@indigoai-us/hq-cli 5.345.34 → 5.345.36

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.36] — 2026-10-07
+- A queued `hq sync` no longer pins the installed `hq` version while it waits its turn, so `hq pkg update` is no longer blocked for the length of somebody else's sync.
+- The flag-registry background refresh no longer throws as it starts, so running any `hq` command stops filing a crash report that nothing in the command caused.
+
+## [5.345.35] — 2026-10-07
+- Claude plugin installs now use the HQ packages marketplace by default; local marketplace directory and environment overrides remain available.
+- Pin self-updates to the pnpm version recorded by the global install; preserve store dirs on pnpm 11+ and omit pnpm 10 virtual-store flags.
+
 ## [5.345.34] — 2026-10-07
 - Protect live remote-control tmux sessions with socket-scoped creator identity before cleanup.
 

package/dist/commands/cloud.js

@@ -16,7 +16,8 @@ import { isAccessDeniedError, accessDeniedKeyOf, formatAccessDenied, } from "../
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, sync, getStateDir, listJournals, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
+import { share, getStateDir, listJournals, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
+import { syncLeg } from "../utils/sync-operation-lock.js";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, loadCachedTokens, } from "../utils/cognito-session.js";
 import { resolveUploadAuthor } from "../utils/upload-author.js";
 import { companyFolderExceedsThreshold, emitNarrowHint, isStrictRefusal, resolveBannerLevel, resolveNarrowHintPresentationLevel, resolveNarrowHintMinBytes, } from "../lib/narrow-hint-banner.js";
@@ -1146,7 +1147,7 @@ export function registerCloudCommands(program) {
             }
             const excludePrefixes = readScopeExcludePrefixes(pullScope);
             syncHealth = beginSyncHealthReport();
-            const result = await sync({
+            const result = await syncLeg({
                 company: options.company,
                 onConflict: options.onConflict,
                 vaultConfig,
@@ -1437,7 +1438,7 @@ async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, for
             // via the shared resolver, so the actual pull is scoped — the CLI no
             // longer seeds an all-mode PullRecord that wedges the menubar runner.
             resolveScope: (companyUid, slug) => resolvePullScope(realClient, companyUid, slug, hqRoot),
-            sync: (opts) => sync({
+            sync: (opts) => syncLeg({
                 company: opts.company,
                 hqRoot: opts.hqRoot,
                 vaultConfig,
@@ -1508,7 +1509,7 @@ export async function runPullPersonal(hqRoot, onConflict) {
             listPersonEntities: () => client.entity.listByType("person"),
             getEntity: async () => null,
         });
-        const result = await sync({
+        const result = await syncLeg({
             company: personalUid,
             ...(onConflict ? { onConflict } : {}),
             vaultConfig,
@@ -1853,7 +1854,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         }
         console.log(chalk.dim("  → pull leg"));
         const excludePrefixes = readScopeExcludePrefixes(pullScope);
-        const pullResult = await sync({
+        const pullResult = await syncLeg({
             company: targetCompany,
             vaultConfig,
             hqRoot,

package/dist/commands/core-resolve-company-native.d.ts

@@ -19,6 +19,8 @@ export type ResolveCompanyDependencies = {
     stdin?: string;
     stdinIsTty?: boolean;
     spawnHq?: (args: string[], env: NodeJS.ProcessEnv, timeoutMs: number, cwd?: string, command?: string) => Promise<HqResult>;
+    onHqSpawn?: (args: readonly string[]) => void;
+    onHqExit?: (args: readonly string[]) => void;
     pid?: number;
     random?: () => number;
 };

package/dist/commands/core-resolve-company-native.js

@@ -1,5 +1,5 @@
 /** Native port of resolve-company.sh. This module stays on the fast import path. */
-import { spawn, spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { awkCannotOpenFileDiagnostic } from "../lib/core-utils/awk-diagnostics.js";
@@ -272,30 +272,46 @@ function commandOnPath(name, env) {
     }
     return false;
 }
-function runHq(args, env, timeoutMs, cwd, command = "hq") {
+function runHq(args, env, timeoutMs, cwd, command = "hq", onExitObserved) {
     return new Promise((resolve) => {
         let settled = false;
         let stdout = "";
         let child;
         let timeoutKill;
         let timedOut = false;
-        const signalGroup = (signal) => {
-            if (!child?.pid)
+        const signalGroup = (signal, onComplete) => {
+            if (!child?.pid) {
+                onComplete?.();
                 return;
+            }
             try {
                 if (process.platform === "win32") {
                     const taskkill = path.join(env.SystemRoot ?? env.WINDIR ?? "C:\\Windows", "System32", "taskkill.exe");
-                    const result = spawnSync(taskkill, ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true });
-                    if (result.error || result.status !== 0)
-                        child.kill(signal);
+                    let completed = false;
+                    const complete = (code) => {
+                        if (completed)
+                            return;
+                        completed = true;
+                        if (code !== 0)
+                            child?.kill(signal);
+                        onComplete?.();
+                    };
+                    const killer = spawn(taskkill, ["/PID", String(child.pid), "/T", "/F"], {
+                        stdio: "ignore",
+                        windowsHide: true,
+                    });
+                    killer.once("error", () => complete(1));
+                    killer.once("exit", (code) => complete(code));
                 }
                 else {
                     process.kill(-child.pid, signal);
+                    onComplete?.();
                 }
             }
             catch (error) {
                 if (errorCode(error) !== "ESRCH")
                     finish({ code: 1, stdout });
+                onComplete?.();
             }
         };
         const finish = (result) => {
@@ -310,13 +326,13 @@ function runHq(args, env, timeoutMs, cwd, command = "hq") {
         const timer = setTimeout(() => {
             timedOut = true;
             if (child?.pid) {
-                signalGroup("SIGTERM");
-                // The shell wrapper returns shortly after its 2 second deadline. Do
-                // not wait for inherited stdio handles after killing the process group.
-                timeoutKill = setTimeout(() => {
-                    signalGroup("SIGKILL");
-                    finish({ code: 124, stdout });
-                }, 250);
+                signalGroup("SIGTERM", () => {
+                    // The shell wrapper returns shortly after its 2 second deadline. Give
+                    // the tree time to exit, then force-kill and wait for Windows cleanup.
+                    timeoutKill = setTimeout(() => {
+                        signalGroup("SIGKILL", () => finish({ code: 124, stdout }));
+                    }, 250);
+                });
             }
             else {
                 finish({ code: 124, stdout });
@@ -349,9 +365,24 @@ function runHq(args, env, timeoutMs, cwd, command = "hq") {
         child.stdout?.setEncoding("utf8");
         child.stdout?.on("data", (chunk) => { stdout += chunk; });
         child.once("error", () => finish({ code: 127, stdout }));
+        if (onExitObserved)
+            child.once("exit", onExitObserved);
         child.once("exit", (code, signal) => {
-            signalGroup("SIGTERM");
-            finish({ code: timedOut ? 124 : typeof code === "number" ? code : signal ? 128 : 1, stdout });
+            if (timedOut)
+                return;
+            clearTimeout(timer);
+            const result = { code: typeof code === "number" ? code : signal ? 128 : 1, stdout };
+            if (process.platform === "win32") {
+                // Tree cleanup is asynchronous on Windows. Start it after the direct
+                // child exits, but let the resolver advance without waiting for
+                // taskkill; detached descendants must not hold up the next lookup.
+                signalGroup("SIGTERM");
+                finish(result);
+                return;
+            }
+            signalGroup("SIGTERM", () => {
+                finish(result);
+            });
         });
     });
 }
@@ -502,7 +533,13 @@ export async function resolveCompany(args, dependencies) {
         hqEnv.HQ_ROOT = dependencies.hqRoot;
         hqEnv.CLAUDE_PROJECT_DIR = dependencies.hqRoot;
     }
-    const invoke = dependencies.spawnHq ?? runHq;
+    const invokeImplementation = dependencies.spawnHq
+        ? dependencies.spawnHq
+        : (args, childEnv, timeoutMs, cwd, command) => runHq(args, childEnv, timeoutMs, cwd, command, () => dependencies.onHqExit?.(args));
+    const invoke = (args, env, timeoutMs, cwd, command) => {
+        dependencies.onHqSpawn?.(args);
+        return invokeImplementation(args, env, timeoutMs, cwd, command);
+    };
     const defaultResponse = await invoke(["mesh", "context", "default", "get", "--json"], hqEnv, 2_000, root);
     const defaultSlug = defaultSlugFromJson(defaultResponse.stdout, knownSlugs);
     if (!defaultSlug)

package/dist/commands/install-global.d.ts

@@ -39,7 +39,7 @@ export interface ClaudePluginSource {
     pluginName: string;
     pluginId: string;
 }
-/** Resolve the local marketplace source; published hosting remains an operator decision. */
+/** Resolve local overrides first, then the published HQ marketplace. */
 export declare function resolveClaudePluginSource(explicitDir?: string, env?: NodeJS.ProcessEnv, repository?: string): ClaudePluginSource;
 export { AnywhereRuntimeDisabledError as AnywhereDisabledError };
 export declare const isAnywhereEnabled: (_home: string, env?: NodeJS.ProcessEnv) => boolean;

package/dist/commands/install-global.js

@@ -46,14 +46,15 @@ export function hookTargetFor(hqRoot, home, daemonInstalled, env = process.env)
     const daemonMatchesRoot = configuredRoot !== undefined && realpathOrSelf(configuredRoot) === realpathOrSelf(hqRoot);
     return installed && daemonMatchesRoot && fs.existsSync(shimPath(hqRoot)) ? 'shim' : 'master';
 }
-/** Resolve the local marketplace source; published hosting remains an operator decision. */
-export function resolveClaudePluginSource(explicitDir, env = process.env, repository) {
+const HQ_PACKAGES_MARKETPLACE_REPOSITORY = 'indigoai-us/hq-packages';
+/** Resolve local overrides first, then the published HQ marketplace. */
+export function resolveClaudePluginSource(explicitDir, env = process.env, repository = HQ_PACKAGES_MARKETPLACE_REPOSITORY) {
     const configured = explicitDir?.trim() || env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim();
     if (!configured) {
-        if (repository === 'indigoai-us/hq-packages') {
+        if (repository === HQ_PACKAGES_MARKETPLACE_REPOSITORY) {
             return { sourceDir: repository, marketplaceName: 'hq-packages', pluginName: 'hq', pluginId: 'hq@hq-packages' };
         }
-        throw Object.assign(new Error('Published HQ Claude plugin source is not configured; its repository/host awaits an operator decision. Pass --marketplace-dir <dir> or set HQ_CLAUDE_PLUGIN_MARKETPLACE.'), { expected: true });
+        throw Object.assign(new Error(`Unsupported published HQ Claude plugin repository "${repository}". Pass --marketplace-dir <dir> or set HQ_CLAUDE_PLUGIN_MARKETPLACE for a local marketplace.`), { expected: true });
     }
     const sourceDir = path.resolve(configured);
     const manifestPath = path.join(sourceDir, '.claude-plugin', 'marketplace.json');

package/dist/commands/pkg-install.js

@@ -72,10 +72,12 @@ export function registerPackageInstallCommand(parent) {
             if (opts.via === 'plugin' &&
                 !marketplaceDir?.trim() &&
                 !process.env.HQ_CLAUDE_PLUGIN_MARKETPLACE?.trim()) {
-                if (await anywhereRuntimeAllowed(process.env)) {
-                    await runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
-                    return;
+                if (!(await anywhereRuntimeAllowed(process.env))) {
+                    console.error(chalk.red('Install failed:'), 'HQ Anywhere plugin installation requires both the hq-anywhere-runtime flag and your person setting.');
+                    process.exit(1);
                 }
+                await runInstallGlobal({ ...opts, marketplaceRepository: 'indigoai-us/hq-packages' });
+                return;
             }
             await runInstallGlobal({ ...opts, marketplaceDir });
             return;