@indigoai-us/hq-cli 5.118.0 → 5.118.2

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 ## [Unreleased]
 
+## [5.118.2] — 2026-09-17
+
+### Changed
+
+- The locked-workspace notice now says what you can still do. A locked
+  workspace is read-only for new things, but deleting still works — which
+  matters, because every fix the notice lists (remove members, disconnect
+  integrations, delete secrets, deprovision agents) is a delete. The notice
+  states that outright instead of leaving "read-only" to be guessed at.
+
+- The plan-limit box names the plan: "HQ Starter plan limit exceeded" rather
+  than "HQ plan limit exceeded".
+
+### Added
+
+- `hq agents provision --model` now sets the brain model during creation. A
+  model such as `gpt-5.5` or `grok-4.6` selects the agents-v2 runtime unless
+  `--provider` is specified, avoiding a later box recreation to change brains.
+
+## [5.118.1] — 2026-09-17
+
+### Fixed
+
+- The locked-workspace notice now names the real reason. A workspace locked
+  because of secrets or agents no longer reads "over its 5-member limit"; each
+  reason gets its own explanation, its own Starter cap and its own fix, and a
+  lock with no recognised reason says only that the workspace is over the
+  Starter limits. The plan-limit warning also names the dimension it is quoting
+  ("users at 9/10 (90%) (members)").
+
+- You can now remove an HQ Agents v2 agent from the CLI without bypassing its
+  safety check. `hq agents rm` accepts `--confirm-destroy-agents-v2
+  <instance-id>` alongside `--yes` and sends only the instance ID you name; HQ
+  still refuses an ID that does not match the live box.
+
 ## [5.118.0] — 2026-09-16
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -3812,7 +3812,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Agent slug (defaults to a slug of <name>)";
         }, {
             readonly flags: "--provider <provider>";
-            readonly description: "Runtime: codex | grok | claude | agents-v2 (default codex). claude is subscription-only; agents-v2 boots its brain box (codex, or grok via a grok-* model) and receives the v2 runtime post-boot";
+            readonly description: "Runtime: agents-v2 (recommended) | codex | grok | claude (legacy). A --model selects agents-v2 by default";
+        }, {
+            readonly flags: "--model <model>";
+            readonly description: "Brain model, for example gpt-5.5 or grok-4.6";
         }, {
             readonly flags: "--auth-mode <mode>";
             readonly description: "Auth: subscription | apiKey (default subscription)";
@@ -4023,6 +4026,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--yes";
             readonly description: "Confirm the irreversible teardown (required)";
+        }, {
+            readonly flags: "--confirm-destroy-agents-v2 <instance-id>";
+            readonly description: "Confirm agents-v2 teardown by naming the live EC2 instance ID";
         }];
         readonly subcommands: readonly [];
     }, {

package/dist/command-catalog.generated.js

@@ -4926,7 +4926,11 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--provider <provider>",
-                        "description": "Runtime: codex | grok | claude | agents-v2 (default codex). claude is subscription-only; agents-v2 boots its brain box (codex, or grok via a grok-* model) and receives the v2 runtime post-boot"
+                        "description": "Runtime: agents-v2 (recommended) | codex | grok | claude (legacy). A --model selects agents-v2 by default"
+                    },
+                    {
+                        "flags": "--model <model>",
+                        "description": "Brain model, for example gpt-5.5 or grok-4.6"
                     },
                     {
                         "flags": "--auth-mode <mode>",
@@ -5205,6 +5209,10 @@ export const COMMAND_CATALOG = [
                     {
                         "flags": "--yes",
                         "description": "Confirm the irreversible teardown (required)"
+                    },
+                    {
+                        "flags": "--confirm-destroy-agents-v2 <instance-id>",
+                        "description": "Confirm agents-v2 teardown by naming the live EC2 instance ID"
                     }
                 ],
                 "subcommands": []

package/dist/commands/agents.d.ts

@@ -171,6 +171,7 @@ export interface ProvisionAgentInput {
     slug: string;
     codexAuthMode: "subscription" | "apiKey";
     provider?: "codex" | "grok" | "claude" | "agents-v2";
+    codexModel?: string;
     codexApiKey?: string;
     idempotencyKey: string;
     title?: string;
@@ -258,7 +259,7 @@ export type AgentTerminalResponse = ({
 };
 export declare function openAgentTerminal(token: string, agentUid: string, body: Record<string, unknown>): Promise<AgentTerminalResponse>;
 export declare function retryAgent(token: string, agentUid: string): Promise<Record<string, unknown>>;
-export declare function deprovisionAgent(token: string, agentUid: string): Promise<{
+export declare function deprovisionAgent(token: string, agentUid: string, confirmDestroyAgentsV2?: string): Promise<{
     uid: string;
     setupState?: string;
     terminal?: boolean;

package/dist/commands/agents.js

@@ -564,11 +564,14 @@ export async function retryAgent(token, agentUid) {
         method: "POST",
     });
 }
-export async function deprovisionAgent(token, agentUid) {
+export async function deprovisionAgent(token, agentUid, confirmDestroyAgentsV2) {
     return agentsRequest({
         token,
         path: `/v1/agents/${encodeURIComponent(agentUid)}`,
         method: "DELETE",
+        body: confirmDestroyAgentsV2 === undefined
+            ? undefined
+            : { confirmDestroyAgentsV2 },
     });
 }
 export async function listAgentJobs(token, agentUid) {
@@ -1071,7 +1074,8 @@ export function registerAgentsCommand(program) {
         .description("Provision a new cloud agent (company-specific monthly price shown before creation)")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--slug <slug>", "Agent slug (defaults to a slug of <name>)")
-        .option("--provider <provider>", "Runtime: codex | grok | claude | agents-v2 (default codex). claude is subscription-only; agents-v2 boots its brain box (codex, or grok via a grok-* model) and receives the v2 runtime post-boot")
+        .option("--provider <provider>", "Runtime: agents-v2 (recommended) | codex | grok | claude (legacy). A --model selects agents-v2 by default")
+        .option("--model <model>", "Brain model, for example gpt-5.5 or grok-4.6")
         .option("--auth-mode <mode>", "Auth: subscription | apiKey (default subscription)", "subscription")
         .option("--api-key-env <VAR>", "Env var holding the API key for --auth-mode apiKey (never pass the key as a flag)")
         .option("--title <title>", "Org-chart job title")
@@ -1085,7 +1089,13 @@ export function registerAgentsCommand(program) {
             // unrecognised value, silently provisioning a billable box the operator
             // did not ask for. They now exit(1) instead — see parseEnumOption.
             const authMode = parseEnumOption(opts.authMode, VALID_AUTH_MODES, "--auth-mode") ?? "subscription";
-            const provider = parseEnumOption(opts.provider, VALID_PROVIDERS, "--provider");
+            const explicitProvider = parseEnumOption(opts.provider, VALID_PROVIDERS, "--provider");
+            if (opts.model !== undefined &&
+                !/^[A-Za-z0-9._-]{1,64}$/.test(opts.model)) {
+                console.error(chalk.red("--model must be a model identifier (letters, digits, dot, dash, underscore; max 64 chars)."));
+                process.exit(1);
+            }
+            const provider = explicitProvider ?? (opts.model ? "agents-v2" : undefined);
             // claude is subscription-only on hq-pro (rejectIncompatibleProviderAuthMode
             // returns AGENT_PROVIDER_INCOMPATIBLE_WITH_AUTH_MODE). Catch it here so the
             // operator gets a direct message instead of a 400 from the control plane
@@ -1136,6 +1146,7 @@ export function registerAgentsCommand(program) {
                     slug,
                     codexAuthMode: authMode,
                     ...(provider ? { provider } : {}),
+                    ...(opts.model ? { codexModel: opts.model } : {}),
                     ...(codexApiKey ? { codexApiKey } : {}),
                     idempotencyKey,
                     ...(opts.title ? { title: opts.title } : {}),
@@ -1477,6 +1488,7 @@ export function registerAgentsCommand(program) {
         .description("Deprovision (permanently tear down) an agent")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--yes", "Confirm the irreversible teardown (required)")
+        .option("--confirm-destroy-agents-v2 <instance-id>", "Confirm agents-v2 teardown by naming the live EC2 instance ID")
         .action(async function (agentUid, opts) {
         if (!opts.yes) {
             console.error(chalk.yellow(`This will permanently deprovision agent ${agentUid} and tear down its ` +
@@ -1486,7 +1498,7 @@ export function registerAgentsCommand(program) {
         }
         try {
             const token = (await resolveVaultCredential()).token;
-            const result = await deprovisionAgent(token, agentUid);
+            const result = await deprovisionAgent(token, agentUid, opts.confirmDestroyAgentsV2);
             if (result.terminal === false) {
                 console.log(chalk.yellow(`Deprovision in progress for agent ${agentUid} (not yet fully torn down — re-run to continue).`));
             }

package/dist/lib/billing/plan-lock.d.ts

@@ -2,8 +2,9 @@
  * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
  * of the workspace plan lock.
  *
- * Starter (free) workspaces are capped at 5 members and 0 integrations. Going
- * over locks the workspace immediately: it becomes read-only until the owner
+ * Starter (free) workspaces are capped on four locking dimensions — members,
+ * integrations, secrets and agents (owner decision 7, 2026-09-17; deployments
+ * and storage nag but never lock). Going over locks the workspace immediately: it becomes read-only until the owner
  * trims back under the caps or upgrades to HQ Workforce. The lock decision is
  * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
  * truth and ships the answer on `GET /membership/me` as a per-company
@@ -15,17 +16,33 @@
  * nothing here ever infers a lock (or an unlock) from missing data
  * (hq-absent-field-never-means-constraining-value).
  */
-/** Mirror of hq-pro's `PlanLockReason`. */
-export type PlanLockReason = "users" | "integrations";
+/**
+ * Mirror of hq-pro's `PlanLockReason`. Owner decision 7 (2026-09-17) fixes the
+ * locking set at these four: `deployments` and `storageBytes` are nag-only and
+ * never appear here. An unrecognised reason is dropped by `parsePlanLock`, so a
+ * server that adds a fifth dimension renders as the generic line rather than as
+ * a false claim about members.
+ */
+export declare const PLAN_LOCK_REASONS: readonly ["users", "integrations", "secrets", "agents"];
+export type PlanLockReason = (typeof PLAN_LOCK_REASONS)[number];
 /** Mirror of hq-pro's `PlanLock` wire shape (see src/billing/plan-lock.ts). */
 export interface PlanLock {
     locked: boolean;
     reasons: PlanLockReason[];
     upgradeUrl: string;
-    fixOptions: {
-        removeMembersTo: number;
-        disconnectIntegrations: boolean;
-    };
+    fixOptions: PlanLockFixOptions;
+}
+/**
+ * The remedies hq-pro ships with the lock. The two original fields are always
+ * present (defaulted when the server omits them) because shipped copy reads
+ * them unconditionally; every dimension added since is optional, so an older
+ * server simply leaves it absent and the renderer quotes the Starter cap.
+ */
+export interface PlanLockFixOptions {
+    removeMembersTo: number;
+    disconnectIntegrations: boolean;
+    removeSecretsTo?: number;
+    deprovisionAgentsTo?: number;
 }
 /** Optional member decoration for the notice ("7 of 5 members"). */
 export interface PlanLockMembers {
@@ -47,6 +64,10 @@ export interface PlanLockStatus {
 }
 /** Starter member cap quoted when the server did not send `removeMembersTo`. */
 export declare const STARTER_MEMBER_TARGET = 5;
+/** Starter secret cap quoted when the server did not send `removeSecretsTo`. */
+export declare const STARTER_SECRET_TARGET = 10;
+/** Starter agent cap quoted when the server did not send `deprovisionAgentsTo`. */
+export declare const STARTER_AGENT_TARGET = 0;
 /** Upgrade destination quoted when the server did not send one. */
 export declare const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
 /** The paid plan the lock wall sends owners to. Copy lives in ONE place. */
@@ -78,10 +99,17 @@ export declare function selectMemberUsage(body: unknown): PlanLockMembers | null
 export declare function fetchPlanLockStatus(token: string, companyRef: string, opts?: {
     timeoutMs?: number;
 }): Promise<PlanLockStatus | null>;
+/** Why the workspace locked, one clause per reason. */
+export declare function reasonLabel(reason: PlanLockReason): string;
 /**
  * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
- * against the cap, and the two fixes. Plain text — colour is applied by the
+ * against the cap, and the ways out. Plain text — colour is applied by the
  * caller so scripts capturing stdout get a clean block.
+ *
+ * Every line is derived from `lock.reasons`. A workspace locked on secrets is
+ * never told it has too many members, and an empty reason list (a server
+ * dimension this CLI does not know) renders a generic line rather than a claim
+ * about a dimension nobody measured.
  */
 export declare function renderPlanLockNotice(status: PlanLockStatus): string;
 /**

