@indigoai-us/hq-cli 5.119.9 → 5.119.10

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [5.119.10] — 2026-09-18
+
+### Added
+
+- `hq skill register` reserves a company skill UID from a proposal-lane
+  source and writes the server-stamped bytes only to `--stamped-output`.
+  It does not write `companies/<company>/skills/`, create a discovery
+  wrapper, or sync. `hq skill promote` copies those exact bytes into the
+  canonical skill path only after `--expected-sha256` matches and the
+  stamped `skill_uid` matches the server registration. A differing
+  canonical file requires `--reviewed-update`. Use `--no-sync` to leave
+  upload to a later steward command.
+
 ## [5.119.9] — 2026-09-17
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -1877,7 +1877,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly subcommands: readonly [];
 }, {
     readonly name: "skill";
-    readonly description: "Create company skills and discuss improvements";
+    readonly description: "Create, stage, promote, and discuss company skills";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly usage: "[options] [command]";
@@ -1914,6 +1914,59 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Refresh local skill discovery without registration or sync";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "register";
+        readonly description: "Register a company skill to a proposal-lane stamped file without writing the canonical tree";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <slug>";
+        readonly arguments: readonly [{
+            readonly name: "slug";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--source <path>";
+            readonly description: "Caller-authored SKILL.md (or its directory) to send to the server validator";
+        }, {
+            readonly flags: "--stamped-output <path>";
+            readonly description: "Write the complete server-stamped bytes here, outside companies/<company>/skills/";
+        }, {
+            readonly flags: "--no-canonical-write";
+            readonly description: "Refuse to write companies/<company>/skills/ (always the register behavior)";
+        }, {
+            readonly flags: "--no-surface";
+            readonly description: "Do not create a discovery wrapper (always the register behavior)";
+        }, {
+            readonly flags: "--no-sync";
+            readonly description: "Do not upload the skill file (always the register behavior)";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "promote";
+        readonly description: "Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <slug>";
+        readonly arguments: readonly [{
+            readonly name: "slug";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--from <path>";
+            readonly description: "Independently-cleared stamped SKILL.md (or its directory)";
+        }, {
+            readonly flags: "--expected-sha256 <hex>";
+            readonly description: "SHA-256 of the exact stamped file bytes that were cleared";
+        }, {
+            readonly flags: "--reviewed-update";
+            readonly description: "Replace an existing canonical SKILL.md whose bytes differ from the stamped file";
+        }, {
+            readonly flags: "--no-sync";
+            readonly description: "Promote locally without uploading the canonical file";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "propose";
         readonly description: "Post a comment-only improvement for a skill";

package/dist/command-catalog.generated.js

@@ -2403,7 +2403,7 @@ export const COMMAND_CATALOG = [
     },
     {
         "name": "skill",
-        "description": "Create company skills and discuss improvements",
+        "description": "Create, stage, promote, and discuss company skills",
         "aliases": [],
         "hidden": false,
         "usage": "[options] [command]",
@@ -2452,6 +2452,76 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "register",
+                "description": "Register a company skill to a proposal-lane stamped file without writing the canonical tree",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <slug>",
+                "arguments": [
+                    {
+                        "name": "slug",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--source <path>",
+                        "description": "Caller-authored SKILL.md (or its directory) to send to the server validator"
+                    },
+                    {
+                        "flags": "--stamped-output <path>",
+                        "description": "Write the complete server-stamped bytes here, outside companies/<company>/skills/"
+                    },
+                    {
+                        "flags": "--no-canonical-write",
+                        "description": "Refuse to write companies/<company>/skills/ (always the register behavior)"
+                    },
+                    {
+                        "flags": "--no-surface",
+                        "description": "Do not create a discovery wrapper (always the register behavior)"
+                    },
+                    {
+                        "flags": "--no-sync",
+                        "description": "Do not upload the skill file (always the register behavior)"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "promote",
+                "description": "Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <slug>",
+                "arguments": [
+                    {
+                        "name": "slug",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--from <path>",
+                        "description": "Independently-cleared stamped SKILL.md (or its directory)"
+                    },
+                    {
+                        "flags": "--expected-sha256 <hex>",
+                        "description": "SHA-256 of the exact stamped file bytes that were cleared"
+                    },
+                    {
+                        "flags": "--reviewed-update",
+                        "description": "Replace an existing canonical SKILL.md whose bytes differ from the stamped file"
+                    },
+                    {
+                        "flags": "--no-sync",
+                        "description": "Promote locally without uploading the canonical file"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "propose",
                 "description": "Post a comment-only improvement for a skill",

package/dist/commands/skill.d.ts

@@ -3,6 +3,11 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
  * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
@@ -39,7 +44,21 @@ export declare function makeSkillTemplate(input: {
     description?: string;
 }): string;
 /** Replace SKILL.md without exposing a partially-written identity to agents. */
-export declare function writeSkillFileAtomically(filePath: string, content: string): void;
+export declare function writeSkillFileAtomically(filePath: string, content: string | Buffer): void;
+export declare function sha256Hex(data: string | Buffer): string;
+export declare function skillVaultPath(skillSlug: string): string;
+export declare function isInsideCompanySkillsTree(hqRoot: string, candidatePath: string): boolean;
+export declare function resolveSkillMarkdownPath(target: string, cwd: string): string;
+export declare function assertStagedOutputPath(hqRoot: string, outputPath: string): string;
+export declare function assertSha256HexMatch(actualHex: string, expectedHex: string): void;
+export declare function assertRegisteredSkillResponse(registered: {
+    skillUid?: unknown;
+    content?: unknown;
+}): {
+    skillUid: string;
+    content: string;
+};
+export declare function normalizeLiveSkillVaultPath(rawPath: string): string;
 export declare function mapSkillError(status: number, body: Record<string, unknown>): string;
 /**
  * Type a failed skills-API response by its HTTP status so the top-level error

package/dist/commands/skill.js

@@ -3,6 +3,11 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
  * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
@@ -11,6 +16,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createHash, timingSafeEqual } from "node:crypto";
 import chalk from "chalk";
 import yaml from "js-yaml";
 import { share } from "@indigoai-us/hq-cloud";
@@ -25,6 +31,7 @@ export const SKILL_UID_PATTERN = /^skl_[A-Za-z0-9]+$/;
 export const SKILL_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
 async function defaultSyncFile(input) {
     const result = await share({
         paths: [input.filePath],
@@ -185,11 +192,19 @@ export function writeSkillFileAtomically(filePath, content) {
         : 0o644;
     const tempPath = path.join(dir, `.SKILL.md.${process.pid}.${Date.now()}.tmp`);
     try {
-        fs.writeFileSync(tempPath, content, {
-            encoding: "utf8",
-            flag: "wx",
-            mode: existingMode,
-        });
+        if (typeof content === "string") {
+            fs.writeFileSync(tempPath, content, {
+                encoding: "utf8",
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
+        else {
+            fs.writeFileSync(tempPath, content, {
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
         fs.renameSync(tempPath, filePath);
     }
     finally {
@@ -197,6 +212,69 @@ export function writeSkillFileAtomically(filePath, content) {
             fs.rmSync(tempPath, { force: true });
     }
 }
+export function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+export function skillVaultPath(skillSlug) {
+    return `skills/${skillSlug}/SKILL.md`;
+}
+export function isInsideCompanySkillsTree(hqRoot, candidatePath) {
+    const companiesRoot = path.resolve(hqRoot, "companies");
+    const resolved = path.resolve(candidatePath);
+    const rel = path.relative(companiesRoot, resolved);
+    if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel))
+        return false;
+    const parts = rel.split(path.sep);
+    return parts.length >= 2 && parts[1] === "skills";
+}
+export function resolveSkillMarkdownPath(target, cwd) {
+    let filePath = path.resolve(cwd, target);
+    if (fs.existsSync(filePath) && fs.statSync(filePath).isDirectory()) {
+        filePath = path.join(filePath, "SKILL.md");
+    }
+    return filePath;
+}
+export function assertStagedOutputPath(hqRoot, outputPath) {
+    const resolved = path.resolve(outputPath);
+    if (isInsideCompanySkillsTree(hqRoot, resolved)) {
+        throw localSkillError(`Stamped output '${resolved}' is inside companies/<company>/skills/. Pass a proposal-lane path outside the canonical skill tree.`);
+    }
+    return resolved;
+}
+export function assertSha256HexMatch(actualHex, expectedHex) {
+    const want = expectedHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(want)) {
+        throw localSkillError("--expected-sha256 must be a 64-character hex SHA-256 digest.");
+    }
+    const got = actualHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(got)) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+    if (!timingSafeEqual(Buffer.from(got, "hex"), Buffer.from(want, "hex"))) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+}
+export function assertRegisteredSkillResponse(registered) {
+    if (typeof registered.skillUid !== "string" ||
+        !SKILL_UID_PATTERN.test(registered.skillUid) ||
+        typeof registered.content !== "string" ||
+        parseSkillUid(registered.content) !== registered.skillUid) {
+        throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
+    }
+    return { skillUid: registered.skillUid, content: registered.content };
+}
+function skillRecordPath(record) {
+    for (const value of [record?.vaultPath, record?.sourcePath, record?.path]) {
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+export function normalizeLiveSkillVaultPath(rawPath) {
+    const normalized = rawPath.replace(/\\/g, "/").replace(/^\/+/, "").replace(/\/+$/, "");
+    const match = normalized.match(/(?:^|\/)skills\/([a-z0-9][a-z0-9-]*)(?:\/SKILL\.md)?$/);
+    return match ? skillVaultPath(match[1]) : normalized;
+}
 export function mapSkillError(status, body) {
     const server = (typeof body.error === "string" && body.error) ||
         (typeof body.message === "string" && body.message) ||
@@ -360,7 +438,7 @@ export function registerSkillCommand(program, deps = {}) {
     const resolveCompanyUid = deps.resolveCompanyUid ?? getCompanyUid;
     const skill = program
         .command("skill")
-        .description("Create company skills and discuss improvements")
+        .description("Create, stage, promote, and discuss company skills")
         .option("--company <slug>", "Company slug (defaults to the active company)")
         .option("--hq-root <path>", "Local HQ root", hqRoot);
     skill
@@ -420,7 +498,7 @@ export function registerSkillCommand(program, deps = {}) {
             path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
             method: "POST",
             body: {
-                path: `skills/${slug}/SKILL.md`,
+                path: skillVaultPath(slug),
                 content: localContent,
             },
         });
@@ -430,13 +508,8 @@ export function registerSkillCommand(program, deps = {}) {
                 machineIdentity: isMachineIdentity(),
             });
         }
-        const registered = (await response.json());
-        if (typeof registered.skillUid !== "string" ||
-            !SKILL_UID_PATTERN.test(registered.skillUid) ||
-            typeof registered.content !== "string" ||
-            parseSkillUid(registered.content) !== registered.skillUid) {
-            throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
-        }
+        const payload = (await response.json());
+        const registered = assertRegisteredSkillResponse(payload);
         writeSkillFileAtomically(filePath, registered.content);
         let discoveryStatus = null;
         try {
@@ -506,11 +579,173 @@ export function registerSkillCommand(program, deps = {}) {
         console.log(chalk.green(`Skill ready: ${registered.skillUid}`));
         console.log(`  File:     ${filePath}`);
         console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
-        console.log(registered.accessPolicy === "open"
+        console.log(payload.accessPolicy === "open"
             ? `  Access:   Open — every active ${companySlug} member can edit`
             : "  Access:   preserved existing policy");
         console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
     });
+    skill
+        .command("register <slug>")
+        .description("Register a company skill to a proposal-lane stamped file without writing the canonical tree")
+        .requiredOption("--source <path>", "Caller-authored SKILL.md (or its directory) to send to the server validator")
+        .requiredOption("--stamped-output <path>", "Write the complete server-stamped bytes here, outside companies/<company>/skills/")
+        .option("--no-canonical-write", "Refuse to write companies/<company>/skills/ (always the register behavior)")
+        .option("--no-surface", "Do not create a discovery wrapper (always the register behavior)")
+        .option("--no-sync", "Do not upload the skill file (always the register behavior)")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const sourcePath = resolveSkillMarkdownPath(opts.source, cwd());
+        if (!fs.existsSync(sourcePath) || !fs.statSync(sourcePath).isFile()) {
+            throw localSkillError(`No SKILL.md found at '${opts.source}'. Pass --source <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedOutputPath = assertStagedOutputPath(resolvedRoot, path.resolve(cwd(), opts.stampedOutput));
+        const localContent = fs.readFileSync(sourcePath, "utf8");
+        const sourceHash = sha256Hex(localContent);
+        const token = await ensureToken();
+        const response = await apiFetch({
+            token,
+            path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
+            method: "POST",
+            body: {
+                path: skillVaultPath(slug),
+                content: localContent,
+            },
+        });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw skillApiError(response.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const registered = assertRegisteredSkillResponse((await response.json()));
+        writeSkillFileAtomically(stampedOutputPath, registered.content);
+        const stampedHash = sha256Hex(registered.content);
+        console.log(chalk.green(`Skill registered (staged): ${registered.skillUid}`));
+        console.log(`  Source:          ${sourcePath}`);
+        console.log(`  Source SHA-256:  ${sourceHash}`);
+        console.log(`  Stamped output:  ${stampedOutputPath}`);
+        console.log(`  Stamped SHA-256: ${stampedHash}`);
+        console.log("  Canonical write: not requested");
+        console.log("  Discovery:       not requested");
+        console.log("  Sync:            not requested");
+    });
+    skill
+        .command("promote <slug>")
+        .description("Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks")
+        .requiredOption("--from <path>", "Independently-cleared stamped SKILL.md (or its directory)")
+        .requiredOption("--expected-sha256 <hex>", "SHA-256 of the exact stamped file bytes that were cleared")
+        .option("--reviewed-update", "Replace an existing canonical SKILL.md whose bytes differ from the stamped file")
+        .option("--no-sync", "Promote locally without uploading the canonical file")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        const canonicalPath = canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const fromPath = resolveSkillMarkdownPath(opts.from, cwd());
+        if (!fs.existsSync(fromPath) || !fs.statSync(fromPath).isFile()) {
+            throw localSkillError(`No stamped SKILL.md found at '${opts.from}'. Pass --from <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedBytes = fs.readFileSync(fromPath);
+        assertSha256HexMatch(sha256Hex(stampedBytes), opts.expectedSha256);
+        const stampedContent = stampedBytes.toString("utf8");
+        const skillUid = parseSkillUid(stampedContent);
+        if (!skillUid) {
+            throw localSkillError(`The stamped SKILL.md at '${fromPath}' has no registered skill_uid. Canonical skill was not written.`);
+        }
+        const token = await ensureToken();
+        const companyUid = await resolveCompanyUid(token, companySlug);
+        const detail = await apiFetch({
+            token,
+            path: `/v1/skills/${encodeURIComponent(companyUid)}/${encodeURIComponent(skillUid)}`,
+            method: "GET",
+        });
+        if (!detail.ok) {
+            const body = (await detail.json().catch(() => ({})));
+            throw skillApiError(detail.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const { skill: record } = (await detail.json());
+        if (typeof record?.skillUid === "string" &&
+            record.skillUid !== skillUid) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} does not match the server registration. Canonical skill was not written.`);
+        }
+        const recordPath = skillRecordPath(record);
+        if (recordPath &&
+            normalizeLiveSkillVaultPath(recordPath) !== skillVaultPath(slug)) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} is registered at '${recordPath}', not '${skillVaultPath(slug)}'. Canonical skill was not written.`);
+        }
+        if (fs.existsSync(canonicalPath) && !fs.statSync(canonicalPath).isFile()) {
+            throw localSkillError(`Expected a SKILL.md file at '${canonicalPath}'.`);
+        }
+        const existing = fs.existsSync(canonicalPath)
+            ? fs.readFileSync(canonicalPath)
+            : null;
+        if (existing && !existing.equals(stampedBytes)) {
+            if (opts.reviewedUpdate !== true) {
+                throw localSkillError(`Canonical skill '${canonicalPath}' already exists and differs from the stamped file. Re-run with --reviewed-update after that exact change is cleared.`);
+            }
+        }
+        if (!existing || !existing.equals(stampedBytes)) {
+            writeSkillFileAtomically(canonicalPath, stampedBytes);
+        }
+        const legacyPrefix = readCompanyPrefix(resolvedRoot, companySlug);
+        let discoveryStatus = null;
+        try {
+            discoveryStatus = surfaceSkillFn({
+                hqRoot: resolvedRoot,
+                companySlug,
+                skillSlug: slug,
+                ...(legacyPrefix ? { legacyPrefix } : {}),
+            }).status;
+        }
+        catch (err) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery failed: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        if (discoveryStatus !== null && discoveryStatus !== 0) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery exited ${discoveryStatus}. Run 'hq skill --company ${companySlug} create ${slug} --surface-only' to retry without another registration request.`));
+        }
+        if (opts.sync !== false) {
+            let syncResult;
+            try {
+                syncResult = await syncFile({
+                    filePath: canonicalPath,
+                    companySlug,
+                    hqRoot: resolvedRoot,
+                    token,
+                });
+            }
+            catch (err) {
+                console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync failed.`));
+                if (err && typeof err === "object") {
+                    const diagnostics = vaultAccessDeniedDiagnostics(err, {
+                        companySlug,
+                        objectKey: skillVaultPath(slug),
+                    });
+                    if (diagnostics)
+                        stampVaultAccessDenied(err, diagnostics);
+                }
+                throw err;
+            }
+            if (syncResult.aborted) {
+                throw localSkillError(`Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync aborted because the remote file conflicts.`);
+            }
+        }
+        console.log(chalk.green(`Skill promoted: ${skillUid}`));
+        console.log(`  File:     ${canonicalPath}`);
+        console.log(`  SHA-256:  ${sha256Hex(stampedBytes)}`);
+        console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
+        console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
+    });
     skill
         .command("propose <target>")
         .description("Post a comment-only improvement for a skill")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.119.9",
+  "version": "5.119.10",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {