@indigoai-us/hq-cli 5.117.1 → 5.117.2

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## [Unreleased]
 
+## [5.117.2] — 2026-09-16
+
+### Fixed
+
+- External agents: the work-mesh listener no longer fails every refresh with
+  "Agent callers may only use DM, channel comms, and reaction routes". It now
+  re-reads the agent's own inbox on each doorbell instead of the person-only
+  conversation routes.
+- External agents: `hq agent probe` no longer waits for a DM to itself to show up
+  in the inbox, which the server never delivers. The dm check passes when the
+  send is accepted and the agent inbox is readable.
+- External agents: kit service logs no longer write every line twice when the
+  services run under a supervisor.
+
+### Changed
+
+- HQ now calls the paid plan by its real name everywhere you see it. If your
+  workspace went over its Starter limit, the notice, the error you got when you
+  tried to write something, and the upgrade prompt used to give three different
+  names for the same plan — "HQ Workforce", "HQ Team", and "Team" — which made
+  it genuinely unclear what you were being asked to buy. They all say HQ
+  Workforce now. The free plan is called Starter rather than "free plan", to
+  match the pricing page.
+
 ## [5.117.1] — 2026-09-16
 
 ### Fixed

package/assets/bot-workers/setup/context/USER-GUIDE.md

@@ -109,9 +109,9 @@ Structured storage for agent and app state — not a replacement for markdown kn
 | `hq db status --company {co}` | Create/open local SQLite at `~/.hq/db/{co}/vault.db` (WAL) |
 | `hq db sql --company {co} -- 'SELECT …'` | Query the company local DB (read-only by default) |
 | `hq db migrate --company {co} --hq-root {HQ}` | Apply reviewable SQL under `companies/{co}/db/migrations/` |
-| `hq db provision --company {co}` | Remote DB on **HQ Team** plan only (secrets never printed) |
+| `hq db provision --company {co}` | Remote DB on **HQ Workforce** ($500/mo) or Enterprise only (secrets never printed) |
 
-Use local for single-machine agent skills and implementer standards. Use Team remote for multi-machine shared data and deploy SecretBinding. Never commit `*.db` files into the vault tree.
+Use local for single-machine agent skills and implementer standards. Use the remote DB for multi-machine shared data and deploy SecretBinding. Never commit `*.db` files into the vault tree.
 
 ### HQ CLI: Direct messages (`hq dm`)
 
@@ -318,6 +318,47 @@ HQ/
     └── threads/               # Session threads + handoff.json
 ```
 
+## Plans and limits
+
+HQ has three plans: **Starter**, **HQ Workforce** ($500/month per workspace), and
+**Enterprise**.
+
+Starter is free. It holds up to 5 members, and it does not include integrations
+or MCP, Atlas, or telemetry. Everything else — knowledge, projects, policies,
+workers, secrets, vault storage, `hq deploy`, and `hq share` — works the same as
+on the paid plans.
+
+### When a workspace goes over
+
+A Starter workspace locks as soon as it goes over 5 members. There is no grace
+period and no countdown.
+
+A locked workspace is read-only. Nothing is deleted or hidden, and everyone can
+still read everything. Writes are refused until the workspace is back inside the
+limits.
+
+There are two ways out, and only the workspace owner can do either:
+
+1. Remove members until there are 5 or fewer. Removing someone from a workspace
+   does not delete their personal HQ or the work they saved into the workspace.
+2. Upgrade to HQ Workforce at $500/month from the workspace billing page.
+
+Either one unlocks the workspace right away.
+
+Existing integration connections on a locked Starter workspace are disabled, not
+deleted. Upgrading turns them back on without reconnecting anything.
+
+### What you'll see
+
+The owner gets one email when the workspace locks, a reminder at most once every
+7 days while it stays locked, and one confirmation when it unlocks. Billing mail
+comes from billing@hqforwork.com, and billing links go to hq.computer, which is
+the console.
+
+In the console you'll see a lock banner, an upgrade wall, and a team roster that
+counts members against the limit. In a Claude Code session, `/startwork` shows a
+short notice on every turn while the workspace is over its limits.
+
 ## Meeting notes, signals & ontology
 
 HQ captures these **natively, per company** — check HQ first, not your email or a third-party notetaker.
@@ -334,7 +375,7 @@ HQ captures these **natively, per company** — check HQ first, not your email o
 
 **Your preference for "meeting notes":** defaults to HQ-native. To point a company at email instead, set `meeting_notes_source: email` in `companies/{co}/settings/knowledge/preferences.yaml` (global default lives in `personal/settings/knowledge-preferences.yaml`).
 
-> Signals extraction and the ontology gardener run on HQ cloud and will require HQ Pro once billing ships. Billing isn't live yet — today these are provisioned per-company when you cloud-back it via `/designate-team`. Reference: `core/knowledge/public/hq-core/native-knowledge-stores.md`.
+> Signals extraction and the ontology gardener run on HQ cloud and are part of HQ Workforce ($500/mo) and Enterprise. They are not included in the free Starter plan. Cloud-back a company with `/designate-team` to turn them on. Reference: `core/knowledge/public/hq-core/native-knowledge-stores.md`.
 
 ## Typical Session
 

package/assets/bot-workers/setup/context/quick-reference.md

@@ -148,7 +148,7 @@ Share-session URLs are encrypted single-use 15-minute capabilities — never per
 
 ## CLI: `hq db` (vault databases)
 
-Local SQLite per company (always) + optional remote Postgres-class on **HQ Team** ($500/mo). Guide: `core/knowledge/public/hq-core/vault-databases.md`. Requires `@indigoai-us/hq-cli` ≥ 5.62.0.
+Local SQLite per company (always, Starter included) + optional remote Postgres-class on **HQ Workforce** ($500/mo) or Enterprise. Guide: `core/knowledge/public/hq-core/vault-databases.md`. Requires `@indigoai-us/hq-cli` ≥ 5.62.0.
 
 | Command | Use |
 |---------|-----|

package/dist/command-catalog.generated.d.ts

@@ -800,6 +800,9 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly options: readonly [{
         readonly flags: "--json";
         readonly description: "Output identity metadata as JSON (never tokens)";
+    }, {
+        readonly flags: "--company <slug>";
+        readonly description: "Also report this company's workspace plan state (Starter lock)";
     }];
     readonly subcommands: readonly [];
 }, {
@@ -1276,7 +1279,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "provision";
-        readonly description: "Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)";
+        readonly description: "Provision (or re-bind) the company remote vault DB via HQ control plane (HQ Workforce plan)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options]";
@@ -4603,7 +4606,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "upgrade";
-        readonly description: "Open Stripe Checkout to upgrade this company to HQ Team ($500/mo)";
+        readonly description: "Open Stripe Checkout to upgrade this company to HQ Workforce ($500/mo)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options]";

package/dist/command-catalog.generated.js

@@ -1021,6 +1021,10 @@ export const COMMAND_CATALOG = [
             {
                 "flags": "--json",
                 "description": "Output identity metadata as JSON (never tokens)"
+            },
+            {
+                "flags": "--company <slug>",
+                "description": "Also report this company's workspace plan state (Starter lock)"
             }
         ],
         "subcommands": []
@@ -1628,7 +1632,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "provision",
-                "description": "Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)",
+                "description": "Provision (or re-bind) the company remote vault DB via HQ control plane (HQ Workforce plan)",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options]",
@@ -5951,7 +5955,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "upgrade",
-                "description": "Open Stripe Checkout to upgrade this company to HQ Team ($500/mo)",
+                "description": "Open Stripe Checkout to upgrade this company to HQ Workforce ($500/mo)",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options]",

package/dist/commands/agent-kit.js

@@ -124,7 +124,7 @@ export function buildKitRuntime(service) {
     process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
     process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
     process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
-    const log = createKitLogger(paths, service, { echo: true });
+    const log = createKitLogger(paths, service, { echo: process.stdout.isTTY === true });
     const getToken = () => ensureCognitoToken({ tokenSource: "machine", interactive: false });
     return { paths, creds, config, getToken, log };
 }
@@ -168,6 +168,21 @@ export async function runKitService(service, rt) {
                 refreshMs: rt.config.meshRefreshMs,
                 getToken: rt.getToken,
                 log: rt.log,
+                // Any doorbell (and the periodic refresh) re-polls the agent inbox, the
+                // only conversation source agent callers are authorized to read.
+                refetch: async () => {
+                    const r = await pollInboxOnce({
+                        paths: rt.paths,
+                        agentUid: rt.creds.entityUid,
+                        apiBaseUrl: rt.creds.apiBaseUrl,
+                        pollMs: rt.config.inboxPollMs,
+                        ack: rt.config.inboxAck,
+                        getToken: rt.getToken,
+                        log: rt.log,
+                    });
+                    if (!r.ok)
+                        throw new Error("agent inbox poll failed; see inbox.log");
+                },
                 // An inbox doorbell means "poll now" rather than waiting for the loop.
                 onInboxDoorbell: () => pollInboxOnce({
                     paths: rt.paths,

package/dist/commands/agent-probe.d.ts

@@ -9,7 +9,7 @@
  *                presence is live: a fresh last-heartbeat.json plus an ok
  *                component-mesh stamp from the doorbell listener. (The company
  *                roster route is owner/admin-only and 404s for agt_ callers.)
- *   dm           send a DM to self via POST /v1/notify/dm and read it back
+ *   dm           send a DM to self via POST /v1/notify/dm (accepted) and read the agent inbox (200)
  *                through GET /v1/agents/{uid}/inbox (the agent read surface;
  *                /v1/notify/thread is intentionally closed to agents)
  *   secrets      `GET /secrets/{companyUid}` answers 200
@@ -38,8 +38,6 @@ export interface ProbeResult {
     /** Seconds since the kit's last successful heartbeat, or null if never. */
     heartbeatAgeSeconds: number | null;
 }
-export declare const DM_ROUNDTRIP_TIMEOUT_MS = 20000;
-export declare const DM_ROUNDTRIP_POLL_MS = 2000;
 /** A heartbeat older than this does not count as live presence (3 missed 60 s beats). */
 export declare const PRESENCE_FRESH_SECONDS = 180;
 export interface ProbeDeps {

package/dist/commands/agent-probe.js

@@ -9,7 +9,7 @@
  *                presence is live: a fresh last-heartbeat.json plus an ok
  *                component-mesh stamp from the doorbell listener. (The company
  *                roster route is owner/admin-only and 404s for agt_ callers.)
- *   dm           send a DM to self via POST /v1/notify/dm and read it back
+ *   dm           send a DM to self via POST /v1/notify/dm (accepted) and read the agent inbox (200)
  *                through GET /v1/agents/{uid}/inbox (the agent read surface;
  *                /v1/notify/thread is intentionally closed to agents)
  *   secrets      `GET /secrets/{companyUid}` answers 200
@@ -41,8 +41,6 @@ import { readKitConfig } from "../lib/agent-kit/kit-config.js";
 import { readLastHeartbeat } from "../lib/agent-kit/run/heartbeat.js";
 import { defaultRunPull, syncPullArgs } from "../lib/agent-kit/run/sync.js";
 import { requireExternalCreds } from "./agent-kit.js";
-export const DM_ROUNDTRIP_TIMEOUT_MS = 20_000;
-export const DM_ROUNDTRIP_POLL_MS = 2_000;
 /** A heartbeat older than this does not count as live presence (3 missed 60 s beats). */
 export const PRESENCE_FRESH_SECONDS = 180;
 function errText(err) {
@@ -59,7 +57,6 @@ export function heartbeatAgeSeconds(paths, now = () => new Date()) {
 }
 export async function runProbe(deps) {
     const now = deps.now ?? (() => new Date());
-    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const nonce = (deps.nonce ?? (() => randomBytes(6).toString("hex")))();
     const self = deps.creds.entityUid;
     const checks = [];
@@ -153,37 +150,22 @@ export async function runProbe(deps) {
     else {
         checks.push({ name: "work-mesh", ok: false, detail: "skipped: no token/company" });
     }
-    // 4. dm round-trip: send via notify, read back via the agent inbox
+    // 4. dm: the send is accepted and the agent inbox is readable.
+    // The server never delivers a self-DM into the sender's own inbox
+    // (hq-pro-core notify-dm skips inbox delivery when recipient === sender),
+    // so a self round-trip can never succeed. Inbound delivery is proven by a
+    // teammate's DM, which the kit's inbox poller mirrors to inbox.jsonl.
     if (token) {
         try {
             const body = `hq agent probe ${nonce}`;
             await deps.sendDm(token, self, body);
-            const deadline = now().getTime() + (deps.dmTimeoutMs ?? DM_ROUNDTRIP_TIMEOUT_MS);
-            let found = false;
-            let lastStatus = 0;
-            for (;;) {
-                const res = await deps.readInbox(token);
-                lastStatus = res.status;
-                if (res.status === 200 && inboxContainsNonce(res.body, nonce)) {
-                    found = true;
-                    break;
-                }
-                // A 4xx will not heal by polling (auth/route refusal): stop now.
-                if (res.status >= 400 && res.status < 500)
-                    break;
-                if (now().getTime() >= deadline)
-                    break;
-                await sleep(DM_ROUNDTRIP_POLL_MS);
-            }
-            const secs = Math.round((deps.dmTimeoutMs ?? DM_ROUNDTRIP_TIMEOUT_MS) / 1000);
+            const res = await deps.readInbox(token);
             checks.push({
                 name: "dm",
-                ok: found,
-                detail: found
-                    ? "sent to self via /v1/notify/dm and read back from /v1/agents/{uid}/inbox"
-                    : lastStatus === 200
-                        ? `sent but not visible in /v1/agents/{uid}/inbox after ${secs}s`
-                        : `sent but /v1/agents/{uid}/inbox answered ${lastStatus}`,
+                ok: res.status === 200,
+                detail: res.status === 200
+                    ? "send accepted by /v1/notify/dm; /v1/agents/{uid}/inbox → 200 (self-DMs are not delivered to the inbox; a DM from a teammate confirms inbound)"
+                    : `send accepted but /v1/agents/{uid}/inbox answered ${res.status}`,
             });
         }
         catch (err) {

package/dist/commands/billing.js

@@ -110,7 +110,7 @@ export function registerBillingCommand(program) {
     });
     billing
         .command("upgrade")
-        .description("Open Stripe Checkout to upgrade this company to HQ Team ($500/mo)")
+        .description("Open Stripe Checkout to upgrade this company to HQ Workforce ($500/mo)")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--no-browser", "Print the Stripe Checkout URL instead of opening it")
         .option("--json", "Emit the Checkout URL as JSON")

package/dist/commands/db-provision.js

@@ -28,7 +28,7 @@ const defaultDeps = () => ({
 });
 export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
     db.command("provision")
-        .description("Provision (or re-bind) the company remote vault DB via HQ control plane (Team plan)")
+        .description("Provision (or re-bind) the company remote vault DB via HQ control plane (HQ Workforce plan)")
         .requiredOption("--company <slug>", "Company slug")
         .option("--region <region>", "AWS region", "us-east-1")
         .action(async (opts) => {
@@ -65,9 +65,9 @@ export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
                 throw error;
             const msg = error instanceof Error ? error.message : "Unknown error";
             const status = error.status;
-            if (status === 402 || /PLAN_REQUIRED|Team plan|\$500/i.test(msg)) {
-                console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Team plan ($500/mo).");
-                console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no Team plan required."));
+            if (status === 402 || /PLAN_REQUIRED|Team plan|Workforce|\$500/i.test(msg)) {
+                console.error(chalk.red("Error:"), "Remote vault DB requires the HQ Workforce plan ($500/mo).");
+                console.error(chalk.dim("Local databases still work: hq db status|sql|migrate — no HQ Workforce plan required."));
             }
             else if (status === 404 || /Unknown route|Not Found/i.test(msg)) {
                 console.error(chalk.red("Error:"), "Remote DB control plane is not available yet (routes not deployed).");

package/dist/commands/meetings.js

@@ -111,8 +111,8 @@ async function handleApiError(res, json = false) {
         console.error(chalk.red(body.error ?? "Not found"));
     }
     else if (res.status === 402) {
-        console.error(chalk.red("Meeting notetaker bots require the $500/mo HQ Team plan."));
-        console.error(chalk.dim(body.message ?? body.error ?? "Upgrade your company to HQ Team to record meetings."));
+        console.error(chalk.red("Meeting notetaker bots require the $500/mo HQ Workforce plan."));
+        console.error(chalk.dim(body.message ?? body.error ?? "Upgrade your company to HQ Workforce to record meetings."));
     }
     else {
         console.error(chalk.red(`API error (${res.status}): ${body.error ?? res.statusText}`));

package/dist/commands/whoami.d.ts

@@ -2,6 +2,7 @@
  * hq whoami — displays current user or 'not logged in'
  */
 import { Command } from 'commander';
+import { type PlanLockStatus } from "../lib/billing/plan-lock.js";
 export interface WhoamiTokenIdentity {
     email?: string;
     sub?: string;
@@ -19,5 +20,11 @@ export interface WhoamiDisplayIdentity {
  * email with the token subject of the delegating machine.
  */
 export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
+/**
+ * Human rendering of the plan state: the full WORKSPACE LOCKED block when the
+ * workspace is locked, the one-line `Plan: Starter — …` orientation when it is
+ * Starter and healthy, and nothing at all otherwise.
+ */
+export declare function renderWhoamiPlanBlock(status: PlanLockStatus): string | null;
 export declare function registerWhoamiCommand(program: Command): void;
 //# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.js

@@ -4,7 +4,8 @@
 import chalk from 'chalk';
 import { loadCachedTokens, isExpiring, loadMachineCreds, } from '@indigoai-us/hq-cloud';
 import { peekIdToken as decodeIdToken } from "../utils/id-token.js";
-import { loadMachineCachedTokens, resolveCognitoTokenSource } from "../utils/cognito-session.js";
+import { ensureCognitoToken, loadMachineCachedTokens, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
+import { colorizePlanLockNotice, fetchPlanLockStatus, renderPlanLine, renderPlanLockNotice, } from "../lib/billing/plan-lock.js";
 /**
  * Resolves the person represented by an ID token without pairing a delegated
  * email with the token subject of the delegating machine.
@@ -40,11 +41,58 @@ function peekIdToken(idToken) {
             : undefined,
     };
 }
+/**
+ * starter-plan-hard-limits / US-011 — read the workspace plan lock for
+ * `--company <slug>`.
+ *
+ * hq-pro owns the decision (`planLock` on GET /membership/me); this only reads
+ * it. Best-effort by construction: no session, a network failure, an older
+ * backend that sends no `planLock`, or a company the caller is not a member of
+ * all resolve to null — reported as UNKNOWN and rendered as nothing, never as
+ * a guessed lock or a guessed all-clear, and never as a command failure. The
+ * command exists to answer "who am I"; the plan line is decoration on top.
+ */
+async function readPlanLock(company) {
+    const slug = company?.trim();
+    if (!slug)
+        return null;
+    try {
+        // NEVER interactive: this runs inside `--json` (before the authenticated
+        // check) and inside hq-core's per-turn plan-lock refresh hook. With the
+        // default `interactive: true`, a box with no cached session would launch a
+        // browser sign-in and block the caller instead of resolving to UNKNOWN.
+        const token = await ensureCognitoToken({ interactive: false });
+        return await fetchPlanLockStatus(token, slug);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Human rendering of the plan state: the full WORKSPACE LOCKED block when the
+ * workspace is locked, the one-line `Plan: Starter — …` orientation when it is
+ * Starter and healthy, and nothing at all otherwise.
+ */
+export function renderWhoamiPlanBlock(status) {
+    if (status.lock.locked) {
+        return colorizePlanLockNotice(renderPlanLockNotice(status));
+    }
+    return renderPlanLine(status);
+}
+async function printPlanBlock(company) {
+    const status = await readPlanLock(company);
+    if (!status)
+        return;
+    const block = renderWhoamiPlanBlock(status);
+    if (block)
+        console.log(block);
+}
 export function registerWhoamiCommand(program) {
     program
         .command('whoami')
         .description('Show the currently authenticated user')
         .option('--json', 'Output identity metadata as JSON (never tokens)')
+        .option('--company <slug>', 'Also report this company\'s workspace plan state (Starter lock)')
         .action(async (opts) => {
         try {
             // Effective source (same as auth status / ensureCognitoToken): env
@@ -67,6 +115,9 @@ export function registerWhoamiCommand(program) {
                 const agentUid = machineCreds?.entityUid !== undefined
                     ? (machineCreds.entityUid.startsWith('agt_') ? machineCreds.entityUid : null)
                     : boundLegacyAgent;
+                // planLock is additive: absent-or-null means UNKNOWN, which is what
+                // every consumer already sees from a backend that predates it.
+                const planLock = await readPlanLock(opts.company);
                 console.log(JSON.stringify({
                     schemaVersion: 1,
                     authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
@@ -75,6 +126,7 @@ export function registerWhoamiCommand(program) {
                     personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
                     agentUid,
                     username: machineCreds?.username ?? null,
+                    planLock,
                 }, null, 2));
                 return;
             }
@@ -88,6 +140,7 @@ export function registerWhoamiCommand(program) {
                     : undefined;
                 console.log(`Machine identity ${username}${entityUid ? ` (agent ${entityUid})` : ''} — sessions mint automatically`);
                 console.log(`token source: machine`);
+                await printPlanBlock(opts.company);
                 return;
             }
             if (!cached) {
@@ -101,6 +154,7 @@ export function registerWhoamiCommand(program) {
             }
             const { email, sub } = resolveWhoamiIdentity(peekIdToken(cached.idToken));
             console.log(`Logged in as ${email ?? 'unknown'}${sub ? ` (${sub})` : ''}`);
+            await printPlanBlock(opts.company);
         }
         catch (error) {
             console.error(chalk.red('Error:'), error instanceof Error ? error.message : 'Unknown error');

package/dist/lib/agent-kit/run/inbox.js

@@ -18,7 +18,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { vaultApiFetch } from "../../../utils/vault-api.js";
-import { warmMeshConversationCache } from "../../mesh/api.js";
 import { writeComponentStatus } from "../creds.js";
 export const SEEN_IDS_NAME = "seen-ids.json";
 export const INBOX_JSONL_NAME = "inbox.jsonl";
@@ -115,7 +114,8 @@ export function defaultAckItem(agentUid, apiBaseUrl) {
 export async function pollInboxOnce(deps) {
     const fetchInbox = deps.fetchInbox ?? defaultFetchInbox(deps.agentUid, deps.apiBaseUrl);
     const ackItem = deps.ackItem ?? defaultAckItem(deps.agentUid, deps.apiBaseUrl);
-    const warmCache = deps.warmCache ?? ((token, uid) => warmMeshConversationCache(token, uid));
+    // No default cache warm: the human conversation routes 403 for agent callers.
+    const warmCache = deps.warmCache ?? (async () => { });
     let token;
     try {
         token = await deps.getToken();

package/dist/lib/agent-kit/run/mesh-listener.js

@@ -20,7 +20,7 @@
  * is stamped ok while subscribed and refreshing, error otherwise.
  */
 import mqtt from "mqtt";
-import { warmMeshConversationCache } from "../../mesh/api.js";
+import { defaultFetchInbox } from "./inbox.js";
 import { createPersonalRealtimeFetcher, MQTT_KEEPALIVE_SECONDS, renewalDelayMs, } from "../../mesh/live/daemon/credentials.js";
 import { presignIotWssUrl } from "../../mesh/live/daemon/presign.js";
 import { writeComponentStatus } from "../creds.js";
@@ -54,7 +54,16 @@ export async function startMeshListener(deps) {
     const setT = deps.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
     const clearT = deps.clearTimeout ?? ((h) => clearTimeout(h));
     const connect = deps.connect ?? ((url, opts) => mqtt.connect(url, opts));
-    const refetch = deps.refetch ?? ((token, uid) => warmMeshConversationCache(token, uid));
+    // Agent callers are refused by the human conversation routes
+    // (/v1/notify/inbox|contacts|thread → 403 AGENT_ROUTE_NOT_SUPPORTED), so the
+    // default refetch reads the agent's own inbox, the agent-authorized source.
+    const refetch = deps.refetch ??
+        (async (token, uid) => {
+            const res = await defaultFetchInbox(uid, deps.apiBaseUrl)(token);
+            if (res.status !== 200) {
+                throw new Error(`GET ${res.url ?? "agent inbox"} → ${res.status}${res.bodyText ? ` body=${res.bodyText}` : ""}`);
+            }
+        });
     const fetchCredentials = deps.fetchCredentials ??
         (async () => {
             const token = await deps.getToken();

package/dist/lib/agent-kit/skills.js

@@ -114,8 +114,8 @@ Rules:
         body: `# Work mesh status
 
 The work mesh is HQ's live board of who is working on what. It is the source
-of truth for project stories and active sessions; the kit's listener keeps a
-local cache under \`~/.hq/work-mesh/cache/\`.
+of truth for project stories and active sessions. The kit's listener re-polls
+this agent's inbox whenever a doorbell rings.
 
 \`\`\`bash
 hq mesh session status --company <slug>          # who is working on what right now

package/dist/lib/billing/plan-lock.d.ts

@@ -0,0 +1,99 @@
+/**
+ * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
+ * of the workspace plan lock.
+ *
+ * Starter (free) workspaces are capped at 5 members and 0 integrations. Going
+ * over locks the workspace immediately: it becomes read-only until the owner
+ * trims back under the caps or upgrades to HQ Workforce. The lock decision is
+ * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
+ * truth and ships the answer on `GET /membership/me` as a per-company
+ * `planLock` object. This module only reads that field and renders it.
+ *
+ * Member counts are decoration, never a second opinion: the count comes from
+ * `GET /v1/billing/usage-limits` on a best-effort basis and its absence only
+ * removes the "n of 5" detail from the notice. An absent field is UNKNOWN, so
+ * nothing here ever infers a lock (or an unlock) from missing data
+ * (hq-absent-field-never-means-constraining-value).
+ */
+/** Mirror of hq-pro's `PlanLockReason`. */
+export type PlanLockReason = "users" | "integrations";
+/** Mirror of hq-pro's `PlanLock` wire shape (see src/billing/plan-lock.ts). */
+export interface PlanLock {
+    locked: boolean;
+    reasons: PlanLockReason[];
+    upgradeUrl: string;
+    fixOptions: {
+        removeMembersTo: number;
+        disconnectIntegrations: boolean;
+    };
+}
+/** Optional member decoration for the notice ("7 of 5 members"). */
+export interface PlanLockMembers {
+    used: number;
+    limit: number;
+}
+export interface PlanLockStatus {
+    companySlug: string;
+    companyUid?: string;
+    lock: PlanLock;
+    members?: PlanLockMembers;
+    /**
+     * Resolved plan id, when the usage endpoint answered. UNKNOWN (absent) when
+     * it did not — surfaces that gate on "is this Starter?" must then stay
+     * silent rather than assume either way.
+     */
+    plan?: "free" | "paid" | "enterprise";
+    checkedAt: string;
+}
+/** Starter member cap quoted when the server did not send `removeMembersTo`. */
+export declare const STARTER_MEMBER_TARGET = 5;
+/** Upgrade destination quoted when the server did not send one. */
+export declare const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
+/** The paid plan the lock wall sends owners to. Copy lives in ONE place. */
+export declare const WORKFORCE_PLAN_LABEL = "HQ Workforce ($500/mo)";
+/**
+ * Defensively parse a `planLock` payload. Anything malformed returns null —
+ * the caller then behaves exactly as if the server had sent nothing, which is
+ * "unknown", not "locked".
+ */
+export declare function parsePlanLock(value: unknown): PlanLock | null;
+/**
+ * Pick the membership row for `companySlug` (or `cmp_…` uid) out of a decoded
+ * `/membership/me` body and return its parsed lock. No matching row — or no
+ * `planLock` on it — is UNKNOWN, so this returns null rather than guessing.
+ */
+export declare function selectPlanLock(body: unknown, companyRef: string): {
+    lock: PlanLock;
+    companyUid?: string;
+} | null;
+/** Parse the resolved plan id out of a usage-limits body. Absent → null. */
+export declare function selectPlan(body: unknown): "free" | "paid" | "enterprise" | null;
+/** Parse the `users` dimension out of a usage-limits body. Absent → null. */
+export declare function selectMemberUsage(body: unknown): PlanLockMembers | null;
+/**
+ * Read the live lock for one company: `planLock` from `/membership/me`, plus a
+ * best-effort member count for the notice. Returns null when the server did not
+ * answer with a lock for this company — callers must then say nothing.
+ */
+export declare function fetchPlanLockStatus(token: string, companyRef: string, opts?: {
+    timeoutMs?: number;
+}): Promise<PlanLockStatus | null>;
+/**
+ * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
+ * against the cap, and the two fixes. Plain text — colour is applied by the
+ * caller so scripts capturing stdout get a clean block.
+ */
+export declare function renderPlanLockNotice(status: PlanLockStatus): string;
+/**
+ * The one-line form injected on every turn while the workspace stays locked.
+ * Kept to a single line on purpose — it repeats each turn.
+ */
+export declare function renderPlanLockLine(status: PlanLockStatus): string;
+/**
+ * The `Plan: …` orientation line. Starter only: a paid or enterprise
+ * workspace — and an UNKNOWN plan — gets no line at all.
+ */
+export declare function renderPlanLine(status: PlanLockStatus): string | null;
+/** Colourised block for interactive output. */
+export declare function colorizePlanLockNotice(notice: string): string;
+//# sourceMappingURL=plan-lock.d.ts.map

package/dist/lib/billing/plan-lock.js

@@ -0,0 +1,230 @@
+/**
+ * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
+ * of the workspace plan lock.
+ *
+ * Starter (free) workspaces are capped at 5 members and 0 integrations. Going
+ * over locks the workspace immediately: it becomes read-only until the owner
+ * trims back under the caps or upgrades to HQ Workforce. The lock decision is
+ * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
+ * truth and ships the answer on `GET /membership/me` as a per-company
+ * `planLock` object. This module only reads that field and renders it.
+ *
+ * Member counts are decoration, never a second opinion: the count comes from
+ * `GET /v1/billing/usage-limits` on a best-effort basis and its absence only
+ * removes the "n of 5" detail from the notice. An absent field is UNKNOWN, so
+ * nothing here ever infers a lock (or an unlock) from missing data
+ * (hq-absent-field-never-means-constraining-value).
+ */
+import chalk from "chalk";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+/** Starter member cap quoted when the server did not send `removeMembersTo`. */
+export const STARTER_MEMBER_TARGET = 5;
+/** Upgrade destination quoted when the server did not send one. */
+export const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
+/** The paid plan the lock wall sends owners to. Copy lives in ONE place. */
+export const WORKFORCE_PLAN_LABEL = "HQ Workforce ($500/mo)";
+function asRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+/**
+ * Defensively parse a `planLock` payload. Anything malformed returns null —
+ * the caller then behaves exactly as if the server had sent nothing, which is
+ * "unknown", not "locked".
+ */
+export function parsePlanLock(value) {
+    const rec = asRecord(value);
+    if (!rec)
+        return null;
+    if (typeof rec.locked !== "boolean")
+        return null;
+    const reasons = [];
+    if (Array.isArray(rec.reasons)) {
+        for (const reason of rec.reasons) {
+            if (reason === "users" || reason === "integrations")
+                reasons.push(reason);
+        }
+    }
+    const fix = asRecord(rec.fixOptions);
+    const removeMembersTo = typeof fix?.removeMembersTo === "number" &&
+        Number.isFinite(fix.removeMembersTo)
+        ? fix.removeMembersTo
+        : STARTER_MEMBER_TARGET;
+    return {
+        locked: rec.locked,
+        reasons,
+        upgradeUrl: typeof rec.upgradeUrl === "string" && rec.upgradeUrl.trim().length > 0
+            ? rec.upgradeUrl.trim()
+            : DEFAULT_UPGRADE_URL,
+        fixOptions: {
+            removeMembersTo,
+            disconnectIntegrations: fix?.disconnectIntegrations === true,
+        },
+    };
+}
+/**
+ * Pick the membership row for `companySlug` (or `cmp_…` uid) out of a decoded
+ * `/membership/me` body and return its parsed lock. No matching row — or no
+ * `planLock` on it — is UNKNOWN, so this returns null rather than guessing.
+ */
+export function selectPlanLock(body, companyRef) {
+    const rec = asRecord(body);
+    const rows = Array.isArray(rec?.memberships) ? rec.memberships : [];
+    const ref = companyRef.trim().toLowerCase();
+    for (const raw of rows) {
+        const row = asRecord(raw);
+        if (!row)
+            continue;
+        if (typeof row.status === "string" && row.status !== "active")
+            continue;
+        const slug = typeof row.companySlug === "string" ? row.companySlug.toLowerCase() : "";
+        const uid = typeof row.companyUid === "string" ? row.companyUid.toLowerCase() : "";
+        if (slug !== ref && uid !== ref)
+            continue;
+        const lock = parsePlanLock(row.planLock);
+        if (!lock)
+            return null;
+        return {
+            lock,
+            companyUid: typeof row.companyUid === "string" ? row.companyUid : undefined,
+        };
+    }
+    return null;
+}
+/** Parse the resolved plan id out of a usage-limits body. Absent → null. */
+export function selectPlan(body) {
+    const plan = asRecord(body)?.plan;
+    return plan === "free" || plan === "paid" || plan === "enterprise"
+        ? plan
+        : null;
+}
+/** Parse the `users` dimension out of a usage-limits body. Absent → null. */
+export function selectMemberUsage(body) {
+    const users = asRecord(asRecord(body)?.users);
+    if (!users)
+        return null;
+    if (typeof users.used !== "number" || !Number.isFinite(users.used)) {
+        return null;
+    }
+    const limit = typeof users.limit === "number" && Number.isFinite(users.limit)
+        ? users.limit
+        : STARTER_MEMBER_TARGET;
+    return { used: users.used, limit };
+}
+/**
+ * Read the live lock for one company: `planLock` from `/membership/me`, plus a
+ * best-effort member count for the notice. Returns null when the server did not
+ * answer with a lock for this company — callers must then say nothing.
+ */
+export async function fetchPlanLockStatus(token, companyRef, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 8000;
+    const res = await vaultApiFetch({
+        token,
+        path: "/membership/me",
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok)
+        return null;
+    const selected = selectPlanLock(await res.json().catch(() => null), companyRef);
+    if (!selected)
+        return null;
+    let members;
+    let plan;
+    // Decoration only. The lock answer above is authoritative; the usage read
+    // adds the member count and the plan id that the notices and the `Plan:`
+    // orientation line quote. A failure here must never suppress — or invent —
+    // a lock, so every field it feeds stays optional.
+    if (selected.companyUid) {
+        try {
+            const usage = await vaultApiFetch({
+                token,
+                path: "/v1/billing/usage-limits",
+                query: { companyUid: selected.companyUid },
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+            if (usage.ok) {
+                const body = await usage.json().catch(() => null);
+                members = selectMemberUsage(body) ?? undefined;
+                plan = selectPlan(body) ?? undefined;
+            }
+        }
+        catch {
+            // Network/timeout: leave both unknown.
+        }
+    }
+    return {
+        companySlug: companyRef,
+        companyUid: selected.companyUid,
+        lock: selected.lock,
+        members,
+        plan,
+        checkedAt: new Date().toISOString(),
+    };
+}
+function reasonLabel(reason) {
+    return reason === "users"
+        ? "too many members"
+        : "integrations are not included on Starter";
+}
+/**
+ * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
+ * against the cap, and the two fixes. Plain text — colour is applied by the
+ * caller so scripts capturing stdout get a clean block.
+ */
+export function renderPlanLockNotice(status) {
+    const { lock, members, companySlug } = status;
+    const target = lock.fixOptions.removeMembersTo;
+    const lines = [];
+    lines.push(`WORKSPACE LOCKED — ${companySlug} is over its Starter plan.`);
+    const reasons = lock.reasons.length
+        ? lock.reasons.map(reasonLabel).join("; ")
+        : "over the Starter plan limits";
+    lines.push(`  Why: ${reasons}.`);
+    if (members) {
+        lines.push(`  Members: ${members.used} of ${target}.`);
+    }
+    else {
+        lines.push(`  Members allowed on Starter: ${target}.`);
+    }
+    lines.push("  This workspace is read-only until it is fixed. Two ways out:");
+    lines.push(`    1. Remove members until you are at ${target} or fewer${lock.fixOptions.disconnectIntegrations
+        ? ", and disconnect the workspace's integrations"
+        : ""}.`);
+    lines.push(`    2. Upgrade to ${WORKFORCE_PLAN_LABEL}.`);
+    lines.push(`  Upgrade: ${lock.upgradeUrl}`);
+    return lines.join("\n");
+}
+/**
+ * The one-line form injected on every turn while the workspace stays locked.
+ * Kept to a single line on purpose — it repeats each turn.
+ */
+export function renderPlanLockLine(status) {
+    const target = status.lock.fixOptions.removeMembersTo;
+    const count = status.members
+        ? `${status.members.used} of ${target} members`
+        : `over its ${target}-member limit`;
+    return (`Company ${status.companySlug} is locked on Starter (${count}). ` +
+        `Writes to HQ cloud will fail until fixed: ${status.lock.upgradeUrl}`);
+}
+/**
+ * The `Plan: …` orientation line. Starter only: a paid or enterprise
+ * workspace — and an UNKNOWN plan — gets no line at all.
+ */
+export function renderPlanLine(status) {
+    if (status.lock.locked)
+        return "Plan: Starter — LOCKED";
+    if (status.plan !== "free")
+        return null;
+    const target = status.lock.fixOptions.removeMembersTo;
+    if (status.members) {
+        return `Plan: Starter — ${status.members.used} of ${target} members`;
+    }
+    return `Plan: Starter — ${target} members included`;
+}
+/** Colourised block for interactive output. */
+export function colorizePlanLockNotice(notice) {
+    return chalk.red(notice);
+}
+//# sourceMappingURL=plan-lock.js.map

package/dist/lib/plan-limit-nag.js

@@ -224,7 +224,7 @@ export function emitPlanLimitNag(opts = {}) {
         if (worst === null)
             return;
         warningShownThisSession = true;
-        const line = `⚠ HQ free plan: ${formatEntryLine(worst.key, worst.entry)}. Upgrade: ${resolvedUpgradeUrl}`;
+        const line = `⚠ HQ Starter plan: ${formatEntryLine(worst.key, worst.entry)}. Upgrade: ${resolvedUpgradeUrl}`;
         write(chalk.yellow(line) + "\n");
     }
     catch {

package/dist/utils/plan-gate-error.js

@@ -1,4 +1,4 @@
-const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to Team.";
+const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to HQ Workforce.";
 export class PlanGateError extends Error {
     code;
     details;
@@ -23,19 +23,19 @@ function formatPlanGateDetails(code, details) {
         typeof details.used === "number" &&
         typeof details.limit === "number") {
         const upgrade = typeof details.upgradeUrl === "string"
-            ? `Upgrade to HQ Team ($500/mo) to remove limits: ${details.upgradeUrl}`
-            : "Upgrade to HQ Team ($500/mo) to remove limits.";
+            ? `Upgrade to HQ Workforce ($500/mo) to remove limits: ${details.upgradeUrl}`
+            : "Upgrade to HQ Workforce ($500/mo) to remove limits.";
         return [
-            `Free plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`,
+            `Starter plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`,
             upgrade,
             existingResourcesNote,
         ].join("\n");
     }
     const upgrade = typeof details.upgradeUrl === "string"
-        ? `Upgrade to HQ Team ($500/mo) to remove limits: ${details.upgradeUrl}`
-        : "Upgrade to HQ Team ($500/mo) to remove limits.";
+        ? `Upgrade to HQ Workforce ($500/mo) to remove limits: ${details.upgradeUrl}`
+        : "Upgrade to HQ Workforce ($500/mo) to remove limits.";
     return [
-        "HQ Team plan required for this feature.",
+        "HQ Workforce plan required for this feature.",
         upgrade,
         existingResourcesNote,
     ].join("\n");
@@ -56,7 +56,7 @@ export async function offerTeamUpgrade(onConfirm, deps = {}) {
     if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
         return false;
     if (deps.ask) {
-        const answer = await deps.ask("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        const answer = await deps.ask("Upgrade to HQ Workforce ($500/mo) now? [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();
@@ -65,7 +65,7 @@ export async function offerTeamUpgrade(onConfirm, deps = {}) {
     const { createInterface } = await import("node:readline/promises");
     const readline = createInterface({ input: process.stdin, output: process.stderr });
     try {
-        const answer = await readline.question("Upgrade to HQ Team ($500/mo) now? [y/N] ");
+        const answer = await readline.question("Upgrade to HQ Workforce ($500/mo) now? [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();

package/dist/utils/team-upgrade.d.ts

@@ -10,7 +10,7 @@ export interface TeamUpgradeOptions {
     error?: (text: string) => void;
 }
 /**
- * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * Start the owner-gated HQ Workforce Checkout flow. Stripe collects payment details
  * in its hosted browser page; the CLI never receives card data.
  */
 export declare function upgradeToTeam(opts?: TeamUpgradeOptions): Promise<string>;

package/dist/utils/team-upgrade.js

@@ -14,7 +14,7 @@ function ownerUpgradeError() {
     return Object.assign(new Error("Only a company owner can upgrade. Ask a company owner to upgrade."), { expected: true });
 }
 /**
- * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * Start the owner-gated HQ Workforce Checkout flow. Stripe collects payment details
  * in its hosted browser page; the CLI never receives card data.
  */
 export async function upgradeToTeam(opts = {}) {
@@ -35,7 +35,7 @@ export async function upgradeToTeam(opts = {}) {
         if (response.status === 403 || /owner/i.test(`${body.error ?? ""} ${body.message ?? ""}`)) {
             throw ownerUpgradeError();
         }
-        throw Object.assign(new Error(`Could not start HQ Team checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
+        throw Object.assign(new Error(`Could not start HQ Workforce checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
     }
     const { url } = (await response.json());
     if (typeof url !== "string" || !url) {
@@ -46,7 +46,7 @@ export async function upgradeToTeam(opts = {}) {
         write(`${JSON.stringify({ url })}\n`);
         return url;
     }
-    write("Opening HQ Team checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
+    write("Opening HQ Workforce checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
     const skipBrowser = opts.noBrowser || (opts.headless ?? isHeadless());
     if (skipBrowser) {
         write(`Open this URL to continue: ${url}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.117.1",
+  "version": "5.117.2",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {