@indigoai-us/hq-cli 5.345.3 → 5.345.4

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.345.4] — 2026-10-05
+- Run a pinned or newer managed hq-cloud sync runner ahead of the staged sync bundle, so daemon sync no longer stays on the hq-cloud version bundled with the CLI after an update or pin (hq-cli#1547).
+- Avoid dispatching the global hook when the working directory is inside an HQ root.
+
 ## [5.345.3] — 2026-10-05
 - Retry a blocker freshness lane-inbox fallback after a transient append failure.
 - Scope bundled-script stdin checks to changes in their workflow, build inputs, CLI sources, tests, or shell assets.

package/dist/lib/daemon/hq-cloud.d.ts

@@ -23,6 +23,11 @@ export type ManagedHqCloud = PickedHqCloud & {
 export declare function managedHqCloudDir(daemonRoot: string): string;
 /** The package folder inside the updater's install prefix. */
 export declare function managedHqCloudRoot(daemonRoot: string): string;
+/**
+ * True only when both versions are valid semver and `a` is older than `b`.
+ * Prereleases count, so 6.18.33-alpha.1 is older than 6.18.33.
+ */
+export declare function hqCloudVersionOlder(a: string, b: string): boolean;
 /**
  * `usable` says whether a copy has what the daemon runs; a newer managed copy
  * that fails it (an interrupted or damaged install) is passed over.

package/dist/lib/daemon/hq-cloud.js

@@ -10,6 +10,7 @@ import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import { createRequire } from "node:module";
 import * as path from "node:path";
+import { lt as semverLt, valid as validSemver } from "semver";
 import { readDaemonConfig } from "./config.js";
 import { buildSpawnPlan } from "../../utils/windows-spawn.js";
 export const HQ_CLOUD_PACKAGE = "@indigoai-us/hq-cloud";
@@ -31,6 +32,15 @@ function newer(a, b) {
     }
     return false;
 }
+/**
+ * True only when both versions are valid semver and `a` is older than `b`.
+ * Prereleases count, so 6.18.33-alpha.1 is older than 6.18.33.
+ */
+export function hqCloudVersionOlder(a, b) {
+    const va = validSemver(a.trim());
+    const vb = validSemver(b.trim());
+    return !!va && !!vb && semverLt(va, vb);
+}
 /**
  * `usable` says whether a copy has what the daemon runs; a newer managed copy
  * that fails it (an interrupted or damaged install) is passed over.

package/dist/lib/daemon/run.d.ts

@@ -59,7 +59,10 @@ export type SyncRunnerSource = {
     kind: "unavailable";
     runnerPath: null;
 };
-export declare function syncRunnerSourceForPlan(stagedRunnerPath: string | null, hqCloud: PickedHqCloud | null, legacyBundledRunnerPath?: string | null): SyncRunnerSource;
+export declare function syncRunnerSourceForPlan(stagedRunnerPath: string | null, hqCloud: PickedHqCloud | null, legacyBundledRunnerPath?: string | null, staged?: {
+    version: string | null;
+    pinnedVersion?: string | null;
+}): SyncRunnerSource;
 /** Whether every executable in the first service plan remains usable after the CLI package is replaced. */
 export declare function daemonPlanCanReleasePackageUseLease(plans: readonly UnitPlan[], replaceablePackageRoots: readonly string[], stagingFailed: boolean, hqBootstrapReady?: boolean): boolean;
 export declare function daemonHqChildCommand(nodeBinary: string, hqBinary: string, args: readonly string[], bootstrapPath: string | null, packagePrefix: string | null): [string, string[]];

package/dist/lib/daemon/run.js

@@ -37,7 +37,7 @@ import { startHqdServer } from "./server.js";
 import { heartbeatFile, startHeartbeat } from "./heartbeat.js";
 import { createProtocolTail, ensureProtocolFifo, openProtocolWriter } from "./protocol-tail.js";
 import { takeControlRequests } from "./requests.js";
-import { currentHqCloud, currentHqCloudAfterLeaseRelease, hqCloudRunners } from "./hq-cloud.js";
+import { currentHqCloud, currentHqCloudAfterLeaseRelease, hqCloudRunners, hqCloudVersionOlder } from "./hq-cloud.js";
 import { stageSyncRunnerBundle } from "./sync-runner-bundle.js";
 import { stageHqChildBootstrap } from "./hq-child-bootstrap-stage.js";
 import { runnerSessionName } from "./remote-control.js";
@@ -76,7 +76,21 @@ export function handoffForPackageUpdateRequest(requested, restartDaemon) {
 const LEGACY_PROBE_TTL_MS = 60_000;
 /** A flag read that has not answered by then counts as off. */
 const HANDOFF_FLAG_TIMEOUT_MS = 10_000;
-export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundledRunnerPath = null) {
+export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundledRunnerPath = null, staged = { version: null }) {
+    // A managed copy lives in the daemon directory, so it survives a CLI
+    // replacement. Before lease release pickHqCloud returns it only when it is
+    // pinned or newer than the bundled copy; after release it is the only
+    // eligible package, so it must not displace a newer staged bundle unless it
+    // is the pinned version. The staged bundle is built from the bundled copy and
+    // otherwise only stands in for that copy (hq-cli#1547).
+    const managedYieldsToStaged = stagedRunnerPath !== null &&
+        hqCloud?.source === "managed" &&
+        hqCloud.version !== staged.pinnedVersion &&
+        staged.version !== null &&
+        hqCloudVersionOlder(hqCloud.version, staged.version);
+    if (hqCloud?.source === "managed" && !managedYieldsToStaged) {
+        return { kind: "managed-full-package", runnerPath: path.join(hqCloud.root, "dist", "bin", "sync-runner.js") };
+    }
     if (stagedRunnerPath)
         return { kind: "staged-sync", runnerPath: stagedRunnerPath };
     if (!hqCloud) {
@@ -86,10 +100,7 @@ export function syncRunnerSourceForPlan(stagedRunnerPath, hqCloud, legacyBundled
     }
     // The caller has already selected a usable full package; preserve the
     // conventional path here, including in tests with virtual package roots.
-    const runnerPath = path.join(hqCloud.root, "dist", "bin", "sync-runner.js");
-    return hqCloud.source === "managed"
-        ? { kind: "managed-full-package", runnerPath }
-        : { kind: "bundled-full-package", runnerPath };
+    return { kind: "bundled-full-package", runnerPath: path.join(hqCloud.root, "dist", "bin", "sync-runner.js") };
 }
 function isPathWithin(root, candidate) {
     if (!root || !path.isAbsolute(candidate))
@@ -559,7 +570,7 @@ export async function runDaemon(opts) {
             legacySyncRunnerPath = resolveSyncRunnerPath();
             legacySyncRunnerPathChecked = true;
         }
-        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath);
+        const syncSource = syncRunnerSourceForPlan(staged?.runnerPath ?? null, hqCloud, packageUseLeaseReleased ? null : legacySyncRunnerPath, { version: staged?.metadata.version ?? null, pinnedVersion: config.hqCloudVersion ?? null });
         if (!syncSource.runnerPath && !warnedMissingSyncRunner) {
             warnedMissingSyncRunner = true;
             log("warn", "the hq-cloud sync runner was not found in this CLI install; sync is unavailable");

package/dist/lib/install/claude-targets.js

@@ -49,7 +49,7 @@ export function hqSkillsSource(hqRoot) {
 }
 /** The exact hook command registered for one event (absolute path, quoted). */
 export function hookCommand(hqRoot, event, target = 'master') {
-    const skipInsideRoot = `if [ -d "\${CLAUDE_PROJECT_DIR:-}" ] && [ "\${CLAUDE_PROJECT_DIR}" -ef ${shellQuote(hqRoot)} ]; then exit 0; fi; `;
+    const skipInsideRoot = `if [ -d "\${CLAUDE_PROJECT_DIR:-}" ] && [ "\${CLAUDE_PROJECT_DIR}" -ef ${shellQuote(hqRoot)} ]; then exit 0; fi; cwd=$(pwd -P 2>/dev/null || pwd); while [ -n "$cwd" ]; do if [ -f "$cwd/core/core.yaml" ] && [ -f "$cwd/companies/manifest.yaml" ]; then exit 0; fi; [ "$cwd" = / ] && break; cwd=\${cwd%/*}; [ -n "$cwd" ] || cwd=/; done; `;
     if (target === 'shim')
         return `${skipInsideRoot}exec /bin/sh ${shellQuote(shimPath(hqRoot))} ${shellQuote(event)} --runtime claude`;
     return `${skipInsideRoot}BASH_ENV=/dev/null exec bash ${shellQuote(masterHookPath(hqRoot))} ${shellQuote(event)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.3",
+  "version": "5.345.4",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {