@indigoai-us/hq-cli 5.345.78 → 5.345.80

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [5.345.80] — 2026-10-11
+- The version gate no longer treats a pnpm global install that Node resolved
+  into `store/v11/links` as a local dependency, so it can self-update instead
+  of blocking commands such as `hq secrets exec`. First-party `hq-cli`
+  self-updates skip the 24h package-age quarantine; if that guard still
+  refuses the required build, the current CLI keeps running rather than
+  locking you out for the rest of the day.
+- `hq doctor --fix` now refreshes a stale personal-files sync journal with
+  the same keep-conflicts pull already used for company journals. An old
+  leftover personal journal beside the current one is no longer reported
+  as an unrepaired health check.
+
+## [5.345.79] — 2026-10-11
+- `hq lanes` no longer fails every list, message, or admission command when
+  one lane still has leftover queue details from an older worker-profile wait.
+  Those leftover details are dropped on read, cleared when the queue reason
+  changes, and one unreadable lane is skipped so the rest of the host stays
+  usable.
+- `hq doctor --fix` still refreshes a stale company sync journal when
+  `.claude/`, `.codex/`, or `.grok/` has uncommitted changes. Those dirty
+  files still block hook-file repairs unless you pass `--force`.
+
 ## [5.345.78] — 2026-10-10
 - `hq lanes` no longer fails every list, message, or admission command when
   one lane still has leftover queue details from an older worker-profile wait.

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -109,6 +109,8 @@ export interface SyncHealthDeps {
 export declare function isSafeCompanySlug(slug: string): boolean;
 /** True when this journal slug names a company rather than the personal tree. */
 export declare function isCompanyJournalSlug(slug: string): boolean;
+/** True when this journal slug names the personal tree or personal vault. */
+export declare function isPersonalJournalSlug(slug: string): boolean;
 /** Company slug from a `sync.journal.<slug>` check id, or null if not one. */
 export declare function journalSlugFromCheckId(checkId: string): string | null;
 /** The versions/sync check family. Registered in `createDefaultRegistry`. */

package/dist/lib/doctor/checks/sync-health.js

@@ -206,6 +206,10 @@ function journalSlugForCheckId(slug) {
 export function isCompanyJournalSlug(slug) {
     return !NON_COMPANY_JOURNAL_SLUGS.has(slug);
 }
+/** True when this journal slug names the personal tree or personal vault. */
+export function isPersonalJournalSlug(slug) {
+    return NON_COMPANY_JOURNAL_SLUGS.has(slug);
+}
 /** Company slug from a `sync.journal.<slug>` check id, or null if not one. */
 export function journalSlugFromCheckId(checkId) {
     const match = /^sync\.journal\.(.+)$/.exec(checkId);
@@ -390,9 +394,24 @@ function journalAndManifestResults(deps) {
 }
 function journalResults(deps, journals) {
     const nowMs = deps.now().getTime();
+    const hasPersonalVaultJournal = journals.some((entry) => entry.slug === PERSONAL_VAULT_SCOPE_SLUG);
     return journals.map((entry) => {
         const lastSync = entry.journal?.lastSync;
         const checkId = `sync.journal.${journalSlugForCheckId(entry.slug)}`;
+        // The legacy `personal` shard and `__hq_personal_vault__` name the same
+        // tree. Once the vault journal exists, the old file is leftover
+        // bookkeeping: WARN would make `hq doctor --fix` look like it failed to
+        // repair a row it cannot refresh (a personal pull writes the vault
+        // journal, not this one).
+        if (entry.slug === PERSONAL_SCOPE_SLUG && hasPersonalVaultJournal) {
+            return {
+                status: "NA",
+                checkId,
+                reasonCode: "legacy-personal-journal",
+                target: entry.path,
+                message: "Sync journal 'personal' is unused on this machine — personal files now sync through the personal vault journal, so this leftover shard is not a live sync target.",
+            };
+        }
         // A company journal without a local tree is leftover membership state,
         // not a live sync target. WARN would make `hq doctor --fix` look like it
         // failed to repair something it was never going to touch (US-015 health

package/dist/lib/doctor/fix/apply.d.ts

@@ -5,14 +5,18 @@
  * wrapped in guardrails that are NOT polish — each is a PRD acceptance criterion:
  *
  *   1. Dirty-tree refusal. If the working tree has uncommitted changes under
- *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses and exits non-zero
- *      unless `--force`, so a repair can never be tangled up with unrelated
- *      in-flight edits to the security layer.
+ *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses hook-file repairs
+ *      and exits non-zero unless `--force`, so those writes can never be
+ *      tangled up with unrelated in-flight edits to the security layer.
+ *      Repairs that do not write those trees (a stale-company `refresh-sync`
+ *      pull) still run: the SessionStart health hook never passes `--force`,
+ *      and blocking the pull left `sync.journal.<slug>` WARN after `--fix`.
  *   2. Allowlist only. It repairs the classified safe classes — restore an
  *      execute bit, add a hook id to the gate profiles it is missing from,
- *      re-register a script present on disk, or pull a company whose local
- *      tree exists but whose journal is stale — and NEVER rewrites a hook body
- *      or deletes a file. Classification is owned by {@link deriveRemediation};
+ *      re-register a script present on disk, or pull a company or personal
+ *      vault whose local tree exists but whose journal is stale — and NEVER
+ *      rewrites a hook body or deletes a file. Classification is owned by
+ *      {@link deriveRemediation};
  *      a content-drift finding is manual-only and simply never appears in the
  *      fixable set.
  *   3. Preview + confirmation. Every change is shown diff-style and requires
@@ -67,8 +71,9 @@ export interface ApplyFixesOptions {
     runChecks?: (hqRoot: string) => Promise<CheckResult[]>;
     /**
      * Targeted pull used by the `refresh-sync` class. Default shells out to
-     * `hq sync pull --company <slug> --on-conflict keep`. Tests inject a stub
-     * so `--fix` never hits the network.
+     * `hq sync pull --company <slug> --on-conflict keep`, or
+     * `hq sync pull --personal --on-conflict keep` for personal journals.
+     * Tests inject a stub so `--fix` never hits the network.
      */
     refreshSync?: (target: RefreshSyncTarget) => Promise<RefreshSyncResult>;
     /**
@@ -81,12 +86,14 @@ export interface ApplyFixesOptions {
         to: string;
     } | null;
 }
-/** One company the `refresh-sync` class will pull. */
+/** One company or personal vault the `refresh-sync` class will pull. */
 export interface RefreshSyncTarget {
-    /** Company slug from the `sync.journal.<slug>` check id. */
+    /** Company slug, or `personal` for the personal vault. */
     slug: string;
     /** HQ root the pull writes into. */
     hqRoot: string;
+    /** Pull the personal vault instead of `companies/<slug>`. */
+    personal?: boolean;
 }
 /** Outcome of one {@link ApplyFixesOptions.refreshSync} call. */
 export interface RefreshSyncResult {
@@ -157,9 +164,9 @@ export interface ApplyFixesResult {
 export declare function applyFixes(options: ApplyFixesOptions): Promise<ApplyFixesResult>;
 /**
  * Default `refresh-sync` repair: a bounded, pull-only, keep-conflicts
- * `hq sync pull --company <slug>` against the tree `--fix` is repairing.
- * Never a push, never interactive. A timeout or non-zero exit is reported
- * rather than thrown so later plans still run.
+ * `hq sync pull --company <slug>` (or `--personal`) against the tree
+ * `--fix` is repairing. Never a push, never interactive. A timeout or
+ * non-zero exit is reported rather than thrown so later plans still run.
  */
 export declare function defaultRefreshSync(target: RefreshSyncTarget): Promise<RefreshSyncResult>;
 /**

package/dist/lib/doctor/fix/apply.js

@@ -5,14 +5,18 @@
  * wrapped in guardrails that are NOT polish — each is a PRD acceptance criterion:
  *
  *   1. Dirty-tree refusal. If the working tree has uncommitted changes under
- *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses and exits non-zero
- *      unless `--force`, so a repair can never be tangled up with unrelated
- *      in-flight edits to the security layer.
+ *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses hook-file repairs
+ *      and exits non-zero unless `--force`, so those writes can never be
+ *      tangled up with unrelated in-flight edits to the security layer.
+ *      Repairs that do not write those trees (a stale-company `refresh-sync`
+ *      pull) still run: the SessionStart health hook never passes `--force`,
+ *      and blocking the pull left `sync.journal.<slug>` WARN after `--fix`.
  *   2. Allowlist only. It repairs the classified safe classes — restore an
  *      execute bit, add a hook id to the gate profiles it is missing from,
- *      re-register a script present on disk, or pull a company whose local
- *      tree exists but whose journal is stale — and NEVER rewrites a hook body
- *      or deletes a file. Classification is owned by {@link deriveRemediation};
+ *      re-register a script present on disk, or pull a company or personal
+ *      vault whose local tree exists but whose journal is stale — and NEVER
+ *      rewrites a hook body or deletes a file. Classification is owned by
+ *      {@link deriveRemediation};
  *      a content-drift finding is manual-only and simply never appears in the
  *      fixable set.
  *   3. Preview + confirmation. Every change is shown diff-style and requires
@@ -31,6 +35,7 @@
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { isPersonalJournalSlug } from "../checks/sync-health.js";
 import { createDefaultRegistry } from "../registry.js";
 import { flattenFamilies } from "../report.js";
 import { gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
@@ -107,20 +112,34 @@ export async function applyFixes(options) {
         ...over,
     });
     // 1. Dirty-tree refusal (AC8). Never write over uncommitted security-layer
-    //    edits unless the user forces it.
-    if (!options.force) {
-        const dirty = (options.dirtyCheck ?? uncommittedHookConfigChanges)(hqRoot);
-        if (dirty.length > 0) {
-            writeErr(`hq doctor --fix: refusing to run — uncommitted changes under ` +
-                `${HOOK_CONFIG_DIRS.join(", ")}:\n` +
-                dirty.map((line) => `  ${line}`).join("\n") +
-                `\nCommit or stash them, or re-run with --force.\n`);
-            return empty({ exitCode: 1, refused: "dirty-tree" });
-        }
-    }
+    //    edits unless the user forces it. Probe once; hook-file plans are
+    //    dropped per pass so a stale-journal pull can still run.
+    const dirty = options.force
+        ? []
+        : (options.dirtyCheck ?? uncommittedHookConfigChanges)(hqRoot);
+    const refuseDirtyHookWrites = (plans) => {
+        if (dirty.length === 0)
+            return plans;
+        const allowed = plans.filter((plan) => plan.relpath.length === 0);
+        if (allowed.length === plans.length)
+            return plans;
+        if (allowed.length === 0)
+            return "refuse";
+        writeErr(`hq doctor --fix: skipping hook-file repairs — uncommitted changes under ` +
+            `${HOOK_CONFIG_DIRS.join(", ")}. Refreshing sync journals still runs; ` +
+            `re-run with --force to repair hook files.\n`);
+        return allowed;
+    };
+    const refuseDirtyTree = () => {
+        writeErr(`hq doctor --fix: refusing to run — uncommitted changes under ` +
+            `${HOOK_CONFIG_DIRS.join(", ")}:\n` +
+            dirty.map((line) => `  ${line}`).join("\n") +
+            `\nCommit or stash them, or re-run with --force.\n`);
+        return empty({ exitCode: 1, refused: "dirty-tree" });
+    };
     // Resolve the customer-visible manual-only output gate once per fix run.
-    // Keep it behind the dirty-tree guard, and fail open to the pre-change
-    // output if the identity is absent or the registry lookup fails.
+    // Fail open to the pre-change output if the identity is absent or the
+    // registry lookup fails.
     let showManualOnlyRemediations = false;
     try {
         showManualOnlyRemediations =
@@ -165,14 +184,29 @@ export async function applyFixes(options) {
             keysThisPass.add(key);
             plans.push(plan);
         }
-        const refreshPlans = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-sync"), lastAttemptedRefreshSyncSlug).slice(0, Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun));
+        const seenRefreshTargets = new Set();
+        const refreshPlans = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-sync"), lastAttemptedRefreshSyncSlug).filter((plan) => {
+            if (seenRefreshTargets.has(plan.target))
+                return false;
+            seenRefreshTargets.add(plan.target);
+            return true;
+        }).slice(0, Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun));
         return [
             ...plans.filter((plan) => plan.fixClass !== "refresh-sync"),
             ...refreshPlans,
         ];
     };
     for (let pass = 1; pass <= MAX_FIX_PASSES; pass += 1) {
-        const plans = buildPlans(findings);
+        const plannedThisPass = refuseDirtyHookWrites(buildPlans(findings));
+        if (plannedThisPass === "refuse") {
+            if (planned.length === 0)
+                return refuseDirtyTree();
+            write(`Pass ${pass}/${MAX_FIX_PASSES}: remaining repairs write hook files; ` +
+                `stopped because the tree is dirty.\n`);
+            refused = "dirty-tree";
+            break;
+        }
+        const plans = plannedThisPass;
         if (plans.length === 0)
             break;
         fixableCount += plans.length;
@@ -304,19 +338,21 @@ async function defaultRunChecks(hqRoot) {
 }
 /**
  * Default `refresh-sync` repair: a bounded, pull-only, keep-conflicts
- * `hq sync pull --company <slug>` against the tree `--fix` is repairing.
- * Never a push, never interactive. A timeout or non-zero exit is reported
- * rather than thrown so later plans still run.
+ * `hq sync pull --company <slug>` (or `--personal`) against the tree
+ * `--fix` is repairing. Never a push, never interactive. A timeout or
+ * non-zero exit is reported rather than thrown so later plans still run.
  */
 export function defaultRefreshSync(target) {
     const hqBin = process.argv[1];
+    const selector = target.personal || isPersonalJournalSlug(target.slug)
+        ? ["--personal"]
+        : ["--company", target.slug];
     const args = hqBin
         ? [
             hqBin,
             "sync",
             "pull",
-            "--company",
-            target.slug,
+            ...selector,
             "--hq-root",
             target.hqRoot,
             "--on-conflict",
@@ -327,8 +363,7 @@ export function defaultRefreshSync(target) {
         : [
             "sync",
             "pull",
-            "--company",
-            target.slug,
+            ...selector,
             "--hq-root",
             target.hqRoot,
             "--on-conflict",
@@ -445,23 +480,28 @@ export function defaultRewriteBotNodePath(name) {
         return null;
     return rewriteBotDaemonNodePath(buildBotDaemonPaths({ name, botDir: dir, hqRoot: config.hqRoot, hqBinary: "hq" }), { platform: "darwin" });
 }
-/** Pull one company to refresh a stale or never-synced journal. */
+/** Pull one company or the personal vault to refresh a stale journal. */
 function planRefreshSync(hqRoot, result, rem, refreshSync) {
     const slug = rem.fixTarget;
     if (!slug)
         return null;
+    const personal = isPersonalJournalSlug(slug);
     let outcome;
     return {
         checkId: result.checkId,
         fixClass: "refresh-sync",
         target: slug,
         relpath: "",
-        preview: `  companies/${slug}\n` +
-            `    ~ hq sync pull --company ${slug} --on-conflict keep\n` +
-            `      refresh the stale sync journal (keeps local conflict copies)`,
+        preview: personal
+            ? `  personal vault\n` +
+                `    ~ hq sync pull --personal --on-conflict keep\n` +
+                `      refresh the stale personal sync journal (keeps local conflict copies)`
+            : `  companies/${slug}\n` +
+                `    ~ hq sync pull --company ${slug} --on-conflict keep\n` +
+                `      refresh the stale sync journal (keeps local conflict copies)`,
         summary: `pull ${slug} to refresh its sync journal`,
         apply: async () => {
-            const result = await refreshSync({ slug, hqRoot });
+            const result = await refreshSync({ slug, hqRoot, personal });
             outcome = result.outcome;
         },
         refreshSyncOutcome: () => outcome,

package/dist/lib/doctor/fix/remediation.d.ts

@@ -24,9 +24,11 @@
  *                         never auto-registered: that is what created them.)
  *   - `refresh-sync`    — run a targeted pull for a company journal that is
  *                         stale or never-synced AND has a local
- *                         `companies/<slug>` tree. Pull-only, `--on-conflict
- *                         keep`, no hook-file rewrite. Personal journals and
- *                         leftover shards without a local tree stay manual.
+ *                         `companies/<slug>` tree, or for a live personal /
+ *                         personal-vault journal. Pull-only, `--on-conflict
+ *                         keep`, no hook-file rewrite. Leftover shards
+ *                         without a local tree stay unfixed (the check reports
+ *                         NA).
  *
  * EVERYTHING else — content drift between platform copies, a missing script, a
  * missing Codex counterpart, an unquoted `$CLAUDE_PROJECT_DIR`, a stale

package/dist/lib/doctor/fix/remediation.js

@@ -24,9 +24,11 @@
  *                         never auto-registered: that is what created them.)
  *   - `refresh-sync`    — run a targeted pull for a company journal that is
  *                         stale or never-synced AND has a local
- *                         `companies/<slug>` tree. Pull-only, `--on-conflict
- *                         keep`, no hook-file rewrite. Personal journals and
- *                         leftover shards without a local tree stay manual.
+ *                         `companies/<slug>` tree, or for a live personal /
+ *                         personal-vault journal. Pull-only, `--on-conflict
+ *                         keep`, no hook-file rewrite. Leftover shards
+ *                         without a local tree stay unfixed (the check reports
+ *                         NA).
  *
  * EVERYTHING else — content drift between platform copies, a missing script, a
  * missing Codex counterpart, an unquoted `$CLAUDE_PROJECT_DIR`, a stale
@@ -36,7 +38,7 @@
  * content-drift finding is manual-only, because that boundary is load-bearing:
  * deciding which of two diverged copies is correct needs human judgement.
  */
-import { isCompanyJournalSlug, journalSlugFromCheckId, } from "../checks/sync-health.js";
+import { isCompanyJournalSlug, isPersonalJournalSlug, journalSlugFromCheckId, } from "../checks/sync-health.js";
 /** Matches an exec-bit remediation command, quoted or not: `chmod +x <path>`. */
 const CHMOD_EXEC = /^chmod\s+\+x\s+(.+)$/;
 /**
@@ -117,10 +119,22 @@ export function deriveRemediation(result) {
             command: remediation ?? `hq bot start ${target}`,
         };
     }
-    // refresh-sync — a company journal that is stale or never-synced. Only
-    // company slugs: personal shards have no companies/<slug> tree and a
-    // SessionStart `--fix --yes` must not pull the personal vault unprompted.
+    // refresh-sync — a company journal that is stale or never-synced, or a
+    // live personal / personal-vault journal. Leftover shards are NA at the
+    // check layer, so they never reach this classifier. A SessionStart
+    // `--fix --yes` pull is keep-conflicts and pull-only, matching the
+    // company repair: leaving personal journals WARN made the health hook
+    // report an unrepaired failure for a row doctor refused to touch.
     const journalSlug = journalSlugFromCheckId(checkId);
+    if (journalSlug && isPersonalJournalSlug(journalSlug)) {
+        return {
+            autoFixable: true,
+            fixClass: "refresh-sync",
+            fixTarget: "personal",
+            action: "Pull the personal vault to refresh its sync journal (keeps local conflict copies).",
+            command: "hq sync pull --personal --on-conflict keep",
+        };
+    }
     if (journalSlug && isCompanyJournalSlug(journalSlug)) {
         return {
             autoFixable: true,

package/dist/lib/doctor/types.d.ts

@@ -19,7 +19,7 @@ export declare const DOCTOR_STATUSES: readonly ["PASS", "FAIL", "WARN", "UNTESTE
  */
 export type DoctorStatus = (typeof DOCTOR_STATUSES)[number];
 /** Stable, privacy-safe diagnostics emitted by the sync health family. */
-export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "never-synced", "invalid-last-sync", "stale-threshold", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
+export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "legacy-personal-journal", "never-synced", "invalid-last-sync", "stale-threshold", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
 export type SyncReasonCode = (typeof SYNC_REASON_CODES)[number];
 /** Runtime type guard: true only for a member of the fixed vocabulary. */
 export declare function isDoctorStatus(value: unknown): value is DoctorStatus;

package/dist/lib/doctor/types.js

@@ -26,6 +26,7 @@ export const SYNC_REASON_CODES = [
     "core-version-unavailable",
     "core-update-available",
     "no-local-tree",
+    "legacy-personal-journal",
     "never-synced",
     "invalid-last-sync",
     "stale-threshold",

package/dist/sentry-before-send.js

@@ -192,6 +192,7 @@ export function beforeSend(event, _hint) {
             "core-version-unavailable",
             "core-update-available",
             "no-local-tree",
+            "legacy-personal-journal",
             "never-synced",
             "invalid-last-sync",
             "stale-threshold",

package/dist/utils/self-update.js

@@ -65,7 +65,7 @@ import chalk from "chalk";
 import { Sentry } from "../sentry.js";
 import { isCliTelemetryDisabled } from "./cli-telemetry.js";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, nonWritablePrefixNote, openInstallOutput, resolvePnpmPathInstall, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
+import { buildBunInstallArgv, buildPnpmInstallArgv, buildPrefixedInstallArgv, buildSpawnPlan, canWriteNpmInstall, captureNonWritableNpmPrefixNotice, claimNonWritableNpmPrefixNotice, checkUpdateConvergence, derivePnpmHome, detachUpdateSupervisor, isBunManagedPackageDir, isLocalDependencyInstall, isPnpmManagedPackageDir, normalizeRunningInstall, nonWritablePrefixNote, openInstallOutput, resolvePnpmPathInstall, pnpmUpdateEnv, pnpmInstalledVersion, performPnpmUpdate, resolveRunningInstall, runUpdateCommand, runSupervisedUpdateCommand, UPDATE_RECURSION_GUARD_ENV, } from "./version-gate.js";
 import { canStageInstall, stagedNpmInstall } from "./staged-install.js";
 import { acquireUpdateLock as acquireSharedUpdateLock } from "./update-lock.js";
 import { markLatestIneffective } from "./version-check.js";
@@ -926,7 +926,7 @@ async function attemptUpdateAndReexec(argv, flavor, known, deps, env) {
     // actually running would stay exactly as stale as it started while the CLI
     // reported success and re-exec'd into the same build. That is the shape of
     // the 2026-09-02 gate loop — see isLocalDependencyInstall in version-gate.ts.
-    let install = (deps.resolveInstall ?? resolveRunningInstall)();
+    let install = normalizeRunningInstall((deps.resolveInstall ?? resolveRunningInstall)());
     if (isLocalDependencyInstall(install)) {
         console.error(chalk.dim(`hq-cli ${latest} is available, but this copy is a local dependency (${install.packageRoot}) — update the project that owns it.`));
         return { action: "skipped", latest };

package/dist/utils/version-gate.d.ts

@@ -31,6 +31,9 @@ import { buildSpawnPlan, quoteForWindowsShell } from "./windows-spawn.js";
 import { type UpdateLockHandle } from "./update-lock.js";
 /** Prevent an update package manager's lifecycle child from starting another updater. */
 export declare const UPDATE_RECURSION_GUARD_ENV = "HQ_RESCUE_SELF_UPDATED";
+/** First-party hq-cli is published by this org; the 24h pnpm quarantine must not
+ *  block the version-gate from installing the server-required build. */
+export declare const PNPM_FIRST_PARTY_RELEASE_AGE_EXCLUDE: string;
 export type VersionGatePhase = "preflight" | "lock_acquired" | "installer_running" | "verifying" | "rollback" | "complete" | "failed" | "unknown";
 /** The last closed version-gate phase observed in this process. */
 export declare function getVersionGatePhase(): VersionGatePhase;
@@ -86,6 +89,8 @@ export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
  * Those layouts fall through to the ordinary npm-prefix/manual handling.
  */
 export declare function isPnpmManagedPackageDir(pkgDir: string): boolean;
+/** pnpm's content-addressed `store/vN/links/…` layout (not `store/vN/tmp` dlx). */
+export declare function isPnpmContentStoreLinksPackageDir(pkgDir: string): boolean;
 /** Whether the running package lives inside Bun's global install tree. */
 export declare function isBunManagedPackageDir(pkgDir: string): boolean;
 /**
@@ -164,6 +169,13 @@ export interface RunningInstall {
     packageRoot: string | null;
 }
 export declare function resolveRunningInstall(): RunningInstall;
+/**
+ * Repair a RunningInstall whose package root is a pnpm content store but whose
+ * manager was recorded as npm (the pre-fix classification of a realpath'd
+ * pnpm-global shim). Callers that inject an install snapshot must run this
+ * before the local-dependency hard stop, or they replay the 2420 lockout.
+ */
+export declare function normalizeRunningInstall(install: RunningInstall): RunningInstall;
 /** Convenience view of {@link resolveRunningInstall} for callers needing one field. */
 export declare function resolveRunningManager(): InstallManager;
 /** Convenience view of {@link resolveRunningInstall} for callers needing one field. */
@@ -564,8 +576,11 @@ export declare const __test__: {
     isLocalDependencyInstall: typeof isLocalDependencyInstall;
     isLocalDependencyPackageDir: typeof isLocalDependencyPackageDir;
     isNewerVersion: typeof isNewerVersion;
+    isPnpmContentStoreLinksPackageDir: typeof isPnpmContentStoreLinksPackageDir;
     isPnpmManagedPackageDir: typeof isPnpmManagedPackageDir;
     isPnpmVirtualStorePackageDir: typeof isPnpmVirtualStorePackageDir;
+    normalizeRunningInstall: typeof normalizeRunningInstall;
+    PNPM_FIRST_PARTY_RELEASE_AGE_EXCLUDE: string;
     isPrefixWritable: typeof isPrefixWritable;
     nonWritablePrefixNote: typeof nonWritablePrefixNote;
     npmPrefixFromPackageDir: typeof npmPrefixFromPackageDir;

package/dist/utils/version-gate.js

@@ -49,6 +49,9 @@ const CLIENT_ID = "hq-cli";
 const ENDPOINT_PATH = "/v1/client-version/check";
 const FETCH_TIMEOUT_MS = 3_000;
 const LATEST_PACKAGE_SPEC = `${CLI_NAME}@latest`;
+/** First-party hq-cli is published by this org; the 24h pnpm quarantine must not
+ *  block the version-gate from installing the server-required build. */
+export const PNPM_FIRST_PARTY_RELEASE_AGE_EXCLUDE = `--config.minimumReleaseAgeExclude=${CLI_NAME}`;
 let currentVersionGatePhase = "unknown";
 /** The last closed version-gate phase observed in this process. */
 export function getVersionGatePhase() {
@@ -294,6 +297,29 @@ export function isPnpmManagedPackageDir(pkgDir) {
             return true;
         }
     }
+    // Node realpaths pnpm's generated shim into the content-addressed store:
+    //   $PNPM_HOME/store/v11/links/@indigoai-us/hq-cli/<ver>/<hash>/node_modules/@indigoai-us/hq-cli
+    // There is no `global/` segment after realpath, so the checks above miss it
+    // and the gate used to label this a "local dependency" (feedback 2420).
+    // `store/vN/tmp/` is pnpm dlx and must stay non-global.
+    if (isPnpmContentStoreLinksPackageDir(normalized))
+        return true;
+    return false;
+}
+/** pnpm's content-addressed `store/vN/links/…` layout (not `store/vN/tmp` dlx). */
+export function isPnpmContentStoreLinksPackageDir(pkgDir) {
+    const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
+    const segments = normalized.split("/").filter(Boolean);
+    for (let i = 0; i < segments.length - 2; i += 1) {
+        if (segments[i] !== "store")
+            continue;
+        if (!/^v\d+$/.test(segments[i + 1]))
+            continue;
+        if (segments[i + 2] === "tmp")
+            return false;
+        if (segments[i + 2] === "links")
+            return true;
+    }
     return false;
 }
 /** Whether the running package lives inside Bun's global install tree. */
@@ -449,6 +475,21 @@ export function resolveRunningInstall() {
         return { manager: "npm", prefix: null, packageRoot: null };
     }
 }
+/**
+ * Repair a RunningInstall whose package root is a pnpm content store but whose
+ * manager was recorded as npm (the pre-fix classification of a realpath'd
+ * pnpm-global shim). Callers that inject an install snapshot must run this
+ * before the local-dependency hard stop, or they replay the 2420 lockout.
+ */
+export function normalizeRunningInstall(install) {
+    if (!install.packageRoot)
+        return install;
+    if (install.manager === "pnpm")
+        return install;
+    if (!isPnpmManagedPackageDir(install.packageRoot))
+        return install;
+    return { manager: "pnpm", prefix: null, packageRoot: install.packageRoot };
+}
 /** Convenience view of {@link resolveRunningInstall} for callers needing one field. */
 export function resolveRunningManager() {
     return resolveRunningInstall().manager;
@@ -652,11 +693,15 @@ export function derivePnpmHome(install) {
     if (install.manager !== "pnpm" || !install.packageRoot)
         return null;
     const normalized = install.packageRoot.replace(/\\/g, "/");
-    const marker = normalized.indexOf("/global/");
-    if (marker === -1)
-        return null;
-    const home = normalized.slice(0, marker);
-    return home || null;
+    const globalMarker = normalized.indexOf("/global/");
+    if (globalMarker !== -1) {
+        const home = normalized.slice(0, globalMarker);
+        return home || null;
+    }
+    const storeMatch = normalized.match(/^(.*)\/store\/v\d+\/links\//);
+    if (storeMatch)
+        return storeMatch[1] || null;
+    return null;
 }
 /**
  * Environment for the pnpm self-update spawn. pnpm requires its configured
@@ -713,7 +758,7 @@ export function buildPrefixedInstallArgv(prefix) {
  * the new version — which is the whole point of routing here instead of npm.
  */
 export function buildPnpmInstallArgv(install) {
-    const args = ["add", "-g", LATEST_PACKAGE_SPEC];
+    const args = ["add", "-g", LATEST_PACKAGE_SPEC, PNPM_FIRST_PARTY_RELEASE_AGE_EXCLUDE];
     const dirs = install ? pnpmInstallDirs(install) : null;
     if (dirs) {
         args.push("--global-dir", dirs.globalDir, "--store-dir", dirs.storeDir);
@@ -732,8 +777,18 @@ export function pnpmInstallDirs(install) {
     const normalized = install.packageRoot.replace(/\\/g, "/");
     const global = normalized.match(/^(.*\/global\/\d+\/node_modules)(?:\/|$)|^(.*\/global\/v\d+\/[^/]+\/node_modules)(?:\/|$)/);
     const globalNodeModules = global?.[1] ?? global?.[2];
-    if (!globalNodeModules)
-        return null;
+    if (!globalNodeModules) {
+        const storeMatch = normalized.match(/^(.*)\/store\/(v\d+)\/links\//);
+        if (!storeMatch)
+            return null;
+        const pnpmHome = storeMatch[1];
+        const storeVersion = storeMatch[2];
+        return {
+            globalDir: path.join(pnpmHome, "global"),
+            storeDir: path.join(pnpmHome, "store", storeVersion),
+            virtualStoreDir: path.join(pnpmHome, "global", storeVersion, "node_modules", ".pnpm"),
+        };
+    }
     const metadataPath = path.join(globalNodeModules, ".modules.yaml");
     try {
         const metadata = yaml.load(readFileSync(metadataPath, "utf8"));
@@ -966,6 +1021,10 @@ async function fetchVersionDecision(timeoutMs = FETCH_TIMEOUT_MS) {
         return null;
     }
 }
+function isReleaseAgeInstallFailure(result) {
+    const text = `${result.detail ?? ""}\n${result.stdout ?? ""}`;
+    return /minimumReleaseAge|minimum-release-age|published less than/i.test(text);
+}
 // The Windows spawn recipe (`buildSpawnPlan` + `quoteForWindowsShell`) lives in
 // ./windows-spawn.ts so the self-update path and the qmd spawn path share one
 // implementation. Imported at the top and re-exported here to keep this module's
@@ -1353,6 +1412,7 @@ function manualUpdateCommand(install, decision) {
  * remains for callers that pass no handler.
  */
 function nudgeUpdateRecommended(decision, install = resolveRunningInstall()) {
+    install = normalizeRunningInstall(install);
     if (!isNewerVersion(decision.latestVersion, CLI_VERSION))
         return;
     const msg = chalk.yellow(`⚠ A new version of hq-cli is available: ${decision.latestVersion} (current: ${CLI_VERSION}).`);
@@ -1663,7 +1723,7 @@ function enforceUpdateRequired(decision, deps = {}) {
     // server's `updateCommand` and any npm prefix are wrong for those layouts, so
     // `resolveRunningInstall`
     // already reports `prefix: null` there and neither is consulted below.
-    const install = (deps.resolveInstall ?? resolveRunningInstall)();
+    const install = normalizeRunningInstall((deps.resolveInstall ?? resolveRunningInstall)());
     // Loop protection #1 — nothing here can update a copy this process does not
     // own. Installing globally would leave the local copy that is actually
     // running stale, so the gate would fire again on the very next invocation.
@@ -1886,6 +1946,13 @@ function attemptRequiredUpdate(decision, deps, install) {
             console.error(chalk.dim("  Continuing on the current hq-cli version."));
             return "continue";
         }
+        // A 24h pnpm quarantine that still blocks first-party hq-cli must not
+        // lock the user out of secrets (or any other command) for the rest of
+        // that window. Warn and run the current CLI — same as a timed-out updater.
+        if (isReleaseAgeInstallFailure(result)) {
+            console.error(chalk.dim("  The package manager refused a build newer than its 24h install guard; continuing on the current hq-cli version."));
+            return "continue";
+        }
         return noticeFlush ? noticeFlush.then(() => 75) : 75;
     }
     // Read-your-writes: a "successful" install into the npm prefix does not
@@ -1914,7 +1981,7 @@ export async function enforceVersionGate(onUpdateRecommended, options = {}) {
         return "continue";
     // Resolved once, here, so the up-to-date case never pays for the walk and
     // neither downstream path repeats it.
-    const install = resolveRunningInstall();
+    const install = normalizeRunningInstall(resolveRunningInstall());
     if (decision.updateRequired) {
         // Load the staged installer only when an npm prefix is resolved. The version
         // gate is imported during every CLI startup, so keep the filesystem-heavy
@@ -1985,8 +2052,11 @@ export const __test__ = {
     isLocalDependencyInstall,
     isLocalDependencyPackageDir,
     isNewerVersion,
+    isPnpmContentStoreLinksPackageDir,
     isPnpmManagedPackageDir,
     isPnpmVirtualStorePackageDir,
+    normalizeRunningInstall,
+    PNPM_FIRST_PARTY_RELEASE_AGE_EXCLUDE,
     isPrefixWritable,
     nonWritablePrefixNote,
     npmPrefixFromPackageDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.78",
+  "version": "5.345.80",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {