@indigoai-us/hq-cli 5.345.202 → 5.345.204

package/dist/lib/sync-core/engine-home.d.ts

@@ -17,13 +17,14 @@ export declare const SYNC_CORE_REQUESTS_PER_DAY = 20000;
 export declare function syncCoreEngineHome(home: string, vaultUid: string): string;
 export declare function syncCoreUnitId(vaultUid: string): string;
 export declare function isSyncCoreVaultUid(value: unknown): value is string;
-export declare function engineConfigToml(vault: SyncCoreVault, hqRoot: string, phase: SyncCoreVaultPhase): string;
+export declare function engineConfigToml(vault: SyncCoreVault, hqRoot: string, phase: SyncCoreVaultPhase, tokenPath?: string): string;
 export interface WriteEngineHomeOptions {
     home: string;
     hqRoot: string;
     vault: SyncCoreVault;
     phase: SyncCoreVaultPhase;
     tokenFile: string;
+    platform?: NodeJS.Platform;
 }
 export declare function writeEngineHome(opts: WriteEngineHomeOptions): {
     engineHome: string;

package/dist/lib/sync-core/engine-home.js

@@ -11,7 +11,7 @@ export function syncCoreUnitId(vaultUid) {
 export function isSyncCoreVaultUid(value) {
     return typeof value === "string" && /^(prs|cmp)_[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value);
 }
-export function engineConfigToml(vault, hqRoot, phase) {
+export function engineConfigToml(vault, hqRoot, phase, tokenPath) {
     const lines = [
         "[sync]",
         'engine = "rust-test"',
@@ -20,6 +20,7 @@ export function engineConfigToml(vault, hqRoot, phase) {
         `vaults = [${JSON.stringify(vault.uid)}]`,
         `hq_root = ${JSON.stringify(hqRoot)}`,
         `requests_per_day = ${SYNC_CORE_REQUESTS_PER_DAY}`,
+        ...(tokenPath ? [`token_path = ${JSON.stringify(tokenPath)}`] : []),
     ];
     if (vault.kind === "company") {
         lines.push("[sync.roots]", `${vault.uid} = ${JSON.stringify(`companies/${vault.slug}`)}`);
@@ -52,15 +53,24 @@ function writeIfChanged(file, text) {
     fs.renameSync(tmp, file);
     return true;
 }
+/**
+ * The files an engine home links to on macOS and Linux. Windows needs a privilege to create a
+ * symlink, so there the config names the token file and the engine reads `menubar.json` and
+ * `work-mesh/` from `HQ_STATE_DIR`, which the daemon sets.
+ */
+const ENGINE_HOME_LINKS = ["menubar.json", "work-mesh", "cognito-tokens.json"];
 export function writeEngineHome(opts) {
     const engineHome = syncCoreEngineHome(opts.home, opts.vault.uid);
     const hq = path.join(engineHome, ".hq");
     const root = path.join(hq, "sync-core");
     fs.mkdirSync(path.join(root, "owned"), { recursive: true, mode: 0o700 });
-    replaceSymlink(path.join(hq, "menubar.json"), path.join(opts.home, ".hq", "menubar.json"));
-    replaceSymlink(path.join(hq, "work-mesh"), path.join(opts.home, ".hq", "work-mesh"));
-    replaceSymlink(path.join(hq, "cognito-tokens.json"), opts.tokenFile);
-    const configChanged = writeIfChanged(path.join(root, "config.toml"), engineConfigToml(opts.vault, opts.hqRoot, opts.phase));
+    const windows = (opts.platform ?? process.platform) === "win32";
+    if (!windows) {
+        replaceSymlink(path.join(hq, "menubar.json"), path.join(opts.home, ".hq", "menubar.json"));
+        replaceSymlink(path.join(hq, "work-mesh"), path.join(opts.home, ".hq", "work-mesh"));
+        replaceSymlink(path.join(hq, "cognito-tokens.json"), opts.tokenFile);
+    }
+    const configChanged = writeIfChanged(path.join(root, "config.toml"), engineConfigToml(opts.vault, opts.hqRoot, opts.phase, windows ? opts.tokenFile : undefined));
     const ownedPath = path.join(root, "owned", `${opts.vault.uid}.json`);
     let ownedChanged = false;
     if (opts.phase === "full") {
@@ -123,8 +133,9 @@ function blocked(plan, blockedReason) {
     return { ...plan, blockedReason };
 }
 export function inspectEngineHome(home, hqRoot, plan, platform) {
-    if (platform !== "darwin" && platform !== "linux")
-        return blocked(plan, "the sync engine requires macOS or Linux");
+    if (platform !== "darwin" && platform !== "linux" && platform !== "win32") {
+        return blocked(plan, "the sync engine requires macOS, Linux or Windows");
+    }
     try {
         if (!fs.statSync(plan.binaryPath).isFile())
             return blocked(plan, "the sync engine binary is missing");
@@ -182,7 +193,13 @@ export function inspectEngineHome(home, hqRoot, plan, platform) {
     else if (fs.existsSync(ownedPath)) {
         return blocked(plan, `the engine ownership record for ${plan.uid} must not exist while the index warms`);
     }
-    for (const link of ["menubar.json", "work-mesh", "cognito-tokens.json"]) {
+    if (platform === "win32") {
+        if (typeof sync.token_path !== "string" || !path.isAbsolute(sync.token_path)) {
+            return blocked(plan, `the engine config for ${plan.uid} must name the token file`);
+        }
+        return plan;
+    }
+    for (const link of ENGINE_HOME_LINKS) {
         try {
             fs.readlinkSync(path.join(plan.engineHome, ".hq", link));
         }

package/dist/lib/sync-core/reconcile.d.ts

@@ -1,5 +1,5 @@
 import { type SyncCoreVault } from "./engine-home.js";
-import { type SyncCoreBinaryInstall } from "./release.js";
+import { type SyncCoreBinaryInstall, type SyncCorePin } from "./release.js";
 import { type SyncCoreRolloutState } from "./rollout-state.js";
 export interface SyncCoreMembership {
     companyUid: string;
@@ -14,7 +14,12 @@ export interface SyncCoreReconcileDeps {
     resolvePersonUid: () => Promise<string | null>;
     readRolloutFlag: (companyUid: string) => Promise<boolean>;
     ensureBinary: (release: string) => Promise<SyncCoreBinaryInstall>;
+    /** A fixed release (tests). Otherwise readPin decides, then SYNC_CORE_RELEASE. */
     release?: string;
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    /** Reads the server-side engine pin; never throws (see readSyncCorePin). */
+    readPin?: () => Promise<SyncCorePin>;
     now?: () => Date;
     log?: (line: string) => void;
 }
@@ -26,6 +31,6 @@ export interface SyncCoreReconcileResult {
     kept: string[];
     warnings: string[];
 }
-export declare function fullModeHold(vault: SyncCoreVault, release: string): string | undefined;
+export declare function fullModeHold(vault: SyncCoreVault, release: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): string | undefined;
 export declare function reconcileSyncCore(deps: SyncCoreReconcileDeps): Promise<SyncCoreReconcileResult>;
 //# sourceMappingURL=reconcile.d.ts.map

package/dist/lib/sync-core/reconcile.js

@@ -3,16 +3,21 @@ import * as path from "node:path";
 import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { readVaultSyncSwitches, writeVaultSyncSwitches } from "../vault-sync-switches.js";
 import { clearEngineStatus, engineFirstCycle, isSyncCoreVaultUid, removeEngineOwnership, syncCoreEngineHome, writeEngineHome, } from "./engine-home.js";
-import { SYNC_CORE_FULL_RELEASE, SYNC_CORE_RELEASE, fullModeAllowed, installedSyncCoreRelease, syncCoreBinaryPath, } from "./release.js";
+import { SYNC_CORE_FULL_RELEASE, SYNC_CORE_RELEASE, compareSyncCoreReleases, fullModeAllowed, installedSyncCoreRelease, syncCoreBinaryPath, windowsFullRelease, } from "./release.js";
 import { readSyncCoreSkips } from "./skip.js";
 import { SYNC_RUST_ENGINE_ROLLOUT_FLAG } from "./flag.js";
 import { readSyncCoreRolloutState, syncCoreRolloutStatePath, writeSyncCoreRolloutState, } from "./rollout-state.js";
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }
-export function fullModeHold(vault, release) {
-    if (fullModeAllowed(release))
+export function fullModeHold(vault, release, platform = process.platform, env = process.env) {
+    if (fullModeAllowed(release, platform, env))
         return undefined;
+    if (platform === "win32" && fullModeAllowed(release, "linux", env)) {
+        const windows = windowsFullRelease(env);
+        const needed = windows ? `engine release ${windows} or later` : "an engine release cleared for full sync on Windows";
+        return `${vault.kind} vaults on Windows move to the new sync engine with ${needed} (${release} available); staying on the current sync`;
+    }
     const needed = SYNC_CORE_FULL_RELEASE ? `engine release ${SYNC_CORE_FULL_RELEASE} or later` : "an engine release cleared for full sync";
     return `${vault.kind} vaults move to the new sync engine with ${needed} (${release} installed); staying on the current sync`;
 }
@@ -65,8 +70,10 @@ function ownedVaultsWithoutState(home, hqRoot) {
 export async function reconcileSyncCore(deps) {
     const now = deps.now ?? (() => new Date());
     const log = deps.log ?? (() => { });
-    const release = deps.release ?? SYNC_CORE_RELEASE;
+    const platform = deps.platform ?? process.platform;
+    const env = deps.env ?? process.env;
     const warnings = [];
+    let release = deps.release ?? SYNC_CORE_RELEASE;
     const previous = readSyncCoreRolloutState(deps.home);
     const previousVaults = previous?.vaults ?? ownedVaultsWithoutState(deps.home, deps.hqRoot);
     const previousByUid = new Map(previousVaults.map((vault) => [vault.uid, vault]));
@@ -114,9 +121,26 @@ export async function reconcileSyncCore(deps) {
     catch (error) {
         warnings.push(message(error));
     }
-    let binaryPath = syncCoreBinaryPath(deps.home);
-    let installedRelease = installedSyncCoreRelease(deps.home);
+    let binaryPath = syncCoreBinaryPath(deps.home, platform);
+    let installedRelease = installedSyncCoreRelease(deps.home, platform);
+    const held = [];
+    const best = installedRelease && compareSyncCoreReleases(installedRelease, release) >= 0 ? installedRelease : release;
+    if (platform === "win32" && !fullModeAllowed(best, platform, env)) {
+        for (const vault of desired)
+            held.push({ uid: vault.uid, reason: fullModeHold(vault, best, platform, env) });
+        desired.length = 0;
+    }
     if (desired.length > 0) {
+        if (deps.release === undefined && deps.readPin) {
+            const pin = await deps.readPin();
+            release = pin.release;
+            if (pin.warning)
+                warnings.push(pin.warning);
+            if (pin.source === "server" && installedRelease && compareSyncCoreReleases(pin.release, installedRelease) < 0) {
+                // The no-downgrade guard in ensureSyncCoreBinary keeps the newer engine.
+                log(`the server pins hq-syncd ${pin.release}, older than the installed ${installedRelease}; keeping ${installedRelease}`);
+            }
+        }
         try {
             const install = await deps.ensureBinary(release);
             binaryPath = install.binaryPath;
@@ -130,10 +154,9 @@ export async function reconcileSyncCore(deps) {
                 desired.length = 0;
         }
     }
-    const held = [];
     const engineRelease = installedRelease ?? release;
     for (let i = desired.length - 1; i >= 0; i -= 1) {
-        const reason = fullModeHold(desired[i], engineRelease);
+        const reason = fullModeHold(desired[i], engineRelease, platform, env);
         if (!reason)
             continue;
         held.unshift({ uid: desired[i].uid, reason });
@@ -152,7 +175,7 @@ export async function reconcileSyncCore(deps) {
         const engineHome = syncCoreEngineHome(deps.home, vault.uid);
         if (!before)
             clearEngineStatus(deps.home, vault.uid);
-        writeEngineHome({ home: deps.home, hqRoot: deps.hqRoot, vault, phase: "full", tokenFile: deps.tokenFile });
+        writeEngineHome({ home: deps.home, hqRoot: deps.hqRoot, vault, phase: "full", tokenFile: deps.tokenFile, platform });
         const wasFull = before?.phase === "full";
         const alreadyOff = vault.kind === "personal"
             ? switchesBefore.personalOff

package/dist/lib/sync-core/release.d.ts

@@ -1,16 +1,48 @@
 export declare const SYNC_CORE_RELEASE = "v0.1.23";
 export declare const SYNC_CORE_FULL_RELEASE: string | null;
+/**
+ * The first engine release whose Windows build runs full sync. Until it is set, Windows vaults
+ * stay on the current sync and no Windows engine is downloaded. `HQ_SYNC_CORE_WINDOWS_FULL_RELEASE`
+ * overrides it on one machine, for testing a build before it is released.
+ */
+export declare const SYNC_CORE_WINDOWS_FULL_RELEASE: string | null;
+export declare const SYNC_CORE_WINDOWS_FULL_RELEASE_ENV = "HQ_SYNC_CORE_WINDOWS_FULL_RELEASE";
 export declare function compareSyncCoreReleases(a: string, b: string): number;
-export declare function fullModeAllowed(release: string): boolean;
+export declare function windowsFullRelease(env?: NodeJS.ProcessEnv): string | null;
+export declare function fullModeAllowed(release: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): boolean;
 export declare const SYNC_CORE_DOWNLOAD_BASE = "https://indigoai-public.s3.amazonaws.com/hq-sync-core";
 export declare const SYNC_CORE_DOWNLOAD_BASE_ENV = "HQ_SYNC_CORE_DOWNLOAD_BASE";
-export declare function syncCoreBinaryPath(home?: string): string;
+/** The server-side engine pin, published next to the release folders on the download base. */
+export declare const SYNC_CORE_PIN_FILE = "pin.json";
+export interface SyncCorePin {
+    /** The engine release machines should run. */
+    release: string;
+    /** "server": read from pin.json; "built-in": SYNC_CORE_RELEASE, because no server pin could be used. */
+    source: "server" | "built-in";
+    /** Why the server pin was not used, when it exists but could not be read. A missing pin.json sets none. */
+    warning?: string;
+}
+/**
+ * The engine release to install, read from `<download base>/pin.json`
+ * (`{"release":"v0.1.24"}`), so an engine release reaches machines without an
+ * hq-cli release. Falls back to SYNC_CORE_RELEASE when the file is missing,
+ * unreadable or malformed. Never throws. The pin only picks a version: on
+ * Windows the release gate (fullModeAllowed) still decides whether it installs.
+ */
+export declare function readSyncCorePin(opts?: {
+    env?: NodeJS.ProcessEnv;
+    baseUrl?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<SyncCorePin>;
+export declare function syncCoreBinaryName(platform?: NodeJS.Platform): string;
+export declare function syncCoreBinaryPath(home?: string, platform?: NodeJS.Platform): string;
 export declare function syncCoreReleaseMarkerPath(home?: string): string;
 export declare function syncCoreAssetName(release: string, platform: NodeJS.Platform, arch: string): string | null;
 export declare function syncCoreDownloadBase(env?: NodeJS.ProcessEnv): string;
 export declare function parseSha256Sums(text: string): Map<string, string>;
 export declare function syncCoreBinaryVersion(binaryPath: string): string | null;
-export declare function installedSyncCoreRelease(home: string): string | null;
+export declare function installedSyncCoreRelease(home: string, platform?: NodeJS.Platform): string | null;
 export interface EnsureSyncCoreBinaryOptions {
     home: string;
     platform: NodeJS.Platform;

package/dist/lib/sync-core/release.js

@@ -5,6 +5,13 @@ import * as path from "node:path";
 import { execFileSync } from "node:child_process";
 export const SYNC_CORE_RELEASE = "v0.1.23";
 export const SYNC_CORE_FULL_RELEASE = "v0.1.23";
+/**
+ * The first engine release whose Windows build runs full sync. Until it is set, Windows vaults
+ * stay on the current sync and no Windows engine is downloaded. `HQ_SYNC_CORE_WINDOWS_FULL_RELEASE`
+ * overrides it on one machine, for testing a build before it is released.
+ */
+export const SYNC_CORE_WINDOWS_FULL_RELEASE = null;
+export const SYNC_CORE_WINDOWS_FULL_RELEASE_ENV = "HQ_SYNC_CORE_WINDOWS_FULL_RELEASE";
 export function compareSyncCoreReleases(a, b) {
     const parse = (release) => release.replace(/^v/, "").split(".").map((part) => Number.parseInt(part, 10) || 0);
     const [x, y] = [parse(a), parse(b)];
@@ -15,14 +22,65 @@ export function compareSyncCoreReleases(a, b) {
     }
     return 0;
 }
-export function fullModeAllowed(release) {
-    return SYNC_CORE_FULL_RELEASE !== null && compareSyncCoreReleases(release, SYNC_CORE_FULL_RELEASE) >= 0;
+export function windowsFullRelease(env = process.env) {
+    const override = env[SYNC_CORE_WINDOWS_FULL_RELEASE_ENV]?.trim();
+    return override && /^v?\d+\.\d+\.\d+$/.test(override) ? override : SYNC_CORE_WINDOWS_FULL_RELEASE;
+}
+export function fullModeAllowed(release, platform = process.platform, env = process.env) {
+    if (SYNC_CORE_FULL_RELEASE === null || compareSyncCoreReleases(release, SYNC_CORE_FULL_RELEASE) < 0)
+        return false;
+    if (platform !== "win32")
+        return true;
+    const windows = windowsFullRelease(env);
+    return windows !== null && compareSyncCoreReleases(release, windows) >= 0;
 }
 export const SYNC_CORE_DOWNLOAD_BASE = "https://indigoai-public.s3.amazonaws.com/hq-sync-core";
 export const SYNC_CORE_DOWNLOAD_BASE_ENV = "HQ_SYNC_CORE_DOWNLOAD_BASE";
 const DOWNLOAD_TIMEOUT_MS = 600_000;
-export function syncCoreBinaryPath(home = os.homedir()) {
-    return path.join(home, ".hq", "bin", "hq-syncd");
+/** The server-side engine pin, published next to the release folders on the download base. */
+export const SYNC_CORE_PIN_FILE = "pin.json";
+const PIN_TIMEOUT_MS = 10_000;
+const RELEASE_PATTERN = /^v\d+\.\d+\.\d+$/;
+/**
+ * The engine release to install, read from `<download base>/pin.json`
+ * (`{"release":"v0.1.24"}`), so an engine release reaches machines without an
+ * hq-cli release. Falls back to SYNC_CORE_RELEASE when the file is missing,
+ * unreadable or malformed. Never throws. The pin only picks a version: on
+ * Windows the release gate (fullModeAllowed) still decides whether it installs.
+ */
+export async function readSyncCorePin(opts = {}) {
+    const builtIn = (warning) => ({ release: SYNC_CORE_RELEASE, source: "built-in", ...(warning ? { warning } : {}) });
+    const url = `${opts.baseUrl?.replace(/\/+$/, "") ?? syncCoreDownloadBase(opts.env)}/${SYNC_CORE_PIN_FILE}`;
+    let response;
+    try {
+        response = await (opts.fetch ?? fetch)(url, { signal: AbortSignal.timeout(opts.timeoutMs ?? PIN_TIMEOUT_MS) });
+    }
+    catch (error) {
+        return builtIn(`could not read the engine pin ${url}: ${error instanceof Error ? error.message : String(error)}; using built-in ${SYNC_CORE_RELEASE}`);
+    }
+    // S3 answers 403 for a missing key on a bucket without public listing.
+    if (response.status === 404 || response.status === 403)
+        return builtIn();
+    if (!response.ok)
+        return builtIn(`could not read the engine pin ${url}: HTTP ${response.status}; using built-in ${SYNC_CORE_RELEASE}`);
+    let parsed;
+    try {
+        parsed = JSON.parse(await response.text());
+    }
+    catch {
+        return builtIn(`the engine pin ${url} is not JSON; using built-in ${SYNC_CORE_RELEASE}`);
+    }
+    const release = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.release : undefined;
+    if (typeof release !== "string" || !RELEASE_PATTERN.test(release)) {
+        return builtIn(`the engine pin ${url} has no valid "release" (want vX.Y.Z); using built-in ${SYNC_CORE_RELEASE}`);
+    }
+    return { release, source: "server" };
+}
+export function syncCoreBinaryName(platform = process.platform) {
+    return platform === "win32" ? "hq-syncd.exe" : "hq-syncd";
+}
+export function syncCoreBinaryPath(home = os.homedir(), platform = process.platform) {
+    return path.join(home, ".hq", "bin", syncCoreBinaryName(platform));
 }
 export function syncCoreReleaseMarkerPath(home = os.homedir()) {
     return path.join(home, ".hq", "bin", "hq-syncd.release");
@@ -34,6 +92,10 @@ export function syncCoreAssetName(release, platform, arch) {
         return `hq-sync-core-${release}-linux-x64.tar.gz`;
     if (platform === "linux" && arch === "arm64")
         return `hq-sync-core-${release}-linux-arm64.tar.gz`;
+    if (platform === "win32" && arch === "x64")
+        return `hq-sync-core-${release}-windows-x64.zip`;
+    if (platform === "win32" && arch === "arm64")
+        return `hq-sync-core-${release}-windows-arm64.zip`;
     return null;
 }
 export function syncCoreDownloadBase(env = process.env) {
@@ -59,9 +121,9 @@ export function syncCoreBinaryVersion(binaryPath) {
         return null;
     }
 }
-export function installedSyncCoreRelease(home) {
+export function installedSyncCoreRelease(home, platform = process.platform) {
     try {
-        const binary = syncCoreBinaryPath(home);
+        const binary = syncCoreBinaryPath(home, platform);
         if (!fs.statSync(binary).isFile())
             return null;
         fs.accessSync(binary, fs.constants.X_OK);
@@ -91,6 +153,24 @@ function findFile(dir, name) {
     }
     return null;
 }
+/**
+ * Windows cannot replace an executable that is running, but it can rename one. The old engine
+ * keeps running from `<binary>.old` until its unit restarts; the copy left by the previous
+ * update is removed first when nothing runs from it any more.
+ */
+function moveRunningBinaryAside(binaryPath) {
+    if (!fs.existsSync(binaryPath))
+        return;
+    const aside = `${binaryPath}.old`;
+    try {
+        fs.rmSync(aside, { force: true });
+    }
+    catch {
+        // still running from the previous update; that copy is removed on a later one
+    }
+    const target = fs.existsSync(aside) ? `${binaryPath}.${process.pid}.old` : aside;
+    fs.renameSync(binaryPath, target);
+}
 async function download(fetcher, url) {
     let response;
     try {
@@ -105,8 +185,8 @@ async function download(fetcher, url) {
 }
 export async function ensureSyncCoreBinary(opts) {
     const release = opts.release ?? SYNC_CORE_RELEASE;
-    const binaryPath = syncCoreBinaryPath(opts.home);
-    const installedRelease = installedSyncCoreRelease(opts.home);
+    const binaryPath = syncCoreBinaryPath(opts.home, opts.platform);
+    const installedRelease = installedSyncCoreRelease(opts.home, opts.platform);
     if (installedRelease && compareSyncCoreReleases(installedRelease, release) >= 0 && fs.existsSync(binaryPath)) {
         const marker = syncCoreReleaseMarkerPath(opts.home);
         let current = "";
@@ -147,13 +227,16 @@ export async function ensureSyncCoreBinary(opts) {
         fs.writeFileSync(archive, bytes, { mode: 0o600 });
         const extracted = path.join(staging, "extracted");
         fs.mkdirSync(extracted, { mode: 0o700 });
-        run("tar", ["-xzf", archive, "-C", extracted]);
-        const unpacked = findFile(extracted, "hq-syncd");
+        run("tar", [asset.endsWith(".zip") ? "-xf" : "-xzf", archive, "-C", extracted]);
+        const name = syncCoreBinaryName(opts.platform);
+        const unpacked = findFile(extracted, name);
         if (!unpacked)
-            throw new SyncCoreReleaseError(`${asset} does not contain hq-syncd`);
-        const prepared = path.join(staging, "hq-syncd");
+            throw new SyncCoreReleaseError(`${asset} does not contain ${name}`);
+        const prepared = path.join(staging, name);
         fs.copyFileSync(unpacked, prepared);
         fs.chmodSync(prepared, 0o700);
+        if (opts.platform === "win32")
+            moveRunningBinaryAside(binaryPath);
         fs.renameSync(prepared, binaryPath);
         const marker = syncCoreReleaseMarkerPath(opts.home);
         fs.writeFileSync(`${marker}.tmp`, `${release}\n`, { mode: 0o600 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.202",
+  "version": "5.345.204",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -117,11 +117,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.202",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.202",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.202",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.202",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.202",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.202"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.204",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.204",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.204",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.204",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.204",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.204"
   }
 }