@indigoai-us/hq-cli 5.117.3 → 5.118.1

package/dist/lib/billing/plan-lock.d.ts

@@ -2,8 +2,9 @@
  * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
  * of the workspace plan lock.
  *
- * Starter (free) workspaces are capped at 5 members and 0 integrations. Going
- * over locks the workspace immediately: it becomes read-only until the owner
+ * Starter (free) workspaces are capped on four locking dimensions — members,
+ * integrations, secrets and agents (owner decision 7, 2026-09-17; deployments
+ * and storage nag but never lock). Going over locks the workspace immediately: it becomes read-only until the owner
  * trims back under the caps or upgrades to HQ Workforce. The lock decision is
  * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
  * truth and ships the answer on `GET /membership/me` as a per-company
@@ -15,17 +16,33 @@
  * nothing here ever infers a lock (or an unlock) from missing data
  * (hq-absent-field-never-means-constraining-value).
  */
-/** Mirror of hq-pro's `PlanLockReason`. */
-export type PlanLockReason = "users" | "integrations";
+/**
+ * Mirror of hq-pro's `PlanLockReason`. Owner decision 7 (2026-09-17) fixes the
+ * locking set at these four: `deployments` and `storageBytes` are nag-only and
+ * never appear here. An unrecognised reason is dropped by `parsePlanLock`, so a
+ * server that adds a fifth dimension renders as the generic line rather than as
+ * a false claim about members.
+ */
+export declare const PLAN_LOCK_REASONS: readonly ["users", "integrations", "secrets", "agents"];
+export type PlanLockReason = (typeof PLAN_LOCK_REASONS)[number];
 /** Mirror of hq-pro's `PlanLock` wire shape (see src/billing/plan-lock.ts). */
 export interface PlanLock {
     locked: boolean;
     reasons: PlanLockReason[];
     upgradeUrl: string;
-    fixOptions: {
-        removeMembersTo: number;
-        disconnectIntegrations: boolean;
-    };
+    fixOptions: PlanLockFixOptions;
+}
+/**
+ * The remedies hq-pro ships with the lock. The two original fields are always
+ * present (defaulted when the server omits them) because shipped copy reads
+ * them unconditionally; every dimension added since is optional, so an older
+ * server simply leaves it absent and the renderer quotes the Starter cap.
+ */
+export interface PlanLockFixOptions {
+    removeMembersTo: number;
+    disconnectIntegrations: boolean;
+    removeSecretsTo?: number;
+    deprovisionAgentsTo?: number;
 }
 /** Optional member decoration for the notice ("7 of 5 members"). */
 export interface PlanLockMembers {
@@ -47,6 +64,10 @@ export interface PlanLockStatus {
 }
 /** Starter member cap quoted when the server did not send `removeMembersTo`. */
 export declare const STARTER_MEMBER_TARGET = 5;
+/** Starter secret cap quoted when the server did not send `removeSecretsTo`. */
+export declare const STARTER_SECRET_TARGET = 10;
+/** Starter agent cap quoted when the server did not send `deprovisionAgentsTo`. */
+export declare const STARTER_AGENT_TARGET = 0;
 /** Upgrade destination quoted when the server did not send one. */
 export declare const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
 /** The paid plan the lock wall sends owners to. Copy lives in ONE place. */
@@ -78,10 +99,17 @@ export declare function selectMemberUsage(body: unknown): PlanLockMembers | null
 export declare function fetchPlanLockStatus(token: string, companyRef: string, opts?: {
     timeoutMs?: number;
 }): Promise<PlanLockStatus | null>;
+/** Why the workspace locked, one clause per reason. */
+export declare function reasonLabel(reason: PlanLockReason): string;
 /**
  * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
- * against the cap, and the two fixes. Plain text — colour is applied by the
+ * against the cap, and the ways out. Plain text — colour is applied by the
  * caller so scripts capturing stdout get a clean block.
+ *
+ * Every line is derived from `lock.reasons`. A workspace locked on secrets is
+ * never told it has too many members, and an empty reason list (a server
+ * dimension this CLI does not know) renders a generic line rather than a claim
+ * about a dimension nobody measured.
  */
 export declare function renderPlanLockNotice(status: PlanLockStatus): string;
 /**

package/dist/lib/billing/plan-lock.js

@@ -2,8 +2,9 @@
  * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
  * of the workspace plan lock.
  *
- * Starter (free) workspaces are capped at 5 members and 0 integrations. Going
- * over locks the workspace immediately: it becomes read-only until the owner
+ * Starter (free) workspaces are capped on four locking dimensions — members,
+ * integrations, secrets and agents (owner decision 7, 2026-09-17; deployments
+ * and storage nag but never lock). Going over locks the workspace immediately: it becomes read-only until the owner
  * trims back under the caps or upgrades to HQ Workforce. The lock decision is
  * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
  * truth and ships the answer on `GET /membership/me` as a per-company
@@ -17,12 +18,35 @@
  */
 import chalk from "chalk";
 import { vaultApiFetch } from "../../utils/vault-api.js";
+/**
+ * Mirror of hq-pro's `PlanLockReason`. Owner decision 7 (2026-09-17) fixes the
+ * locking set at these four: `deployments` and `storageBytes` are nag-only and
+ * never appear here. An unrecognised reason is dropped by `parsePlanLock`, so a
+ * server that adds a fifth dimension renders as the generic line rather than as
+ * a false claim about members.
+ */
+export const PLAN_LOCK_REASONS = [
+    "users",
+    "integrations",
+    "secrets",
+    "agents",
+];
+function isPlanLockReason(value) {
+    return PLAN_LOCK_REASONS.includes(value);
+}
 /** Starter member cap quoted when the server did not send `removeMembersTo`. */
 export const STARTER_MEMBER_TARGET = 5;
+/** Starter secret cap quoted when the server did not send `removeSecretsTo`. */
+export const STARTER_SECRET_TARGET = 10;
+/** Starter agent cap quoted when the server did not send `deprovisionAgentsTo`. */
+export const STARTER_AGENT_TARGET = 0;
 /** Upgrade destination quoted when the server did not send one. */
 export const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
 /** The paid plan the lock wall sends owners to. Copy lives in ONE place. */
 export const WORKFORCE_PLAN_LABEL = "HQ Workforce ($500/mo)";
+function finiteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 function asRecord(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         return null;
@@ -43,25 +67,32 @@ export function parsePlanLock(value) {
     const reasons = [];
     if (Array.isArray(rec.reasons)) {
         for (const reason of rec.reasons) {
-            if (reason === "users" || reason === "integrations")
+            if (isPlanLockReason(reason))
                 reasons.push(reason);
         }
     }
     const fix = asRecord(rec.fixOptions);
-    const removeMembersTo = typeof fix?.removeMembersTo === "number" &&
-        Number.isFinite(fix.removeMembersTo)
-        ? fix.removeMembersTo
-        : STARTER_MEMBER_TARGET;
+    const removeMembersTo = finiteNumber(fix?.removeMembersTo) ?? STARTER_MEMBER_TARGET;
+    const removeSecretsTo = finiteNumber(fix?.removeSecretsTo);
+    const deprovisionAgentsTo = finiteNumber(fix?.deprovisionAgentsTo);
+    const fixOptions = {
+        removeMembersTo,
+        disconnectIntegrations: fix?.disconnectIntegrations === true,
+    };
+    // Absent stays absent: an omitted remedy target is UNKNOWN, and the renderer
+    // quotes the published Starter cap rather than inventing a server answer.
+    if (removeSecretsTo !== null)
+        fixOptions.removeSecretsTo = removeSecretsTo;
+    if (deprovisionAgentsTo !== null) {
+        fixOptions.deprovisionAgentsTo = deprovisionAgentsTo;
+    }
     return {
         locked: rec.locked,
         reasons,
         upgradeUrl: typeof rec.upgradeUrl === "string" && rec.upgradeUrl.trim().length > 0
             ? rec.upgradeUrl.trim()
             : DEFAULT_UPGRADE_URL,
-        fixOptions: {
-            removeMembersTo,
-            disconnectIntegrations: fix?.disconnectIntegrations === true,
-        },
+        fixOptions,
     };
 }
 /**
@@ -163,35 +194,98 @@ export async function fetchPlanLockStatus(token, companyRef, opts = {}) {
         checkedAt: new Date().toISOString(),
     };
 }
-function reasonLabel(reason) {
-    return reason === "users"
-        ? "too many members"
-        : "integrations are not included on Starter";
+/** Why the workspace locked, one clause per reason. */
+export function reasonLabel(reason) {
+    switch (reason) {
+        case "users":
+            return "too many members";
+        case "integrations":
+            return "integrations are not included on Starter";
+        case "secrets":
+            return "too many secrets";
+        case "agents":
+            return "agents are not included on Starter";
+    }
+}
+function secretTarget(lock) {
+    return lock.fixOptions.removeSecretsTo ?? STARTER_SECRET_TARGET;
+}
+function agentTarget(lock) {
+    return lock.fixOptions.deprovisionAgentsTo ?? STARTER_AGENT_TARGET;
+}
+/** The remedy sentence for one reason — what the owner does to clear it. */
+function reasonRemedy(reason, lock) {
+    switch (reason) {
+        case "users":
+            return `remove members until you are at ${lock.fixOptions.removeMembersTo} or fewer`;
+        case "integrations":
+            return "disconnect the workspace's integrations";
+        case "secrets":
+            return `delete secrets until you are at ${secretTarget(lock)} or fewer`;
+        case "agents": {
+            const target = agentTarget(lock);
+            return target > 0
+                ? `deprovision agents until you are at ${target} or fewer`
+                : "deprovision the workspace's agents";
+        }
+    }
+}
+/** The short per-reason clause used inside the one-line turn notice. */
+function reasonDetail(reason, status) {
+    const { lock, members } = status;
+    switch (reason) {
+        case "users": {
+            const target = lock.fixOptions.removeMembersTo;
+            return members
+                ? `${members.used} of ${target} members`
+                : `over its ${target}-member limit`;
+        }
+        case "integrations":
+            return "integrations are not included on Starter";
+        case "secrets":
+            return `over its ${secretTarget(status.lock)}-secret limit`;
+        case "agents":
+            return "agents are not included on Starter";
+    }
+}
+function capitalize(text) {
+    return text.charAt(0).toUpperCase() + text.slice(1);
 }
 /**
  * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
- * against the cap, and the two fixes. Plain text — colour is applied by the
+ * against the cap, and the ways out. Plain text — colour is applied by the
  * caller so scripts capturing stdout get a clean block.
+ *
+ * Every line is derived from `lock.reasons`. A workspace locked on secrets is
+ * never told it has too many members, and an empty reason list (a server
+ * dimension this CLI does not know) renders a generic line rather than a claim
+ * about a dimension nobody measured.
  */
 export function renderPlanLockNotice(status) {
     const { lock, members, companySlug } = status;
-    const target = lock.fixOptions.removeMembersTo;
     const lines = [];
     lines.push(`WORKSPACE LOCKED — ${companySlug} is over its Starter plan.`);
     const reasons = lock.reasons.length
         ? lock.reasons.map(reasonLabel).join("; ")
         : "over the Starter plan limits";
     lines.push(`  Why: ${reasons}.`);
-    if (members) {
-        lines.push(`  Members: ${members.used} of ${target}.`);
+    if (lock.reasons.includes("users")) {
+        const target = lock.fixOptions.removeMembersTo;
+        lines.push(members
+            ? `  Members: ${members.used} of ${target}.`
+            : `  Members allowed on Starter: ${target}.`);
+    }
+    if (lock.reasons.includes("secrets")) {
+        lines.push(`  Secrets allowed on Starter: ${secretTarget(lock)}.`);
     }
-    else {
-        lines.push(`  Members allowed on Starter: ${target}.`);
+    if (lock.reasons.includes("agents")) {
+        lines.push(`  Agents allowed on Starter: ${agentTarget(lock)}.`);
     }
     lines.push("  This workspace is read-only until it is fixed. Two ways out:");
-    lines.push(`    1. Remove members until you are at ${target} or fewer${lock.fixOptions.disconnectIntegrations
-        ? ", and disconnect the workspace's integrations"
-        : ""}.`);
+    const remedy = lock.reasons.length
+        ? lock.reasons.map((reason) => reasonRemedy(reason, lock)).join(", and ")
+        : "come back under the Starter plan limits";
+    lines.push(`    1. ${capitalize(remedy)}.`);
     lines.push(`    2. Upgrade to ${WORKFORCE_PLAN_LABEL}.`);
     lines.push(`  Upgrade: ${lock.upgradeUrl}`);
     return lines.join("\n");
@@ -201,11 +295,12 @@ export function renderPlanLockNotice(status) {
  * Kept to a single line on purpose — it repeats each turn.
  */
 export function renderPlanLockLine(status) {
-    const target = status.lock.fixOptions.removeMembersTo;
-    const count = status.members
-        ? `${status.members.used} of ${target} members`
-        : `over its ${target}-member limit`;
-    return (`Company ${status.companySlug} is locked on Starter (${count}). ` +
+    const detail = status.lock.reasons.length
+        ? status.lock.reasons
+            .map((reason) => reasonDetail(reason, status))
+            .join("; ")
+        : "over the Starter plan limits";
+    return (`Company ${status.companySlug} is locked on Starter (${detail}). ` +
         `Writes to HQ cloud will fail until fixed: ${status.lock.upgradeUrl}`);
 }
 /**

package/dist/lib/plan-limit-nag.d.ts

@@ -16,6 +16,14 @@
  * writes to stdout. Env off-switch: `HQ_NO_PLAN_LIMIT_NAG=1`.
  */
 export declare const PLAN_LIMIT_UPGRADE_URL = "https://hq.computer/billing/upgrade";
+/**
+ * Plain-English name for each plan-limit resource key, so a nag line says which
+ * dimension is tight rather than only the wire key. The key itself stays in the
+ * copy — hooks and support transcripts match on it — and the label is appended
+ * only when it differs. An unknown key (a resource this CLI predates) renders
+ * as the bare key rather than a guess.
+ */
+export declare const PLAN_LIMIT_DIMENSION_LABELS: Record<string, string>;
 export interface PlanLimitEntry {
     used: number;
     limit: number;

package/dist/lib/plan-limit-nag.js

@@ -21,6 +21,25 @@ import * as os from "node:os";
 import * as path from "node:path";
 export const PLAN_LIMIT_UPGRADE_URL = "https://hq.computer/billing/upgrade";
 const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Plain-English name for each plan-limit resource key, so a nag line says which
+ * dimension is tight rather than only the wire key. The key itself stays in the
+ * copy — hooks and support transcripts match on it — and the label is appended
+ * only when it differs. An unknown key (a resource this CLI predates) renders
+ * as the bare key rather than a guess.
+ */
+export const PLAN_LIMIT_DIMENSION_LABELS = {
+    users: "members",
+    integrations: "integrations",
+    secrets: "secrets",
+    agents: "agents",
+    deployments: "deployments",
+    storageBytes: "storage",
+};
+function dimensionSuffix(key) {
+    const label = PLAN_LIMIT_DIMENSION_LABELS[key];
+    return label && label !== key ? ` (${label})` : "";
+}
 /** Module-level last-seen cell — overwritten by each successful parse. */
 let lastSeen = null;
 /** Session dedupe for the ≥80% one-line warning. */
@@ -142,7 +161,7 @@ function formatPct(entry) {
     return `${Math.round((entry.used / entry.limit) * 100)}%`;
 }
 function formatEntryLine(key, entry) {
-    return `${key} at ${entry.used}/${entry.limit} (${formatPct(entry)})`;
+    return `${key} at ${entry.used}/${entry.limit} (${formatPct(entry)})${dimensionSuffix(key)}`;
 }
 function readShownAt(statePath) {
     try {
@@ -173,7 +192,7 @@ function withinDayWindow(shownAt, nowMs) {
 function buildOverBox(overEntries, upgradeUrl) {
     const title = "⚠ HQ plan limit exceeded";
     const upgrade = `Upgrade: ${upgradeUrl}`;
-    const resourceLines = overEntries.map(([key, entry]) => `  ${key}: ${entry.used}/${entry.limit}`);
+    const resourceLines = overEntries.map(([key, entry]) => `  ${key}: ${entry.used}/${entry.limit}${dimensionSuffix(key)}`);
     const contentLines = [title, "", ...resourceLines, "", upgrade];
     const innerWidth = Math.max(...contentLines.map((l) => l.length), 40);
     const top = `┌${"─".repeat(innerWidth + 2)}┐`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.117.3",
+  "version": "5.118.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {