@indigoai-us/hq-cli 5.119.9 → 5.119.11

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+## [5.119.11] — 2026-09-18
+
+### Added
+
+- On a personal account, My Telemetry is part of the paid Individual plan
+  ($50/mo). When the server withholds it, the CLI now prints a short notice
+  naming the plan and where to upgrade, instead of the raw refusal. Company
+  plans are unaffected, and the notice has nothing to do with the plan-limit
+  nags — it is a plan fact, printed once, where it happened.
+
+### Fixed
+
+- `hq files … --company prs_<person-uid>` now reaches that person's vault
+  instead of failing with "Company slug ... was not found". This is how a DM
+  recipient reads a file attached to a message: the attachment lives in the
+  sender's personal vault, so naming the sender is the only scope that works.
+
+## [5.119.10] — 2026-09-18
+
+### Added
+
+- `hq skill register` reserves a company skill UID from a proposal-lane
+  source and writes the server-stamped bytes only to `--stamped-output`.
+  It does not write `companies/<company>/skills/`, create a discovery
+  wrapper, or sync. `hq skill promote` copies those exact bytes into the
+  canonical skill path only after `--expected-sha256` matches and the
+  stamped `skill_uid` matches the server registration. A differing
+  canonical file requires `--reviewed-update`. Use `--no-sync` to leave
+  upload to a later steward command.
+
 ## [5.119.9] — 2026-09-17
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -1877,7 +1877,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly subcommands: readonly [];
 }, {
     readonly name: "skill";
-    readonly description: "Create company skills and discuss improvements";
+    readonly description: "Create, stage, promote, and discuss company skills";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly usage: "[options] [command]";
@@ -1914,6 +1914,59 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Refresh local skill discovery without registration or sync";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "register";
+        readonly description: "Register a company skill to a proposal-lane stamped file without writing the canonical tree";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <slug>";
+        readonly arguments: readonly [{
+            readonly name: "slug";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--source <path>";
+            readonly description: "Caller-authored SKILL.md (or its directory) to send to the server validator";
+        }, {
+            readonly flags: "--stamped-output <path>";
+            readonly description: "Write the complete server-stamped bytes here, outside companies/<company>/skills/";
+        }, {
+            readonly flags: "--no-canonical-write";
+            readonly description: "Refuse to write companies/<company>/skills/ (always the register behavior)";
+        }, {
+            readonly flags: "--no-surface";
+            readonly description: "Do not create a discovery wrapper (always the register behavior)";
+        }, {
+            readonly flags: "--no-sync";
+            readonly description: "Do not upload the skill file (always the register behavior)";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "promote";
+        readonly description: "Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <slug>";
+        readonly arguments: readonly [{
+            readonly name: "slug";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--from <path>";
+            readonly description: "Independently-cleared stamped SKILL.md (or its directory)";
+        }, {
+            readonly flags: "--expected-sha256 <hex>";
+            readonly description: "SHA-256 of the exact stamped file bytes that were cleared";
+        }, {
+            readonly flags: "--reviewed-update";
+            readonly description: "Replace an existing canonical SKILL.md whose bytes differ from the stamped file";
+        }, {
+            readonly flags: "--no-sync";
+            readonly description: "Promote locally without uploading the canonical file";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "propose";
         readonly description: "Post a comment-only improvement for a skill";

