@indigoai-us/hq-cli 5.50.0 → 5.50.2

package/dist/utils/pack-contributions.js

@@ -1,83 +1,135 @@
 /**
- * Content-pack contribution helpers -- the single source of truth (in TS) for
- * the `contributes.* -> host-path` symlink mapping that `hq install` wires via
+ * Content-pack contribution helpers -- the SINGLE SOURCE OF TRUTH (US-003) for
+ * the `contributes.* -> host` mapping that `hq install` wires via
  * `core/scripts/scan-packages.sh`.
  *
  * `pack-install.ts` only INSTALLS content packs (into `core/packages/<name>/`,
  * tracked by filesystem presence -- there is no registry file). The list /
  * update / uninstall lifecycle in `commands/packs.ts` needs to reason about the
  * SAME mapping so it can report link health and cleanly un-wire a pack without
- * leaving dangling symlinks. That mapping is duplicated today in two places:
+ * leaving dangling symlinks.
  *
- *   - core/scripts/scan-packages.sh  (bash `case`, the wiring authority)
- *   - pack-install.ts validateManifest's `subpaths` record (payload validation)
+ * Historically that mapping was RESTATED in five places (the scan-packages.sh
+ * bash `case`, pack-install.ts:validateManifest's `subpaths` record,
+ * `linkFor`'s switch, `contributionLinks`, and the `PackContributeKey` union),
+ * drift-guarded only by a substring check. US-003 collapses it to ONE
+ * declarative table -- `CONTRIBUTION_TABLE` below -- with a row per key
+ * `{ payload, host, wire }`:
  *
- * This module re-encodes it once for TS callers. A parity test
- * (`pack-contributions.test.ts`) asserts it matches scan-packages.sh's `case`
- * arms so the three copies cannot drift.
+ *   - `PackContributeKey` is DERIVED from the table keys (see types.ts).
+ *   - `linkFor` / `contributionLinks` / the `subpaths` validator READ the table.
+ *   - `core/scripts/scan-packages.sh` reads a generated data block emitted from
+ *     this same table (regenerate via `scripts/generate-scan-packages-table.mjs`).
+ *
+ * A parity test (`pack-contributions.test.ts`) asserts FULL key-set +
+ * payload-suffix + wire-mode equivalence across every surface, so the copies
+ * cannot drift.
+ *
+ * `wire` discriminates HOW a contribution reaches the host:
+ *   - `symlink`: a single `ln -s` into a well-known host directory (every
+ *     contribution type that shipped before MCP).
+ *   - `merge`: the contribution is MERGED into a shared host config rather than
+ *     symlinked (the `mcp` row -- registered into the Claude + Codex agent
+ *     configs). The merge WIRING is delivered in US-004/US-005; US-003 only
+ *     DECLARES the row as data so the table is the single source and the parity
+ *     test guards the real invariant. `symlink`-only readers (linkFor,
+ *     contributionLinks, the symlink validator, scan-packages) must SKIP
+ *     `merge` rows -- they never produce a symlink.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f5492359-fdf3-5e85-9a81-699c4cd68f6a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="63e778df-65dd-51a4-8a43-3a7d2aa9a451")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
+import { CONTRIBUTION_TABLE, payloadFor } from './contribution-table.js';
+import { unregisterMcpServers, } from '../commands/mcp-registration.js';
+// NOTE on dependency direction: this module imports from ../commands/mcp-registration.js
+// to un-register `wire:merge` (mcp) servers on uninstall. mcp-registration.ts imports
+// ONLY fs/os/path/smol-toml (it does NOT import from pack-contributions.ts), so there
+// is NO import cycle. If that ever changes, invert via a callback injected by packs.ts.
+export { CONTRIBUTION_TABLE };
 /**
- * Map one contributes entry to its source/host paths. MUST stay in lockstep
- * with scan-packages.sh:wire_one_package and pack-install.ts:validateManifest.
+ * Where a contributes key is ROUTED (US-005). Reads the single-source table's
+ * `wire` field — `'symlink'` keys go through `linkFor`/`contributionLinks` (a
+ * host `ln -s`); `'merge'` keys (e.g. `mcp`) go through the `registerMcpServers`
+ * seam in `commands/mcp-registration.ts` and are NEVER symlinked.
+ *
+ * This is the explicit, code-enforced discriminator behind the invariant that
+ * merge keys never reach the symlink path: callers fan out on the return value
+ * rather than relying on `linkFor` happening to return `null`.
  */
-function linkFor(hqRoot, packDir, key, item) {
-    let srcRel;
-    let dstRel;
-    switch (key) {
-        case 'workers':
-            srcRel = path.join('workers', item);
-            dstRel = path.join('core', 'workers', 'public', item);
-            break;
-        case 'knowledge':
-            srcRel = path.join('knowledge', item);
-            dstRel = path.join('core', 'knowledge', 'public', item);
-            break;
-        case 'skills':
-            srcRel = path.join('skills', item);
-            dstRel = path.join('.claude', 'skills', item);
-            break;
-        case 'commands':
-            srcRel = path.join('commands', `${item}.md`);
-            dstRel = path.join('.claude', 'commands', `${item}.md`);
-            break;
-        case 'hooks':
-            srcRel = path.join('hooks', `${item}.sh`);
-            dstRel = path.join('.claude', 'hooks', `${item}.sh`);
-            break;
-        case 'policies':
-            srcRel = path.join('policies', `${item}.md`);
-            dstRel = path.join('core', 'policies', `${item}.md`);
-            break;
-        case 'scripts':
-            srcRel = path.join('scripts', item);
-            dstRel = path.join('core', 'scripts', item);
-            break;
+export function routeContribution(key) {
+    return CONTRIBUTION_TABLE[key].wire;
+}
+/**
+ * The subset of a pack's declared `contributes` keys that are `wire: 'merge'`
+ * (e.g. `mcp`) — the keys that MUST be routed to `registerMcpServers` (US-006)
+ * and MUST NOT be symlinked. Unknown keys and non-array/empty values are
+ * ignored, mirroring `contributionLinks`. Returned in `contributes` iteration
+ * order, de-duplicated.
+ */
+export function mergeKeys(contributes) {
+    const out = [];
+    for (const [key, items] of Object.entries(contributes)) {
+        if (!(key in CONTRIBUTION_TABLE))
+            continue; // unknown key -> ignore
+        if (!Array.isArray(items) || items.length === 0)
+            continue;
+        if (routeContribution(key) === 'merge' && !out.includes(key))
+            out.push(key);
     }
+    return out;
+}
+/**
+ * Map one SYMLINK contributes entry to its source/host paths, READING the
+ * single-source `CONTRIBUTION_TABLE` (US-003). The src is the expanded pack
+ * payload; the dst is `<host-dir>/<payload-basename>` so per-key suffixes
+ * (`.md`, `.sh`, none) carry through.
+ *
+ * Returns `null` for a `wire: 'merge'` key (e.g. `mcp`): a merge contribution
+ * is not a symlink and has no `WiredLink`. Callers that only handle symlinks
+ * (contributionLinks/unwirePack) skip those keys.
+ */
+function linkFor(hqRoot, packDir, key, item) {
+    const row = CONTRIBUTION_TABLE[key];
+    if (row.wire !== 'symlink')
+        return null;
+    const payloadRel = payloadFor(key, item); // e.g. commands/foo.md
+    // dst keeps the payload's basename (so the suffix carries through) under the
+    // host directory declared in the table.
+    const dstRel = path.join(row.host, path.basename(payloadRel));
     return {
         key,
         item,
-        src: path.join(packDir, srcRel),
+        src: path.join(packDir, payloadRel),
         dst: path.join(hqRoot, dstRel),
     };
 }
 /**
- * Every symlink a pack's `contributes` block declares. Empty subfields and
- * non-array values are ignored, mirroring scan-packages.sh.
+ * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
+ * keys (e.g. `mcp`) produce no symlink and are skipped here -- their host
+ * effect (a config merge) is handled separately (US-004/US-005).
  */
 export function contributionLinks(hqRoot, packDir, contributes) {
     const links = [];
     for (const [key, items] of Object.entries(contributes)) {
+        if (!(key in CONTRIBUTION_TABLE))
+            continue; // unknown key -> ignore
         if (!Array.isArray(items))
             continue;
+        // INVARIANT (US-005): merge keys are NEVER symlinked. They route to
+        // registerMcpServers (commands/mcp-registration.ts) instead. Skip them
+        // explicitly here -- not just via linkFor returning null -- so the symlink
+        // path provably excludes them.
+        if (routeContribution(key) === 'merge')
+            continue;
         for (const item of items) {
             if (typeof item !== 'string' || item.length === 0)
                 continue;
-            links.push(linkFor(hqRoot, packDir, key, item));
+            const link = linkFor(hqRoot, packDir, key, item);
+            if (link)
+                links.push(link); // null for merge keys -- skip
         }
     }
     return links;
@@ -161,6 +213,16 @@ export function listInstalledPacks(hqRoot) {
     }
     return out;
 }
+/**
+ * Installed packs that declare `name` in their `requires.packs` (M0). Pure over
+ * the supplied list — the uninstall dependents guard calls this with
+ * `listInstalledPacks(hqRoot)`. Excludes the pack named `name` itself, so a
+ * self-reference never counts as its own dependent.
+ */
+export function findDependentPacks(installed, name) {
+    return installed.filter((p) => p.name !== name &&
+        (p.manifest?.requires?.packs ?? []).some((d) => d.name === name));
+}
 /**
  * Remove only the host symlinks that resolve into THIS pack's directory
  * (status `live` or `broken`). Foreign links and real files are left in place
@@ -196,6 +258,36 @@ export function unwirePack(hqRoot, packDir, contributes) {
     }
     return result;
 }
+/**
+ * Un-register the `wire: 'merge'` (MCP) servers a pack declares — the parallel to
+ * {@link unwirePack}'s symlink removal. For each name in `mergeKeys(contributes)` →
+ * `contributes.<mergeKey>` (today only `mcp`), this delegates to
+ * {@link unregisterMcpServers}, which removes ONLY entries stamped with THIS pack's
+ * `_hqPack` provenance and SKIPS-AND-WARNS on a foreign/unstamped same-named entry.
+ *
+ * No-ops cleanly when the pack declares no merge keys (returns `{ servers: [] }`),
+ * when the runtime config is absent (Codex-less host → first-class skip; missing
+ * ~/.claude.json → `absent`), and on a re-run (already-removed → `absent`). It does
+ * NOT throw on a foreign entry — uninstall of one pack must not abort on a server
+ * another pack (or the user) owns.
+ *
+ * @param packName    the pack being uninstalled — the provenance to match
+ * @param contributes the pack's `contributes` block (its `mcp` list drives removal)
+ */
+export function unwirePackMcp(packName, contributes, options) {
+    const servers = [];
+    for (const key of mergeKeys(contributes)) {
+        const names = (contributes[key] ?? []).filter((n) => typeof n === 'string' && n.length > 0);
+        if (names.length === 0)
+            continue;
+        servers.push(...unregisterMcpServers(packName, names, {
+            env: options?.env,
+            lock: options?.lock,
+            stamp: options?.stamp,
+        }));
+    }
+    return { servers };
+}
 // ---------------------------------------------------------------------------
 // Host introspection: hqVersion + recommended_packages catalog
 // ---------------------------------------------------------------------------
@@ -236,4 +328,4 @@ export function readRecommendedPackages(hqRoot) {
     }
 }
 //# sourceMappingURL=pack-contributions.js.map
-//# debugId=f5492359-fdf3-5e85-9a81-699c4cd68f6a
+//# debugId=63e778df-65dd-51a4-8a43-3a7d2aa9a451

package/dist/utils/secrets-cache.d.ts

@@ -1,6 +1,15 @@
 export declare const DEFAULT_SECRETS_CACHE_TTL_MS: number;
 export declare function readCache(companyUid: string, name: string): string | null;
 export declare function writeCache(companyUid: string, name: string, value: string, ttlMs?: number): void;
+/**
+ * List the scope UIDs (`cmp_*` / `prs_*` subdirectories) that currently have a
+ * secrets-cache directory on disk. Used by offline callers (e.g. install-time MCP
+ * registration) that have no `--company` flag and no network token and so cannot
+ * resolve a single active company UID up front: they instead probe every cached
+ * scope for a given secret name. Returns `[]` when the cache root is absent or
+ * unreadable (the desired graceful-deferral behavior — no scopes, no hits).
+ */
+export declare function listSecretCacheScopes(): string[];
 export declare function removeCacheEntry(companyUid: string, name: string): void;
 export declare function clearAllCache(): {
     removed: number;

package/dist/utils/secrets-cache.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fd3738da-3061-5784-bb7c-02021291aecc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="68c3f1d3-dac4-57d6-8e2b-650c10a807ba")}catch(e){}}();
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -140,6 +140,28 @@ export function writeCache(companyUid, name, value, ttlMs = DEFAULT_SECRETS_CACH
         // Cache write failure is non-fatal
     }
 }
+/**
+ * List the scope UIDs (`cmp_*` / `prs_*` subdirectories) that currently have a
+ * secrets-cache directory on disk. Used by offline callers (e.g. install-time MCP
+ * registration) that have no `--company` flag and no network token and so cannot
+ * resolve a single active company UID up front: they instead probe every cached
+ * scope for a given secret name. Returns `[]` when the cache root is absent or
+ * unreadable (the desired graceful-deferral behavior — no scopes, no hits).
+ */
+export function listSecretCacheScopes() {
+    try {
+        return fs
+            .readdirSync(CACHE_DIR, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            // Only real entity scopes (cmp_*/prs_*); validateInputs in readCache also
+            // rejects anything with `/` or `..`, so this is belt-and-suspenders.
+            .filter((name) => !name.startsWith("."));
+    }
+    catch {
+        return [];
+    }
+}
 export function removeCacheEntry(companyUid, name) {
     if (!validateInputs(companyUid, name))
         return;
@@ -163,4 +185,4 @@ export function clearAllCache() {
     return { removed };
 }
 //# sourceMappingURL=secrets-cache.js.map
-//# debugId=fd3738da-3061-5784-bb7c-02021291aecc
+//# debugId=68c3f1d3-dac4-57d6-8e2b-650c10a807ba

package/dist/utils/version-gate.d.ts

@@ -27,16 +27,49 @@
  * Opt-out: `HQ_NO_UPDATE_CHECK=1` (same env as `version-check.ts` — one knob
  * to silence both check + gate).
  */
+interface VersionCheckResponse {
+    clientId: string;
+    currentVersion: string;
+    minVersion: string;
+    latestVersion: string;
+    updateRequired: boolean;
+    updateRecommended: boolean;
+    updateCommand?: string;
+    downloadUrl?: string;
+    message?: string;
+}
+export declare function npmPrefixFromPackageDir(pkgDir: string): string | null;
+export declare function resolveRunningPrefix(): string | null;
+export declare function buildPrefixedInstallArgv(prefix: string): string[];
 /**
  * Run the upgrade command in a blocking subprocess. Inherits stdio so the
  * user sees the npm progress. We do NOT auto-rerun the CLI on completion —
  * forcing a re-invocation would run twice on the same process and feel
  * janky; instead we print a clear "rerun your command" message and exit.
  */
-declare function performUpdate(command: string): {
+type UpdateResult = {
     ok: boolean;
     detail?: string;
 };
+type UpdateRunner = (cmd: string, args: string[]) => UpdateResult;
+declare function runUpdateCommand(cmd: string, args: string[]): UpdateResult;
+declare function performUpdateCommand(cmd: string, args: string[], runner?: UpdateRunner): UpdateResult;
+declare function performUpdate(command: string, runner?: UpdateRunner): UpdateResult;
+/**
+ * Hard enforcement when the server says we're below `minVersion`. Print a
+ * red banner, attempt the update, then exit so the user reruns against the
+ * fresh binary. Sequence chosen so a user with a broken `npm` global prefix
+ * still gets a clear error rather than an opaque silent failure.
+ *
+ * Exit codes:
+ *   0 — update succeeded; user must rerun their command
+ *   75 — update failed (EX_TEMPFAIL; common for sudo/EACCES on system npm)
+ */
+declare function enforceUpdateRequired(decision: VersionCheckResponse, deps?: {
+    performUpdateString?: (command: string) => UpdateResult;
+    resolvePrefix?: () => string | null;
+    runner?: UpdateRunner;
+}): never;
 /**
  * Public entry point. Call before commander parses argv. Blocks the CLI on
  * network IO for up to FETCH_TIMEOUT_MS — acceptable because the alternative
@@ -58,7 +91,13 @@ export declare const __test__: {
     CLIENT_ID: string;
     ENDPOINT_PATH: string;
     FETCH_TIMEOUT_MS: number;
+    buildPrefixedInstallArgv: typeof buildPrefixedInstallArgv;
+    enforceUpdateRequired: typeof enforceUpdateRequired;
+    npmPrefixFromPackageDir: typeof npmPrefixFromPackageDir;
     performUpdate: typeof performUpdate;
+    performUpdateCommand: typeof performUpdateCommand;
+    runUpdateCommand: typeof runUpdateCommand;
+    resolveRunningPrefix: typeof resolveRunningPrefix;
 };
 export {};
 //# sourceMappingURL=version-gate.d.ts.map

package/dist/utils/version-gate.js

@@ -28,17 +28,66 @@
  * to silence both check + gate).
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d7d58261-f0e4-56bc-b6eb-4117731744f9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0f613895-ad4a-5211-bf75-a2e843782c47")}catch(e){}}();
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 import chalk from "chalk";
-import { CLI_VERSION } from "../cli-version.js";
+import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 import { DEFAULT_VAULT_API_URL } from "./cognito-session.js";
 const CLIENT_ID = "hq-cli";
 const ENDPOINT_PATH = "/v1/client-version/check";
 const FETCH_TIMEOUT_MS = 3_000;
+const LATEST_PACKAGE_SPEC = `${CLI_NAME}@latest`;
 function isOptedOut() {
     return process.env.HQ_NO_UPDATE_CHECK === "1";
 }
+function findRunningPackageRoot() {
+    let dir = path.dirname(fileURLToPath(import.meta.url));
+    while (true) {
+        try {
+            const pkg = JSON.parse(readFileSync(path.join(dir, "package.json"), "utf-8"));
+            if (pkg.name === CLI_NAME)
+                return dir;
+        }
+        catch {
+            // Keep walking; compiled installs usually start under dist/.
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+export function npmPrefixFromPackageDir(pkgDir) {
+    const normalized = pkgDir.replace(/\\/g, "/").replace(/\/+$/, "");
+    const segments = normalized.split("/");
+    const nodeModulesIndex = segments.lastIndexOf("node_modules");
+    if (nodeModulesIndex === -1)
+        return null;
+    const prefixEnd = segments[nodeModulesIndex - 1] === "lib"
+        ? nodeModulesIndex - 1
+        : nodeModulesIndex;
+    const prefix = segments.slice(0, prefixEnd).join("/");
+    if (prefix === "" && normalized.startsWith("/"))
+        return "/";
+    return prefix || null;
+}
+export function resolveRunningPrefix() {
+    try {
+        const pkgRoot = findRunningPackageRoot();
+        if (!pkgRoot)
+            return null;
+        return npmPrefixFromPackageDir(pkgRoot);
+    }
+    catch {
+        return null;
+    }
+}
+export function buildPrefixedInstallArgv(prefix) {
+    return ["install", "-g", "--prefix", prefix, LATEST_PACKAGE_SPEC];
+}
 /**
  * Hit POST /v1/client-version/check. Returns the parsed body on 200, or
  * `null` on any failure (caller treats as "no gate"). Tight 3s timeout —
@@ -74,18 +123,7 @@ async function fetchVersionDecision() {
         return null;
     }
 }
-/**
- * Run the upgrade command in a blocking subprocess. Inherits stdio so the
- * user sees the npm progress. We do NOT auto-rerun the CLI on completion —
- * forcing a re-invocation would run twice on the same process and feel
- * janky; instead we print a clear "rerun your command" message and exit.
- */
-function performUpdate(command) {
-    const parts = command.split(/\s+/).filter(Boolean);
-    if (parts.length === 0)
-        return { ok: false, detail: "empty command" };
-    const cmd = parts[0];
-    const args = parts.slice(1);
+function runUpdateCommand(cmd, args) {
     try {
         const result = spawnSync(cmd, args, { stdio: "inherit" });
         if (result.status !== 0) {
@@ -100,6 +138,17 @@ function performUpdate(command) {
         return { ok: false, detail: err instanceof Error ? err.message : String(err) };
     }
 }
+function performUpdateCommand(cmd, args, runner = runUpdateCommand) {
+    return runner(cmd, args);
+}
+function performUpdate(command, runner = runUpdateCommand) {
+    const parts = command.split(/\s+/).filter(Boolean);
+    if (parts.length === 0)
+        return { ok: false, detail: "empty command" };
+    const cmd = parts[0];
+    const args = parts.slice(1);
+    return performUpdateCommand(cmd, args, runner);
+}
 /**
  * Soft notify when the server says we're below `latestVersion` but still ≥
  * `minVersion`. Single chalk-yellow line on stderr; never blocks.
@@ -121,24 +170,40 @@ function nudgeUpdateRecommended(decision) {
  *   0 — update succeeded; user must rerun their command
  *   75 — update failed (EX_TEMPFAIL; common for sudo/EACCES on system npm)
  */
-function enforceUpdateRequired(decision) {
+function enforceUpdateRequired(decision, deps = {}) {
     const banner = chalk.red.bold(`✗ hq-cli ${decision.currentVersion} is below the minimum required version (${decision.minVersion}).`);
     console.error(banner);
     if (decision.message)
         console.error(chalk.dim(`  ${decision.message}`));
     const command = decision.updateCommand;
-    if (!command) {
+    const prefix = (deps.resolvePrefix ?? resolveRunningPrefix)();
+    if (!command && !prefix) {
         console.error(chalk.red("  No updateCommand provided by hq-pro — see https://hq.indigo.ai/docs/cli-update for manual steps."));
         if (decision.downloadUrl) {
             console.error(chalk.dim(`  Download: ${decision.downloadUrl}`));
         }
         process.exit(75);
     }
-    console.error(chalk.dim(`  Running: ${command}`));
-    const result = performUpdate(command);
+    const runner = deps.runner ?? runUpdateCommand;
+    const result = prefix
+        ? (() => {
+            const args = buildPrefixedInstallArgv(prefix);
+            console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
+            console.error(chalk.dim(`  Running: npm ${args.join(" ")}`));
+            return performUpdateCommand("npm", args, runner);
+        })()
+        : (() => {
+            console.error(chalk.dim(`  Running: ${command}`));
+            return deps.performUpdateString
+                ? deps.performUpdateString(command)
+                : performUpdate(command, runner);
+        })();
     if (!result.ok) {
         console.error(chalk.red(`✗ Update failed${result.detail ? `: ${result.detail}` : ""}.`));
-        console.error(chalk.dim(`  Try manually: ${command}`));
+        const manual = prefix
+            ? `npm ${buildPrefixedInstallArgv(prefix).join(" ")}`
+            : command;
+        console.error(chalk.dim(`  Try manually: ${manual}`));
         process.exit(75);
     }
     console.error(chalk.green(`✓ Updated to hq-cli ${decision.latestVersion}. Rerun your command.`));
@@ -179,7 +244,13 @@ export const __test__ = {
     CLIENT_ID,
     ENDPOINT_PATH,
     FETCH_TIMEOUT_MS,
+    buildPrefixedInstallArgv,
+    enforceUpdateRequired,
+    npmPrefixFromPackageDir,
     performUpdate,
+    performUpdateCommand,
+    runUpdateCommand,
+    resolveRunningPrefix,
 };
 //# sourceMappingURL=version-gate.js.map
-//# debugId=d7d58261-f0e4-56bc-b6eb-4117731744f9
+//# debugId=0f613895-ad4a-5211-bf75-a2e843782c47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.50.0",
+  "version": "5.50.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -18,7 +18,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.12.0",
+    "@indigoai-us/hq-cloud": "^6.12.1",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",
@@ -27,6 +27,7 @@
     "open": "^10.1.0",
     "semver": "^7.6.3",
     "simple-git": "^3.27.0",
+    "smol-toml": "1.6.1",
     "varlock": "1.0.0"
   },
   "devDependencies": {