@indigoai-us/hq-cli 5.35.0 → 5.35.2

package/src/commands/cloud-provision.test.ts

@@ -379,6 +379,84 @@ describe("patchManifest", () => {
       bucket_name: "hq-vault-cmp-NEW",
     });
   });
+
+  it("returns true when it actually changes a value", () => {
+    expect(patchManifest(tmpRoot, "indigo", "cmp_01H", "hq-vault-cmp-01H")).toBe(
+      true,
+    );
+  });
+
+  // ── Conflict-loop regression ───────────────────────────────────────────────
+  // Repro for the recurring HQ Sync conflict loop on companies/manifest.yaml:
+  // a re-provision / menubar Connect on an already-provisioned company used to
+  // unconditionally reserialize the manifest via yaml.dump — stripping comments
+  // and reflowing — even though nothing changed. The initial-sync step then
+  // pushed that comment-stripped form, so it perpetually diverged from any
+  // peer/cloud copy still holding the commented form, re-firing a conflict on
+  // every sync. The fix: skip the write entirely when values already match.
+  describe("conflict-loop regression — no-op re-provision must not churn the file", () => {
+    // A manifest in the on-disk shape /newcompany writes: header comment, blank
+    // lines, per-entry comment — none of which yaml.dump round-trips.
+    const COMMENTED_MANIFEST = `# HQ companies manifest — source of truth for routing.
+# Synced across machines via the personal vault; edit with care.
+
+companies:
+  indigo:
+    name: Indigo
+    status: active
+    cloud_uid: cmp_01H
+    bucket_name: hq-vault-cmp-01H
+  acme:
+    name: Acme Corp
+    status: active
+`;
+
+    beforeEach(() => {
+      const mPath = manifestPath(tmpRoot);
+      fs.mkdirSync(path.dirname(mPath), { recursive: true });
+      fs.writeFileSync(mPath, COMMENTED_MANIFEST);
+    });
+
+    it("returns false and leaves the file byte-for-byte intact (comments preserved) when values already match", () => {
+      const changed = patchManifest(
+        tmpRoot,
+        "indigo",
+        "cmp_01H",
+        "hq-vault-cmp-01H",
+      );
+      expect(changed).toBe(false);
+      // The whole point: no rewrite at all — comments + layout survive, so the
+      // synced bytes never diverge and no conflict is seeded.
+      expect(fs.readFileSync(manifestPath(tmpRoot), "utf-8")).toBe(
+        COMMENTED_MANIFEST,
+      );
+    });
+
+    it("re-running many times never churns the on-disk bytes (loop cannot start)", () => {
+      for (let i = 0; i < 5; i++) {
+        patchManifest(tmpRoot, "indigo", "cmp_01H", "hq-vault-cmp-01H");
+      }
+      expect(fs.readFileSync(manifestPath(tmpRoot), "utf-8")).toBe(
+        COMMENTED_MANIFEST,
+      );
+    });
+
+    it("a genuine change writes once, then converges — subsequent re-runs are no-ops", () => {
+      // First real change (acme had no cloud_uid) writes once and returns true.
+      expect(patchManifest(tmpRoot, "acme", "cmp_AC", "hq-vault-cmp-AC")).toBe(
+        true,
+      );
+      const afterFirst = fs.readFileSync(manifestPath(tmpRoot), "utf-8");
+      // Every subsequent identical provision is a no-op — stable bytes, false.
+      expect(patchManifest(tmpRoot, "acme", "cmp_AC", "hq-vault-cmp-AC")).toBe(
+        false,
+      );
+      expect(patchManifest(tmpRoot, "acme", "cmp_AC", "hq-vault-cmp-AC")).toBe(
+        false,
+      );
+      expect(fs.readFileSync(manifestPath(tmpRoot), "utf-8")).toBe(afterFirst);
+    });
+  });
 });
 
 // ── writeCompanyConfig ───────────────────────────────────────────────────────

package/src/commands/cloud-provision.ts

@@ -388,11 +388,20 @@ export interface ManifestCompanyEntry {
  * under the target slug. Read → mutate → temp-write → rename so concurrent
  * readers never see a partially-written file.
  *
- * Idempotent: if the values already match, this is a no-op (still rewrites
- * the file to canonical YAML, but the mutation is identical).
+ * Skip-if-unchanged: if the target slug already carries the exact
+ * `cloud_uid` + `bucket_name`, this is a true no-op — the file is left
+ * byte-for-byte intact (comments, ordering, and formatting preserved) and
+ * we return `false`. This matters because `yaml.dump` does NOT round-trip
+ * comments or the original layout: an unconditional rewrite re-canonicalises
+ * the manifest (stripping the `/newcompany` header comment, reflowing keys)
+ * on EVERY provision/Connect, even when nothing semantically changed. Each
+ * such rewrite is then pushed by the initial-sync step, so the
+ * comment-stripped local form perpetually diverges from any peer/cloud copy
+ * that still holds the commented form — manifesting as a recurring HQ Sync
+ * conflict loop on `companies/manifest.yaml` that re-fires every sync. Only
+ * writing when a value actually changes lets the two forms converge.
  *
- * Returns true if the file was written (always true in current impl —
- * reserved for future "skip if unchanged" optimization).
+ * Returns true if the file was written, false if it was already current.
  */
 export function patchManifest(
   hqRoot: string,
@@ -408,6 +417,14 @@ export function patchManifest(
   // Preserve null / object / unknown — promote null → {} so we can write keys.
   const entry: ManifestCompanyEntry =
     existing && typeof existing === "object" ? { ...existing } : {};
+
+  // No-op guard: both fields already match → leave the on-disk file (and its
+  // comments) untouched so a re-provision can't churn the manifest and seed a
+  // sync conflict loop.
+  if (entry.cloud_uid === cloudUid && entry.bucket_name === bucketName) {
+    return false;
+  }
+
   entry.cloud_uid = cloudUid;
   entry.bucket_name = bucketName;
   parsed.companies[slug] = entry;
@@ -757,9 +774,20 @@ export async function provisionCompany(
   const bucketName = entity.bucketName;
   const kmsKeyId = entity.kmsKeyId ?? null;
 
-  // Step 6: patch manifest atomically
-  patchManifest(options.hqRoot, options.slug, cloudUid, bucketName);
-  log(`patched companies/manifest.yaml`);
+  // Step 6: patch manifest atomically. Skip-if-unchanged returns false when
+  // the manifest already carries this slug's cloud_uid + bucket_name, so we
+  // report the honest outcome rather than always claiming a patch.
+  const manifestPatched = patchManifest(
+    options.hqRoot,
+    options.slug,
+    cloudUid,
+    bucketName,
+  );
+  log(
+    manifestPatched
+      ? `patched companies/manifest.yaml`
+      : `companies/manifest.yaml already current — left untouched`,
+  );
 
   // Step 7: write .hq/config.json atomically
   writeCompanyConfig(options.hqRoot, options.slug, {
@@ -821,7 +849,7 @@ export async function provisionCompany(
     vault_api_url: options.vaultApiUrl,
     kms_key_id: kmsKeyId,
     created_entity: createdEntity,
-    manifest_patched: true,
+    manifest_patched: manifestPatched,
     config_written: true,
     initial_sync: initialSync,
   };

package/src/commands/cloud.ts

@@ -45,6 +45,34 @@ import {
   type BannerLevel,
 } from "../lib/narrow-hint-banner.js";
 
+/**
+ * Resolve the `propagateDeletePolicy` for share() calls.
+ *
+ * Mirrors `@indigoai-us/hq-cloud`'s `bin/sync-runner.js` `resolveDeletePolicy`
+ * — the same function the AppBar HQ Sync menubar uses — so the CLI and the
+ * menubar agree on the policy by default. Inlined here (rather than
+ * deep-imported from `dist/bin/sync-runner.js`) to avoid coupling to a
+ * non-public subpath.
+ *
+ * Default is `"currency-gated"` (etag-verified safe delete). Override via
+ * the `HQ_SYNC_DELETE_POLICY` env var: `owned-only` (legacy direction-of-
+ * origin filter, multi-user safe but stranded down-stream litter on
+ * personal vaults until hq-cloud 6.0.1's prs_ override), `currency-gated`
+ * (the menubar default), or `all` (emergency-reconcile, no safety gates).
+ *
+ * Prior to this helper, the CLI passed nothing → share() fell through to
+ * its own `"owned-only"` default, leaving CLI users on a stricter (and
+ * sometimes wrong, on personal vault) policy than menubar users for
+ * months. See `workspace/reports/owned-only-delete-policy-purpose-debug.md`.
+ */
+function resolveDeletePolicy(): "owned-only" | "currency-gated" | "all" {
+  const env = process.env.HQ_SYNC_DELETE_POLICY;
+  if (env === "owned-only" || env === "all" || env === "currency-gated") {
+    return env;
+  }
+  return "currency-gated";
+}
+
 interface CommonSyncOptions {
   hqRoot: string;
   company?: string;
@@ -164,6 +192,7 @@ export interface ShareCallOptions {
   message?: string;
   skipUnchanged?: boolean;
   propagateDeletes?: boolean;
+  propagateDeletePolicy?: "owned-only" | "currency-gated" | "all";
 }
 
 export interface ShareCallResult {
@@ -397,6 +426,7 @@ export async function pushAll(
         paths: [path.join(options.hqRoot, "companies", slug)],
         skipUnchanged: true,
         propagateDeletes: true,
+        propagateDeletePolicy: resolveDeletePolicy(),
         ...(options.onConflict ? { onConflict: options.onConflict } : {}),
         ...(options.message ? { message: options.message } : {}),
       },
@@ -415,6 +445,7 @@ export async function pushAll(
         journalSlug: "personal",
         skipUnchanged: true,
         propagateDeletes: true,
+        propagateDeletePolicy: resolveDeletePolicy(),
         ...(options.onConflict ? { onConflict: options.onConflict } : {}),
         ...(options.message ? { message: options.message } : {}),
       },
@@ -1406,6 +1437,9 @@ async function runPushAll(
             ...(opts.propagateDeletes !== undefined
               ? { propagateDeletes: opts.propagateDeletes }
               : {}),
+            ...(opts.propagateDeletePolicy !== undefined
+              ? { propagateDeletePolicy: opts.propagateDeletePolicy }
+              : {}),
             ...(author ? { author } : {}),
           }),
       },
@@ -1505,6 +1539,7 @@ async function runNowSingle(
       hqRoot,
       skipUnchanged: true,
       propagateDeletes: true,
+      propagateDeletePolicy: resolveDeletePolicy(),
       ...(onConflict ? { onConflict } : {}),
       ...(message ? { message } : {}),
       ...(personalMode ? { personalMode: true } : {}),

package/src/commands/creators.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it, vi } from "vitest";
+import { runCreatorApply } from "./creators.js";
+
+function jsonResponse(status: number, body: unknown): Response {
+  return {
+    status,
+    json: async () => body,
+  } as unknown as Response;
+}
+
+describe("runCreatorApply", () => {
+  it("submits the application and reports the application id", async () => {
+    const post = vi
+      .fn()
+      .mockResolvedValue(
+        jsonResponse(202, { status: "request_received", applicationId: "capp_1" }),
+      );
+    const res = await runCreatorApply(
+      { reason: "I build automation skills" },
+      { getAccessToken: async () => "tok", post },
+    );
+    expect(res.message).toMatch(/submitted \(capp_1\)/);
+    expect(post).toHaveBeenCalledWith("tok", { reason: "I build automation skills" });
+  });
+
+  it("passes an optional handle through", async () => {
+    const post = vi.fn().mockResolvedValue(jsonResponse(202, { applicationId: "capp_2" }));
+    await runCreatorApply(
+      { reason: "pitch", handle: "  acme  " },
+      { getAccessToken: async () => "tok", post },
+    );
+    expect(post).toHaveBeenCalledWith("tok", { reason: "pitch", handle: "acme" });
+  });
+
+  it("treats a 409 / APPLICATION_PENDING as an already-pending message", async () => {
+    const post = vi
+      .fn()
+      .mockResolvedValue(jsonResponse(409, { code: "APPLICATION_PENDING", applicationId: "capp_3" }));
+    const res = await runCreatorApply(
+      { reason: "pitch" },
+      { getAccessToken: async () => "tok", post },
+    );
+    expect(res.message).toMatch(/already have a pending/i);
+  });
+
+  it("requires a non-empty reason", async () => {
+    const post = vi.fn();
+    await expect(
+      runCreatorApply({ reason: "   " }, { getAccessToken: async () => "tok", post }),
+    ).rejects.toThrow(/reason is required/i);
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  it("throws on a hard server error", async () => {
+    const post = vi.fn().mockResolvedValue(jsonResponse(500, { error: "boom" }));
+    await expect(
+      runCreatorApply({ reason: "pitch" }, { getAccessToken: async () => "tok", post }),
+    ).rejects.toThrow(/boom/);
+  });
+});

package/src/commands/creators.ts

@@ -0,0 +1,117 @@
+/**
+ * `hq creators apply` — apply for verified-creator access.
+ *
+ * Publishing to the marketplace is gated on verified-creator status. An
+ * unverified caller submits an application (a short pitch + optional desired
+ * handle); it is persisted server-side and an Indigo admin reviews it. On
+ * approval the caller becomes a verified creator and can `hq publish`.
+ *
+ * Wire contract (POST /v1/creators/request-access, authed):
+ *   body { reason: string, handle?: string }
+ *   202  { status, code, applicationId, requestAccessPath }
+ *   409  { code: "APPLICATION_PENDING", error, applicationId }  (already pending)
+ */
+import { Command } from "commander";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+
+export interface CreatorApplyOptions {
+  reason: string;
+  handle?: string;
+}
+
+export interface CreatorApplyDeps {
+  /** Resolve a non-expired access token (prompts login when interactive). */
+  getAccessToken: () => Promise<string>;
+  /** POST the application body to the vault API. */
+  post: (token: string, body: Record<string, unknown>) => Promise<Response>;
+}
+
+export interface CreatorApplyResult {
+  message: string;
+}
+
+/**
+ * Testable core. Submits the application and maps the server response to a
+ * single human-readable message. Throws on hard failures.
+ */
+export async function runCreatorApply(
+  opts: CreatorApplyOptions,
+  deps: CreatorApplyDeps,
+): Promise<CreatorApplyResult> {
+  const reason = opts.reason?.trim();
+  if (!reason) {
+    throw new Error(
+      'A reason is required — pass --reason "why you want to publish to the marketplace".',
+    );
+  }
+
+  const token = await deps.getAccessToken();
+  const body: Record<string, unknown> = { reason };
+  const handle = opts.handle?.trim();
+  if (handle) body.handle = handle;
+
+  const res = await deps.post(token, body);
+  const parsed = (await res
+    .json()
+    .catch(() => ({}))) as Record<string, unknown>;
+
+  if (res.status === 409 || parsed.code === "APPLICATION_PENDING") {
+    return {
+      message:
+        "You already have a pending creator application — an Indigo admin will review it.",
+    };
+  }
+  if (res.status < 200 || res.status >= 300) {
+    const msg =
+      (parsed.error as string) ?? (parsed.message as string) ?? `HTTP ${res.status}`;
+    throw new Error(`Creator application failed: ${msg}`);
+  }
+
+  const id =
+    typeof parsed.applicationId === "string" ? ` (${parsed.applicationId})` : "";
+  return {
+    message:
+      `Creator application submitted${id} — an Indigo admin will review it. ` +
+      "You'll be able to `hq publish` once approved.",
+  };
+}
+
+export function registerCreatorsCommand(program: Command): void {
+  const creators = program
+    .command("creators")
+    .description("Creator marketplace account");
+
+  creators
+    .command("apply")
+    .description(
+      "Apply for verified-creator access (required to publish packs)",
+    )
+    .requiredOption(
+      "--reason <reason>",
+      "Why you want to publish to the marketplace",
+    )
+    .option("--handle <handle>", "Desired creator handle (optional)")
+    .action(async (options: CreatorApplyOptions) => {
+      try {
+        const result = await runCreatorApply(
+          { reason: options.reason, handle: options.handle },
+          {
+            getAccessToken: () => ensureCognitoToken({ interactive: true }),
+            post: (token, body) =>
+              vaultApiFetch({
+                token,
+                path: "/v1/creators/request-access",
+                method: "POST",
+                body,
+              }),
+          },
+        );
+        console.log(chalk.green(result.message));
+      } catch (err) {
+        console.error(chalk.red((err as Error).message));
+        process.exitCode = 1;
+      }
+    });
+}

package/src/commands/login.ts

@@ -1,11 +1,11 @@
 /**
- * hq login — opens browser for Cognito auth via Google OAuth
+ * hq login — opens browser for Cognito auth.
  */
 
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
-import { DEFAULT_COGNITO } from '../utils/cognito-session.js';
+import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
 
 function peekIdToken(idToken: string): { email?: string; sub?: string } {
   try {
@@ -23,8 +23,12 @@ function peekIdToken(idToken: string): { email?: string; sub?: string } {
 export function registerLoginCommand(program: Command): void {
   program
     .command('login')
-    .description('Authenticate with HQ via Cognito (Google OAuth)')
-    .action(async () => {
+    .description('Authenticate with HQ via Cognito')
+    .option(
+      '--provider <provider>',
+      'OAuth provider to use: google, microsoft, or picker',
+    )
+    .action(async (options: { provider?: string }) => {
       try {
         const existing = loadCachedTokens();
         if (existing && !isExpiring(existing, 120)) {
@@ -34,7 +38,7 @@ export function registerLoginCommand(program: Command): void {
         }
 
         console.log('Opening browser for authentication...');
-        const tokens = await browserLogin(DEFAULT_COGNITO);
+        const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
         const who = peekIdToken(tokens.idToken).email ?? 'HQ';
         console.log(chalk.green(`Logged in as ${who}`));
       } catch (error) {

package/src/commands/marketplace-install.test.ts

@@ -38,6 +38,30 @@ vi.mock('node:readline', () => ({
   }),
 }));
 
+// Mock the public listings API so `defaultMarketplaceDeps().resolveListing` is
+// exercised against a controllable feed (BUG-1 exact-slug-match regression).
+// `publicResponder` is read at call time so each test can shape the response —
+// it receives the call options + a zero-based call index so a test can return a
+// different body for the browse call vs. the follow-up detail fetch.
+type PublicResponse = { ok: boolean; status: number; body: unknown };
+let publicResponder: (
+  opts: { path: string; query?: Record<string, string> },
+  call: number,
+) => PublicResponse = () => ({ ok: true, status: 200, body: { listings: [] } });
+const fetchPublicCalls: Array<{ path: string; query?: Record<string, string> }> = [];
+vi.mock('../utils/vault-api.js', () => ({
+  vaultApiFetchPublic: async (opts: { path: string; query?: Record<string, string> }) => {
+    const call = fetchPublicCalls.length;
+    fetchPublicCalls.push(opts);
+    const r = publicResponder(opts, call);
+    return {
+      ok: r.ok,
+      status: r.status,
+      json: async () => r.body,
+    } as unknown as Response;
+  },
+}));
+
 import {
   classify,
   parseMarketplaceSource,
@@ -45,6 +69,7 @@ import {
   fetchMarketplace,
   resolveLatestMarketplace,
   installPack,
+  defaultMarketplaceDeps,
   ArtifactVerificationError,
   type MarketplaceDeps,
   type MarketplaceListing,
@@ -412,3 +437,107 @@ describe('US-006 REGRESSION: legacy transports still dispatch + install unchange
     }
   });
 });
+
+// ---------------------------------------------------------------------------
+// BUG-1 — defaultMarketplaceDeps().resolveListing must EXACT-slug-match
+//
+// The browse handler historically ignored `?slug=` and only honored `?q=`
+// (fuzzy), so `?slug=tdd` returned ALL approved listings newest-first. The old
+// code took `listings[0]` → installed the NEWEST pack, not the requested slug
+// (verified live: `marketplace:tdd` installed hq-pack-review). resolveListing
+// must now exact-match `l.slug === slug` and throw when no exact match exists,
+// and must query with BOTH `slug` + `q` for forward/back compatibility.
+// ---------------------------------------------------------------------------
+
+describe('BUG-1 resolveListing exact-slug match (defaultMarketplaceDeps)', () => {
+  beforeEach(() => {
+    fetchPublicCalls.length = 0;
+    publicResponder = () => ({ ok: true, status: 200, body: { listings: [] } });
+  });
+
+  /** A browse-summary entry (id present, no URL — detail fetch mints it). */
+  function summary(slug: string, version: string, extra?: Record<string, unknown>) {
+    return { listingId: `lst_${slug}`, slug, version, status: 'approved', ...extra };
+  }
+
+  /** The `GET /v1/listings/{id}` detail the follow-up fetch returns. */
+  function detailBody(slug: string, version: string) {
+    return {
+      listing: {
+        id: `lst_${slug}`,
+        slug,
+        version,
+        downloadUrl: 'https://s3.example/presigned?sig=abc',
+        contentHash: 'a'.repeat(64),
+      },
+    };
+  }
+
+  it('returns the EXACTLY-slugged listing — NOT listings[0] — from a multi-pack feed', async () => {
+    // Server returns a slug-ignoring fuzzy feed newest-first: review is [0], the
+    // requested tdd is later. Old code returned review; the fix returns tdd.
+    publicResponder = (_opts, call) =>
+      call === 0
+        ? {
+            ok: true,
+            status: 200,
+            body: { listings: [summary('review', '3.0.0'), summary('tdd', '1.2.0')] },
+          }
+        : { ok: true, status: 200, body: detailBody('tdd', '1.2.0') };
+
+    const listing = await defaultMarketplaceDeps().resolveListing('tdd');
+
+    expect(listing.slug).toBe('tdd');
+    expect(listing.listingId).toBe('lst_tdd');
+    // The browse query carried BOTH slug (exact) and q (fuzzy fallback).
+    expect(fetchPublicCalls[0].query).toMatchObject({ slug: 'tdd', q: 'tdd' });
+  });
+
+  it('throws a clear error when NO exact-slug match exists (never installs a near-miss)', async () => {
+    // Feed contains only OTHER slugs — a slug-ignoring/fuzzy server response.
+    publicResponder = () => ({
+      ok: true,
+      status: 200,
+      body: { listings: [summary('review', '3.0.0'), summary('tdd-helper', '1.0.0')] },
+    });
+
+    await expect(defaultMarketplaceDeps().resolveListing('tdd')).rejects.toThrow(
+      /No marketplace listing found for slug "tdd"/,
+    );
+  });
+
+  it('with a pinned version, requires BOTH exact slug AND exact version', async () => {
+    publicResponder = (_opts, call) =>
+      call === 0
+        ? {
+            ok: true,
+            status: 200,
+            body: {
+              listings: [
+                summary('tdd', '2.0.0'),
+                summary('tdd', '1.5.0'),
+                summary('review', '9.9.9'),
+              ],
+            },
+          }
+        : { ok: true, status: 200, body: detailBody('tdd', '1.5.0') };
+
+    const listing = await defaultMarketplaceDeps().resolveListing('tdd', '1.5.0');
+
+    expect(listing.slug).toBe('tdd');
+    expect(listing.version).toBe('1.5.0');
+    expect(fetchPublicCalls[0].query).toMatchObject({ slug: 'tdd', q: 'tdd', version: '1.5.0' });
+  });
+
+  it('throws when the pinned version is absent even if the slug matches', async () => {
+    publicResponder = () => ({
+      ok: true,
+      status: 200,
+      body: { listings: [summary('tdd', '2.0.0'), summary('tdd', '1.5.0')] },
+    });
+
+    await expect(defaultMarketplaceDeps().resolveListing('tdd', '9.9.9')).rejects.toThrow(
+      /No marketplace listing found for slug "tdd"@9\.9\.9/,
+    );
+  });
+});

package/src/commands/pack-install.test.ts

@@ -307,6 +307,55 @@ describe('pack-install: install path layout', () => {
     });
   });
 
+  // ---- 7. hqCore host-version check is prerelease-tolerant -------------------
+  // BUGFIX: a prerelease host version (e.g. `15.0.9-beta.1`) was rejected by the
+  // `requires.hqCore` check because node-semver excludes prereleases from range
+  // matching by default. The fix passes `{ includePrerelease: true }` so a beta/rc
+  // HQ build can still install packs — while a genuinely-too-old host still fails.
+  describe('requires.hqCore prerelease tolerance', () => {
+    function writePackRequiring(range: string): string {
+      const dir = mkFakePackPayload({ 'knowledge/demo/README.md': '# demo' });
+      fs.writeFileSync(
+        path.join(dir, 'package.yaml'),
+        [
+          'name: hq-pack-test',
+          'version: 1.0.0',
+          "publisher: '@indigoai-us'",
+          'access: public',
+          'requires:',
+          `  hqCore: '${range}'`,
+          'contributes:',
+          '  knowledge:',
+          '    - demo',
+          '',
+        ].join('\n'),
+      );
+      return dir;
+    }
+
+    it('ACCEPTS a prerelease host version against a plain range (>=14.2.0)', () => {
+      const dir = writePackRequiring('>=14.2.0');
+      const m = validateManifest(dir, '15.0.9-beta.1');
+      expect(m.name).toBe('hq-pack-test');
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('still REJECTS a genuinely-too-old host (13.0.0 against >=14.2.0)', () => {
+      const dir = writePackRequiring('>=14.2.0');
+      expect(() => validateManifest(dir, '13.0.0')).toThrow(
+        /does not satisfy pack requirement/,
+      );
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('still ACCEPTS a normal (non-prerelease) host version', () => {
+      const dir = writePackRequiring('>=14.2.0');
+      const m = validateManifest(dir, '15.0.0');
+      expect(m.name).toBe('hq-pack-test');
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+  });
+
   it('stampInstallSource preserves a leading `---` document marker — no multi-doc YAML stream', () => {
     // Regression: prepending `source:` before a `---` would split the file
     // into two YAML documents, and single-doc `yaml.load` callers downstream