@indigoai-us/hq-cli 5.54.0 → 5.54.1

package/dist/utils/version-gate.js

@@ -28,7 +28,7 @@
  * to silence both check + gate).
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0f613895-ad4a-5211-bf75-a2e843782c47")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="00fa2aa9-f5d1-57a7-92db-c441c6bef906")}catch(e){}}();
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import path from "node:path";
@@ -185,12 +185,24 @@ function enforceUpdateRequired(decision, deps = {}) {
         process.exit(75);
     }
     const runner = deps.runner ?? runUpdateCommand;
-    const result = prefix
+    // Resolve the concrete install argv once so the sudo fallback below can re-run
+    // the EXACT same command under elevation.
+    let primaryCmd;
+    let primaryArgs;
+    if (prefix) {
+        primaryCmd = "npm";
+        primaryArgs = buildPrefixedInstallArgv(prefix);
+    }
+    else {
+        const parts = (command ?? "").split(/\s+/).filter(Boolean);
+        primaryCmd = parts[0] ?? "";
+        primaryArgs = parts.slice(1);
+    }
+    let result = prefix
         ? (() => {
-            const args = buildPrefixedInstallArgv(prefix);
             console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
-            console.error(chalk.dim(`  Running: npm ${args.join(" ")}`));
-            return performUpdateCommand("npm", args, runner);
+            console.error(chalk.dim(`  Running: npm ${primaryArgs.join(" ")}`));
+            return performUpdateCommand("npm", primaryArgs, runner);
         })()
         : (() => {
             console.error(chalk.dim(`  Running: ${command}`));
@@ -198,6 +210,20 @@ function enforceUpdateRequired(decision, deps = {}) {
                 ? deps.performUpdateString(command)
                 : performUpdate(command, runner);
         })();
+    // A root-owned global install (e.g. a system `/usr` install where the CLI runs
+    // unprivileged — the outpost agent boxes) can't rewrite the prefix's bin dir,
+    // so the install above fails with EACCES (`rename /usr/bin/hq`). Retry ONCE
+    // under non-interactive sudo: `sudo -n` fails fast WITHOUT a password prompt
+    // when passwordless sudo isn't configured, so interactive installs (e.g.
+    // Homebrew on macOS, where the first attempt already succeeded anyway) fall
+    // through to the manual path unchanged, while headless boxes with passwordless
+    // sudo self-update cleanly.
+    if (!result.ok && primaryCmd) {
+        console.error(chalk.dim(`  Update failed unprivileged; retrying with: sudo -n ${primaryCmd} ${primaryArgs.join(" ")}`));
+        const sudoResult = performUpdateCommand("sudo", ["-n", primaryCmd, ...primaryArgs], runner);
+        if (sudoResult.ok)
+            result = sudoResult;
+    }
     if (!result.ok) {
         console.error(chalk.red(`✗ Update failed${result.detail ? `: ${result.detail}` : ""}.`));
         const manual = prefix
@@ -253,4 +279,4 @@ export const __test__ = {
     resolveRunningPrefix,
 };
 //# sourceMappingURL=version-gate.js.map
-//# debugId=0f613895-ad4a-5211-bf75-a2e843782c47
+//# debugId=00fa2aa9-f5d1-57a7-92db-c441c6bef906

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.54.0",
+  "version": "5.54.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/utils/version-gate.test.ts

@@ -364,4 +364,76 @@ describe("enforceVersionGate — hard-update path", () => {
     expect(exitSpy).toHaveBeenCalledWith(0);
     expect(performUpdateString).toHaveBeenCalledWith(updateCommand);
   });
+
+  it("retries under `sudo -n` when the unprivileged install fails (root-owned global)", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = vi
+      .spyOn(process, "exit")
+      .mockImplementation(((code?: number) => {
+        throw new Error(`__process_exit__:${code ?? 0}`);
+      }) as never);
+    // First (unprivileged) npm install fails with EACCES; the sudo -n retry succeeds.
+    const runner = vi
+      .fn()
+      .mockImplementation((cmd: string) =>
+        cmd === "sudo" ? { ok: true } : { ok: false, detail: "EACCES" },
+      );
+    const { __test__ } = await loadModule();
+    const prefix = "/usr";
+
+    expect(() =>
+      __test__.enforceUpdateRequired(
+        {
+          clientId: "hq-cli",
+          currentVersion: "5.10.0",
+          minVersion: "5.20.0",
+          latestVersion: "5.24.0",
+          updateRequired: true,
+          updateRecommended: false,
+          updateCommand: "npm install -g @indigoai-us/hq-cli@latest",
+        },
+        { resolvePrefix: () => prefix, runner },
+      ),
+    ).toThrow(/__process_exit__:0/); // succeeds after the sudo retry
+
+    expect(exitSpy).toHaveBeenCalledWith(0);
+    const installArgs = [
+      "install",
+      "-g",
+      "--prefix",
+      prefix,
+      "@indigoai-us/hq-cli@latest",
+    ];
+    expect(runner).toHaveBeenCalledWith("npm", installArgs);
+    expect(runner).toHaveBeenCalledWith("sudo", ["-n", "npm", ...installArgs]);
+  });
+
+  it("exits 75 when BOTH the unprivileged install and the sudo -n retry fail", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = vi
+      .spyOn(process, "exit")
+      .mockImplementation(((code?: number) => {
+        throw new Error(`__process_exit__:${code ?? 0}`);
+      }) as never);
+    const runner = vi.fn().mockReturnValue({ ok: false, detail: "EACCES" });
+    const { __test__ } = await loadModule();
+
+    expect(() =>
+      __test__.enforceUpdateRequired(
+        {
+          clientId: "hq-cli",
+          currentVersion: "5.10.0",
+          minVersion: "5.20.0",
+          latestVersion: "5.24.0",
+          updateRequired: true,
+          updateRecommended: false,
+          updateCommand: "npm install -g @indigoai-us/hq-cli@latest",
+        },
+        { resolvePrefix: () => "/usr", runner },
+      ),
+    ).toThrow(/__process_exit__:75/);
+
+    expect(exitSpy).toHaveBeenCalledWith(75);
+    expect(runner).toHaveBeenCalledWith("sudo", expect.arrayContaining(["-n"]));
+  });
 });

package/src/utils/version-gate.ts

@@ -236,12 +236,24 @@ function enforceUpdateRequired(
   }
 
   const runner = deps.runner ?? runUpdateCommand;
-  const result = prefix
+  // Resolve the concrete install argv once so the sudo fallback below can re-run
+  // the EXACT same command under elevation.
+  let primaryCmd: string;
+  let primaryArgs: string[];
+  if (prefix) {
+    primaryCmd = "npm";
+    primaryArgs = buildPrefixedInstallArgv(prefix);
+  } else {
+    const parts = (command ?? "").split(/\s+/).filter(Boolean);
+    primaryCmd = parts[0] ?? "";
+    primaryArgs = parts.slice(1);
+  }
+
+  let result = prefix
     ? (() => {
-        const args = buildPrefixedInstallArgv(prefix);
         console.error(chalk.dim(`  Installing into npm prefix: ${prefix}`));
-        console.error(chalk.dim(`  Running: npm ${args.join(" ")}`));
-        return performUpdateCommand("npm", args, runner);
+        console.error(chalk.dim(`  Running: npm ${primaryArgs.join(" ")}`));
+        return performUpdateCommand("npm", primaryArgs, runner);
       })()
     : (() => {
         console.error(chalk.dim(`  Running: ${command}`));
@@ -249,6 +261,29 @@ function enforceUpdateRequired(
           ? deps.performUpdateString(command!)
           : performUpdate(command!, runner);
       })();
+
+  // A root-owned global install (e.g. a system `/usr` install where the CLI runs
+  // unprivileged — the outpost agent boxes) can't rewrite the prefix's bin dir,
+  // so the install above fails with EACCES (`rename /usr/bin/hq`). Retry ONCE
+  // under non-interactive sudo: `sudo -n` fails fast WITHOUT a password prompt
+  // when passwordless sudo isn't configured, so interactive installs (e.g.
+  // Homebrew on macOS, where the first attempt already succeeded anyway) fall
+  // through to the manual path unchanged, while headless boxes with passwordless
+  // sudo self-update cleanly.
+  if (!result.ok && primaryCmd) {
+    console.error(
+      chalk.dim(
+        `  Update failed unprivileged; retrying with: sudo -n ${primaryCmd} ${primaryArgs.join(" ")}`,
+      ),
+    );
+    const sudoResult = performUpdateCommand(
+      "sudo",
+      ["-n", primaryCmd, ...primaryArgs],
+      runner,
+    );
+    if (sudoResult.ok) result = sudoResult;
+  }
+
   if (!result.ok) {
     console.error(
       chalk.red(`✗ Update failed${result.detail ? `: ${result.detail}` : ""}.`),