package/dist/lib/billing/plan-lock.js

@@ -2,8 +2,9 @@
  * `plan-lock` (starter-plan-hard-limits / US-011) — the CLI-side read + render
  * of the workspace plan lock.
  *
- * Starter (free) workspaces are capped at 5 members and 0 integrations. Going
- * over locks the workspace immediately: it becomes read-only until the owner
+ * Starter (free) workspaces are capped on four locking dimensions — members,
+ * integrations, secrets and agents (owner decision 7, 2026-09-17; deployments
+ * and storage nag but never lock). Going over locks the workspace immediately: it becomes read-only until the owner
  * trims back under the caps or upgrades to HQ Workforce. The lock decision is
  * NOT made here — hq-pro's `src/billing/plan-lock.ts` is the single source of
  * truth and ships the answer on `GET /membership/me` as a per-company
@@ -17,12 +18,35 @@
  */
 import chalk from "chalk";
 import { vaultApiFetch } from "../../utils/vault-api.js";
+/**
+ * Mirror of hq-pro's `PlanLockReason`. Owner decision 7 (2026-09-17) fixes the
+ * locking set at these four: `deployments` and `storageBytes` are nag-only and
+ * never appear here. An unrecognised reason is dropped by `parsePlanLock`, so a
+ * server that adds a fifth dimension renders as the generic line rather than as
+ * a false claim about members.
+ */
+export const PLAN_LOCK_REASONS = [
+    "users",
+    "integrations",
+    "secrets",
+    "agents",
+];
+function isPlanLockReason(value) {
+    return PLAN_LOCK_REASONS.includes(value);
+}
 /** Starter member cap quoted when the server did not send `removeMembersTo`. */
 export const STARTER_MEMBER_TARGET = 5;
+/** Starter secret cap quoted when the server did not send `removeSecretsTo`. */
+export const STARTER_SECRET_TARGET = 10;
+/** Starter agent cap quoted when the server did not send `deprovisionAgentsTo`. */
+export const STARTER_AGENT_TARGET = 0;
 /** Upgrade destination quoted when the server did not send one. */
 export const DEFAULT_UPGRADE_URL = "https://hq.computer/billing";
 /** The paid plan the lock wall sends owners to. Copy lives in ONE place. */
 export const WORKFORCE_PLAN_LABEL = "HQ Workforce ($500/mo)";
+function finiteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 function asRecord(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         return null;
@@ -43,25 +67,32 @@ export function parsePlanLock(value) {
     const reasons = [];
     if (Array.isArray(rec.reasons)) {
         for (const reason of rec.reasons) {
-            if (reason === "users" || reason === "integrations")
+            if (isPlanLockReason(reason))
                 reasons.push(reason);
         }
     }
     const fix = asRecord(rec.fixOptions);
-    const removeMembersTo = typeof fix?.removeMembersTo === "number" &&
-        Number.isFinite(fix.removeMembersTo)
-        ? fix.removeMembersTo
-        : STARTER_MEMBER_TARGET;
+    const removeMembersTo = finiteNumber(fix?.removeMembersTo) ?? STARTER_MEMBER_TARGET;
+    const removeSecretsTo = finiteNumber(fix?.removeSecretsTo);
+    const deprovisionAgentsTo = finiteNumber(fix?.deprovisionAgentsTo);
+    const fixOptions = {
+        removeMembersTo,
+        disconnectIntegrations: fix?.disconnectIntegrations === true,
+    };
+    // Absent stays absent: an omitted remedy target is UNKNOWN, and the renderer
+    // quotes the published Starter cap rather than inventing a server answer.
+    if (removeSecretsTo !== null)
+        fixOptions.removeSecretsTo = removeSecretsTo;
+    if (deprovisionAgentsTo !== null) {
+        fixOptions.deprovisionAgentsTo = deprovisionAgentsTo;
+    }
     return {
         locked: rec.locked,
         reasons,
         upgradeUrl: typeof rec.upgradeUrl === "string" && rec.upgradeUrl.trim().length > 0
             ? rec.upgradeUrl.trim()
             : DEFAULT_UPGRADE_URL,
-        fixOptions: {
-            removeMembersTo,
-            disconnectIntegrations: fix?.disconnectIntegrations === true,
-        },
+        fixOptions,
     };
 }
 /**
@@ -163,35 +194,100 @@ export async function fetchPlanLockStatus(token, companyRef, opts = {}) {
         checkedAt: new Date().toISOString(),
     };
 }
-function reasonLabel(reason) {
-    return reason === "users"
-        ? "too many members"
-        : "integrations are not included on Starter";
+/** Why the workspace locked, one clause per reason. */
+export function reasonLabel(reason) {
+    switch (reason) {
+        case "users":
+            return "too many members";
+        case "integrations":
+            return "integrations are not included on Starter";
+        case "secrets":
+            return "too many secrets";
+        case "agents":
+            return "agents are not included on Starter";
+    }
+}
+function secretTarget(lock) {
+    return lock.fixOptions.removeSecretsTo ?? STARTER_SECRET_TARGET;
+}
+function agentTarget(lock) {
+    return lock.fixOptions.deprovisionAgentsTo ?? STARTER_AGENT_TARGET;
+}
+/** The remedy sentence for one reason — what the owner does to clear it. */
+function reasonRemedy(reason, lock) {
+    switch (reason) {
+        case "users":
+            return `remove members until you are at ${lock.fixOptions.removeMembersTo} or fewer`;
+        case "integrations":
+            return "disconnect the workspace's integrations";
+        case "secrets":
+            return `delete secrets until you are at ${secretTarget(lock)} or fewer`;
+        case "agents": {
+            const target = agentTarget(lock);
+            return target > 0
+                ? `deprovision agents until you are at ${target} or fewer`
+                : "deprovision the workspace's agents";
+        }
+    }
+}
+/** The short per-reason clause used inside the one-line turn notice. */
+function reasonDetail(reason, status) {
+    const { lock, members } = status;
+    switch (reason) {
+        case "users": {
+            const target = lock.fixOptions.removeMembersTo;
+            return members
+                ? `${members.used} of ${target} members`
+                : `over its ${target}-member limit`;
+        }
+        case "integrations":
+            return "integrations are not included on Starter";
+        case "secrets":
+            return `over its ${secretTarget(status.lock)}-secret limit`;
+        case "agents":
+            return "agents are not included on Starter";
+    }
+}
+function capitalize(text) {
+    return text.charAt(0).toUpperCase() + text.slice(1);
 }
 /**
  * The full WORKSPACE LOCKED block: why it locked, where the workspace stands
- * against the cap, and the two fixes. Plain text — colour is applied by the
+ * against the cap, and the ways out. Plain text — colour is applied by the
  * caller so scripts capturing stdout get a clean block.
+ *
+ * Every line is derived from `lock.reasons`. A workspace locked on secrets is
+ * never told it has too many members, and an empty reason list (a server
+ * dimension this CLI does not know) renders a generic line rather than a claim
+ * about a dimension nobody measured.
  */
 export function renderPlanLockNotice(status) {
     const { lock, members, companySlug } = status;
-    const target = lock.fixOptions.removeMembersTo;
     const lines = [];
     lines.push(`WORKSPACE LOCKED — ${companySlug} is over its Starter plan.`);
     const reasons = lock.reasons.length
         ? lock.reasons.map(reasonLabel).join("; ")
         : "over the Starter plan limits";
     lines.push(`  Why: ${reasons}.`);
-    if (members) {
-        lines.push(`  Members: ${members.used} of ${target}.`);
+    if (lock.reasons.includes("users")) {
+        const target = lock.fixOptions.removeMembersTo;
+        lines.push(members
+            ? `  Members: ${members.used} of ${target}.`
+            : `  Members allowed on Starter: ${target}.`);
+    }
+    if (lock.reasons.includes("secrets")) {
+        lines.push(`  Secrets allowed on Starter: ${secretTarget(lock)}.`);
     }
-    else {
-        lines.push(`  Members allowed on Starter: ${target}.`);
+    if (lock.reasons.includes("agents")) {
+        lines.push(`  Agents allowed on Starter: ${agentTarget(lock)}.`);
     }
-    lines.push("  This workspace is read-only until it is fixed. Two ways out:");
-    lines.push(`    1. Remove members until you are at ${target} or fewer${lock.fixOptions.disconnectIntegrations
-        ? ", and disconnect the workspace's integrations"
-        : ""}.`);
+    lines.push("  Nothing has been deleted. This workspace is read-only until it is fixed:");
+    lines.push("  you can still delete things, but you cannot create, invite or upload.");
+    lines.push("  Two ways to fix it:");
+    const remedy = lock.reasons.length
+        ? lock.reasons.map((reason) => reasonRemedy(reason, lock)).join(", and ")
+        : "come back under the Starter plan limits";
+    lines.push(`    1. ${capitalize(remedy)}.`);
     lines.push(`    2. Upgrade to ${WORKFORCE_PLAN_LABEL}.`);
     lines.push(`  Upgrade: ${lock.upgradeUrl}`);
     return lines.join("\n");
@@ -201,11 +297,12 @@ export function renderPlanLockNotice(status) {
  * Kept to a single line on purpose — it repeats each turn.
  */
 export function renderPlanLockLine(status) {
-    const target = status.lock.fixOptions.removeMembersTo;
-    const count = status.members
-        ? `${status.members.used} of ${target} members`
-        : `over its ${target}-member limit`;
-    return (`Company ${status.companySlug} is locked on Starter (${count}). ` +
+    const detail = status.lock.reasons.length
+        ? status.lock.reasons
+            .map((reason) => reasonDetail(reason, status))
+            .join("; ")
+        : "over the Starter plan limits";
+    return (`Company ${status.companySlug} is locked on Starter (${detail}). ` +
         `Writes to HQ cloud will fail until fixed: ${status.lock.upgradeUrl}`);
 }
 /**

package/dist/lib/plan-limit-nag.d.ts

@@ -16,6 +16,14 @@
  * writes to stdout. Env off-switch: `HQ_NO_PLAN_LIMIT_NAG=1`.
  */
 export declare const PLAN_LIMIT_UPGRADE_URL = "https://hq.computer/billing/upgrade";
+/**
+ * Plain-English name for each plan-limit resource key, so a nag line says which
+ * dimension is tight rather than only the wire key. The key itself stays in the
+ * copy — hooks and support transcripts match on it — and the label is appended
+ * only when it differs. An unknown key (a resource this CLI predates) renders
+ * as the bare key rather than a guess.
+ */
+export declare const PLAN_LIMIT_DIMENSION_LABELS: Record<string, string>;
 export interface PlanLimitEntry {
     used: number;
     limit: number;

package/dist/lib/plan-limit-nag.js

@@ -21,6 +21,25 @@ import * as os from "node:os";
 import * as path from "node:path";
 export const PLAN_LIMIT_UPGRADE_URL = "https://hq.computer/billing/upgrade";
 const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Plain-English name for each plan-limit resource key, so a nag line says which
+ * dimension is tight rather than only the wire key. The key itself stays in the
+ * copy — hooks and support transcripts match on it — and the label is appended
+ * only when it differs. An unknown key (a resource this CLI predates) renders
+ * as the bare key rather than a guess.
+ */
+export const PLAN_LIMIT_DIMENSION_LABELS = {
+    users: "members",
+    integrations: "integrations",
+    secrets: "secrets",
+    agents: "agents",
+    deployments: "deployments",
+    storageBytes: "storage",
+};
+function dimensionSuffix(key) {
+    const label = PLAN_LIMIT_DIMENSION_LABELS[key];
+    return label && label !== key ? ` (${label})` : "";
+}
 /** Module-level last-seen cell — overwritten by each successful parse. */
 let lastSeen = null;
 /** Session dedupe for the ≥80% one-line warning. */
@@ -142,7 +161,7 @@ function formatPct(entry) {
     return `${Math.round((entry.used / entry.limit) * 100)}%`;
 }
 function formatEntryLine(key, entry) {
-    return `${key} at ${entry.used}/${entry.limit} (${formatPct(entry)})`;
+    return `${key} at ${entry.used}/${entry.limit} (${formatPct(entry)})${dimensionSuffix(key)}`;
 }
 function readShownAt(statePath) {
     try {
@@ -171,9 +190,9 @@ function withinDayWindow(shownAt, nowMs) {
     return nowMs - shownAt < DAY_MS;
 }
 function buildOverBox(overEntries, upgradeUrl) {
-    const title = "⚠ HQ plan limit exceeded";
+    const title = "⚠ HQ Starter plan limit exceeded";
     const upgrade = `Upgrade: ${upgradeUrl}`;
-    const resourceLines = overEntries.map(([key, entry]) => `  ${key}: ${entry.used}/${entry.limit}`);
+    const resourceLines = overEntries.map(([key, entry]) => `  ${key}: ${entry.used}/${entry.limit}${dimensionSuffix(key)}`);
     const contentLines = [title, "", ...resourceLines, "", upgrade];
     const innerWidth = Math.max(...contentLines.map((l) => l.length), 40);
     const top = `┌${"─".repeat(innerWidth + 2)}┐`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.118.0",
+  "version": "5.118.2",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {