@indigoai-us/hq-cli 5.37.0 → 5.37.2

package/.github/workflows/ci.yml

@@ -8,6 +8,14 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # 20 is the declared engines floor (package.json engines.node >=20),
+        # 22 is the current dev/publish baseline. Running the suite on 20
+        # enforces the floor so it stays real, not aspirational.
+        node-version: [20, 22]
+    name: build (node ${{ matrix.node-version }})
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -15,7 +23,7 @@ jobs:
           version: 10
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: ${{ matrix.node-version }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
       # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with

package/dist/commands/pack-install.js

@@ -34,7 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d5029b6f-fc42-52ea-9ddd-aaaae682a8f4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cbb11285-034d-50c4-917d-797ab226db66")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -48,6 +48,7 @@ import semverValid from 'semver/functions/valid.js';
 import semverValidRange from 'semver/ranges/valid.js';
 import semverGt from 'semver/functions/gt.js';
 import { findHqRoot } from '../utils/manifest.js';
+import { readHqVersion } from '../utils/pack-contributions.js';
 import { safeExtractTarball } from './safe-extract.js';
 import { vaultApiFetchPublic } from '../utils/vault-api.js';
 /** Prefix that routes a source through the HQ marketplace transport (US-006). */
@@ -808,18 +809,6 @@ export function validateManifest(payloadDir, hqVersion) {
     }
     return m;
 }
-function readHqVersion(hqRoot) {
-    const p = path.join(hqRoot, 'core.yaml');
-    if (!fs.existsSync(p))
-        return null;
-    try {
-        const c = yaml.load(fs.readFileSync(p, 'utf-8'));
-        return c?.hqVersion ?? null;
-    }
-    catch {
-        return null;
-    }
-}
 // ---------------------------------------------------------------------------
 // Hooks confirmation
 // ---------------------------------------------------------------------------
@@ -1015,6 +1004,12 @@ export function runScanPackages(hqRoot, opts = {}) {
 export async function installPack(source, opts = {}) {
     const transport = classify(source);
     const hqRoot = findHqRoot();
+    // `readHqVersion` (shared with `hq packs`) reads the CANONICAL
+    // `core/core.yaml` (hq-core ≥v14), falling back to the legacy
+    // `<root>/core.yaml` only when the nested file is absent. The previous local
+    // reader looked at `<root>/core.yaml` ONLY, so on a post-v12→v15 tree it
+    // picked up a STALE leftover root copy (e.g. hqVersion 12.1.0) and wrongly
+    // rejected packs requiring a newer hqCore (feedback_57d7edcf, symptom b).
     const hqVersion = readHqVersion(hqRoot);
     const say = opts.quiet
         ? (...a) => console.error(...a)
@@ -1081,4 +1076,4 @@ export async function installPack(source, opts = {}) {
     }
 }
 //# sourceMappingURL=pack-install.js.map
-//# debugId=d5029b6f-fc42-52ea-9ddd-aaaae682a8f4
+//# debugId=cbb11285-034d-50c4-917d-797ab226db66

package/dist/commands/publish.js

@@ -28,7 +28,7 @@
  *   - manifest.ts (modules.yaml read/write for provenance)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f5046847-a2b9-50e4-9a68-6a81a9e0de2b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9b60d0b2-fea1-50bd-8c4e-e39163c38e30")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -40,6 +40,7 @@ import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { vaultApiFetch } from '../utils/vault-api.js';
 import { validateManifest } from './pack-install.js';
 import { findHqRoot, readManifest, writeManifest } from '../utils/manifest.js';
+import { readHqVersion } from '../utils/pack-contributions.js';
 /**
  * Decode a Cognito idToken's payload (no signature verification — this is a
  * local read of an already-trusted cached token, mirroring whoami.ts/login.ts).
@@ -321,18 +322,6 @@ export async function runPublish(targetPath, deps) {
 // ---------------------------------------------------------------------------
 // Command wiring
 // ---------------------------------------------------------------------------
-function readHqVersion(hqRoot) {
-    const p = path.join(hqRoot, 'core.yaml');
-    if (!fs.existsSync(p))
-        return null;
-    try {
-        const c = yaml.load(fs.readFileSync(p, 'utf-8'));
-        return c?.hqVersion ?? null;
-    }
-    catch {
-        return null;
-    }
-}
 export function registerPublishCommand(program) {
     program
         .command('publish <path>')
@@ -378,4 +367,4 @@ export function registerPublishCommand(program) {
     });
 }
 //# sourceMappingURL=publish.js.map
-//# debugId=f5046847-a2b9-50e4-9a68-6a81a9e0de2b
+//# debugId=9b60d0b2-fea1-50bd-8c4e-e39163c38e30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.37.0",
+  "version": "5.37.2",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -49,6 +49,6 @@
   "license": "MIT",
   "type": "module",
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=20.0.0"
   }
 }

package/src/commands/pack-install.ts

@@ -53,6 +53,7 @@ import semverValid from 'semver/functions/valid.js';
 import semverValidRange from 'semver/ranges/valid.js';
 import semverGt from 'semver/functions/gt.js';
 import { findHqRoot } from '../utils/manifest.js';
+import { readHqVersion } from '../utils/pack-contributions.js';
 import { safeExtractTarball } from './safe-extract.js';
 import { vaultApiFetchPublic } from '../utils/vault-api.js';
 import type { PackManifest, PackContributeKey } from '../types.js';
@@ -1086,17 +1087,6 @@ export function validateManifest(
   return m as PackManifest;
 }
 
-function readHqVersion(hqRoot: string): string | null {
-  const p = path.join(hqRoot, 'core.yaml');
-  if (!fs.existsSync(p)) return null;
-  try {
-    const c = yaml.load(fs.readFileSync(p, 'utf-8')) as { hqVersion?: string };
-    return c?.hqVersion ?? null;
-  } catch {
-    return null;
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Hooks confirmation
 // ---------------------------------------------------------------------------
@@ -1368,6 +1358,12 @@ export async function installPack(
 ): Promise<void> {
   const transport = classify(source);
   const hqRoot = findHqRoot();
+  // `readHqVersion` (shared with `hq packs`) reads the CANONICAL
+  // `core/core.yaml` (hq-core ≥v14), falling back to the legacy
+  // `<root>/core.yaml` only when the nested file is absent. The previous local
+  // reader looked at `<root>/core.yaml` ONLY, so on a post-v12→v15 tree it
+  // picked up a STALE leftover root copy (e.g. hqVersion 12.1.0) and wrongly
+  // rejected packs requiring a newer hqCore (feedback_57d7edcf, symptom b).
   const hqVersion = readHqVersion(hqRoot);
   const say: (...a: unknown[]) => void = opts.quiet
     ? (...a) => console.error(...a)

package/src/commands/publish.ts

@@ -40,6 +40,7 @@ import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { vaultApiFetch } from '../utils/vault-api.js';
 import { validateManifest } from './pack-install.js';
 import { findHqRoot, readManifest, writeManifest } from '../utils/manifest.js';
+import { readHqVersion } from '../utils/pack-contributions.js';
 import type { PackManifest, PackModuleDefinition, ModulesManifest } from '../types.js';
 
 // ---------------------------------------------------------------------------
@@ -461,17 +462,6 @@ export async function runPublish(
 // Command wiring
 // ---------------------------------------------------------------------------
 
-function readHqVersion(hqRoot: string): string | null {
-  const p = path.join(hqRoot, 'core.yaml');
-  if (!fs.existsSync(p)) return null;
-  try {
-    const c = yaml.load(fs.readFileSync(p, 'utf-8')) as { hqVersion?: string };
-    return c?.hqVersion ?? null;
-  } catch {
-    return null;
-  }
-}
-
 export function registerPublishCommand(program: Command): void {
   program
     .command('publish <path>')

package/src/utils/pack-contributions.test.ts

@@ -18,6 +18,7 @@ import {
   listInstalledPacks,
   unwirePack,
   packagesDir,
+  readHqVersion,
   type WiredLink,
 } from './pack-contributions.js';
 import type { PackContributeKey } from '../types.js';
@@ -206,3 +207,53 @@ describe('listInstalledPacks', () => {
     expect(packs[0].error).toMatch(/invalid/i);
   });
 });
+
+describe('readHqVersion: v15 layout awareness (feedback_57d7edcf, symptom b)', () => {
+  let hqRoot: string;
+
+  beforeEach(() => {
+    hqRoot = mkTmp('hq-readhqversion-');
+  });
+
+  afterEach(() => {
+    fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+
+  it('reads the CANONICAL core/core.yaml on a v14+/v15 layout', () => {
+    fs.mkdirSync(path.join(hqRoot, 'core'), { recursive: true });
+    fs.writeFileSync(
+      path.join(hqRoot, 'core', 'core.yaml'),
+      'version: 1\nhqVersion: "15.0.11"\n',
+    );
+    expect(readHqVersion(hqRoot)).toBe('15.0.11');
+  });
+
+  it('PREFERS canonical core/core.yaml over a STALE leftover root core.yaml', () => {
+    // The exact reported failure: post-v12→v15 reshape moved core.yaml under
+    // core/, but a stale root copy (hqVersion 12.1.0) lingered. The version
+    // read MUST report the canonical 15.x, not the stale root 12.1.0 — else
+    // `hq install` wrongly rejects packs requiring hqCore >=15.
+    fs.mkdirSync(path.join(hqRoot, 'core'), { recursive: true });
+    fs.writeFileSync(
+      path.join(hqRoot, 'core', 'core.yaml'),
+      'version: 1\nhqVersion: "15.0.11"\n',
+    );
+    fs.writeFileSync(
+      path.join(hqRoot, 'core.yaml'),
+      'version: 1\nhqVersion: "12.1.0"\n',
+    );
+    expect(readHqVersion(hqRoot)).toBe('15.0.11');
+  });
+
+  it('falls back to the legacy root core.yaml when no nested core/core.yaml exists', () => {
+    fs.writeFileSync(
+      path.join(hqRoot, 'core.yaml'),
+      'version: 1\nhqVersion: "13.4.0"\n',
+    );
+    expect(readHqVersion(hqRoot)).toBe('13.4.0');
+  });
+
+  it('returns null when neither core/core.yaml nor root core.yaml exists', () => {
+    expect(readHqVersion(hqRoot)).toBeNull();
+  });
+});