@indigoai-us/hq-cli 5.345.34 → 5.345.36

package/dist/utils/package-use-lease.d.ts

@@ -50,5 +50,22 @@ export declare const __test__: {
     waitForUpdateRequest: typeof waitForUpdateRequest;
     setCurrentPackageUseLease(lease: PackageUseLease | null): void;
 };
+/**
+ * Run `wait` with this process's package-use lease DROPPED, then reacquire the
+ * lease before returning.
+ *
+ * `hq sync` runs under purpose `"command"`, and
+ * {@link releasePackageUseLeaseAfterCommandLoad} deliberately keeps that lease
+ * for the whole command. hq-cloud's per-root operation lock then waits — by
+ * default without a bound — for whichever process is already syncing, so an old
+ * `hq` install pinned `hq pkg update` for the entire length of somebody else's
+ * lock wait (HQ-DESKTOP-8H). Queuing is not using the package: drop the lease
+ * while this process is only waiting, and take it again once the wait is over.
+ *
+ * A reacquire that throws {@link PackageUseUpdatePendingError} is the correct
+ * outcome — an update landed while we queued — and propagates to the caller. On
+ * the failure path the original error wins and the reacquire is best-effort.
+ */
+export declare function withPackageUseLeaseReleasedDuring<T>(wait: () => Promise<T>, argv?: readonly string[], release?: () => void, reacquire?: (argv: readonly string[]) => unknown): Promise<T>;
 export {};
 //# sourceMappingURL=package-use-lease.d.ts.map

package/dist/utils/package-use-lease.js

@@ -413,4 +413,40 @@ export const __test__ = {
         currentPackageUseLease = lease;
     },
 };
+/**
+ * Run `wait` with this process's package-use lease DROPPED, then reacquire the
+ * lease before returning.
+ *
+ * `hq sync` runs under purpose `"command"`, and
+ * {@link releasePackageUseLeaseAfterCommandLoad} deliberately keeps that lease
+ * for the whole command. hq-cloud's per-root operation lock then waits — by
+ * default without a bound — for whichever process is already syncing, so an old
+ * `hq` install pinned `hq pkg update` for the entire length of somebody else's
+ * lock wait (HQ-DESKTOP-8H). Queuing is not using the package: drop the lease
+ * while this process is only waiting, and take it again once the wait is over.
+ *
+ * A reacquire that throws {@link PackageUseUpdatePendingError} is the correct
+ * outcome — an update landed while we queued — and propagates to the caller. On
+ * the failure path the original error wins and the reacquire is best-effort.
+ */
+export async function withPackageUseLeaseReleasedDuring(wait, argv = process.argv, release = releaseCurrentPackageUseLease, reacquire = acquireCurrentPackageUseLease) {
+    if (currentPackageUseLease === null)
+        return wait();
+    release();
+    let result;
+    try {
+        result = await wait();
+    }
+    catch (error) {
+        try {
+            reacquire(argv);
+        }
+        catch {
+            // The caller's error is the one worth reporting.
+        }
+        throw error;
+    }
+    reacquire(argv);
+    return result;
+}
 //# sourceMappingURL=package-use-lease.js.map

package/dist/utils/self-update.d.ts

@@ -58,7 +58,7 @@
  */
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
-import { type RunningInstall, type UpdateResult } from "./version-gate.js";
+import { probePnpmVersion, type RunningInstall, type UpdateResult } from "./version-gate.js";
 import { type RestartDaemonResult } from "../lib/mesh/live/daemon/install.js";
 /**
  * Set on the re-exec'd child so it can never self-update (and re-exec) again.
@@ -116,7 +116,7 @@ export declare function buildSelfUpdatePlan(install: RunningInstall): {
  * to stdout. Progress is summarised on stderr by the caller instead; captured
  * stderr is kept only to explain a failure.
  */
-export declare function runUpdateQuiet(cmd: string, args: string[], env?: NodeJS.ProcessEnv): UpdateResult;
+export declare function runUpdateQuiet(cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
 /**
  * Serialize self-updates across concurrent `hq` processes AND the hq-sync
  * menubar app. Without this, a machine running several HQ agents can fire many
@@ -144,7 +144,8 @@ export interface SelfUpdateDeps {
     homeDir?: string;
     /** Same-filesystem install rename, injectable for rollback tests. */
     renamePath?: typeof fs.renameSync;
-    runner?: (cmd: string, args: string[], env?: NodeJS.ProcessEnv) => UpdateResult;
+    runner?: (cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string) => UpdateResult;
+    probePnpmVersion?: typeof probePnpmVersion;
     /** Delay between bounded npm retries when the just-published target is not visible yet. */
     sleep?: (ms: number) => Promise<void>;
     reexec?: (argv: string[], env: NodeJS.ProcessEnv) => number | null;

package/dist/utils/self-update.js

@@ -65,7 +65,7 @@ import chalk from "chalk";
 import { Sentry } from "../sentry.js";
 import { isCliTelemetryDisabled } from "./cli-telemetry.js";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
 import { canStageInstall, stagedNpmInstall } from "./staged-install.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
@@ -548,8 +548,12 @@ async function fetchLatestVersion() {
  * through the resolved prefix so the copy that is actually running is replaced.
  */
 export function buildSelfUpdatePlan(install) {
-    if (install.manager === "pnpm")
-        return { cmd: "pnpm", args: buildPnpmInstallArgv(install) };
+    if (install.manager === "pnpm") {
+        const version = pnpmInstalledVersion(install);
+        return version
+            ? { cmd: "corepack", args: [`pnpm@${version}`, ...buildPnpmInstallArgv(install)] }
+            : { cmd: "pnpm", args: buildPnpmInstallArgv(install) };
+    }
     if (install.manager === "bun")
         return { cmd: "bun", args: buildBunInstallArgv() };
     if (install.prefix)
@@ -563,12 +567,12 @@ export function buildSelfUpdatePlan(install) {
  * to stdout. Progress is summarised on stderr by the caller instead; captured
  * stderr is kept only to explain a failure.
  */
-export function runUpdateQuiet(cmd, args, env) {
+export function runUpdateQuiet(cmd, args, env, cwd) {
     // File sinks rather than pipes: a pipe dies with this process and would take
     // the installer down with it mid-write. See `openInstallOutput`.
     const output = openInstallOutput(false);
     try {
-        return runSupervisedUpdateCommand(cmd, args, output, env);
+        return runSupervisedUpdateCommand(cmd, args, output, env, cwd);
     }
     finally {
         output.dispose();
@@ -826,6 +830,9 @@ async function updateAndReexec(argv, flavor, known, deps) {
             if (staged) {
                 return stagedNpmInstall(install, latestValid, { run: runner, env, rename: renamePath });
             }
+            if (install.manager === "pnpm") {
+                return performPnpmUpdate(install, runner, updateEnv ?? env, deps.probePnpmVersion);
+            }
             return updateEnv === undefined
                 ? runner(plan.cmd, plan.args)
                 : runner(plan.cmd, plan.args, updateEnv);

package/dist/utils/sync-operation-lock.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Take hq-cloud's per-root operation lock for a sync pass from hq-cli, so the
+ * wait for an existing holder happens OUTSIDE this process's package-use lease.
+ *
+ * `sync()` normally wraps itself in `withOperationLock`, which waits for a live
+ * holder with no bound unless `HQ_OP_LOCK_TIMEOUT` says otherwise. `hq sync`
+ * runs under package-use purpose `"command"`, whose lease is held for the whole
+ * command, so the queued process pinned the installed `hq` version — and
+ * therefore blocked `hq pkg update` — for the entire length of somebody else's
+ * sync (HQ-DESKTOP-8H).
+ *
+ * Acquiring the lock here instead lets the lease be dropped across the wait and
+ * retaken the moment the lock is held, before any sync work runs.
+ * `operationLockAlreadyHeld` is the seam hq-cloud exposes for a caller that owns
+ * the lock; the lock is NOT reentrant in-process, so the flag is required rather
+ * than optional.
+ */
+import { type SyncOptions, type SyncResult } from "@indigoai-us/hq-cloud";
+import { type LockHandle } from "@indigoai-us/hq-cloud/operation-lock";
+export interface SyncUnderOperationLockDeps<Options, Result> {
+    sync: (options: Options & {
+        operationLockAlreadyHeld: true;
+    }) => Promise<Result>;
+    /** Injected in tests; defaults to hq-cloud's wait-capable acquisition. */
+    acquireLock?: (hqRoot: string) => Promise<LockHandle>;
+    /** Injected in tests; defaults to the real lease drop/retake. */
+    withLeaseReleased?: <T>(wait: () => Promise<T>) => Promise<T>;
+}
+export declare function syncUnderOperationLock<Options extends {
+    hqRoot: string;
+}, Result>(options: Options, deps: SyncUnderOperationLockDeps<Options, Result>): Promise<Result>;
+/**
+ * The production sync leg: hq-cloud's `sync()` under a lock this process takes
+ * itself. Every `hq sync` path in `src/commands/cloud.ts` calls this.
+ */
+export declare function syncLeg(options: SyncOptions): Promise<SyncResult>;
+//# sourceMappingURL=sync-operation-lock.d.ts.map

package/dist/utils/sync-operation-lock.js

@@ -0,0 +1,40 @@
+/**
+ * Take hq-cloud's per-root operation lock for a sync pass from hq-cli, so the
+ * wait for an existing holder happens OUTSIDE this process's package-use lease.
+ *
+ * `sync()` normally wraps itself in `withOperationLock`, which waits for a live
+ * holder with no bound unless `HQ_OP_LOCK_TIMEOUT` says otherwise. `hq sync`
+ * runs under package-use purpose `"command"`, whose lease is held for the whole
+ * command, so the queued process pinned the installed `hq` version — and
+ * therefore blocked `hq pkg update` — for the entire length of somebody else's
+ * sync (HQ-DESKTOP-8H).
+ *
+ * Acquiring the lock here instead lets the lease be dropped across the wait and
+ * retaken the moment the lock is held, before any sync work runs.
+ * `operationLockAlreadyHeld` is the seam hq-cloud exposes for a caller that owns
+ * the lock; the lock is NOT reentrant in-process, so the flag is required rather
+ * than optional.
+ */
+import { sync } from "@indigoai-us/hq-cloud";
+import { acquireOperationLockAsync, } from "@indigoai-us/hq-cloud/operation-lock";
+import { withPackageUseLeaseReleasedDuring } from "./package-use-lease.js";
+export async function syncUnderOperationLock(options, deps) {
+    const acquireLock = deps.acquireLock ?? ((hqRoot) => acquireOperationLockAsync(hqRoot, "sync"));
+    const withLeaseReleased = deps.withLeaseReleased ??
+        ((wait) => withPackageUseLeaseReleasedDuring(wait));
+    const handle = await withLeaseReleased(() => acquireLock(options.hqRoot));
+    try {
+        return await deps.sync({ ...options, operationLockAlreadyHeld: true });
+    }
+    finally {
+        handle.release();
+    }
+}
+/**
+ * The production sync leg: hq-cloud's `sync()` under a lock this process takes
+ * itself. Every `hq sync` path in `src/commands/cloud.ts` calls this.
+ */
+export function syncLeg(options) {
+    return syncUnderOperationLock(options, { sync });
+}
+//# sourceMappingURL=sync-operation-lock.js.map

package/dist/utils/version-gate.d.ts

@@ -229,9 +229,19 @@ export declare function buildPnpmInstallArgv(install?: RunningInstall): string[]
  * forward the paths recorded for the install it is replacing.
  */
 export declare function pnpmInstallDirs(install: RunningInstall): {
+    globalDir: string;
     storeDir: string;
     virtualStoreDir: string;
 } | null;
+/** Version recorded by pnpm for the global install that owns this package. */
+export declare function pnpmInstalledVersion(install: RunningInstall): string | null;
+/**
+ * Resolve a bounded pnpm executable probe. pnpm 10 and older reject
+ * --virtual-store-dir for global installs; pnpm 11+ accepts the flag.
+ */
+export declare function probePnpmVersion(cmd: string, args: string[], env: NodeJS.ProcessEnv, cwd: string): string | null;
+/** Run the install-owned pnpm first; use PATH only if that version cannot run. */
+export declare function performPnpmUpdate(install: RunningInstall, runner?: UpdateRunner, env?: NodeJS.ProcessEnv, probe?: typeof probePnpmVersion): UpdateResult;
 /** Argv for updating a Bun-managed global install. */
 export declare function buildBunInstallArgv(): string[];
 /**
@@ -278,11 +288,12 @@ export type UpdateResult = {
     ok: boolean;
     detail?: string;
     code?: string;
+    stdout?: string;
     /** Sanitized installer error code for diagnostics; never drives retry or exit behavior. */
     diagnosticCode?: string;
     failureKind?: "package_manager_exit";
 };
-type UpdateRunner = (cmd: string, args: string[], env?: NodeJS.ProcessEnv) => UpdateResult;
+type UpdateRunner = (cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string) => UpdateResult;
 export { buildSpawnPlan, quoteForWindowsShell };
 /**
  * Add `detached` to a **synchronous** spawn's options.
@@ -366,9 +377,9 @@ export interface InstallOutput {
     dispose: () => void;
 }
 export declare function openInstallOutput(verbose: boolean, isTty?: boolean): InstallOutput;
-export declare function runSupervisedUpdateCommand(cmd: string, args: string[], output: InstallOutput, env?: NodeJS.ProcessEnv): UpdateResult;
-export declare function runUpdateCommand(cmd: string, args: string[], env?: NodeJS.ProcessEnv): UpdateResult;
-declare function performUpdateCommand(cmd: string, args: string[], runner?: UpdateRunner, env?: NodeJS.ProcessEnv): UpdateResult;
+export declare function runSupervisedUpdateCommand(cmd: string, args: string[], output: InstallOutput, env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
+export declare function runUpdateCommand(cmd: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
+declare function performUpdateCommand(cmd: string, args: string[], runner?: UpdateRunner, env?: NodeJS.ProcessEnv, cwd?: string): UpdateResult;
 declare function performUpdate(command: string, runner?: UpdateRunner): UpdateResult;
 /**
  * Soft notify when the server says we're below `latestVersion` but still ≥
@@ -434,6 +445,7 @@ export declare function checkUpdateConvergence(targetVersion: string, deps?: {
 /** Injectable surface for {@link enforceUpdateRequired} (unit tests). */
 interface EnforceUpdateDeps {
     performUpdateString?: (command: string) => UpdateResult;
+    probePnpmVersion?: typeof probePnpmVersion;
     resolveInstall?: () => RunningInstall;
     canWriteNpmInstall?: (install: RunningInstall) => boolean;
     homeDir?: string;
@@ -518,6 +530,10 @@ export declare const __test__: {
     enforceUpdateRequired: typeof enforceUpdateRequired;
     isBunManagedPackageDir: typeof isBunManagedPackageDir;
     pnpmUpdateEnv: typeof pnpmUpdateEnv;
+    pnpmInstallDirs: typeof pnpmInstallDirs;
+    pnpmInstalledVersion: typeof pnpmInstalledVersion;
+    performPnpmUpdate: typeof performPnpmUpdate;
+    probePnpmVersion: typeof probePnpmVersion;
     isLocalDependencyInstall: typeof isLocalDependencyInstall;
     isLocalDependencyPackageDir: typeof isLocalDependencyPackageDir;
     isNewerVersion: typeof isNewerVersion;

package/dist/utils/version-gate.js

@@ -626,8 +626,10 @@ export function buildPrefixedInstallArgv(prefix) {
 export function buildPnpmInstallArgv(install) {
     const args = ["add", "-g", LATEST_PACKAGE_SPEC];
     const dirs = install ? pnpmInstallDirs(install) : null;
-    if (dirs)
-        args.push("--store-dir", dirs.storeDir, "--virtual-store-dir", dirs.virtualStoreDir);
+    if (dirs) {
+        args.push("--global-dir", dirs.globalDir, "--store-dir", dirs.storeDir);
+        args.push("--virtual-store-dir", dirs.virtualStoreDir);
+    }
     return args;
 }
 /**
@@ -655,7 +657,10 @@ export function pnpmInstallDirs(install) {
         const virtualStoreDir = path.isAbsolute(configuredVirtualStore)
             ? configuredVirtualStore
             : path.resolve(globalNodeModules, configuredVirtualStore);
-        return { storeDir, virtualStoreDir };
+        const pnpmHome = derivePnpmHome(install);
+        if (!pnpmHome)
+            return null;
+        return { globalDir: path.join(pnpmHome, "global"), storeDir, virtualStoreDir };
     }
     catch {
         // The metadata file is absent in older pnpm global layouts. The global
@@ -664,11 +669,93 @@ export function pnpmInstallDirs(install) {
         if (!pnpmHome)
             return null;
         return {
+            globalDir: path.join(pnpmHome, "global"),
             storeDir: path.join(pnpmHome, "store", "v11"),
             virtualStoreDir: path.join(globalNodeModules, ".pnpm"),
         };
     }
 }
+/** Version recorded by pnpm for the global install that owns this package. */
+export function pnpmInstalledVersion(install) {
+    if (install.manager !== "pnpm" || !install.packageRoot)
+        return null;
+    const normalized = install.packageRoot.replace(/\\/g, "/");
+    const match = normalized.match(/^(.*\/global\/\d+\/node_modules)(?:\/|$)|^(.*\/global\/v\d+\/[^/]+\/node_modules)(?:\/|$)/);
+    const globalNodeModules = match?.[1] ?? match?.[2];
+    if (!globalNodeModules)
+        return null;
+    try {
+        const metadata = yaml.load(readFileSync(path.join(globalNodeModules, ".modules.yaml"), "utf8"));
+        const value = typeof metadata?.packageManager === "string" ? metadata.packageManager : "";
+        const version = value.match(/^pnpm@(.+)$/)?.[1];
+        return version && semver.valid(version) ? version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a bounded pnpm executable probe. pnpm 10 and older reject
+ * --virtual-store-dir for global installs; pnpm 11+ accepts the flag.
+ */
+export function probePnpmVersion(cmd, args, env, cwd) {
+    try {
+        const plan = buildSpawnPlan(cmd, args);
+        const result = spawnSync(plan.cmd, plan.args, {
+            encoding: "utf8",
+            timeout: 10_000,
+            cwd,
+            env,
+            shell: plan.shell,
+            windowsHide: true,
+        });
+        if (result.error || result.status !== 0)
+            return null;
+        const match = (result.stdout ?? "").trim().match(/(?:^|\s)(\d+\.\d+\.\d+(?:-[\w.-]+)?)(?:\s|$)/);
+        return match?.[1] && semver.valid(match[1]) ? match[1] : null;
+    }
+    catch (error) {
+        console.error(chalk.dim(`hq: pnpm version probe failed (${error instanceof Error ? error.name : "unknown"}).`));
+        return null;
+    }
+}
+/** Run the install-owned pnpm first; use PATH only if that version cannot run. */
+export function performPnpmUpdate(install, runner = runUpdateCommand, env = process.env, probe = probePnpmVersion) {
+    const cwd = mkdtempSync(path.join(os.tmpdir(), "hq-cli-pnpm-update-"));
+    const updateEnv = {
+        ...env,
+        COREPACK_ENABLE_PROJECT_SPEC: "0",
+        COREPACK_ENABLE_STRICT: "0",
+        COREPACK_DEFAULT_TO_LATEST: "0",
+        npm_config_manage_package_manager_versions: "false",
+    };
+    try {
+        const installedVersion = pnpmInstalledVersion(install);
+        if (installedVersion) {
+            const command = `pnpm@${installedVersion}`;
+            if (probe("corepack", [command, "--version"], updateEnv, cwd) === installedVersion) {
+                return runner("corepack", [command, ...buildPnpmInstallArgv(install)], updateEnv, cwd);
+            }
+        }
+        const fallbackVersion = probe("pnpm", ["--version"], updateEnv, cwd);
+        if (!fallbackVersion) {
+            return { ok: false, code: "PNPM_UNAVAILABLE", detail: "pnpm not found on PATH; install-owned Corepack pnpm could not run" };
+        }
+        // pnpm 10.28.1 and earlier reject --virtual-store-dir with -g. Keep the
+        // existing global directory and store, but omit only that unsupported flag.
+        const supportsGlobalVirtualStoreDir = semver.gte(fallbackVersion, "11.0.0");
+        const args = buildPnpmInstallArgv(install);
+        if (!supportsGlobalVirtualStoreDir) {
+            const index = args.indexOf("--virtual-store-dir");
+            if (index !== -1)
+                args.splice(index, 2);
+        }
+        return runner("pnpm", args, updateEnv, cwd);
+    }
+    finally {
+        rmSync(cwd, { recursive: true, force: true });
+    }
+}
 /** Argv for updating a Bun-managed global install. */
 export function buildBunInstallArgv() {
     return ["add", "-g", LATEST_PACKAGE_SPEC];
@@ -1037,7 +1124,7 @@ export function openInstallOutput(verbose, isTty = process.stdout.isTTY === true
         },
     };
 }
-export function runSupervisedUpdateCommand(cmd, args, output, env) {
+export function runSupervisedUpdateCommand(cmd, args, output, env, cwd) {
     try {
         const plan = buildSpawnPlan(cmd, args);
         const timeoutMs = updateTimeoutMs(env);
@@ -1061,6 +1148,7 @@ export function runSupervisedUpdateCommand(cmd, args, output, env) {
         ], inOwnProcessGroup({
             stdio: output.stdio,
             ...(env ? { env } : {}),
+            ...(cwd ? { cwd } : {}),
         }));
         // spawnSync reports a missing executable via `error`, not a throw.
         if (result.error) {
@@ -1108,20 +1196,22 @@ export function runSupervisedUpdateCommand(cmd, args, output, env) {
         };
     }
 }
-export function runUpdateCommand(cmd, args, env) {
+export function runUpdateCommand(cmd, args, env, cwd) {
     const output = openInstallOutput(true);
     try {
-        return runSupervisedUpdateCommand(cmd, args, output, env);
+        return runSupervisedUpdateCommand(cmd, args, output, env, cwd);
     }
     finally {
         output.dispose();
     }
 }
-function performUpdateCommand(cmd, args, runner = runUpdateCommand, env) {
+function performUpdateCommand(cmd, args, runner = runUpdateCommand, env, cwd) {
     // Forward env only when there is one to forward, so the common path keeps the
     // two-argument runner call it has always made (and existing runner spies see
     // no phantom `undefined` third argument).
-    return env === undefined ? runner(cmd, args) : runner(cmd, args, env);
+    return env === undefined && cwd === undefined
+        ? runner(cmd, args)
+        : runner(cmd, args, env, cwd);
 }
 function performUpdate(command, runner = runUpdateCommand) {
     const parts = command.split(/\s+/).filter(Boolean);
@@ -1141,8 +1231,13 @@ function performUpdate(command, runner = runUpdateCommand) {
  * speak the running manager's language.
  */
 function manualUpdateCommand(install, decision) {
-    if (install.manager === "pnpm")
-        return `pnpm ${buildPnpmInstallArgv(install).join(" ")}`;
+    if (install.manager === "pnpm") {
+        const version = pnpmInstalledVersion(install);
+        const plan = version
+            ? `corepack pnpm@${version} ${buildPnpmInstallArgv(install).join(" ")}`
+            : `pnpm ${buildPnpmInstallArgv(install).join(" ")}`;
+        return plan;
+    }
     if (install.manager === "bun")
         return `bun ${buildBunInstallArgv().join(" ")}`;
     if (install.prefix)
@@ -1522,7 +1617,9 @@ function attemptRequiredUpdate(decision, deps, install) {
     if (isManagedOutsideNpm) {
         console.error(chalk.dim(`  Detected a ${install.manager}-managed global install; updating with ${install.manager}`));
         console.error(chalk.dim(`  Running: ${primaryCmd} ${primaryArgs.join(" ")}`));
-        result = performUpdateCommand(primaryCmd, primaryArgs, runner, updateEnv);
+        result = install.manager === "pnpm"
+            ? performPnpmUpdate(install, runner, updateEnv ?? process.env, deps.probePnpmVersion)
+            : performUpdateCommand(primaryCmd, primaryArgs, runner, updateEnv);
     }
     else if (prefix) {
         console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
@@ -1719,6 +1816,10 @@ export const __test__ = {
     enforceUpdateRequired,
     isBunManagedPackageDir,
     pnpmUpdateEnv,
+    pnpmInstallDirs,
+    pnpmInstalledVersion,
+    performPnpmUpdate,
+    probePnpmVersion,
     isLocalDependencyInstall,
     isLocalDependencyPackageDir,
     isNewerVersion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.34",
+  "version": "5.345.36",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.33",
+    "@indigoai-us/hq-cloud": "~6.18.50",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",