@indigoai-us/hq-cli 5.119.8 → 5.119.10

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## [Unreleased]
 
+## [5.119.10] — 2026-09-18
+
+### Added
+
+- `hq skill register` reserves a company skill UID from a proposal-lane
+  source and writes the server-stamped bytes only to `--stamped-output`.
+  It does not write `companies/<company>/skills/`, create a discovery
+  wrapper, or sync. `hq skill promote` copies those exact bytes into the
+  canonical skill path only after `--expected-sha256` matches and the
+  stamped `skill_uid` matches the server registration. A differing
+  canonical file requires `--reviewed-update`. Use `--no-sync` to leave
+  upload to a later steward command.
+
+## [5.119.9] — 2026-09-17
+
+### Added
+
+- The CLI now prints a one-time notice when your workspace crosses a plan
+  threshold — reaching 80% of a Starter limit, or going past one. The server
+  decides when a threshold has been crossed and sends it with the response, so
+  a session you already have open surfaces the notice on its next API call
+  rather than on its next launch. Each `{resource}:{band}` is printed exactly
+  once per episode, remembered in `~/.hq/plan-limit-nag.json`; a dimension that
+  drops back under the threshold and climbs again is announced again.
+  `HQ_NO_PLAN_LIMIT_NAG=1` silences it along with the other plan-limit lines.
+
+### Fixed
+
+- A file attached to a DM is now visible to a bot reading its mail. `hq dm
+  inbox`, `hq dm thread`, `hq dm channel` and `hq agent inbox` print each
+  attached file's name, type and vault path under the message body; the JSON
+  forms carry an `attachments[]` field. Previously only the body text was
+  rendered, so an agent sent a screenshot answered "no image came through".
+
 ## [5.119.8] — 2026-09-17
 
 ### Fixed
@@ -44,6 +78,15 @@
   on Starter: 1", and tells you to "disconnect integrations until you are at 1
   or fewer"; the per-turn line reads "over its 1-integration limit". Nothing in
   the CLI says Starter has no integrations any more.
+- Plan-limit messages now say what is actually happening. Going over a Starter
+  limit never stopped the workspace, and the copy no longer implies it did:
+  the words "locked" and "read-only" are gone from every line `hq` prints, and
+  the notice states the two things that do pause — adding new files and adding
+  new secrets — while everything else keeps working. A test scans every
+  rendered string for both words so the copy cannot drift back.
+- The over-limit per-turn nag is one line instead of a box, and it repeats at
+  most once every 6 hours (was once a day). `HQ_NO_PLAN_LIMIT_NAG=1` still
+  silences it.
 
 ## [5.119.4] — 2026-09-17
 

package/dist/command-catalog.generated.d.ts

@@ -1877,7 +1877,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly subcommands: readonly [];
 }, {
     readonly name: "skill";
-    readonly description: "Create company skills and discuss improvements";
+    readonly description: "Create, stage, promote, and discuss company skills";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly usage: "[options] [command]";
@@ -1914,6 +1914,59 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Refresh local skill discovery without registration or sync";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "register";
+        readonly description: "Register a company skill to a proposal-lane stamped file without writing the canonical tree";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <slug>";
+        readonly arguments: readonly [{
+            readonly name: "slug";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--source <path>";
+            readonly description: "Caller-authored SKILL.md (or its directory) to send to the server validator";
+        }, {
+            readonly flags: "--stamped-output <path>";
+            readonly description: "Write the complete server-stamped bytes here, outside companies/<company>/skills/";
+        }, {
+            readonly flags: "--no-canonical-write";
+            readonly description: "Refuse to write companies/<company>/skills/ (always the register behavior)";
+        }, {
+            readonly flags: "--no-surface";
+            readonly description: "Do not create a discovery wrapper (always the register behavior)";
+        }, {
+            readonly flags: "--no-sync";
+            readonly description: "Do not upload the skill file (always the register behavior)";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "promote";
+        readonly description: "Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <slug>";
+        readonly arguments: readonly [{
+            readonly name: "slug";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--from <path>";
+            readonly description: "Independently-cleared stamped SKILL.md (or its directory)";
+        }, {
+            readonly flags: "--expected-sha256 <hex>";
+            readonly description: "SHA-256 of the exact stamped file bytes that were cleared";
+        }, {
+            readonly flags: "--reviewed-update";
+            readonly description: "Replace an existing canonical SKILL.md whose bytes differ from the stamped file";
+        }, {
+            readonly flags: "--no-sync";
+            readonly description: "Promote locally without uploading the canonical file";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "propose";
         readonly description: "Post a comment-only improvement for a skill";

package/dist/command-catalog.generated.js

@@ -2403,7 +2403,7 @@ export const COMMAND_CATALOG = [
     },
     {
         "name": "skill",
-        "description": "Create company skills and discuss improvements",
+        "description": "Create, stage, promote, and discuss company skills",
         "aliases": [],
         "hidden": false,
         "usage": "[options] [command]",
@@ -2452,6 +2452,76 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "register",
+                "description": "Register a company skill to a proposal-lane stamped file without writing the canonical tree",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <slug>",
+                "arguments": [
+                    {
+                        "name": "slug",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--source <path>",
+                        "description": "Caller-authored SKILL.md (or its directory) to send to the server validator"
+                    },
+                    {
+                        "flags": "--stamped-output <path>",
+                        "description": "Write the complete server-stamped bytes here, outside companies/<company>/skills/"
+                    },
+                    {
+                        "flags": "--no-canonical-write",
+                        "description": "Refuse to write companies/<company>/skills/ (always the register behavior)"
+                    },
+                    {
+                        "flags": "--no-surface",
+                        "description": "Do not create a discovery wrapper (always the register behavior)"
+                    },
+                    {
+                        "flags": "--no-sync",
+                        "description": "Do not upload the skill file (always the register behavior)"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "promote",
+                "description": "Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <slug>",
+                "arguments": [
+                    {
+                        "name": "slug",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--from <path>",
+                        "description": "Independently-cleared stamped SKILL.md (or its directory)"
+                    },
+                    {
+                        "flags": "--expected-sha256 <hex>",
+                        "description": "SHA-256 of the exact stamped file bytes that were cleared"
+                    },
+                    {
+                        "flags": "--reviewed-update",
+                        "description": "Replace an existing canonical SKILL.md whose bytes differ from the stamped file"
+                    },
+                    {
+                        "flags": "--no-sync",
+                        "description": "Promote locally without uploading the canonical file"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "propose",
                 "description": "Post a comment-only improvement for a skill",

package/dist/commands/agent-inbox.js

@@ -52,6 +52,12 @@ export function registerAgentInboxCommand(agent) {
             console.log(`${chalk.bold(r.id)}${state}  ${r.channel ?? "?"}  from ${r.from}${r.fromUid ? ` <${r.fromUid}>` : ""}  ${r.at ?? ""}`);
             if (r.text)
                 console.log(`  ${r.text.replace(/\n/g, "\n  ")}`);
+            for (const f of r.attachments ?? []) {
+                const label = f.name ?? f.vaultPath.split("/").pop() ?? "file";
+                const type = f.contentType ? ` (${f.contentType})` : "";
+                console.log(`  ${chalk.dim("[file]")} ${label}${type}`);
+                console.log(`    ${chalk.dim(`vault: ${f.vaultPath}`)}`);
+            }
         }
         if (!opts.all)
             console.log(chalk.dim(`\nReply with hq dm <uid> "…", then: hq agent inbox done <id>`));

package/dist/commands/dm.d.ts

@@ -201,6 +201,9 @@ export interface DmInboxEvent {
     details?: string;
     prompt?: string;
     acknowledgedAt?: string;
+    /** US-007 file references. Singular `attachment` is the legacy form. */
+    attachments?: DmAttachment[];
+    attachment?: DmAttachment;
 }
 /** One message in a 1:1 thread as returned by GET /v1/notify/thread. */
 export interface DmThreadMessage {
@@ -213,6 +216,8 @@ export interface DmThreadMessage {
     direction: "in" | "out";
     details?: string;
     prompt?: string;
+    attachments?: DmAttachment[];
+    attachment?: DmAttachment;
 }
 /** One channel/group message from GET /v1/notify/channels/{id}/messages. */
 export interface ChannelMessageItem {
@@ -223,7 +228,33 @@ export interface ChannelMessageItem {
     fromDisplayName?: string;
     body: string;
     createdAt: string;
+    attachments?: DmAttachment[];
+    attachment?: DmAttachment;
 }
+/**
+ * One file attached to a DM (US-007 `attachments[]` on the read endpoints). The
+ * server returns a vault path, not bytes: a reader fetches it with
+ * a presigned read of that key.
+ */
+export interface DmAttachment {
+    vaultPath: string;
+    name?: string;
+    sizeBytes?: number;
+    contentType?: string;
+    kind?: string;
+    companyUid?: string;
+}
+/**
+ * Render the attachment lines for one message. An agent reading its DMs through
+ * the CLI only ever sees this text, so the vault path AND the command that
+ * fetches it both have to be on screen — a bare "[image]" marker is why a bot
+ * answers "no image came through". Returns "" when there is nothing attached.
+ * Pure → unit-testable.
+ */
+export declare function formatAttachments(m: {
+    attachments?: DmAttachment[];
+    attachment?: DmAttachment;
+}, indent?: string): string;
 /**
  * Human label for a message sender — display name, else email, else uid. Pure →
  * unit-testable.

package/dist/commands/dm.js

@@ -693,6 +693,27 @@ async function runDmRequests() {
         process.exit(1);
     }
 }
+/**
+ * Render the attachment lines for one message. An agent reading its DMs through
+ * the CLI only ever sees this text, so the vault path AND the command that
+ * fetches it both have to be on screen — a bare "[image]" marker is why a bot
+ * answers "no image came through". Returns "" when there is nothing attached.
+ * Pure → unit-testable.
+ */
+export function formatAttachments(m, indent = "    ") {
+    const files = (m.attachments?.length ? m.attachments : m.attachment ? [m.attachment] : [])
+        .filter((f) => Boolean(f?.vaultPath));
+    if (files.length === 0)
+        return "";
+    return files
+        .map((f) => {
+        const label = f.name?.trim() || f.vaultPath.split("/").pop() || "file";
+        const type = f.contentType ? ` ${chalk.dim(f.contentType)}` : "";
+        const company = f.companyUid ? chalk.dim(` company=${f.companyUid}`) : "";
+        return `\n${indent}${chalk.dim("[file]")} ${label}${type}\n${indent}   ${chalk.dim(`vault: ${f.vaultPath}`)}${company}`;
+    })
+        .join("");
+}
 /**
  * Human label for a message sender — display name, else email, else uid. Pure →
  * unit-testable.
@@ -773,20 +794,20 @@ export function formatInboxEvent(e, nowMs) {
     const when = chalk.dim(formatRelativeTime(e.createdAt, nowMs));
     const who = chalk.bold(senderLabel(e));
     const email = e.fromEmail && e.fromDisplayName ? chalk.dim(` <${e.fromEmail}>`) : "";
-    return `${marker} ${when}  ${who}${email}\n    ${firstLine(e.body)}`;
+    return `${marker} ${when}  ${who}${email}\n    ${firstLine(e.body)}${formatAttachments(e)}`;
 }
 /** Render one 1:1 thread line, tagged by direction. */
 export function formatThreadMessage(m, nowMs) {
     const arrow = m.direction === "out" ? chalk.dim("→") : chalk.cyan("←");
     const who = m.direction === "out" ? "you" : senderLabel(m);
     const when = chalk.dim(formatRelativeTime(m.createdAt, nowMs));
-    return `${arrow} ${chalk.bold(who)} ${when}\n    ${firstLine(m.body)}`;
+    return `${arrow} ${chalk.bold(who)} ${when}\n    ${firstLine(m.body)}${formatAttachments(m)}`;
 }
 /** Render one channel/group message line. */
 export function formatChannelMessage(m, nowMs) {
     const who = chalk.bold(senderLabel(m));
     const when = chalk.dim(formatRelativeTime(m.createdAt, nowMs));
-    return `${who} ${when}\n    ${firstLine(m.body)}`;
+    return `${who} ${when}\n    ${firstLine(m.body)}${formatAttachments(m)}`;
 }
 /** POST /v1/notify/inbox/ack — idempotently mark messages read. */
 async function ackEvents(token, eventIds) {

package/dist/commands/skill.d.ts

@@ -3,6 +3,11 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
  * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
@@ -39,7 +44,21 @@ export declare function makeSkillTemplate(input: {
     description?: string;
 }): string;
 /** Replace SKILL.md without exposing a partially-written identity to agents. */
-export declare function writeSkillFileAtomically(filePath: string, content: string): void;
+export declare function writeSkillFileAtomically(filePath: string, content: string | Buffer): void;
+export declare function sha256Hex(data: string | Buffer): string;
+export declare function skillVaultPath(skillSlug: string): string;
+export declare function isInsideCompanySkillsTree(hqRoot: string, candidatePath: string): boolean;
+export declare function resolveSkillMarkdownPath(target: string, cwd: string): string;
+export declare function assertStagedOutputPath(hqRoot: string, outputPath: string): string;
+export declare function assertSha256HexMatch(actualHex: string, expectedHex: string): void;
+export declare function assertRegisteredSkillResponse(registered: {
+    skillUid?: unknown;
+    content?: unknown;
+}): {
+    skillUid: string;
+    content: string;
+};
+export declare function normalizeLiveSkillVaultPath(rawPath: string): string;
 export declare function mapSkillError(status: number, body: Record<string, unknown>): string;
 /**
  * Type a failed skills-API response by its HTTP status so the top-level error