@indigoai-us/hq-cli 5.345.34 → 5.345.35

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.345.35] — 2026-10-07
+- Claude plugin installs now use the HQ packages marketplace by default; local marketplace directory and environment overrides remain available.
+- Pin self-updates to the pnpm version recorded by the global install; preserve store dirs on pnpm 11+ and omit pnpm 10 virtual-store flags.
+
 ## [5.345.34] — 2026-10-07
 - Protect live remote-control tmux sessions with socket-scoped creator identity before cleanup.
 

package/dist/commands/core-resolve-company-native.d.ts

@@ -19,6 +19,8 @@ export type ResolveCompanyDependencies = {
     stdin?: string;
     stdinIsTty?: boolean;
     spawnHq?: (args: string[], env: NodeJS.ProcessEnv, timeoutMs: number, cwd?: string, command?: string) => Promise<HqResult>;
+    onHqSpawn?: (args: readonly string[]) => void;
+    onHqExit?: (args: readonly string[]) => void;
     pid?: number;
     random?: () => number;
 };

package/dist/commands/core-resolve-company-native.js

@@ -1,5 +1,5 @@
 /** Native port of resolve-company.sh. This module stays on the fast import path. */
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { awkCannotOpenFileDiagnostic } from "../lib/core-utils/awk-diagnostics.js";
@@ -272,30 +272,46 @@ function commandOnPath(name, env) {
     }
     return false;
 }
-function runHq(args, env, timeoutMs, cwd, command = "hq") {
+function runHq(args, env, timeoutMs, cwd, command = "hq", onExitObserved) {
     return new Promise((resolve) => {
         let settled = false;
         let stdout = "";
         let child;
         let timeoutKill;
         let timedOut = false;
-        const signalGroup = (signal) => {
-            if (!child?.pid)
+        const signalGroup = (signal, onComplete) => {
+            if (!child?.pid) {
+                onComplete?.();
                 return;
+            }
             try {
                 if (process.platform === "win32") {
                     const taskkill = path.join(env.SystemRoot ?? env.WINDIR ?? "C:\\Windows", "System32", "taskkill.exe");
-                    const result = spawnSync(taskkill, ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true });
-                    if (result.error || result.status !== 0)
-                        child.kill(signal);
+                    let completed = false;
+                    const complete = (code) => {
+                        if (completed)
+                            return;
+                        completed = true;
+                        if (code !== 0)
+                            child?.kill(signal);
+                        onComplete?.();
+                    };
+                    const killer = spawn(taskkill, ["/PID", String(child.pid), "/T", "/F"], {
+                        stdio: "ignore",
+                        windowsHide: true,
+                    });
+                    killer.once("error", () => complete(1));
+                    killer.once("exit", (code) => complete(code));
                 }
                 else {
                     process.kill(-child.pid, signal);
+                    onComplete?.();
                 }
             }
             catch (error) {
                 if (errorCode(error) !== "ESRCH")
                     finish({ code: 1, stdout });
+                onComplete?.();
             }
         };
         const finish = (result) => {
@@ -310,13 +326,13 @@ function runHq(args, env, timeoutMs, cwd, command = "hq") {
         const timer = setTimeout(() => {
             timedOut = true;
             if (child?.pid) {
-                signalGroup("SIGTERM");
-                // The shell wrapper returns shortly after its 2 second deadline. Do
-                // not wait for inherited stdio handles after killing the process group.
-                timeoutKill = setTimeout(() => {
-                    signalGroup("SIGKILL");
-                    finish({ code: 124, stdout });
-                }, 250);
+                signalGroup("SIGTERM", () => {
+                    // The shell wrapper returns shortly after its 2 second deadline. Give
+                    // the tree time to exit, then force-kill and wait for Windows cleanup.
+                    timeoutKill = setTimeout(() => {
+                        signalGroup("SIGKILL", () => finish({ code: 124, stdout }));
+                    }, 250);
+                });
             }
             else {
                 finish({ code: 124, stdout });
@@ -349,9 +365,24 @@ function runHq(args, env, timeoutMs, cwd, command = "hq") {
         child.stdout?.setEncoding("utf8");
         child.stdout?.on("data", (chunk) => { stdout += chunk; });
         child.once("error", () => finish({ code: 127, stdout }));
+        if (onExitObserved)
+            child.once("exit", onExitObserved);
         child.once("exit", (code, signal) => {
-            signalGroup("SIGTERM");
-            finish({ code: timedOut ? 124 : typeof code === "number" ? code : signal ? 128 : 1, stdout });
+            if (timedOut)
+                return;
+            clearTimeout(timer);
+            const result = { code: typeof code === "number" ? code : signal ? 128 : 1, stdout };
+            if (process.platform === "win32") {
+                // Tree cleanup is asynchronous on Windows. Start it after the direct
+                // child exits, but let the resolver advance without waiting for
+                // taskkill; detached descendants must not hold up the next lookup.
+                signalGroup("SIGTERM");
+                finish(result);
+                return;
+            }
+            signalGroup("SIGTERM", () => {
+                finish(result);
+            });
         });
     });
 }
@@ -502,7 +533,13 @@ export async function resolveCompany(args, dependencies) {
         hqEnv.HQ_ROOT = dependencies.hqRoot;
         hqEnv.CLAUDE_PROJECT_DIR = dependencies.hqRoot;
     }
-    const invoke = dependencies.spawnHq ?? runHq;
+    const invokeImplementation = dependencies.spawnHq
+        ? dependencies.spawnHq
+        : (args, childEnv, timeoutMs, cwd, command) => runHq(args, childEnv, timeoutMs, cwd, command, () => dependencies.onHqExit?.(args));
+    const invoke = (args, env, timeoutMs, cwd, command) => {
+        dependencies.onHqSpawn?.(args);
+        return invokeImplementation(args, env, timeoutMs, cwd, command);
+    };
     const defaultResponse = await invoke(["mesh", "context", "default", "get", "--json"], hqEnv, 2_000, root);
     const defaultSlug = defaultSlugFromJson(defaultResponse.stdout, knownSlugs);
     if (!defaultSlug)

package/dist/commands/install-global.d.ts

@@ -39,7 +39,7 @@ export interface ClaudePluginSource {
     pluginName: string;
     pluginId: string;
 }
-/** Resolve the local marketplace source; published hosting remains an operator decision. */
+/** Resolve local overrides first, then the published HQ marketplace. */
 export declare function resolveClaudePluginSource(explicitDir?: string, env?: NodeJS.ProcessEnv, repository?: string): ClaudePluginSource;
 export { AnywhereRuntimeDisabledError as AnywhereDisabledError };
 export declare const isAnywhereEnabled: (_home: string, env?: NodeJS.ProcessEnv) => boolean;

package/dist/commands/install-global.js

@@ -46,14 +46,15 @@ export function hookTargetFor(hqRoot, home, daemonInstalled, env = process.env)
     const daemonMatchesRoot = configuredRoot !== undefined && realpathOrSelf(configuredRoot) === realpathOrSelf(hqRoot);
     return installed && daemonMatchesRoot && fs.existsSync(shimPath(hqRoot)) ? 'shim' : 'master';
 }
-/** Resolve the local marketplace source; published hosting remains an operator decision. */
-export function resolveClaudePluginSource(explicitDir, env = process.env, repository) {
+const HQ_PACKAGES_MARKETPLACE_REPOSITORY = 'indigoai-us/hq-packages';
+/** Resolve local overrides first, then the published HQ marketplace. */
+export function resolveClaudePluginSource(explicitDir, env = process.env, repository = HQ_PACKAGES_MARKETPLACE_REPOSITORY) {
     const configured = explicitDir?.trim() || env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim();
     if (!configured) {
-        if (repository === 'indigoai-us/hq-packages') {
+        if (repository === HQ_PACKAGES_MARKETPLACE_REPOSITORY) {
             return { sourceDir: repository, marketplaceName: 'hq-packages', pluginName: 'hq', pluginId: 'hq@hq-packages' };
         }
-        throw Object.assign(new Error('Published HQ Claude plugin source is not configured; its repository/host awaits an operator decision. Pass --marketplace-dir <dir> or set HQ_CLAUDE_PLUGIN_MARKETPLACE.'), { expected: true });
+        throw Object.assign(new Error(`Unsupported published HQ Claude plugin repository "${repository}". Pass --marketplace-dir <dir> or set HQ_CLAUDE_PLUGIN_MARKETPLACE for a local marketplace.`), { expected: true });
     }
     const sourceDir = path.resolve(configured);
     const manifestPath = path.join(sourceDir, '.claude-plugin', 'marketplace.json');

package/dist/commands/pkg-install.js

@@ -72,10 +72,12 @@ export function registerPackageInstallCommand(parent) {
             if (opts.via === 'plugin' &&
                 !marketplaceDir?.trim() &&
                 !process.env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim()) {
-                if (await anywhereRuntimeAllowed(process.env)) {
-                    await runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
-                    return;
+                if (!(await anywhereRuntimeAllowed(process.env))) {
+                    console.error(chalk.red('Install failed:'), 'HQ Anywhere plugin installation requires both the hq-anywhere-runtime flag and your person setting.');
+                    process.exit(1);
                 }
+                await runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
+                return;
             }
             await runInstallGlobal({ ...opts, marketplaceDir });
             return;

package/dist/utils/self-update.d.ts

@@ -58,7 +58,7 @@
  */
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
-import { type RunningInstall, type UpdateResult } from "./version-gate.js";
+import { probePnpmVersion, type RunningInstall, type UpdateResult } from "./version-gate.js";
 import { type RestartDaemonResult } from "../lib/mesh/live/daemon/install.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
@@ -116,7 +116,7 @@ export declare function buildSelfUpdatePlan(install: RunningInstall): {
  * to stdout. Progress is summarised on stderr by the caller instead; captured
  * stderr is kept only to explain a failure.
  */
-export declare function runUpdateQuiet(cmd: string, args: string[], env?: NodeJS.ProcessEnv): UpdateResult;
+export declare function runUpdateQuiet(cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
 /**
  * Serialize self-updates across concurrent `hq` processes AND the hq-sync
  * menubar app. Without this, a machine running several HQ agents can fire many
@@ -144,7 +144,8 @@ export interface SelfUpdateDeps {
     homeDir?: string;
     /** Same-filesystem install rename, injectable for rollback tests. */
     renamePath?: typeof fs.renameSync;
-    runner?: (cmd: string, args: string[], env?: NodeJS.ProcessEnv) => UpdateResult;
+    runner?: (cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string) => UpdateResult;
+    probePnpmVersion?: typeof probePnpmVersion;
     /** Delay between bounded npm retries when the just-published target is not visible yet. */
     sleep?: (ms: number) => Promise<void>;
     reexec?: (argv: string[], env: NodeJS.ProcessEnv) => number | null;

package/dist/utils/self-update.js

@@ -65,7 +65,7 @@ import chalk from "chalk";
 import { Sentry } from "../sentry.js";
 import { isCliTelemetryDisabled } from "./cli-telemetry.js";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
 import { canStageInstall, stagedNpmInstall } from "./staged-install.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
@@ -548,8 +548,12 @@ async function fetchLatestVersion() {
  * through the resolved prefix so the copy that is actually running is replaced.
  */
 export function buildSelfUpdatePlan(install) {
-    if (install.manager === "pnpm")
-        return { cmd: "pnpm", args: buildPnpmInstallArgv(install) };
+    if (install.manager === "pnpm") {
+        const version = pnpmInstalledVersion(install);
+        return version
+            ? { cmd: "corepack", args: [`pnpm@${version}`, ...buildPnpmInstallArgv(install)] }
+            : { cmd: "pnpm", args: buildPnpmInstallArgv(install) };
+    }
     if (install.manager === "bun")
         return { cmd: "bun", args: buildBunInstallArgv() };
     if (install.prefix)
@@ -563,12 +567,12 @@ export function buildSelfUpdatePlan(install) {
  * to stdout. Progress is summarised on stderr by the caller instead; captured
  * stderr is kept only to explain a failure.
  */
-export function runUpdateQuiet(cmd, args, env) {
+export function runUpdateQuiet(cmd, args, env, cwd) {
     // File sinks rather than pipes: a pipe dies with this process and would take
     // the installer down with it mid-write. See `openInstallOutput`.
     const output = openInstallOutput(false);
     try {
-        return runSupervisedUpdateCommand(cmd, args, output, env);
+        return runSupervisedUpdateCommand(cmd, args, output, env, cwd);
     }
     finally {
         output.dispose();
@@ -826,6 +830,9 @@ async function updateAndReexec(argv, flavor, known, deps) {
             if (staged) {
                 return stagedNpmInstall(install, latestValid, { run: runner, env, rename: renamePath });
             }
+            if (install.manager === "pnpm") {
+                return performPnpmUpdate(install, runner, updateEnv ?? env, deps.probePnpmVersion);
+            }
             return updateEnv === undefined
                 ? runner(plan.cmd, plan.args)
                 : runner(plan.cmd, plan.args, updateEnv);

package/dist/utils/version-gate.d.ts

@@ -229,9 +229,19 @@ export declare function buildPnpmInstallArgv(install?: RunningInstall): string[]
  * forward the paths recorded for the install it is replacing.
  */
 export declare function pnpmInstallDirs(install: RunningInstall): {
+    globalDir: string;
     storeDir: string;
     virtualStoreDir: string;
 } | null;
+/** Version recorded by pnpm for the global install that owns this package. */
+export declare function pnpmInstalledVersion(install: RunningInstall): string | null;
+/**
+ * Resolve a bounded pnpm executable probe. pnpm 10 and older reject
+ * --virtual-store-dir for global installs; pnpm 11+ accepts the flag.
+ */
+export declare function probePnpmVersion(cmd: string, args: string[], env: NodeJS.ProcessEnv, cwd: string): string | null;
+/** Run the install-owned pnpm first; use PATH only if that version cannot run. */
+export declare function performPnpmUpdate(install: RunningInstall, runner?: UpdateRunner, env?: NodeJS.ProcessEnv, probe?: typeof probePnpmVersion): UpdateResult;
 /** Argv for updating a Bun-managed global install. */
 export declare function buildBunInstallArgv(): string[];
 /**
@@ -278,11 +288,12 @@ export type UpdateResult = {
     ok: boolean;
     detail?: string;
     code?: string;
+    stdout?: string;
     /** Sanitized installer error code for diagnostics; never drives retry or exit behavior. */
     diagnosticCode?: string;
     failureKind?: "package_manager_exit";
 };
-type UpdateRunner = (cmd: string, args: string[], env?: NodeJS.ProcessEnv) => UpdateResult;
+type UpdateRunner = (cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string) => UpdateResult;
 export { buildSpawnPlan, quoteForWindowsShell };
 /**
  * Add `detached` to a **synchronous** spawn's options.
@@ -366,9 +377,9 @@ export interface InstallOutput {
     dispose: () => void;
 }
 export declare function openInstallOutput(verbose: boolean, isTty?: boolean): InstallOutput;
-export declare function runSupervisedUpdateCommand(cmd: string, args: string[], output: InstallOutput, env?: NodeJS.ProcessEnv): UpdateResult;
-export declare function runUpdateCommand(cmd: string, args: string[], env?: NodeJS.ProcessEnv): UpdateResult;
-declare function performUpdateCommand(cmd: string, args: string[], runner?: UpdateRunner, env?: NodeJS.ProcessEnv): UpdateResult;
+export declare function runSupervisedUpdateCommand(cmd: string, args: string[], output: InstallOutput, env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
+export declare function runUpdateCommand(cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
+declare function performUpdateCommand(cmd: string, args: string[], runner?: UpdateRunner, env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
 declare function performUpdate(command: string, runner?: UpdateRunner): UpdateResult;
 /**
  * Soft notify when the server says we're below `latestVersion` but still ≥
@@ -434,6 +445,7 @@ export declare function checkUpdateConvergence(targetVersion: string, deps?: {
 /** Injectable surface for {@link enforceUpdateRequired} (unit tests). */
 interface EnforceUpdateDeps {
     performUpdateString?: (command: string) => UpdateResult;
+    probePnpmVersion?: typeof probePnpmVersion;
     resolveInstall?: () => RunningInstall;
     canWriteNpmInstall?: (install: RunningInstall) => boolean;
     homeDir?: string;
@@ -518,6 +530,10 @@ export declare const __test__: {
     enforceUpdateRequired: typeof enforceUpdateRequired;
     isBunManagedPackageDir: typeof isBunManagedPackageDir;
     pnpmUpdateEnv: typeof pnpmUpdateEnv;
+    pnpmInstallDirs: typeof pnpmInstallDirs;
+    pnpmInstalledVersion: typeof pnpmInstalledVersion;
+    performPnpmUpdate: typeof performPnpmUpdate;
+    probePnpmVersion: typeof probePnpmVersion;
     isLocalDependencyInstall: typeof isLocalDependencyInstall;
     isLocalDependencyPackageDir: typeof isLocalDependencyPackageDir;
     isNewerVersion: typeof isNewerVersion;

package/dist/utils/version-gate.js

@@ -626,8 +626,10 @@ export function buildPrefixedInstallArgv(prefix) {
 export function buildPnpmInstallArgv(install) {
     const args = ["add", "-g", LATEST_PACKAGE_SPEC];
     const dirs = install ? pnpmInstallDirs(install) : null;
-    if (dirs)
-        args.push("--store-dir", dirs.storeDir, "--virtual-store-dir", dirs.virtualStoreDir);
+    if (dirs) {
+        args.push("--global-dir", dirs.globalDir, "--store-dir", dirs.storeDir);
+        args.push("--virtual-store-dir", dirs.virtualStoreDir);
+    }
     return args;
 }
 /**
@@ -655,7 +657,10 @@ export function pnpmInstallDirs(install) {
         const virtualStoreDir = path.isAbsolute(configuredVirtualStore)
             ? configuredVirtualStore
             : path.resolve(globalNodeModules, configuredVirtualStore);
-        return { storeDir, virtualStoreDir };
+        const pnpmHome = derivePnpmHome(install);
+        if (!pnpmHome)
+            return null;
+        return { globalDir: path.join(pnpmHome, "global"), storeDir, virtualStoreDir };
     }
     catch {
         // The metadata file is absent in older pnpm global layouts. The global
@@ -664,11 +669,93 @@ export function pnpmInstallDirs(install) {
         if (!pnpmHome)
             return null;
         return {
+            globalDir: path.join(pnpmHome, "global"),
             storeDir: path.join(pnpmHome, "store", "v11"),
             virtualStoreDir: path.join(globalNodeModules, ".pnpm"),
         };
     }
 }
+/** Version recorded by pnpm for the global install that owns this package. */
+export function pnpmInstalledVersion(install) {
+    if (install.manager !== "pnpm" || !install.packageRoot)
+        return null;
+    const normalized = install.packageRoot.replace(/\\/g, "/");
+    const match = normalized.match(/^(.*\/global\/\d+\/node_modules)(?:\/|$)|^(.*\/global\/v\d+\/[^/]+\/node_modules)(?:\/|$)/);
+    const globalNodeModules = match?.[1] ?? match?.[2];
+    if (!globalNodeModules)
+        return null;
+    try {
+        const metadata = yaml.load(readFileSync(path.join(globalNodeModules, ".modules.yaml"), "utf8"));
+        const value = typeof metadata?.packageManager === "string" ? metadata.packageManager : "";
+        const version = value.match(/^pnpm@(.+)$/)?.[1];
+        return version && semver.valid(version) ? version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a bounded pnpm executable probe. pnpm 10 and older reject
+ * --virtual-store-dir for global installs; pnpm 11+ accepts the flag.
+ */
+export function probePnpmVersion(cmd, args, env, cwd) {
+    try {
+        const plan = buildSpawnPlan(cmd, args);
+        const result = spawnSync(plan.cmd, plan.args, {
+            encoding: "utf8",
+            timeout: 10_000,
+            cwd,
+            env,
+            shell: plan.shell,
+            windowsHide: true,
+        });
+        if (result.error || result.status !== 0)
+            return null;
+        const match = (result.stdout ?? "").trim().match(/(?:^|\s)(\d+\.\d+\.\d+(?:-[\w.-]+)?)(?:\s|$)/);
+        return match?.[1] && semver.valid(match[1]) ? match[1] : null;
+    }
+    catch (error) {
+        console.error(chalk.dim(`hq: pnpm version probe failed (${error instanceof Error ? error.name : "unknown"}).`));
+        return null;
+    }
+}
+/** Run the install-owned pnpm first; use PATH only if that version cannot run. */
+export function performPnpmUpdate(install, runner = runUpdateCommand, env = process.env, probe = probePnpmVersion) {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), "hq-cli-pnpm-update-"));
+    const updateEnv = {
+        ...env,
+        COREPACK_ENABLE_PROJECT_SPEC: "0",
+        COREPACK_ENABLE_STRICT: "0",
+        COREPACK_DEFAULT_TO_LATEST: "0",
+        npm_config_manage_package_manager_versions: "false",
+    };
+    try {
+        const installedVersion = pnpmInstalledVersion(install);
+        if (installedVersion) {
+            const command = `pnpm@${installedVersion}`;
+            if (probe("corepack", [command, "--version"], updateEnv, cwd) === installedVersion) {
+                return runner("corepack", [command, ...buildPnpmInstallArgv(install)], updateEnv, cwd);
+            }
+        }
+        const fallbackVersion = probe("pnpm", ["--version"], updateEnv, cwd);
+        if (!fallbackVersion) {
+            return { ok: false, code: "PNPM_UNAVAILABLE", detail: "pnpm not found on PATH; install-owned Corepack pnpm could not run" };
+        }
+        // pnpm 10.28.1 and earlier reject --virtual-store-dir with -g. Keep the
+        // existing global directory and store, but omit only that unsupported flag.
+        const supportsGlobalVirtualStoreDir = semver.gte(fallbackVersion, "11.0.0");
+        const args = buildPnpmInstallArgv(install);
+        if (!supportsGlobalVirtualStoreDir) {
+            const index = args.indexOf("--virtual-store-dir");
+            if (index !== -1)
+                args.splice(index, 2);
+        }
+        return runner("pnpm", args, updateEnv, cwd);
+    }
+    finally {
+        rmSync(cwd, { recursive: true, force: true });
+    }
+}
 /** Argv for updating a Bun-managed global install. */
 export function buildBunInstallArgv() {
     return ["add", "-g", LATEST_PACKAGE_SPEC];
@@ -1037,7 +1124,7 @@ export function openInstallOutput(verbose, isTty = process.stdout.isTTY === true
         },
     };
 }
-export function runSupervisedUpdateCommand(cmd, args, output, env) {
+export function runSupervisedUpdateCommand(cmd, args, output, env, cwd) {
     try {
         const plan = buildSpawnPlan(cmd, args);
         const timeoutMs = updateTimeoutMs(env);
@@ -1061,6 +1148,7 @@ export function runSupervisedUpdateCommand(cmd, args, output, env) {
         ], inOwnProcessGroup({
             stdio: output.stdio,
             ...(env ? { env } : {}),
+            ...(cwd ? { cwd } : {}),
         }));
         // spawnSync reports a missing executable via `error`, not a throw.
         if (result.error) {
@@ -1108,20 +1196,22 @@ export function runSupervisedUpdateCommand(cmd, args, output, env) {
         };
     }
 }
-export function runUpdateCommand(cmd, args, env) {
+export function runUpdateCommand(cmd, args, env, cwd) {
     const output = openInstallOutput(true);
     try {
-        return runSupervisedUpdateCommand(cmd, args, output, env);
+        return runSupervisedUpdateCommand(cmd, args, output, env, cwd);
     }
     finally {
         output.dispose();
     }
 }
-function performUpdateCommand(cmd, args, runner = runUpdateCommand, env) {
+function performUpdateCommand(cmd, args, runner = runUpdateCommand, env, cwd) {
     // Forward env only when there is one to forward, so the common path keeps the
     // two-argument runner call it has always made (and existing runner spies see
     // no phantom `undefined` third argument).
-    return env === undefined ? runner(cmd, args) : runner(cmd, args, env);
+    return env === undefined && cwd === undefined
+        ? runner(cmd, args)
+        : runner(cmd, args, env, cwd);
 }
 function performUpdate(command, runner = runUpdateCommand) {
     const parts = command.split(/\s+/).filter(Boolean);
@@ -1141,8 +1231,13 @@ function performUpdate(command, runner = runUpdateCommand) {
  * speak the running manager's language.
  */
 function manualUpdateCommand(install, decision) {
-    if (install.manager === "pnpm")
-        return `pnpm ${buildPnpmInstallArgv(install).join(" ")}`;
+    if (install.manager === "pnpm") {
+        const version = pnpmInstalledVersion(install);
+        const plan = version
+            ? `corepack pnpm@${version} ${buildPnpmInstallArgv(install).join(" ")}`
+            : `pnpm ${buildPnpmInstallArgv(install).join(" ")}`;
+        return plan;
+    }
     if (install.manager === "bun")
         return `bun ${buildBunInstallArgv().join(" ")}`;
     if (install.prefix)
@@ -1522,7 +1617,9 @@ function attemptRequiredUpdate(decision, deps, install) {
     if (isManagedOutsideNpm) {
         console.error(chalk.dim(`  Detected a ${install.manager}-managed global install; updating with ${install.manager}`));
         console.error(chalk.dim(`  Running: ${primaryCmd} ${primaryArgs.join(" ")}`));
-        result = performUpdateCommand(primaryCmd, primaryArgs, runner, updateEnv);
+        result = install.manager === "pnpm"
+            ? performPnpmUpdate(install, runner, updateEnv ?? process.env, deps.probePnpmVersion)
+            : performUpdateCommand(primaryCmd, primaryArgs, runner, updateEnv);
     }
     else if (prefix) {
         console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
@@ -1719,6 +1816,10 @@ export const __test__ = {
     enforceUpdateRequired,
     isBunManagedPackageDir,
     pnpmUpdateEnv,
+    pnpmInstallDirs,
+    pnpmInstalledVersion,
+    performPnpmUpdate,
+    probePnpmVersion,
     isLocalDependencyInstall,
     isLocalDependencyPackageDir,
     isNewerVersion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.34",
+  "version": "5.345.35",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {