@indigoai-us/hq-cli 5.345.46 → 5.345.48

package/dist/lib/lanes/watcher.js

@@ -106,11 +106,19 @@ export function classifyLaneExit(input) {
         throw new LanesError("unknown_envelope_decision", `Unknown envelope decision ${JSON.stringify(input.envelope.decision)}. Accepted: done, ask, blocked`, { accepted: ["done", "ask", "blocked"], value: input.envelope.decision });
     }
     if (input.providerRejection) {
+        const rejection = input.providerRejection;
+        const reason = isProviderLoginFailure(rejection)
+            ? "account_not_logged_in"
+            : rejection.status === 402
+                ? "provider_billing_required"
+                : rejection.status === 401 || rejection.status === 403
+                    ? "provider_auth_failed"
+                    : rejection.status === 429 || /\b(?:rate limit|too many requests)\b/i.test(rejection.message)
+                        ? "provider_rate_limited"
+                        : PROVIDER_REJECTED_REASON;
         return {
-            state: "failed",
-            reason: isProviderLoginFailure(input.providerRejection)
-                ? "account_not_logged_in"
-                : PROVIDER_REJECTED_REASON,
+            state: rejection.retryable && input.hasProviderSession === true ? "interrupted" : "failed",
+            reason,
         };
     }
     if (input.invalidEnvelope) {
@@ -129,15 +137,14 @@ export function classifyLaneExit(input) {
 }
 /**
  * One decision for an exited worker's output. An explicit provider status
- * wins over the quota text heuristics: a 429 from any provider (including
- * codex `turn.failed` and grok error objects, which the claude-shaped quota
- * reader never sees) becomes a quota signal; any other explicit status is a
- * rejection even when its text sounds like a quota message (a 402 "requires
- * usage credits" is a rejection, not a hold). A failure with no status at
- * all is matched against the quota text heuristics first: a status-less
- * "usage limit" / "rate limit" turn.failed still creates the account hold;
- * any other status-less message is a rejection. Only when the stream
- * carries no failure object does the quota reader's own read apply.
+ * wins over the quota text heuristics: a 429 with quota-specific text or a
+ * usage-limit error type becomes an account hold; a generic rate-limit
+ * response stays a retryable provider rejection. Any other explicit status
+ * is a rejection even when its text sounds like a quota message (a 402
+ * "requires usage credits" is a billing refusal, not a hold). A status-less
+ * usage-limit message can create an account hold, while a status-less
+ * rate-limit message remains a retryable provider rejection. Only when the
+ * stream carries no failure object does the quota reader's own read apply.
  */
 function validFailureOutputTime(value, fallback) {
     const parsed = new Date(value);
@@ -146,21 +153,31 @@ function validFailureOutputTime(value, fallback) {
         : fallback;
 }
 export function routeProviderFailure(failure, readQuota, model, now) {
-    if (failure && failure.status === QUOTA_STATUS) {
+    if (failure && failure.status === QUOTA_STATUS && isAccountQuotaFailure(failure)) {
         return {
             quota: quotaSignalFromFields({ api_error_status: QUOTA_STATUS, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now),
             rejection: null,
         };
     }
-    if (failure && failure.status === null) {
+    if (failure && failure.status === null && isAccountQuotaFailure(failure)) {
         const quota = quotaSignalFromFields({ api_error_status: undefined, is_error: true, result: failure.message }, model, failure.output_at ? validFailureOutputTime(failure.output_at, now) : now);
         if (quota)
             return { quota, rejection: null };
     }
-    if (failure)
-        return { quota: null, rejection: failure };
+    if (failure) {
+        return {
+            quota: null,
+            rejection: failure.status === QUOTA_STATUS
+                ? { ...failure, retryable: true }
+                : failure,
+        };
+    }
     return { quota: readQuota(), rejection: null };
 }
+function isAccountQuotaFailure(failure) {
+    return failure.error_type === "usage_limit_reached" ||
+        /weekly limit|usage limit|quota|usage credits|hit your .+ limit/i.test(failure.message);
+}
 export function tickWatcher(input) {
     const silenceMs = input.silenceMs ?? SILENCE_MS;
     const at = new Date(input.nowMs).toISOString();
@@ -171,6 +188,7 @@ export function tickWatcher(input) {
             quota: input.quota,
             invalidEnvelope: input.invalidEnvelope,
             providerRejection: input.providerRejection,
+            hasProviderSession: input.hasProviderSession,
         });
         return {
             emit: { kind: "terminal", at, classification },
@@ -1578,6 +1596,8 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
             quota,
             invalidEnvelope,
             providerRejection,
+            hasProviderSession: typeof quotaLane?.provider_session_id === "string" &&
+                quotaLane.provider_session_id.trim().length > 0,
         });
         if (processAlive) {
             maybeHeartbeatLane(hqRoot, laneId, now());

package/dist/utils/resident-package-preload.js

@@ -83,6 +83,8 @@ export const RESIDENT_PACKAGE_MODULES = {
         "../utils/cli-telemetry.js",
         "../utils/cognito-session.js",
         "../lib/first-sync-next-step.js",
+        "../lib/process-flag-company-context.js",
+        "../lib/flag-snapshot-file.js",
         "@indigoai-us/hq-cloud",
     ],
 };
@@ -352,6 +354,8 @@ const LOADERS = {
         () => import("../utils/cli-telemetry.js"),
         () => import("../utils/cognito-session.js"),
         () => import("../lib/first-sync-next-step.js"),
+        () => import("../lib/process-flag-company-context.js"),
+        () => import("../lib/flag-snapshot-file.js"),
         () => import("@indigoai-us/hq-cloud"),
     ],
 };

package/dist/utils/self-update.js

@@ -65,7 +65,7 @@ import chalk from "chalk";
 import { Sentry } from "../sentry.js";
 import { isCliTelemetryDisabled } from "./cli-telemetry.js";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, pnpmPathConflict, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
 import { canStageInstall, stagedNpmInstall } from "./staged-install.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
@@ -931,6 +931,13 @@ async function attemptUpdateAndReexec(argv, flavor, known, deps, env) {
         console.error(chalk.dim(`hq-cli ${latest} is available, but this copy is a local dependency (${install.packageRoot}) — update the project that owns it.`));
         return { action: "skipped", latest };
     }
+    if (install.manager === "pnpm") {
+        const conflict = pnpmPathConflict(install);
+        if (conflict) {
+            console.error(chalk.yellow(`⚠ hq self-update refused: ${conflict}`));
+            return { action: "skipped", latest };
+        }
+    }
     const releaseLock = flavor.lock ? (deps.acquireLock ?? acquireUpdateLock)() : () => { };
     if (!releaseLock)
         return { action: "skipped", latest };

package/dist/utils/version-gate.d.ts

@@ -430,6 +430,13 @@ declare function resolveHqOnPath(): string | null;
 export declare function parseReportedCliVersion(stdout: string): string | null;
 /** `<bin> --version` output (trimmed), or null on any failure/timeout. */
 declare function probeCliVersion(bin: string): string | null;
+/**
+ * Detect a second pnpm global install winning PATH before the updater mutates
+ * the running install. pnpm homes have independent global package trees and
+ * shims, so writing one home cannot change a different home that appears first
+ * on PATH.
+ */
+export declare function pnpmPathConflict(install: RunningInstall): string | null;
 /**
  * Read-your-writes convergence check, run after an install reports success.
  *

package/dist/utils/version-gate.js

@@ -1395,6 +1395,43 @@ function probeCliVersion(bin) {
         return null;
     }
 }
+/**
+ * Detect a second pnpm global install winning PATH before the updater mutates
+ * the running install. pnpm homes have independent global package trees and
+ * shims, so writing one home cannot change a different home that appears first
+ * on PATH.
+ */
+export function pnpmPathConflict(install) {
+    if (install.manager !== "pnpm" || !install.packageRoot)
+        return null;
+    const bin = resolveHqOnPath();
+    if (!bin)
+        return null;
+    const pathPackageRoot = findPackageRootForExecutable(bin);
+    if (!pathPackageRoot ||
+        globalInstallManagerForPath(bin, pathPackageRoot) !== "pnpm") {
+        return null;
+    }
+    // The fallback resolver scans every hash in a PNPM_HOME because generated
+    // shims do not expose their target. Multiple installs in the SAME home can
+    // therefore produce an arbitrary package root; only a different home means
+    // that updating this install cannot change which global shim wins PATH.
+    const runningHome = derivePnpmHome(install);
+    const pathHome = derivePnpmHome({ manager: "pnpm", prefix: null, packageRoot: pathPackageRoot });
+    if (!runningHome || !pathHome || samePath(runningHome, pathHome))
+        return null;
+    let resolvedBin = bin;
+    try {
+        resolvedBin = realpathSync(bin);
+    }
+    catch {
+        // Keep the PATH entry when a platform shim cannot be canonicalized.
+    }
+    const version = probeCliVersion(bin) ?? "unknown";
+    return (`PATH resolves ${resolvedBin} at version ${version} (manager: pnpm), ` +
+        `but this process is running from a different pnpm install at ${install.packageRoot}. ` +
+        "Refusing to update one pnpm home while another hq-cli install wins PATH resolution.");
+}
 /**
  * Read-your-writes convergence check, run after an install reports success.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.46",
+  "version": "5.345.48",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {