@indigoai-us/hq-cli 5.12.4 → 5.13.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## [Unreleased]
+
+## [5.13.0] — 2026-05-14
+
+### Added
+
+- **`hq sync now` — bidirectional sync command.** Mirrors the AppBar HQ Sync
+  "Sync Now" button: pushes local changes to the target vault, then pulls
+  remote updates. Push runs first so the subsequent pull doesn't redownload
+  files that were about to be broadcast (matches `hq-sync-runner` ordering).
+  Supports `--company <slug>`, `--personal`, `--all`, `--message <msg>`,
+  `--on-conflict <strategy>`, and `--hq-root <path>`. The `--all` form
+  composes `pushAll` then `pullAll`, fanning out across every membership and
+  the canonical personal vault in a single invocation.
+
+- **`--personal` flag on `hq sync pull`, `hq sync push`, and `hq sync now`.**
+  Targets the caller's canonical person-entity vault without needing the
+  person UID — resolves it from the cached Cognito session, then routes
+  through `personalMode` (no `companies/<slug>/` prefix) with `journalSlug:
+  "personal"` for idempotency-state parity with the Rust personal first-push.
+  For `push --personal` with no explicit `[paths]`, defaults to the same
+  top-level scope as `--all`'s personal slot (every top-level entry under
+  `<hq-root>` minus `.git`, `companies`, `repos`, `workspace`). Mutually
+  exclusive with `--all` and `--company`.
+
+- **`--all` flag on `hq sync push`.** Symmetric with `pull --all`: pushes
+  every company you are a member of plus the canonical personal vault in
+  a single invocation. Company targets push `<hq-root>/companies/<slug>/`;
+  personal pushes the canonical personal-vault scope. Each leg uses the
+  menubar runner's bulk defaults (`skipUnchanged: true`,
+  `propagateDeletes: true`) so re-runs are cheap and on-disk deletes
+  propagate to the vault. Cannot be combined with explicit `[paths]` or
+  `--creds-from-stdin` — the fanout needs to vend per-target credentials.
+
+### Changed
+
+- **Selector flags on `hq sync {pull,push,now}` are mutually exclusive.**
+  `--all`, `--personal`, and `--company` are now validated as a single
+  selector: at most one may be set per invocation; zero means "use the
+  active company from `.hq/config.json`". Conflicting combinations are
+  rejected with a clear error before any network calls.
+
+### Fixed
+
+- **Swallow `EPIPE` on stdout/stderr to stop Sentry fatals.** When a
+  downstream consumer (`| head`, closed pager, broken shell pipe) shut the
+  read end of the CLI's stdout or stderr, Node raised `EPIPE` that Sentry
+  then captured as a fatal. Both streams now ignore `EPIPE` quietly so the
+  CLI exits cleanly when piped into truncating consumers, and the Sentry
+  dashboard stops filling up with non-actionable pipe errors.
+
 ## [5.12.4] — 2026-05-12
 
 ### Changed

package/dist/commands/cloud.d.ts

@@ -58,6 +58,50 @@ export interface PullAllRow {
     result?: SyncCallResult;
     error?: string;
 }
+export interface ShareCallOptions {
+    company: string;
+    hqRoot: string;
+    paths: string[];
+    onConflict?: ConflictStrategy;
+    personalMode?: boolean;
+    journalSlug?: string;
+    message?: string;
+    skipUnchanged?: boolean;
+    propagateDeletes?: boolean;
+}
+export interface ShareCallResult {
+    filesUploaded: number;
+    bytesUploaded: number;
+    filesSkipped: number;
+    filesDeleted: number;
+    conflictPaths: string[];
+    aborted: boolean;
+}
+export interface PushAllDeps {
+    vaultClient: PullAllVaultClient;
+    share: (options: ShareCallOptions) => Promise<ShareCallResult>;
+}
+export interface PushAllOptions {
+    hqRoot: string;
+    onConflict?: ConflictStrategy;
+    message?: string;
+}
+export interface PushAllRow {
+    slug: string;
+    result?: ShareCallResult;
+    error?: string;
+}
+export interface PushAllResult {
+    attempted: number;
+    filesUploaded: number;
+    bytesUploaded: number;
+    filesDeleted: number;
+    errors: Array<{
+        company: string;
+        message: string;
+    }>;
+    perCompany: PushAllRow[];
+}
 export interface PullAllResult {
     attempted: number;
     filesDownloaded: number;
@@ -70,5 +114,29 @@ export interface PullAllResult {
     perCompany: PullAllRow[];
 }
 export declare function pullAll(options: PullAllOptions, deps: PullAllDeps): Promise<PullAllResult>;
+/**
+ * Drives `hq sync push --all`: same membership + canonical-person fanout as
+ * pullAll, but each leg calls share() with the runner's bulk defaults
+ * (skipUnchanged: true, propagateDeletes: true). Pure function with injected
+ * deps so tests can drive it without network or filesystem.
+ */
+export declare function pushAll(options: PushAllOptions, deps: PushAllDeps): Promise<PushAllResult>;
+/**
+ * Resolve the canonical person entity UID for the logged-in user. Used by
+ * `hq sync {push,pull,now} --personal` to target the personal vault without
+ * the caller needing to know the UID. Throws a clean error if the user has
+ * no person entity (typically means they haven't run `hq onboard`).
+ */
+export declare function resolveCanonicalPersonUid(vaultClient: PullAllVaultClient): Promise<string>;
+/**
+ * Refuse ambiguous selector combinations. `--all`, `--personal`, and
+ * `--company` are mutually exclusive — at most one may be set per
+ * invocation; zero means "use the active company from .hq/config.json".
+ */
+export declare function assertSingleSelector(opts: {
+    all?: boolean;
+    personal?: boolean;
+    company?: string;
+}, command: string): void;
 export declare function registerCloudCommands(program: Command): void;
 //# sourceMappingURL=cloud.d.ts.map

package/dist/commands/cloud.js

@@ -13,11 +13,11 @@
  *   hq sync status            — show local journal summary
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e7f5f66e-78d5-5787-acb4-fe35424f69c9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7bc55d66-7b02-5b45-9444-710bb6d8dfd6")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, sync, readJournal, getJournalPath, loadCachedTokens, VaultClient, } from "@indigoai-us/hq-cloud";
+import { share, sync, readJournal, getJournalPath, loadCachedTokens, VaultClient, computePersonalVaultPaths, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 // Oldest-first by createdAt, ties broken by uid lexicographic — matches
 // `pickCanonicalPersonEntity` in @indigoai-us/hq-cloud so the CLI lands on
@@ -93,6 +93,115 @@ export async function pullAll(options, deps) {
     }
     return result;
 }
+/**
+ * Drives `hq sync push --all`: same membership + canonical-person fanout as
+ * pullAll, but each leg calls share() with the runner's bulk defaults
+ * (skipUnchanged: true, propagateDeletes: true). Pure function with injected
+ * deps so tests can drive it without network or filesystem.
+ */
+export async function pushAll(options, deps) {
+    const memberships = await deps.vaultClient.listMyMemberships();
+    const persons = await deps.vaultClient.listPersonEntities();
+    const plan = [];
+    for (const m of memberships) {
+        let slug = m.companyUid;
+        try {
+            const info = await deps.vaultClient.getEntity(m.companyUid);
+            if (info?.slug)
+                slug = info.slug;
+        }
+        catch {
+            // Best-effort — keep UID as the row label.
+        }
+        plan.push({
+            slug,
+            shareOptions: {
+                company: m.companyUid,
+                hqRoot: options.hqRoot,
+                paths: [path.join(options.hqRoot, "companies", slug)],
+                skipUnchanged: true,
+                propagateDeletes: true,
+                ...(options.onConflict ? { onConflict: options.onConflict } : {}),
+                ...(options.message ? { message: options.message } : {}),
+            },
+        });
+    }
+    const personal = pickCanonicalPerson(persons);
+    if (personal) {
+        plan.push({
+            slug: "personal",
+            shareOptions: {
+                company: personal.uid,
+                hqRoot: options.hqRoot,
+                paths: computePersonalVaultPaths(options.hqRoot),
+                personalMode: true,
+                journalSlug: "personal",
+                skipUnchanged: true,
+                propagateDeletes: true,
+                ...(options.onConflict ? { onConflict: options.onConflict } : {}),
+                ...(options.message ? { message: options.message } : {}),
+            },
+        });
+    }
+    const result = {
+        attempted: 0,
+        filesUploaded: 0,
+        bytesUploaded: 0,
+        filesDeleted: 0,
+        errors: [],
+        perCompany: [],
+    };
+    for (const entry of plan) {
+        result.attempted += 1;
+        try {
+            const r = await deps.share(entry.shareOptions);
+            result.filesUploaded += r.filesUploaded;
+            result.bytesUploaded += r.bytesUploaded;
+            result.filesDeleted += r.filesDeleted;
+            result.perCompany.push({ slug: entry.slug, result: r });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            result.errors.push({ company: entry.slug, message });
+            result.perCompany.push({ slug: entry.slug, error: message });
+        }
+    }
+    return result;
+}
+/**
+ * Resolve the canonical person entity UID for the logged-in user. Used by
+ * `hq sync {push,pull,now} --personal` to target the personal vault without
+ * the caller needing to know the UID. Throws a clean error if the user has
+ * no person entity (typically means they haven't run `hq onboard`).
+ */
+export async function resolveCanonicalPersonUid(vaultClient) {
+    const persons = await vaultClient.listPersonEntities();
+    const pick = pickCanonicalPerson(persons);
+    if (!pick) {
+        throw new Error("No personal vault found for the logged-in user. Run `hq onboard` " +
+            "first, or check `hq whoami` to confirm you're signed in to the " +
+            "right account.");
+    }
+    return pick.uid;
+}
+/**
+ * Refuse ambiguous selector combinations. `--all`, `--personal`, and
+ * `--company` are mutually exclusive — at most one may be set per
+ * invocation; zero means "use the active company from .hq/config.json".
+ */
+export function assertSingleSelector(opts, command) {
+    const selectors = [];
+    if (opts.all)
+        selectors.push("--all");
+    if (opts.personal)
+        selectors.push("--personal");
+    if (opts.company)
+        selectors.push(`--company ${opts.company}`);
+    if (selectors.length > 1) {
+        throw new Error(`\`hq sync ${command}\` accepts at most one of --all, --personal, ` +
+            `--company; got: ${selectors.join(", ")}.`);
+    }
+}
 export function registerCloudCommands(program) {
     program
         .command("push")
@@ -112,7 +221,42 @@ export function registerCloudCommands(program) {
         "synthetic `{type:\"complete\",...}` line is appended at the end with " +
         "the final ShareResult. Subprocess callers parse these to render their " +
         "own UI (e.g. AppBar Tauri events).")
+        .option("--all", "Push every company you are a member of plus your personal vault. " +
+        "Company targets push `<hq-root>/companies/<slug>/`; personal pushes " +
+        "every top-level entry under <hq-root> minus the excluded set " +
+        "(.git, companies, repos, workspace). Implies --skip-unchanged + " +
+        "--propagate-deletes. Mutually exclusive with --company, --personal, " +
+        "and any explicit [paths].")
+        .option("--personal", "Push to the caller's canonical personal vault (resolved from the " +
+        "cached Cognito session). When no [paths] are given, defaults to " +
+        "every top-level entry under <hq-root> minus the excluded set " +
+        "(.git, companies, repos, workspace) — same scope as `--all`'s " +
+        "personal slot. Mutually exclusive with --company and --all.")
         .action(async (paths, options) => {
+        try {
+            assertSingleSelector(options, "push");
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Push failed:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+        if (options.all) {
+            if (paths && paths.length > 0) {
+                console.error(chalk.red("\n✗ Push failed:"), "`--all` cannot be combined with explicit [paths]. " +
+                    "Drop the paths to fan out to every membership + personal, " +
+                    "or drop --all to push specific paths to a single target.");
+                process.exit(1);
+            }
+            if (options.credsFromStdin) {
+                console.error(chalk.red("\n✗ Push failed:"), "`--all` cannot be combined with --creds-from-stdin (fanout " +
+                    "needs to vend per-target credentials via the cached Cognito " +
+                    "session). Run separate `--creds-from-stdin` invocations per " +
+                    "target instead.");
+                process.exit(1);
+            }
+            await runPushAll(options.hqRoot, options.message, options.onConflict);
+            return;
+        }
         const jsonMode = options.json === true;
         // Suppress the human banner/result output in JSON mode — the parent
         // process renders its own UI from the stderr ndjson stream.
@@ -124,11 +268,14 @@ export function registerCloudCommands(program) {
             process.stderr.write(JSON.stringify(event) + "\n");
         };
         try {
-            const targetPaths = paths && paths.length > 0 ? paths : [process.cwd()];
+            if (options.personal && options.credsFromStdin) {
+                throw new Error("`--personal` cannot be combined with --creds-from-stdin: " +
+                    "--personal resolves the canonical person UID via the cached " +
+                    "Cognito session, while --creds-from-stdin expects the caller " +
+                    "to have already resolved entity + credentials. Pick one.");
+            }
             log(chalk.bold("\nHQ Sync — Push"));
             log(`  HQ root:  ${options.hqRoot}`);
-            log(`  Company:  ${options.company ?? "(from .hq/config.json or stdin)"}`);
-            log(`  Paths:    ${targetPaths.join(", ")}\n`);
             // Resolve credentials. Two paths:
             //   1. --creds-from-stdin: parse JSON EntityContext from stdin (the
             //      AppBar shell-out contract — vend-child upstream, pipe in here).
@@ -153,6 +300,39 @@ export function registerCloudCommands(program) {
                 const accessToken = await ensureCognitoToken();
                 vaultConfig = buildVaultConfig(accessToken);
             }
+            // Resolve the target. For `--personal`, look up the caller's
+            // canonical person entity and force personalMode + journalSlug so
+            // share() lands files at hqRoot directly (no companies/<slug>/
+            // prefix). For everything else, the company is whatever the user
+            // passed or the active company from .hq/config.json.
+            let targetCompany = options.company;
+            let personalMode = false;
+            let journalSlug;
+            if (options.personal) {
+                const client = new VaultClient(vaultConfig);
+                targetCompany = await resolveCanonicalPersonUid({
+                    listMyMemberships: () => client.listMyMemberships(),
+                    listPersonEntities: () => client.entity.listByType("person"),
+                    getEntity: async () => null,
+                });
+                personalMode = true;
+                journalSlug = "personal";
+            }
+            // Default paths. For `--personal` with no explicit paths, default to
+            // the canonical personal-vault top-level scope so re-runs from a
+            // user shell push the same surface as `--all`'s personal slot.
+            // Otherwise preserve the historical "default to cwd" semantics so
+            // `hq sync push <file>` and bare `hq sync push` from inside the
+            // company tree both work as before.
+            const targetPaths = paths && paths.length > 0
+                ? paths
+                : options.personal
+                    ? computePersonalVaultPaths(options.hqRoot)
+                    : [process.cwd()];
+            log(`  Company:  ${options.personal
+                ? `(personal: ${targetCompany})`
+                : (options.company ?? "(from .hq/config.json or stdin)")}`);
+            log(`  Paths:    ${targetPaths.join(", ")}\n`);
             // In JSON mode, forward every share() event verbatim to stderr as
             // ndjson. In human mode, share()'s defaultConsoleLogger handles the
             // rendering (no onEvent → falls through to stdout/stderr printing).
@@ -168,13 +348,15 @@ export function registerCloudCommands(program) {
             const author = resolveUploadAuthorFromCache();
             const result = await share({
                 paths: targetPaths,
-                company: options.company,
+                company: targetCompany,
                 message: options.message,
                 onConflict: options.onConflict,
                 vaultConfig,
                 entityContext,
                 hqRoot: options.hqRoot,
                 onEvent,
+                ...(personalMode ? { personalMode: true } : {}),
+                ...(journalSlug !== undefined ? { journalSlug } : {}),
                 ...(author ? { author } : {}),
             });
             if (jsonMode) {
@@ -219,12 +401,28 @@ export function registerCloudCommands(program) {
         .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
         .option("--all", "Pull every company you are a member of plus your personal vault " +
         "into <hq-root>. Companies land at <hq-root>/companies/<slug>; " +
-        "the personal vault syncs at <hq-root>. Ignores --company.")
+        "the personal vault syncs at <hq-root>. Mutually exclusive with " +
+        "--company and --personal.")
+        .option("--personal", "Pull the caller's canonical personal vault into <hq-root> directly " +
+        "(no companies/<slug>/ prefix). Resolves the person UID automatically " +
+        "from the cached Cognito session. Mutually exclusive with --company " +
+        "and --all.")
         .action(async (options) => {
+        try {
+            assertSingleSelector(options, "pull");
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Pull failed:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
         if (options.all) {
             await runPullAll(options.hqRoot, options.onConflict);
             return;
         }
+        if (options.personal) {
+            await runPullPersonal(options.hqRoot, options.onConflict);
+            return;
+        }
         try {
             console.log(chalk.bold("\nHQ Sync — Pull"));
             console.log(`  HQ root:  ${options.hqRoot}`);
@@ -291,6 +489,33 @@ export function registerCloudCommands(program) {
             process.exit(1);
         }
     });
+    program
+        .command("now")
+        .description("Bidirectional sync: push local changes, then pull remote updates " +
+        "(mirrors AppBar HQ Sync's \"Sync Now\" button)")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
+        .option("--message <msg>", "Optional message attached to journal entries for the push leg")
+        .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
+        .option("--all", "Sync every company you are a member of plus your personal vault " +
+        "(pushAll then pullAll). Mutually exclusive with --company and " +
+        "--personal.")
+        .option("--personal", "Sync the caller's canonical personal vault bidirectionally. " +
+        "Mutually exclusive with --company and --all.")
+        .action(async (options) => {
+        try {
+            assertSingleSelector(options, "now");
+            if (options.all) {
+                await runNowAll(options.hqRoot, options.message, options.onConflict);
+                return;
+            }
+            await runNowSingle(options.hqRoot, options.company, options.personal === true, options.message, options.onConflict);
+        }
+        catch (err) {
+            console.error(chalk.red("\n✗ Sync now failed:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
 }
 async function runPullAll(hqRoot, onConflict) {
     console.log(chalk.bold("\nHQ Sync — Pull (all)"));
@@ -354,6 +579,232 @@ async function runPullAll(hqRoot, onConflict) {
     if (errored > 0)
         process.exit(1);
 }
+async function runPullPersonal(hqRoot, onConflict) {
+    console.log(chalk.bold("\nHQ Sync — Pull (personal)"));
+    console.log(`  HQ root:  ${hqRoot}`);
+    console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+    try {
+        const accessToken = await ensureCognitoToken();
+        const vaultConfig = buildVaultConfig(accessToken);
+        const client = new VaultClient(vaultConfig);
+        const personalUid = await resolveCanonicalPersonUid({
+            listMyMemberships: () => client.listMyMemberships(),
+            listPersonEntities: () => client.entity.listByType("person"),
+            getEntity: async () => null,
+        });
+        const result = await sync({
+            company: personalUid,
+            ...(onConflict ? { onConflict } : {}),
+            vaultConfig,
+            hqRoot,
+            personalMode: true,
+            journalSlug: "personal",
+        });
+        if (result.aborted) {
+            console.log(chalk.yellow(`\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
+            process.exit(1);
+        }
+        console.log(chalk.green(`\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
+    }
+    catch (err) {
+        console.error(chalk.red("\n✗ Pull (personal) failed:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+async function runPushAll(hqRoot, message, onConflict) {
+    console.log(chalk.bold("\nHQ Sync — Push (all)"));
+    console.log(`  HQ root:  ${hqRoot}`);
+    console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+    let result;
+    try {
+        const accessToken = await ensureCognitoToken();
+        const vaultConfig = buildVaultConfig(accessToken);
+        const realClient = new VaultClient(vaultConfig);
+        const author = resolveUploadAuthorFromCache();
+        const adapter = {
+            listMyMemberships: () => realClient.listMyMemberships(),
+            listPersonEntities: () => realClient.entity.listByType("person"),
+            getEntity: async (uid) => {
+                try {
+                    return await realClient.entity.get(uid);
+                }
+                catch {
+                    return null;
+                }
+            },
+        };
+        result = await pushAll({
+            hqRoot,
+            ...(onConflict ? { onConflict } : {}),
+            ...(message ? { message } : {}),
+        }, {
+            vaultClient: adapter,
+            share: (opts) => share({
+                paths: opts.paths,
+                company: opts.company,
+                vaultConfig,
+                hqRoot: opts.hqRoot,
+                ...(opts.onConflict ? { onConflict: opts.onConflict } : {}),
+                ...(opts.personalMode !== undefined
+                    ? { personalMode: opts.personalMode }
+                    : {}),
+                ...(opts.journalSlug !== undefined
+                    ? { journalSlug: opts.journalSlug }
+                    : {}),
+                ...(opts.message !== undefined ? { message: opts.message } : {}),
+                ...(opts.skipUnchanged !== undefined
+                    ? { skipUnchanged: opts.skipUnchanged }
+                    : {}),
+                ...(opts.propagateDeletes !== undefined
+                    ? { propagateDeletes: opts.propagateDeletes }
+                    : {}),
+                ...(author ? { author } : {}),
+            }),
+        });
+    }
+    catch (err) {
+        console.error(chalk.red("\n✗ Push-all failed:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    for (const row of result.perCompany) {
+        if (row.error) {
+            console.log(chalk.red(`  ✗ ${row.slug}: ${row.error}`));
+        }
+        else if (row.result) {
+            const r = row.result;
+            const status = r.aborted ? chalk.yellow("⚠") : chalk.green("✓");
+            console.log(`  ${status} ${row.slug}: ${r.filesUploaded} file(s), ` +
+                `${formatBytes(r.bytesUploaded)}, ${r.filesSkipped} skipped, ` +
+                `${r.filesDeleted} deleted, ${r.conflictPaths.length} conflict(s)` +
+                (r.aborted ? " — aborted" : ""));
+        }
+    }
+    const errored = result.errors.length;
+    const summary = `\nPushed ${result.filesUploaded} file(s) ` +
+        `(${formatBytes(result.bytesUploaded)}) across ${result.attempted} ` +
+        `target(s); ${result.filesDeleted} deleted; ${errored} error(s)`;
+    console.log(errored > 0 ? chalk.yellow(summary) : chalk.green(summary));
+    if (errored > 0)
+        process.exit(1);
+}
+async function runNowSingle(hqRoot, company, personal, message, onConflict) {
+    console.log(chalk.bold("\nHQ Sync — Now"));
+    console.log(`  HQ root:  ${hqRoot}`);
+    console.log(`  Target:   ${personal ? "(personal)" : (company ?? "(active company)")}`);
+    console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+    try {
+        const accessToken = await ensureCognitoToken();
+        const vaultConfig = buildVaultConfig(accessToken);
+        const author = resolveUploadAuthorFromCache();
+        // Resolve the target. For --personal, look up the canonical person and
+        // route paths/journal through personalMode. Otherwise use the company arg
+        // (or fall back to the active company inside share()/sync()).
+        let targetCompany = company;
+        let personalMode = false;
+        let journalSlug;
+        let pushPaths;
+        if (personal) {
+            const client = new VaultClient(vaultConfig);
+            targetCompany = await resolveCanonicalPersonUid({
+                listMyMemberships: () => client.listMyMemberships(),
+                listPersonEntities: () => client.entity.listByType("person"),
+                getEntity: async () => null,
+            });
+            personalMode = true;
+            journalSlug = "personal";
+            pushPaths = computePersonalVaultPaths(hqRoot);
+        }
+        else {
+            // For company targets we need a concrete slug to compute the push path.
+            // share() can resolve `company` itself for the upload, but the path
+            // computation must happen here. Use the explicit company if given;
+            // otherwise fall back to the active-company resolution inside the
+            // engine and compute paths from `hqRoot/companies` (share() will refuse
+            // anything outside that subtree anyway).
+            const slug = company ?? readActiveCompanySlug(hqRoot);
+            if (!slug) {
+                throw new Error("No company specified and no active company found. " +
+                    "Use --company <slug>, --personal, or set up .hq/config.json.");
+            }
+            pushPaths = [path.join(hqRoot, "companies", slug)];
+        }
+        // Push first so the subsequent pull doesn't redownload files we were
+        // about to broadcast (matches hq-sync-runner ordering).
+        console.log(chalk.dim("  → push leg"));
+        const pushResult = await share({
+            paths: pushPaths,
+            company: targetCompany,
+            vaultConfig,
+            hqRoot,
+            skipUnchanged: true,
+            propagateDeletes: true,
+            ...(onConflict ? { onConflict } : {}),
+            ...(message ? { message } : {}),
+            ...(personalMode ? { personalMode: true } : {}),
+            ...(journalSlug !== undefined ? { journalSlug } : {}),
+            ...(author ? { author } : {}),
+        });
+        console.log(`    ${pushResult.aborted ? chalk.yellow("⚠") : chalk.green("✓")} ` +
+            `${pushResult.filesUploaded} uploaded, ${pushResult.filesSkipped} skipped, ` +
+            `${pushResult.filesDeleted} deleted` +
+            (pushResult.aborted ? " — aborted" : ""));
+        if (pushResult.aborted) {
+            console.log(chalk.yellow("\n⚠ Sync now aborted on push leg; pull skipped."));
+            process.exit(1);
+        }
+        console.log(chalk.dim("  → pull leg"));
+        const pullResult = await sync({
+            company: targetCompany,
+            vaultConfig,
+            hqRoot,
+            ...(onConflict ? { onConflict } : {}),
+            ...(personalMode ? { personalMode: true } : {}),
+            ...(journalSlug !== undefined ? { journalSlug } : {}),
+        });
+        console.log(`    ${pullResult.aborted ? chalk.yellow("⚠") : chalk.green("✓")} ` +
+            `${pullResult.filesDownloaded} downloaded, ${pullResult.filesSkipped} skipped, ` +
+            `${pullResult.conflicts} conflict(s)` +
+            (pullResult.aborted ? " — aborted" : ""));
+        if (pullResult.aborted) {
+            console.log(chalk.yellow("\n⚠ Sync now finished with pull leg aborted."));
+            process.exit(1);
+        }
+        console.log(chalk.green("\n✓ Sync now complete"));
+    }
+    catch (err) {
+        console.error(chalk.red("\n✗ Sync now failed:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+async function runNowAll(hqRoot, message, onConflict) {
+    console.log(chalk.bold("\nHQ Sync — Now (all)"));
+    console.log(`  HQ root:  ${hqRoot}`);
+    console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+    // Push first (matches runner), then pull. Re-uses the per-leg orchestrators
+    // so the per-target rendering, error isolation, and exit codes are
+    // identical to running `push --all` then `pull --all` back-to-back.
+    console.log(chalk.dim("→ push --all"));
+    await runPushAll(hqRoot, message, onConflict);
+    console.log(chalk.dim("\n→ pull --all"));
+    await runPullAll(hqRoot, onConflict);
+}
+/**
+ * Best-effort read of the active company slug from `<hqRoot>/.hq/config.json`.
+ * Returns undefined when the file is missing, malformed, or has no
+ * `activeCompany` field — `runNowSingle` surfaces a clean error in that case.
+ */
+function readActiveCompanySlug(hqRoot) {
+    const configPath = path.join(hqRoot, ".hq", "config.json");
+    if (!fs.existsSync(configPath))
+        return undefined;
+    try {
+        const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+        return cfg.activeCompany;
+    }
+    catch {
+        return undefined;
+    }
+}
 function formatBytes(bytes) {
     if (bytes === 0)
         return "0 B";
@@ -409,4 +860,4 @@ function resolveUploadAuthorFromCache() {
     }
 }
 //# sourceMappingURL=cloud.js.map
-//# debugId=e7f5f66e-78d5-5787-acb4-fe35424f69c9
+//# debugId=7bc55d66-7b02-5b45-9444-710bb6d8dfd6