@indigoai-us/hq-cli 5.12.5 → 5.13.0

package/src/commands/cloud.ts

@@ -25,6 +25,7 @@ import {
   getJournalPath,
   loadCachedTokens,
   VaultClient,
+  computePersonalVaultPaths,
   type ConflictStrategy,
   type EntityContext,
   type SyncProgressEvent,
@@ -98,6 +99,63 @@ export interface PullAllRow {
   error?: string;
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// `hq sync push --all` orchestrator — symmetric with pullAll.
+//
+// Plan: every membership → company target (paths = the company's local
+// subtree); plus the canonical person entity → personal target (paths =
+// computePersonalVaultPaths(hqRoot)). Each target calls share() with
+// skipUnchanged + propagateDeletes so re-runs are cheap and on-disk deletes
+// propagate to the vault — same defaults the menubar runner uses.
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface ShareCallOptions {
+  company: string;
+  hqRoot: string;
+  paths: string[];
+  onConflict?: ConflictStrategy;
+  personalMode?: boolean;
+  journalSlug?: string;
+  message?: string;
+  skipUnchanged?: boolean;
+  propagateDeletes?: boolean;
+}
+
+export interface ShareCallResult {
+  filesUploaded: number;
+  bytesUploaded: number;
+  filesSkipped: number;
+  filesDeleted: number;
+  conflictPaths: string[];
+  aborted: boolean;
+}
+
+export interface PushAllDeps {
+  vaultClient: PullAllVaultClient;
+  share: (options: ShareCallOptions) => Promise<ShareCallResult>;
+}
+
+export interface PushAllOptions {
+  hqRoot: string;
+  onConflict?: ConflictStrategy;
+  message?: string;
+}
+
+export interface PushAllRow {
+  slug: string;
+  result?: ShareCallResult;
+  error?: string;
+}
+
+export interface PushAllResult {
+  attempted: number;
+  filesUploaded: number;
+  bytesUploaded: number;
+  filesDeleted: number;
+  errors: Array<{ company: string; message: string }>;
+  perCompany: PushAllRow[];
+}
+
 export interface PullAllResult {
   attempted: number;
   filesDownloaded: number;
@@ -193,6 +251,135 @@ export async function pullAll(
   return result;
 }
 
+interface PushPlanEntry {
+  slug: string;
+  shareOptions: ShareCallOptions;
+}
+
+/**
+ * Drives `hq sync push --all`: same membership + canonical-person fanout as
+ * pullAll, but each leg calls share() with the runner's bulk defaults
+ * (skipUnchanged: true, propagateDeletes: true). Pure function with injected
+ * deps so tests can drive it without network or filesystem.
+ */
+export async function pushAll(
+  options: PushAllOptions,
+  deps: PushAllDeps,
+): Promise<PushAllResult> {
+  const memberships = await deps.vaultClient.listMyMemberships();
+  const persons = await deps.vaultClient.listPersonEntities();
+
+  const plan: PushPlanEntry[] = [];
+  for (const m of memberships) {
+    let slug = m.companyUid;
+    try {
+      const info = await deps.vaultClient.getEntity(m.companyUid);
+      if (info?.slug) slug = info.slug;
+    } catch {
+      // Best-effort — keep UID as the row label.
+    }
+    plan.push({
+      slug,
+      shareOptions: {
+        company: m.companyUid,
+        hqRoot: options.hqRoot,
+        paths: [path.join(options.hqRoot, "companies", slug)],
+        skipUnchanged: true,
+        propagateDeletes: true,
+        ...(options.onConflict ? { onConflict: options.onConflict } : {}),
+        ...(options.message ? { message: options.message } : {}),
+      },
+    });
+  }
+
+  const personal = pickCanonicalPerson(persons);
+  if (personal) {
+    plan.push({
+      slug: "personal",
+      shareOptions: {
+        company: personal.uid,
+        hqRoot: options.hqRoot,
+        paths: computePersonalVaultPaths(options.hqRoot),
+        personalMode: true,
+        journalSlug: "personal",
+        skipUnchanged: true,
+        propagateDeletes: true,
+        ...(options.onConflict ? { onConflict: options.onConflict } : {}),
+        ...(options.message ? { message: options.message } : {}),
+      },
+    });
+  }
+
+  const result: PushAllResult = {
+    attempted: 0,
+    filesUploaded: 0,
+    bytesUploaded: 0,
+    filesDeleted: 0,
+    errors: [],
+    perCompany: [],
+  };
+
+  for (const entry of plan) {
+    result.attempted += 1;
+    try {
+      const r = await deps.share(entry.shareOptions);
+      result.filesUploaded += r.filesUploaded;
+      result.bytesUploaded += r.bytesUploaded;
+      result.filesDeleted += r.filesDeleted;
+      result.perCompany.push({ slug: entry.slug, result: r });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      result.errors.push({ company: entry.slug, message });
+      result.perCompany.push({ slug: entry.slug, error: message });
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Resolve the canonical person entity UID for the logged-in user. Used by
+ * `hq sync {push,pull,now} --personal` to target the personal vault without
+ * the caller needing to know the UID. Throws a clean error if the user has
+ * no person entity (typically means they haven't run `hq onboard`).
+ */
+export async function resolveCanonicalPersonUid(
+  vaultClient: PullAllVaultClient,
+): Promise<string> {
+  const persons = await vaultClient.listPersonEntities();
+  const pick = pickCanonicalPerson(persons);
+  if (!pick) {
+    throw new Error(
+      "No personal vault found for the logged-in user. Run `hq onboard` " +
+        "first, or check `hq whoami` to confirm you're signed in to the " +
+        "right account.",
+    );
+  }
+  return pick.uid;
+}
+
+/**
+ * Refuse ambiguous selector combinations. `--all`, `--personal`, and
+ * `--company` are mutually exclusive — at most one may be set per
+ * invocation; zero means "use the active company from .hq/config.json".
+ */
+export function assertSingleSelector(opts: {
+  all?: boolean;
+  personal?: boolean;
+  company?: string;
+}, command: string): void {
+  const selectors: string[] = [];
+  if (opts.all) selectors.push("--all");
+  if (opts.personal) selectors.push("--personal");
+  if (opts.company) selectors.push(`--company ${opts.company}`);
+  if (selectors.length > 1) {
+    throw new Error(
+      `\`hq sync ${command}\` accepts at most one of --all, --personal, ` +
+        `--company; got: ${selectors.join(", ")}.`,
+    );
+  }
+}
+
 export function registerCloudCommands(program: Command): void {
   program
     .command("push")
@@ -231,6 +418,23 @@ export function registerCloudCommands(program: Command): void {
         "the final ShareResult. Subprocess callers parse these to render their " +
         "own UI (e.g. AppBar Tauri events).",
     )
+    .option(
+      "--all",
+      "Push every company you are a member of plus your personal vault. " +
+        "Company targets push `<hq-root>/companies/<slug>/`; personal pushes " +
+        "every top-level entry under <hq-root> minus the excluded set " +
+        "(.git, companies, repos, workspace). Implies --skip-unchanged + " +
+        "--propagate-deletes. Mutually exclusive with --company, --personal, " +
+        "and any explicit [paths].",
+    )
+    .option(
+      "--personal",
+      "Push to the caller's canonical personal vault (resolved from the " +
+        "cached Cognito session). When no [paths] are given, defaults to " +
+        "every top-level entry under <hq-root> minus the excluded set " +
+        "(.git, companies, repos, workspace) — same scope as `--all`'s " +
+        "personal slot. Mutually exclusive with --company and --all.",
+    )
     .action(
       async (
         paths: string[],
@@ -239,8 +443,46 @@ export function registerCloudCommands(program: Command): void {
           onConflict?: ConflictStrategy;
           credsFromStdin?: boolean;
           json?: boolean;
+          all?: boolean;
+          personal?: boolean;
         },
       ) => {
+        try {
+          assertSingleSelector(options, "push");
+        } catch (err) {
+          console.error(
+            chalk.red("\n✗ Push failed:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
+        }
+        if (options.all) {
+          if (paths && paths.length > 0) {
+            console.error(
+              chalk.red("\n✗ Push failed:"),
+              "`--all` cannot be combined with explicit [paths]. " +
+                "Drop the paths to fan out to every membership + personal, " +
+                "or drop --all to push specific paths to a single target.",
+            );
+            process.exit(1);
+          }
+          if (options.credsFromStdin) {
+            console.error(
+              chalk.red("\n✗ Push failed:"),
+              "`--all` cannot be combined with --creds-from-stdin (fanout " +
+                "needs to vend per-target credentials via the cached Cognito " +
+                "session). Run separate `--creds-from-stdin` invocations per " +
+                "target instead.",
+            );
+            process.exit(1);
+          }
+          await runPushAll(
+            options.hqRoot,
+            options.message,
+            options.onConflict,
+          );
+          return;
+        }
         const jsonMode = options.json === true;
         // Suppress the human banner/result output in JSON mode — the parent
         // process renders its own UI from the stderr ndjson stream.
@@ -252,15 +494,17 @@ export function registerCloudCommands(program: Command): void {
         };
 
         try {
-          const targetPaths =
-            paths && paths.length > 0 ? paths : [process.cwd()];
+          if (options.personal && options.credsFromStdin) {
+            throw new Error(
+              "`--personal` cannot be combined with --creds-from-stdin: " +
+                "--personal resolves the canonical person UID via the cached " +
+                "Cognito session, while --creds-from-stdin expects the caller " +
+                "to have already resolved entity + credentials. Pick one.",
+            );
+          }
 
           log(chalk.bold("\nHQ Sync — Push"));
           log(`  HQ root:  ${options.hqRoot}`);
-          log(
-            `  Company:  ${options.company ?? "(from .hq/config.json or stdin)"}`,
-          );
-          log(`  Paths:    ${targetPaths.join(", ")}\n`);
 
           // Resolve credentials. Two paths:
           //   1. --creds-from-stdin: parse JSON EntityContext from stdin (the
@@ -292,6 +536,47 @@ export function registerCloudCommands(program: Command): void {
             vaultConfig = buildVaultConfig(accessToken);
           }
 
+          // Resolve the target. For `--personal`, look up the caller's
+          // canonical person entity and force personalMode + journalSlug so
+          // share() lands files at hqRoot directly (no companies/<slug>/
+          // prefix). For everything else, the company is whatever the user
+          // passed or the active company from .hq/config.json.
+          let targetCompany = options.company;
+          let personalMode = false;
+          let journalSlug: string | undefined;
+          if (options.personal) {
+            const client = new VaultClient(vaultConfig!);
+            targetCompany = await resolveCanonicalPersonUid({
+              listMyMemberships: () => client.listMyMemberships(),
+              listPersonEntities: () => client.entity.listByType("person"),
+              getEntity: async () => null,
+            });
+            personalMode = true;
+            journalSlug = "personal";
+          }
+
+          // Default paths. For `--personal` with no explicit paths, default to
+          // the canonical personal-vault top-level scope so re-runs from a
+          // user shell push the same surface as `--all`'s personal slot.
+          // Otherwise preserve the historical "default to cwd" semantics so
+          // `hq sync push <file>` and bare `hq sync push` from inside the
+          // company tree both work as before.
+          const targetPaths =
+            paths && paths.length > 0
+              ? paths
+              : options.personal
+                ? computePersonalVaultPaths(options.hqRoot)
+                : [process.cwd()];
+
+          log(
+            `  Company:  ${
+              options.personal
+                ? `(personal: ${targetCompany})`
+                : (options.company ?? "(from .hq/config.json or stdin)")
+            }`,
+          );
+          log(`  Paths:    ${targetPaths.join(", ")}\n`);
+
           // In JSON mode, forward every share() event verbatim to stderr as
           // ndjson. In human mode, share()'s defaultConsoleLogger handles the
           // rendering (no onEvent → falls through to stdout/stderr printing).
@@ -310,13 +595,15 @@ export function registerCloudCommands(program: Command): void {
 
           const result = await share({
             paths: targetPaths,
-            company: options.company,
+            company: targetCompany,
             message: options.message,
             onConflict: options.onConflict,
             vaultConfig,
             entityContext,
             hqRoot: options.hqRoot,
             onEvent,
+            ...(personalMode ? { personalMode: true } : {}),
+            ...(journalSlug !== undefined ? { journalSlug } : {}),
             ...(author ? { author } : {}),
           });
 
@@ -384,19 +671,41 @@ export function registerCloudCommands(program: Command): void {
       "--all",
       "Pull every company you are a member of plus your personal vault " +
         "into <hq-root>. Companies land at <hq-root>/companies/<slug>; " +
-        "the personal vault syncs at <hq-root>. Ignores --company.",
+        "the personal vault syncs at <hq-root>. Mutually exclusive with " +
+        "--company and --personal.",
+    )
+    .option(
+      "--personal",
+      "Pull the caller's canonical personal vault into <hq-root> directly " +
+        "(no companies/<slug>/ prefix). Resolves the person UID automatically " +
+        "from the cached Cognito session. Mutually exclusive with --company " +
+        "and --all.",
     )
     .action(
       async (
         options: CommonSyncOptions & {
           onConflict?: ConflictStrategy;
           all?: boolean;
+          personal?: boolean;
         },
       ) => {
+        try {
+          assertSingleSelector(options, "pull");
+        } catch (err) {
+          console.error(
+            chalk.red("\n✗ Pull failed:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
+        }
         if (options.all) {
           await runPullAll(options.hqRoot, options.onConflict);
           return;
         }
+        if (options.personal) {
+          await runPullPersonal(options.hqRoot, options.onConflict);
+          return;
+        }
         try {
           console.log(chalk.bold("\nHQ Sync — Pull"));
           console.log(`  HQ root:  ${options.hqRoot}`);
@@ -489,6 +798,76 @@ export function registerCloudCommands(program: Command): void {
         process.exit(1);
       }
     });
+
+  program
+    .command("now")
+    .description(
+      "Bidirectional sync: push local changes, then pull remote updates " +
+        "(mirrors AppBar HQ Sync's \"Sync Now\" button)",
+    )
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .option(
+      "--company <slug>",
+      "Company slug or UID (defaults to active company in .hq/config.json)",
+    )
+    .option(
+      "--message <msg>",
+      "Optional message attached to journal entries for the push leg",
+    )
+    .option(
+      "--on-conflict <strategy>",
+      "Conflict strategy: overwrite | keep | abort (omit for interactive)",
+    )
+    .option(
+      "--all",
+      "Sync every company you are a member of plus your personal vault " +
+        "(pushAll then pullAll). Mutually exclusive with --company and " +
+        "--personal.",
+    )
+    .option(
+      "--personal",
+      "Sync the caller's canonical personal vault bidirectionally. " +
+        "Mutually exclusive with --company and --all.",
+    )
+    .action(
+      async (
+        options: CommonSyncOptions & {
+          onConflict?: ConflictStrategy;
+          message?: string;
+          all?: boolean;
+          personal?: boolean;
+        },
+      ) => {
+        try {
+          assertSingleSelector(options, "now");
+          if (options.all) {
+            await runNowAll(
+              options.hqRoot,
+              options.message,
+              options.onConflict,
+            );
+            return;
+          }
+          await runNowSingle(
+            options.hqRoot,
+            options.company,
+            options.personal === true,
+            options.message,
+            options.onConflict,
+          );
+        } catch (err) {
+          console.error(
+            chalk.red("\n✗ Sync now failed:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
+        }
+      },
+    );
 }
 
 async function runPullAll(
@@ -568,6 +947,293 @@ async function runPullAll(
   if (errored > 0) process.exit(1);
 }
 
+async function runPullPersonal(
+  hqRoot: string,
+  onConflict?: ConflictStrategy,
+): Promise<void> {
+  console.log(chalk.bold("\nHQ Sync — Pull (personal)"));
+  console.log(`  HQ root:  ${hqRoot}`);
+  console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+
+  try {
+    const accessToken = await ensureCognitoToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const client = new VaultClient(vaultConfig);
+    const personalUid = await resolveCanonicalPersonUid({
+      listMyMemberships: () => client.listMyMemberships(),
+      listPersonEntities: () => client.entity.listByType("person"),
+      getEntity: async () => null,
+    });
+
+    const result = await sync({
+      company: personalUid,
+      ...(onConflict ? { onConflict } : {}),
+      vaultConfig,
+      hqRoot,
+      personalMode: true,
+      journalSlug: "personal",
+    });
+
+    if (result.aborted) {
+      console.log(
+        chalk.yellow(
+          `\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
+        ),
+      );
+      process.exit(1);
+    }
+
+    console.log(
+      chalk.green(
+        `\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
+      ),
+    );
+  } catch (err) {
+    console.error(
+      chalk.red("\n✗ Pull (personal) failed:"),
+      err instanceof Error ? err.message : String(err),
+    );
+    process.exit(1);
+  }
+}
+
+async function runPushAll(
+  hqRoot: string,
+  message?: string,
+  onConflict?: ConflictStrategy,
+): Promise<void> {
+  console.log(chalk.bold("\nHQ Sync — Push (all)"));
+  console.log(`  HQ root:  ${hqRoot}`);
+  console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+
+  let result: PushAllResult;
+  try {
+    const accessToken = await ensureCognitoToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const realClient = new VaultClient(vaultConfig);
+    const author = resolveUploadAuthorFromCache();
+
+    const adapter: PullAllVaultClient = {
+      listMyMemberships: () => realClient.listMyMemberships(),
+      listPersonEntities: () => realClient.entity.listByType("person"),
+      getEntity: async (uid: string) => {
+        try {
+          return await realClient.entity.get(uid);
+        } catch {
+          return null;
+        }
+      },
+    };
+
+    result = await pushAll(
+      {
+        hqRoot,
+        ...(onConflict ? { onConflict } : {}),
+        ...(message ? { message } : {}),
+      },
+      {
+        vaultClient: adapter,
+        share: (opts) =>
+          share({
+            paths: opts.paths,
+            company: opts.company,
+            vaultConfig,
+            hqRoot: opts.hqRoot,
+            ...(opts.onConflict ? { onConflict: opts.onConflict } : {}),
+            ...(opts.personalMode !== undefined
+              ? { personalMode: opts.personalMode }
+              : {}),
+            ...(opts.journalSlug !== undefined
+              ? { journalSlug: opts.journalSlug }
+              : {}),
+            ...(opts.message !== undefined ? { message: opts.message } : {}),
+            ...(opts.skipUnchanged !== undefined
+              ? { skipUnchanged: opts.skipUnchanged }
+              : {}),
+            ...(opts.propagateDeletes !== undefined
+              ? { propagateDeletes: opts.propagateDeletes }
+              : {}),
+            ...(author ? { author } : {}),
+          }),
+      },
+    );
+  } catch (err) {
+    console.error(
+      chalk.red("\n✗ Push-all failed:"),
+      err instanceof Error ? err.message : String(err),
+    );
+    process.exit(1);
+  }
+
+  for (const row of result.perCompany) {
+    if (row.error) {
+      console.log(chalk.red(`  ✗ ${row.slug}: ${row.error}`));
+    } else if (row.result) {
+      const r = row.result;
+      const status = r.aborted ? chalk.yellow("⚠") : chalk.green("✓");
+      console.log(
+        `  ${status} ${row.slug}: ${r.filesUploaded} file(s), ` +
+          `${formatBytes(r.bytesUploaded)}, ${r.filesSkipped} skipped, ` +
+          `${r.filesDeleted} deleted, ${r.conflictPaths.length} conflict(s)` +
+          (r.aborted ? " — aborted" : ""),
+      );
+    }
+  }
+
+  const errored = result.errors.length;
+  const summary =
+    `\nPushed ${result.filesUploaded} file(s) ` +
+    `(${formatBytes(result.bytesUploaded)}) across ${result.attempted} ` +
+    `target(s); ${result.filesDeleted} deleted; ${errored} error(s)`;
+  console.log(errored > 0 ? chalk.yellow(summary) : chalk.green(summary));
+  if (errored > 0) process.exit(1);
+}
+
+async function runNowSingle(
+  hqRoot: string,
+  company: string | undefined,
+  personal: boolean,
+  message?: string,
+  onConflict?: ConflictStrategy,
+): Promise<void> {
+  console.log(chalk.bold("\nHQ Sync — Now"));
+  console.log(`  HQ root:  ${hqRoot}`);
+  console.log(`  Target:   ${personal ? "(personal)" : (company ?? "(active company)")}`);
+  console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+
+  try {
+    const accessToken = await ensureCognitoToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const author = resolveUploadAuthorFromCache();
+
+    // Resolve the target. For --personal, look up the canonical person and
+    // route paths/journal through personalMode. Otherwise use the company arg
+    // (or fall back to the active company inside share()/sync()).
+    let targetCompany = company;
+    let personalMode = false;
+    let journalSlug: string | undefined;
+    let pushPaths: string[];
+
+    if (personal) {
+      const client = new VaultClient(vaultConfig);
+      targetCompany = await resolveCanonicalPersonUid({
+        listMyMemberships: () => client.listMyMemberships(),
+        listPersonEntities: () => client.entity.listByType("person"),
+        getEntity: async () => null,
+      });
+      personalMode = true;
+      journalSlug = "personal";
+      pushPaths = computePersonalVaultPaths(hqRoot);
+    } else {
+      // For company targets we need a concrete slug to compute the push path.
+      // share() can resolve `company` itself for the upload, but the path
+      // computation must happen here. Use the explicit company if given;
+      // otherwise fall back to the active-company resolution inside the
+      // engine and compute paths from `hqRoot/companies` (share() will refuse
+      // anything outside that subtree anyway).
+      const slug = company ?? readActiveCompanySlug(hqRoot);
+      if (!slug) {
+        throw new Error(
+          "No company specified and no active company found. " +
+            "Use --company <slug>, --personal, or set up .hq/config.json.",
+        );
+      }
+      pushPaths = [path.join(hqRoot, "companies", slug)];
+    }
+
+    // Push first so the subsequent pull doesn't redownload files we were
+    // about to broadcast (matches hq-sync-runner ordering).
+    console.log(chalk.dim("  → push leg"));
+    const pushResult = await share({
+      paths: pushPaths,
+      company: targetCompany,
+      vaultConfig,
+      hqRoot,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      ...(onConflict ? { onConflict } : {}),
+      ...(message ? { message } : {}),
+      ...(personalMode ? { personalMode: true } : {}),
+      ...(journalSlug !== undefined ? { journalSlug } : {}),
+      ...(author ? { author } : {}),
+    });
+    console.log(
+      `    ${pushResult.aborted ? chalk.yellow("⚠") : chalk.green("✓")} ` +
+        `${pushResult.filesUploaded} uploaded, ${pushResult.filesSkipped} skipped, ` +
+        `${pushResult.filesDeleted} deleted` +
+        (pushResult.aborted ? " — aborted" : ""),
+    );
+    if (pushResult.aborted) {
+      console.log(chalk.yellow("\n⚠ Sync now aborted on push leg; pull skipped."));
+      process.exit(1);
+    }
+
+    console.log(chalk.dim("  → pull leg"));
+    const pullResult = await sync({
+      company: targetCompany,
+      vaultConfig,
+      hqRoot,
+      ...(onConflict ? { onConflict } : {}),
+      ...(personalMode ? { personalMode: true } : {}),
+      ...(journalSlug !== undefined ? { journalSlug } : {}),
+    });
+    console.log(
+      `    ${pullResult.aborted ? chalk.yellow("⚠") : chalk.green("✓")} ` +
+        `${pullResult.filesDownloaded} downloaded, ${pullResult.filesSkipped} skipped, ` +
+        `${pullResult.conflicts} conflict(s)` +
+        (pullResult.aborted ? " — aborted" : ""),
+    );
+
+    if (pullResult.aborted) {
+      console.log(chalk.yellow("\n⚠ Sync now finished with pull leg aborted."));
+      process.exit(1);
+    }
+    console.log(chalk.green("\n✓ Sync now complete"));
+  } catch (err) {
+    console.error(
+      chalk.red("\n✗ Sync now failed:"),
+      err instanceof Error ? err.message : String(err),
+    );
+    process.exit(1);
+  }
+}
+
+async function runNowAll(
+  hqRoot: string,
+  message?: string,
+  onConflict?: ConflictStrategy,
+): Promise<void> {
+  console.log(chalk.bold("\nHQ Sync — Now (all)"));
+  console.log(`  HQ root:  ${hqRoot}`);
+  console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+
+  // Push first (matches runner), then pull. Re-uses the per-leg orchestrators
+  // so the per-target rendering, error isolation, and exit codes are
+  // identical to running `push --all` then `pull --all` back-to-back.
+  console.log(chalk.dim("→ push --all"));
+  await runPushAll(hqRoot, message, onConflict);
+  console.log(chalk.dim("\n→ pull --all"));
+  await runPullAll(hqRoot, onConflict);
+}
+
+/**
+ * Best-effort read of the active company slug from `<hqRoot>/.hq/config.json`.
+ * Returns undefined when the file is missing, malformed, or has no
+ * `activeCompany` field — `runNowSingle` surfaces a clean error in that case.
+ */
+function readActiveCompanySlug(hqRoot: string): string | undefined {
+  const configPath = path.join(hqRoot, ".hq", "config.json");
+  if (!fs.existsSync(configPath)) return undefined;
+  try {
+    const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8")) as {
+      activeCompany?: string;
+    };
+    return cfg.activeCompany;
+  } catch {
+    return undefined;
+  }
+}
+
 function formatBytes(bytes: number): string {
   if (bytes === 0) return "0 B";
   const units = ["B", "KB", "MB", "GB"];