package/dist/command-catalog.generated.js

@@ -2403,7 +2403,7 @@ export const COMMAND_CATALOG = [
     },
     {
         "name": "skill",
-        "description": "Create company skills and discuss improvements",
+        "description": "Create, stage, promote, and discuss company skills",
         "aliases": [],
         "hidden": false,
         "usage": "[options] [command]",
@@ -2452,6 +2452,76 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "register",
+                "description": "Register a company skill to a proposal-lane stamped file without writing the canonical tree",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <slug>",
+                "arguments": [
+                    {
+                        "name": "slug",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--source <path>",
+                        "description": "Caller-authored SKILL.md (or its directory) to send to the server validator"
+                    },
+                    {
+                        "flags": "--stamped-output <path>",
+                        "description": "Write the complete server-stamped bytes here, outside companies/<company>/skills/"
+                    },
+                    {
+                        "flags": "--no-canonical-write",
+                        "description": "Refuse to write companies/<company>/skills/ (always the register behavior)"
+                    },
+                    {
+                        "flags": "--no-surface",
+                        "description": "Do not create a discovery wrapper (always the register behavior)"
+                    },
+                    {
+                        "flags": "--no-sync",
+                        "description": "Do not upload the skill file (always the register behavior)"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "promote",
+                "description": "Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <slug>",
+                "arguments": [
+                    {
+                        "name": "slug",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--from <path>",
+                        "description": "Independently-cleared stamped SKILL.md (or its directory)"
+                    },
+                    {
+                        "flags": "--expected-sha256 <hex>",
+                        "description": "SHA-256 of the exact stamped file bytes that were cleared"
+                    },
+                    {
+                        "flags": "--reviewed-update",
+                        "description": "Replace an existing canonical SKILL.md whose bytes differ from the stamped file"
+                    },
+                    {
+                        "flags": "--no-sync",
+                        "description": "Promote locally without uploading the canonical file"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "propose",
                 "description": "Post a comment-only improvement for a skill",

package/dist/commands/skill.d.ts

@@ -3,6 +3,11 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
  * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
@@ -39,7 +44,21 @@ export declare function makeSkillTemplate(input: {
     description?: string;
 }): string;
 /** Replace SKILL.md without exposing a partially-written identity to agents. */
-export declare function writeSkillFileAtomically(filePath: string, content: string): void;
+export declare function writeSkillFileAtomically(filePath: string, content: string | Buffer): void;
+export declare function sha256Hex(data: string | Buffer): string;
+export declare function skillVaultPath(skillSlug: string): string;
+export declare function isInsideCompanySkillsTree(hqRoot: string, candidatePath: string): boolean;
+export declare function resolveSkillMarkdownPath(target: string, cwd: string): string;
+export declare function assertStagedOutputPath(hqRoot: string, outputPath: string): string;
+export declare function assertSha256HexMatch(actualHex: string, expectedHex: string): void;
+export declare function assertRegisteredSkillResponse(registered: {
+    skillUid?: unknown;
+    content?: unknown;
+}): {
+    skillUid: string;
+    content: string;
+};
+export declare function normalizeLiveSkillVaultPath(rawPath: string): string;
 export declare function mapSkillError(status: number, body: Record<string, unknown>): string;
 /**
  * Type a failed skills-API response by its HTTP status so the top-level error

package/dist/commands/skill.js

@@ -3,6 +3,11 @@
  *
  * `hq skill create <slug>` registers a canonical company skill, stamps its
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
+ * `hq skill register <slug>` reserves that UID from a proposal-lane source and
+ * writes server-stamped bytes only to `--stamped-output` — never under
+ * `companies/<company>/skills/`, and never as a discovery wrapper or sync.
+ * `hq skill promote <slug>` copies independently-cleared stamped bytes into the
+ * canonical tree only after the expected SHA-256 and registered skill_uid match.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
  * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
@@ -11,6 +16,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createHash, timingSafeEqual } from "node:crypto";
 import chalk from "chalk";
 import yaml from "js-yaml";
 import { share } from "@indigoai-us/hq-cloud";
@@ -25,6 +31,7 @@ export const SKILL_UID_PATTERN = /^skl_[A-Za-z0-9]+$/;
 export const SKILL_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
 async function defaultSyncFile(input) {
     const result = await share({
         paths: [input.filePath],
@@ -185,11 +192,19 @@ export function writeSkillFileAtomically(filePath, content) {
         : 0o644;
     const tempPath = path.join(dir, `.SKILL.md.${process.pid}.${Date.now()}.tmp`);
     try {
-        fs.writeFileSync(tempPath, content, {
-            encoding: "utf8",
-            flag: "wx",
-            mode: existingMode,
-        });
+        if (typeof content === "string") {
+            fs.writeFileSync(tempPath, content, {
+                encoding: "utf8",
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
+        else {
+            fs.writeFileSync(tempPath, content, {
+                flag: "wx",
+                mode: existingMode,
+            });
+        }
         fs.renameSync(tempPath, filePath);
     }
     finally {
@@ -197,6 +212,69 @@ export function writeSkillFileAtomically(filePath, content) {
             fs.rmSync(tempPath, { force: true });
     }
 }
+export function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+export function skillVaultPath(skillSlug) {
+    return `skills/${skillSlug}/SKILL.md`;
+}
+export function isInsideCompanySkillsTree(hqRoot, candidatePath) {
+    const companiesRoot = path.resolve(hqRoot, "companies");
+    const resolved = path.resolve(candidatePath);
+    const rel = path.relative(companiesRoot, resolved);
+    if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel))
+        return false;
+    const parts = rel.split(path.sep);
+    return parts.length >= 2 && parts[1] === "skills";
+}
+export function resolveSkillMarkdownPath(target, cwd) {
+    let filePath = path.resolve(cwd, target);
+    if (fs.existsSync(filePath) && fs.statSync(filePath).isDirectory()) {
+        filePath = path.join(filePath, "SKILL.md");
+    }
+    return filePath;
+}
+export function assertStagedOutputPath(hqRoot, outputPath) {
+    const resolved = path.resolve(outputPath);
+    if (isInsideCompanySkillsTree(hqRoot, resolved)) {
+        throw localSkillError(`Stamped output '${resolved}' is inside companies/<company>/skills/. Pass a proposal-lane path outside the canonical skill tree.`);
+    }
+    return resolved;
+}
+export function assertSha256HexMatch(actualHex, expectedHex) {
+    const want = expectedHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(want)) {
+        throw localSkillError("--expected-sha256 must be a 64-character hex SHA-256 digest.");
+    }
+    const got = actualHex.trim().toLowerCase();
+    if (!SHA256_HEX_PATTERN.test(got)) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+    if (!timingSafeEqual(Buffer.from(got, "hex"), Buffer.from(want, "hex"))) {
+        throw localSkillError(`Stamped file SHA-256 ${got} does not match --expected-sha256. Canonical skill was not written.`);
+    }
+}
+export function assertRegisteredSkillResponse(registered) {
+    if (typeof registered.skillUid !== "string" ||
+        !SKILL_UID_PATTERN.test(registered.skillUid) ||
+        typeof registered.content !== "string" ||
+        parseSkillUid(registered.content) !== registered.skillUid) {
+        throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
+    }
+    return { skillUid: registered.skillUid, content: registered.content };
+}
+function skillRecordPath(record) {
+    for (const value of [record?.vaultPath, record?.sourcePath, record?.path]) {
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+export function normalizeLiveSkillVaultPath(rawPath) {
+    const normalized = rawPath.replace(/\\/g, "/").replace(/^\/+/, "").replace(/\/+$/, "");
+    const match = normalized.match(/(?:^|\/)skills\/([a-z0-9][a-z0-9-]*)(?:\/SKILL\.md)?$/);
+    return match ? skillVaultPath(match[1]) : normalized;
+}
 export function mapSkillError(status, body) {
     const server = (typeof body.error === "string" && body.error) ||
         (typeof body.message === "string" && body.message) ||
@@ -360,7 +438,7 @@ export function registerSkillCommand(program, deps = {}) {
     const resolveCompanyUid = deps.resolveCompanyUid ?? getCompanyUid;
     const skill = program
         .command("skill")
-        .description("Create company skills and discuss improvements")
+        .description("Create, stage, promote, and discuss company skills")
         .option("--company <slug>", "Company slug (defaults to the active company)")
         .option("--hq-root <path>", "Local HQ root", hqRoot);
     skill
@@ -420,7 +498,7 @@ export function registerSkillCommand(program, deps = {}) {
             path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
             method: "POST",
             body: {
-                path: `skills/${slug}/SKILL.md`,
+                path: skillVaultPath(slug),
                 content: localContent,
             },
         });
@@ -430,13 +508,8 @@ export function registerSkillCommand(program, deps = {}) {
                 machineIdentity: isMachineIdentity(),
             });
         }
-        const registered = (await response.json());
-        if (typeof registered.skillUid !== "string" ||
-            !SKILL_UID_PATTERN.test(registered.skillUid) ||
-            typeof registered.content !== "string" ||
-            parseSkillUid(registered.content) !== registered.skillUid) {
-            throw new Error("The server returned an invalid skill registration response; the local file was not changed.");
-        }
+        const payload = (await response.json());
+        const registered = assertRegisteredSkillResponse(payload);
         writeSkillFileAtomically(filePath, registered.content);
         let discoveryStatus = null;
         try {
@@ -506,11 +579,173 @@ export function registerSkillCommand(program, deps = {}) {
         console.log(chalk.green(`Skill ready: ${registered.skillUid}`));
         console.log(`  File:     ${filePath}`);
         console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
-        console.log(registered.accessPolicy === "open"
+        console.log(payload.accessPolicy === "open"
             ? `  Access:   Open — every active ${companySlug} member can edit`
             : "  Access:   preserved existing policy");
         console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
     });
+    skill
+        .command("register <slug>")
+        .description("Register a company skill to a proposal-lane stamped file without writing the canonical tree")
+        .requiredOption("--source <path>", "Caller-authored SKILL.md (or its directory) to send to the server validator")
+        .requiredOption("--stamped-output <path>", "Write the complete server-stamped bytes here, outside companies/<company>/skills/")
+        .option("--no-canonical-write", "Refuse to write companies/<company>/skills/ (always the register behavior)")
+        .option("--no-surface", "Do not create a discovery wrapper (always the register behavior)")
+        .option("--no-sync", "Do not upload the skill file (always the register behavior)")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const sourcePath = resolveSkillMarkdownPath(opts.source, cwd());
+        if (!fs.existsSync(sourcePath) || !fs.statSync(sourcePath).isFile()) {
+            throw localSkillError(`No SKILL.md found at '${opts.source}'. Pass --source <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedOutputPath = assertStagedOutputPath(resolvedRoot, path.resolve(cwd(), opts.stampedOutput));
+        const localContent = fs.readFileSync(sourcePath, "utf8");
+        const sourceHash = sha256Hex(localContent);
+        const token = await ensureToken();
+        const response = await apiFetch({
+            token,
+            path: `/v1/files/skills/company/${encodeURIComponent(companySlug)}/register`,
+            method: "POST",
+            body: {
+                path: skillVaultPath(slug),
+                content: localContent,
+            },
+        });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw skillApiError(response.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const registered = assertRegisteredSkillResponse((await response.json()));
+        writeSkillFileAtomically(stampedOutputPath, registered.content);
+        const stampedHash = sha256Hex(registered.content);
+        console.log(chalk.green(`Skill registered (staged): ${registered.skillUid}`));
+        console.log(`  Source:          ${sourcePath}`);
+        console.log(`  Source SHA-256:  ${sourceHash}`);
+        console.log(`  Stamped output:  ${stampedOutputPath}`);
+        console.log(`  Stamped SHA-256: ${stampedHash}`);
+        console.log("  Canonical write: not requested");
+        console.log("  Discovery:       not requested");
+        console.log("  Sync:            not requested");
+    });
+    skill
+        .command("promote <slug>")
+        .description("Copy independently-cleared stamped bytes into the canonical skill path after SHA-256 and skill_uid checks")
+        .requiredOption("--from <path>", "Independently-cleared stamped SKILL.md (or its directory)")
+        .requiredOption("--expected-sha256 <hex>", "SHA-256 of the exact stamped file bytes that were cleared")
+        .option("--reviewed-update", "Replace an existing canonical SKILL.md whose bytes differ from the stamped file")
+        .option("--no-sync", "Promote locally without uploading the canonical file")
+        .action(async (slug, opts) => {
+        if (!SKILL_SLUG_PATTERN.test(slug)) {
+            throw localSkillError("Skill slug must start with a lowercase letter or number and contain only lowercase letters, numbers, and hyphens.");
+        }
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        const canonicalPath = canonicalCompanySkillPath(resolvedRoot, companySlug, slug);
+        const fromPath = resolveSkillMarkdownPath(opts.from, cwd());
+        if (!fs.existsSync(fromPath) || !fs.statSync(fromPath).isFile()) {
+            throw localSkillError(`No stamped SKILL.md found at '${opts.from}'. Pass --from <file> or a directory that contains SKILL.md.`);
+        }
+        const stampedBytes = fs.readFileSync(fromPath);
+        assertSha256HexMatch(sha256Hex(stampedBytes), opts.expectedSha256);
+        const stampedContent = stampedBytes.toString("utf8");
+        const skillUid = parseSkillUid(stampedContent);
+        if (!skillUid) {
+            throw localSkillError(`The stamped SKILL.md at '${fromPath}' has no registered skill_uid. Canonical skill was not written.`);
+        }
+        const token = await ensureToken();
+        const companyUid = await resolveCompanyUid(token, companySlug);
+        const detail = await apiFetch({
+            token,
+            path: `/v1/skills/${encodeURIComponent(companyUid)}/${encodeURIComponent(skillUid)}`,
+            method: "GET",
+        });
+        if (!detail.ok) {
+            const body = (await detail.json().catch(() => ({})));
+            throw skillApiError(detail.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const { skill: record } = (await detail.json());
+        if (typeof record?.skillUid === "string" &&
+            record.skillUid !== skillUid) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} does not match the server registration. Canonical skill was not written.`);
+        }
+        const recordPath = skillRecordPath(record);
+        if (recordPath &&
+            normalizeLiveSkillVaultPath(recordPath) !== skillVaultPath(slug)) {
+            throw localSkillError(`Stamped skill_uid ${skillUid} is registered at '${recordPath}', not '${skillVaultPath(slug)}'. Canonical skill was not written.`);
+        }
+        if (fs.existsSync(canonicalPath) && !fs.statSync(canonicalPath).isFile()) {
+            throw localSkillError(`Expected a SKILL.md file at '${canonicalPath}'.`);
+        }
+        const existing = fs.existsSync(canonicalPath)
+            ? fs.readFileSync(canonicalPath)
+            : null;
+        if (existing && !existing.equals(stampedBytes)) {
+            if (opts.reviewedUpdate !== true) {
+                throw localSkillError(`Canonical skill '${canonicalPath}' already exists and differs from the stamped file. Re-run with --reviewed-update after that exact change is cleared.`);
+            }
+        }
+        if (!existing || !existing.equals(stampedBytes)) {
+            writeSkillFileAtomically(canonicalPath, stampedBytes);
+        }
+        const legacyPrefix = readCompanyPrefix(resolvedRoot, companySlug);
+        let discoveryStatus = null;
+        try {
+            discoveryStatus = surfaceSkillFn({
+                hqRoot: resolvedRoot,
+                companySlug,
+                skillSlug: slug,
+                ...(legacyPrefix ? { legacyPrefix } : {}),
+            }).status;
+        }
+        catch (err) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery failed: ${err instanceof Error ? err.message : String(err)}`));
+        }
+        if (discoveryStatus !== null && discoveryStatus !== 0) {
+            console.warn(chalk.yellow(`⚠ Skill promoted, but local discovery exited ${discoveryStatus}. Run 'hq skill --company ${companySlug} create ${slug} --surface-only' to retry without another registration request.`));
+        }
+        if (opts.sync !== false) {
+            let syncResult;
+            try {
+                syncResult = await syncFile({
+                    filePath: canonicalPath,
+                    companySlug,
+                    hqRoot: resolvedRoot,
+                    token,
+                });
+            }
+            catch (err) {
+                console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync failed.`));
+                if (err && typeof err === "object") {
+                    const diagnostics = vaultAccessDeniedDiagnostics(err, {
+                        companySlug,
+                        objectKey: skillVaultPath(slug),
+                    });
+                    if (diagnostics)
+                        stampVaultAccessDenied(err, diagnostics);
+                }
+                throw err;
+            }
+            if (syncResult.aborted) {
+                throw localSkillError(`Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync aborted because the remote file conflicts.`);
+            }
+        }
+        console.log(chalk.green(`Skill promoted: ${skillUid}`));
+        console.log(`  File:     ${canonicalPath}`);
+        console.log(`  SHA-256:  ${sha256Hex(stampedBytes)}`);
+        console.log(`  Discovery: ${discoveryStatus === 0 ? "ready" : "needs attention"}`);
+        console.log(`  Sync:     ${opts.sync === false ? "not requested" : "complete"}`);
+    });
     skill
         .command("propose <target>")
         .description("Post a comment-only improvement for a skill")

package/dist/lib/plan-limit-nag.d.ts

@@ -83,6 +83,28 @@ export declare function recordPlanLimitStatus(body: unknown, opts?: {
  * never claims the workspace has stopped working.
  */
 export declare function buildOverLine(overEntries: Array<[string, PlanLimitEntry]>, upgradeUrl: string): string;
+/**
+ * My Telemetry is an Individual-plan feature on a personal scope (owner
+ * decision 9 / us-044-individual-plan-design.md §11). When hq-pro refuses it,
+ * the CLI prints this notice INSTEAD of telemetry output.
+ *
+ * It lives beside the nag copy so plan wording stays in one file, but it is
+ * NOT part of the nag model: no persistence, no throttle, no episode state. It
+ * is rendered once, on the spot, by whoever received the refusal. The refusal
+ * is a plan fact, so it neither counts toward the nag bands nor is silenced by
+ * the nag cadence.
+ *
+ * Copy names the plan and its price only — no Outposts, no bot pricing (owner
+ * decisions 10 and 11).
+ */
+export declare const INDIVIDUAL_PLAN_NAME = "Individual";
+export declare const INDIVIDUAL_PRICE_LABEL = "$50/mo";
+/**
+ * The notice a personal feature refusal prints. `upgradeUrl` is the server's
+ * own checkout target; an older hq-pro sends none, and the line then names the
+ * plan without a link rather than inventing one.
+ */
+export declare function renderPersonalPlanFeatureNotice(feature: string, upgradeUrl?: string | null): string;
 /**
  * One line per crossing.
  *

package/dist/lib/plan-limit-nag.js

@@ -326,6 +326,42 @@ export function buildOverLine(overEntries, upgradeUrl) {
     return (`⚠ HQ Starter: ${facts}. New files and new secrets are paused. ` +
         `Upgrade: ${upgradeUrl}`);
 }
+// ---------------------------------------------------------------------------
+// Individual-plan feature notice (US-054)
+// ---------------------------------------------------------------------------
+/**
+ * My Telemetry is an Individual-plan feature on a personal scope (owner
+ * decision 9 / us-044-individual-plan-design.md §11). When hq-pro refuses it,
+ * the CLI prints this notice INSTEAD of telemetry output.
+ *
+ * It lives beside the nag copy so plan wording stays in one file, but it is
+ * NOT part of the nag model: no persistence, no throttle, no episode state. It
+ * is rendered once, on the spot, by whoever received the refusal. The refusal
+ * is a plan fact, so it neither counts toward the nag bands nor is silenced by
+ * the nag cadence.
+ *
+ * Copy names the plan and its price only — no Outposts, no bot pricing (owner
+ * decisions 10 and 11).
+ */
+export const INDIVIDUAL_PLAN_NAME = "Individual";
+export const INDIVIDUAL_PRICE_LABEL = "$50/mo";
+/** Human names for the features a personal scope can be refused. */
+const PERSONAL_FEATURE_LABELS = {
+    telemetry: "My Telemetry",
+};
+/**
+ * The notice a personal feature refusal prints. `upgradeUrl` is the server's
+ * own checkout target; an older hq-pro sends none, and the line then names the
+ * plan without a link rather than inventing one.
+ */
+export function renderPersonalPlanFeatureNotice(feature, upgradeUrl) {
+    const label = PERSONAL_FEATURE_LABELS[feature] ?? feature;
+    const headline = `${label} is included with the HQ ${INDIVIDUAL_PLAN_NAME} plan (${INDIVIDUAL_PRICE_LABEL}).`;
+    const action = typeof upgradeUrl === "string" && upgradeUrl.trim().length > 0
+        ? `Upgrade: ${upgradeUrl.trim()}`
+        : "Upgrade in your HQ billing settings.";
+    return `${headline} Your personal account is on the free tier. ${action}`;
+}
 /** `"{resource}:{band}"` — the persisted key, matching the server's own. */
 function crossingKey(crossing) {
     return `${crossing.resource}:${crossing.band}`;

package/dist/utils/plan-gate-error.d.ts

@@ -1,11 +1,15 @@
+export type PlanGateCode = "PLAN_LIMIT_EXCEEDED" | "PLAN_REQUIRED"
 /**
- * A deliberate subscription denial returned by hq-pro. Keeping its structured
- * fields on a typed error lets the CLI boundary render one safe, consistent
- * message instead of every command parsing and printing a server response.
+ * US-054: a PERSONAL scope asked for a feature the paid Individual plan
+ * includes and the free tier does not. A different plan, a different price
+ * and a different remedy from the company codes above, so it is its own
+ * code rather than a reuse of `PLAN_REQUIRED` with company copy.
  */
-export type PlanGateCode = "PLAN_LIMIT_EXCEEDED" | "PLAN_REQUIRED";
+ | "PERSONAL_PLAN_REQUIRED";
 export interface PlanGateDetails {
     resource?: string;
+    /** The refused feature, on a `PERSONAL_PLAN_REQUIRED` denial. */
+    feature?: string;
     used?: number;
     limit?: number;
     upgradeUrl?: string;

package/dist/utils/plan-gate-error.js

@@ -1,3 +1,9 @@
+/**
+ * A deliberate subscription denial returned by hq-pro. Keeping its structured
+ * fields on a typed error lets the CLI boundary render one safe, consistent
+ * message instead of every command parsing and printing a server response.
+ */
+import { renderPersonalPlanFeatureNotice } from "../lib/plan-limit-nag.js";
 const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to HQ Workforce.";
 export class PlanGateError extends Error {
     code;
@@ -6,7 +12,11 @@ export class PlanGateError extends Error {
         // Commands with their own expected-error boundary commonly print
         // `err.message`. Keeping the friendly copy here means those boundaries
         // retain the same plan-gate voice as main.ts without per-command handling.
-        super([formatPlanGateDetails(code, details), TEAM_UPGRADE_HINT].join("\n"));
+        // The HQ Workforce hint is company advice; a personal denial ends at its
+        // own notice, which already names the Individual plan and its checkout.
+        super(code === "PERSONAL_PLAN_REQUIRED"
+            ? formatPlanGateDetails(code, details)
+            : [formatPlanGateDetails(code, details), TEAM_UPGRADE_HINT].join("\n"));
         this.code = code;
         this.details = details;
         this.name = "PlanGateError";
@@ -31,6 +41,12 @@ function formatPlanGateDetails(code, details) {
             existingResourcesNote,
         ].join("\n");
     }
+    // A personal scope is not a workspace: it has no members to trim, no $500
+    // tier to buy, and nothing of its own is paused. One line, the plan's own
+    // copy, and no company remedy.
+    if (code === "PERSONAL_PLAN_REQUIRED") {
+        return renderPersonalPlanFeatureNotice(details.feature ?? "this feature", details.upgradeUrl ?? null);
+    }
     const upgrade = typeof details.upgradeUrl === "string"
         ? `Upgrade to HQ Workforce ($500/mo) to remove limits: ${details.upgradeUrl}`
         : "Upgrade to HQ Workforce ($500/mo) to remove limits.";
@@ -41,6 +57,9 @@ function formatPlanGateDetails(code, details) {
     ].join("\n");
 }
 export function formatPlanGateError(err) {
+    if (err.code === "PERSONAL_PLAN_REQUIRED") {
+        return formatPlanGateDetails(err.code, err.details);
+    }
     return [
         formatPlanGateDetails(err.code, err.details),
         TEAM_UPGRADE_HINT,
@@ -80,6 +99,22 @@ export function planGateErrorFromPayload(status, body, companyUid) {
     if (status !== 402 || !body || typeof body !== "object")
         return null;
     const payload = body;
+    // US-054: the personal feature denial. hq-pro identifies it with
+    // `error: "plan_feature_unavailable"` plus `scope: "personal"`; both the
+    // `scope` and `requiredPlan` fields are OPTIONAL on the wire, so an hq-pro
+    // that predates US-054 sends a company-shaped denial and keeps falling
+    // through to the company path below (defensive consumer).
+    if (payload.error === "plan_feature_unavailable" &&
+        payload.scope === "personal") {
+        return new PlanGateError("PERSONAL_PLAN_REQUIRED", {
+            ...(typeof payload.feature === "string"
+                ? { feature: payload.feature }
+                : {}),
+            ...(typeof payload.upgradeUrl === "string"
+                ? { upgradeUrl: payload.upgradeUrl }
+                : {}),
+        });
+    }
     if (payload.code !== "PLAN_LIMIT_EXCEEDED" && payload.code !== "PLAN_REQUIRED") {
         return null;
     }

package/dist/utils/vault-api.d.ts

@@ -59,6 +59,7 @@ export declare function vaultApiFetchPublic(opts: {
     query?: Record<string, string>;
 }): Promise<Response>;
 export declare function looksLikeCompanyUid(ref: string): boolean;
+export declare function looksLikePersonVaultUid(ref: string): boolean;
 export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
 export declare function resolveCallerPersonUid(token: string, baseUrl?: string): Promise<string>;
 export declare function getEntityUid(token: string, opts: {

package/dist/utils/vault-api.js

@@ -285,6 +285,24 @@ const COMPANY_UID_PREFIX = 'cmp_';
 export function looksLikeCompanyUid(ref) {
     return ref.startsWith(COMPANY_UID_PREFIX);
 }
+/**
+ * A `--company` value beginning with `prs_` names a PERSON'S vault, not a
+ * company. It is the only way to reach a DM attachment: the file lives in the
+ * SENDER's personal vault under
+ * `chat/attachments/dm/<uidA>--<uidB>/…`, and the vault API authorizes either
+ * member of that pair to `get` it (hq-pro #3571). The recipient has no
+ * personal vault of their own (so `--personal` cannot work) and the key is not
+ * in any company bucket (so a slug 404s on the object), which left the read
+ * with no expressible scope at all.
+ *
+ * Routed straight through as the scope uid: person entities have no slug
+ * namespace, so there is nothing to resolve, and the server's own per-key gate
+ * — not the CLI — decides whether the caller may read it.
+ */
+const PERSON_VAULT_UID_PREFIX = 'prs_';
+export function looksLikePersonVaultUid(ref) {
+    return ref.startsWith(PERSON_VAULT_UID_PREFIX);
+}
 // A 401 from ANY vault resolution call means the caller's HQ session is
 // expired or missing — an expected auth state fixed by `hq login`, not a
 // code defect. Raise a typed AuthError so the top-level handler prints an
@@ -351,6 +369,12 @@ async function resolveCompanyUid(token, ref) {
     if (looksLikeCompanyUid(ref)) {
         return resolveCompanyByUid(token, ref);
     }
+    // A `prs_` ref names a person's vault (DM attachments). There is no slug to
+    // resolve and no company lookup that could succeed; pass it through as the
+    // scope and let the vault API's per-key authorization answer.
+    if (looksLikePersonVaultUid(ref)) {
+        return ref;
+    }
     // PRIMARY PATH — caller-scoped slug resolution. Resolves the slug to the
     // caller's OWN company (unique within their namespace by the invariant
     // above), making a stranger's same-slug company invisible.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.119.9",
+  "version": "5.119.11",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {