.js";
 /** Matches an exec-bit remediation command, quoted or not: `chmod +x <path>`. */
 const CHMOD_EXEC = /^chmod\s+\+x\s+(.+)$/;
@@ -143,6 +152,19 @@ export function deriveRemediation(result) {
             command: remediation ?? `hq bot daemon install ${name}`,
         };
     }
+    // remove-ps1-shims — PowerShell resolves `hq` to npm's hq.ps1 and the
+    // execution policy blocks it (feedback_29d91817). The target is the shim;
+    // the fix acts on its directory, the npm prefix.
+    if (checkId === "cli-ps1-shim.blocked-by-policy" && result.status === "WARN" && target) {
+        const dir = path.win32.dirname(target);
+        return {
+            autoFixable: true,
+            fixClass: "remove-ps1-shims",
+            fixTarget: dir,
+            action: `Remove the npm-generated hq .ps1 launchers from ${dir} so PowerShell runs hq.cmd (the execution policy is not changed).`,
+            command: "hq.cmd install --global",
+        };
+    }
     // Available hq-core upgrade. WARN is intentional in `hq doctor` and is
     // not a broken sync; --fix has no mechanical repair for it.
     if (checkId === "sync.update.core") {

package/dist/lib/doctor/registry.js

@@ -29,6 +29,7 @@ import { scaffoldCliFloorFamily } from "./checks/scaffold-cli-floor.js";
 import { strandedLanesFamily } from "./checks/stranded-lanes.js";
 import { releaseLinksFamily } from "./checks/release-links.js";
 import { cliPathFamily } from "./checks/cli-path.js";
+import { ps1ShimsFamily } from "./checks/ps1-shims.js";
 import { tempHomesFamily } from "./checks/temp-homes.js";
 import { fixtureCoverageFamily } from "./fixtures/discover.js";
 import { checkClaudeWiring } from "./checks/claude-wiring.js";
@@ -280,6 +281,7 @@ export function createDefaultRegistry() {
     // Windows: the npm hq.cmd shim folder must be on PATH for a new terminal to
     // find hq. Registry read only; prints the fix, never edits PATH.
     registry.register(cliPathFamily);
+    registry.register(ps1ShimsFamily);
     // Idle tmp.* throwaway homes holding a Rust toolchain download. Dry-run
     // scan only; `hq doctor --sweep-temp-homes` is the delete path.
     registry.register(tempHomesFamily);