@indigoai-us/hq-cli 5.161.0 → 5.163.0

package/dist/lib/mesh/live/session-events-client.d.ts

@@ -23,6 +23,7 @@ export interface SessionEventsPostResult {
     body: unknown;
     ok: boolean;
     retryable: boolean;
+    retryAfterMs?: number;
     networkError?: boolean;
 }
 /** Contract §2.3 batch ingest ack (parsed from a 2xx body). */
@@ -51,6 +52,7 @@ export declare function createSessionEventsPoster(opts: {
     post?: (path: string, body: SessionEventsBatchBody) => Promise<{
         status: number;
         body: unknown;
+        headers?: Pick<Headers, "get">;
     }>;
 }): SessionEventsPoster;
 /** Resolve API base: HQ_VAULT_API_URL overrides DEFAULT_VAULT_API_URL. */

package/dist/lib/mesh/live/session-events-client.js

@@ -15,6 +15,27 @@ export const WRITABLE_CONTEXT_STATUSES = new Set([
     "bound",
     "migration_pending",
 ]);
+/** Parse the Retry-After delta-seconds or HTTP-date form into milliseconds. */
+function parseRetryAfterMs(value, nowMs = Date.now()) {
+    if (value === null || !value.trim())
+        return undefined;
+    const trimmed = value.trim();
+    if (/^\d+$/.test(trimmed)) {
+        const delayMs = Number(trimmed) * 1_000;
+        return Number.isSafeInteger(delayMs) ? delayMs : undefined;
+    }
+    if (/^[+-]/.test(trimmed))
+        return undefined;
+    const retryAtMs = Date.parse(trimmed);
+    if (!Number.isFinite(retryAtMs))
+        return undefined;
+    return Math.max(0, retryAtMs - nowMs);
+}
+function retryAfterForStatus(status, headers) {
+    if (status !== 429 && status !== 503)
+        return undefined;
+    return parseRetryAfterMs(headers?.get("retry-after") ?? null);
+}
 /**
  * Parse a batch ingest response body. Returns null when the body is not an
  * object (caller should retain events rather than treating them as posted).
@@ -65,9 +86,11 @@ export function createSessionEventsPoster(opts) {
         try {
             if (opts.post) {
                 const res = await opts.post(SESSION_EVENTS_PATH, body);
+                const retryAfterMs = retryAfterForStatus(res.status, res.headers);
                 return {
                     status: res.status,
                     body: res.body,
+                    ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
                     ...classifySessionEventsResponse(res.status),
                 };
             }
@@ -88,9 +111,11 @@ export function createSessionEventsPoster(opts) {
                     parsed = { raw: text };
                 }
             }
+            const retryAfterMs = retryAfterForStatus(res.status, res.headers);
             return {
                 status: res.status,
                 body: parsed,
+                ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
                 ...classifySessionEventsResponse(res.status),
             };
         }

package/dist/lib/service-manager/systemd.d.ts

@@ -10,8 +10,8 @@ import { type ServiceHostPaths, type ServiceSpec } from "./types.js";
 import type { RunCommand } from "./launchd.js";
 export declare const SYSTEMD_PATH_ENV = "/usr/local/bin:/usr/bin:/bin";
 export declare function systemdUserDir(home: string): string;
-export declare function systemdUnitName(spec: Pick<ServiceSpec, "name">): string;
-export declare function systemdUnitPath(home: string, spec: Pick<ServiceSpec, "name">): string;
+export declare function systemdUnitName(spec: Pick<ServiceSpec, "name" | "unitName">): string;
+export declare function systemdUnitPath(home: string, spec: Pick<ServiceSpec, "name" | "unitName">): string;
 export declare function renderSystemdUserUnit(spec: ServiceSpec, host: ServiceHostPaths): string;
 export declare function activateSystemd(unitName: string, run: RunCommand): void;
 export declare function deactivateSystemd(unitName: string, run: RunCommand): void;

package/dist/lib/service-manager/systemd.js

@@ -13,7 +13,7 @@ export function systemdUserDir(home) {
     return path.join(home, ".config", "systemd", "user");
 }
 export function systemdUnitName(spec) {
-    return `hq-agent-${spec.name}.service`;
+    return spec.unitName ?? `hq-agent-${spec.name}.service`;
 }
 export function systemdUnitPath(home, spec) {
     return path.join(systemdUserDir(home), systemdUnitName(spec));

package/dist/lib/service-manager/types.d.ts

@@ -19,6 +19,8 @@ export interface ServiceSpec {
     env: Record<string, string>;
     /** Seconds to wait before a restart after exit. */
     restartSec: number;
+    /** systemd unit file name; defaults to `hq-agent-<name>.service`. */
+    unitName?: string;
 }
 export interface ServiceHostPaths {
     home: string;

package/dist/main.d.ts

@@ -5,6 +5,7 @@
 import "./node-preflight.js";
 import "./node-network-compat.js";
 import { Sentry } from "./sentry.js";
+import { upgradeToTeam } from "./utils/team-upgrade.js";
 /**
  * Total time one CLI invocation may await foreground network work. This spans
  * the hard version decision, pre-action observability, and release-health
@@ -21,6 +22,11 @@ export type TopLevelErrorDependencies = {
     sentry: Pick<typeof Sentry, "captureException">;
     stderr: Pick<typeof process.stderr, "write">;
     setExitCode: (code: number) => void;
+    interactive?: boolean;
+    argv?: readonly string[];
+    ask?: (question: string) => Promise<string>;
+    openUrl?: (url: string) => Promise<void>;
+    upgradeToTeam?: typeof upgradeToTeam;
 };
 /** Classify a top-level failure without making the CLI process boundary opaque to tests. */
 export declare function handleTopLevelError(err: unknown, deps?: TopLevelErrorDependencies): Promise<void>;

package/dist/main.js

@@ -35,7 +35,7 @@ import { browserLoginAbandonedMessage } from "./utils/browser-login-abandoned.js
 import { callbackPortBusyMessage, DEFAULT_CALLBACK_PORT } from "./utils/callback-port-busy.js";
 import { DEFAULT_COGNITO } from "./utils/cognito-session.js";
 import { isCompanySelectionError } from "./utils/company-selection-error.js";
-import { canOfferTeamUpgrade, formatPlanGateError, isPlanGateError, offerTeamUpgrade, } from "./utils/plan-gate-error.js";
+import { canOfferTeamUpgrade, formatPlanGateError, isPlanGateError, offerTeamUpgrade, offerUpgradeLink, } from "./utils/plan-gate-error.js";
 import { upgradeToTeam } from "./utils/team-upgrade.js";
 import { refreshVersionCache, staleAgainstCachedLatest, } from "./utils/version-check.js";
 import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
@@ -379,20 +379,60 @@ export async function handleTopLevelError(err, deps = defaultTopLevelErrorDepend
         deps.setExitCode(1);
     }
     else if (isPlanGateError(err)) {
-        // hq-pro's plan denials are expected product limits, never a CLI crash.
-        // The shared vault client has already decoded and typed the small safe
-        // envelope; do not expose its raw body or retry a rejected creation.
-        deps.stderr.write(`hq: ${formatPlanGateError(err)}\n`);
+        // Plan denials are expected product limits, never a CLI crash. The
+        // server URL is always shown. Company refusals that the Workforce
+        // checkout satisfies retain the direct Stripe checkout action.
+        const interactive = deps.interactive ?? canOfferTeamUpgrade(deps.argv);
+        const message = formatPlanGateError(err, { urlOnly: !interactive });
+        deps.stderr.write(interactive ? `hq: ${message}\n` : `${message}\n`);
         deps.setExitCode(1);
-        if (canOfferTeamUpgrade()) {
-            try {
-                await offerTeamUpgrade(async () => {
-                    await upgradeToTeam({ companyUid: err.details.companyUid });
-                });
+        if (interactive && err.details.upgradeUrl) {
+            const companyUid = err.details.companyUid;
+            const isCompanyWorkforceCheckout = typeof companyUid === "string" &&
+                /^cmp_[A-Za-z0-9_-]+$/.test(companyUid) &&
+                (err.code === "PLAN_REQUIRED" ||
+                    err.code === "MEETING_PLAN_REQUIRED" ||
+                    err.code === "BILLING_REQUIRED");
+            if (isCompanyWorkforceCheckout && companyUid) {
+                try {
+                    await offerTeamUpgrade(async () => {
+                        await (deps.upgradeToTeam ?? upgradeToTeam)({ companyUid });
+                    }, {
+                        interactive: true,
+                        argv: deps.argv,
+                        ask: deps.ask,
+                    });
+                }
+                catch (upgradeErr) {
+                    const message = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
+                    deps.stderr.write(`hq: ${message}\n`);
+                    try {
+                        await offerUpgradeLink(err.details.upgradeUrl, {
+                            interactive: true,
+                            argv: deps.argv,
+                            ask: deps.ask,
+                            openUrl: deps.openUrl,
+                        });
+                    }
+                    catch (linkErr) {
+                        const linkMessage = linkErr instanceof Error ? linkErr.message : String(linkErr);
+                        deps.stderr.write(`hq: ${linkMessage}\n`);
+                    }
+                }
             }
-            catch (upgradeErr) {
-                const message = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
-                deps.stderr.write(`hq: ${message}\n`);
+            else {
+                try {
+                    await offerUpgradeLink(err.details.upgradeUrl, {
+                        interactive: true,
+                        argv: deps.argv,
+                        ask: deps.ask,
+                        openUrl: deps.openUrl,
+                    });
+                }
+                catch (upgradeErr) {
+                    const message = upgradeErr instanceof Error ? upgradeErr.message : String(upgradeErr);
+                    deps.stderr.write(`hq: ${message}\n`);
+                }
             }
         }
     }

package/dist/utils/cognito-session.d.ts

@@ -81,6 +81,10 @@ export declare const DEFAULT_VAULT_API_URL: string;
  */
 export declare function resolveDefaultHqRoot(opts?: {
     onMissing?: "throw" | "fallback";
+    /** Defaults to process.env, process.cwd() and os.homedir(). */
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    home?: string;
 }): string;
 export declare const DEFAULT_HQ_ROOT: string;
 /**

package/dist/utils/cognito-session.js

@@ -102,22 +102,24 @@ export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ?? "https://hq
  * Re-importable as a function for command-time resolution and tests.
  */
 export function resolveDefaultHqRoot(opts = {}) {
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? os.homedir();
     // Tier 1: explicit override.
-    if (process.env.HQ_ROOT)
-        return path.resolve(process.env.HQ_ROOT);
+    if (env.HQ_ROOT)
+        return path.resolve(env.HQ_ROOT);
     // Tier 2: working-tree walk-up — operate on the HQ tree you're inside.
-    let cur = path.resolve(process.cwd());
+    let cur = path.resolve(opts.cwd ?? process.cwd());
     while (cur !== path.dirname(cur)) {
         if (isHqRoot(cur))
             return cur;
         cur = path.dirname(cur);
     }
     // Tiers 3–4: the installer/menubar's canonical "where is HQ" records.
-    const fromConfig = readHqRootFromHqConfig(path.join(os.homedir(), ".hq"));
+    const fromConfig = readHqRootFromHqConfig(path.join(home, ".hq"));
     if (fromConfig)
         return path.resolve(fromConfig);
     // Tier 5: discover a valid HQ root in the well-known locations.
-    const discovered = discoverHqRootViaCoreYaml();
+    const discovered = discoverHqRootViaCoreYaml(home);
     if (discovered)
         return discovered;
     // Tier 6: nothing resolved.
@@ -127,7 +129,7 @@ export function resolveDefaultHqRoot(opts = {}) {
             "or install HQ via the installer/menubar so ~/.hq/menubar.json records " +
             "its location.");
     }
-    return path.join(os.homedir(), "hq");
+    return path.join(home, "hq");
 }
 /**
  * Read the configured HQ root from the installer/menubar records under
@@ -156,8 +158,7 @@ function readJsonStringField(file, field) {
     }
 }
 /** Well-known parent locations an HQ tree commonly lives in (mirrors hq-sync). */
-function hqDiscoveryCandidates() {
-    const home = os.homedir();
+function hqDiscoveryCandidates(home = os.homedir()) {
     return [
         path.join(home, "HQ"),
         path.join(home, "hq"),
@@ -172,8 +173,8 @@ function hqDiscoveryCandidates() {
  * signature. First match wins; returns undefined if none qualify. Cheap — a
  * few stats plus one small YAML parse on a hit.
  */
-function discoverHqRootViaCoreYaml() {
-    return hqDiscoveryCandidates().find(isValidHqRootSignature);
+function discoverHqRootViaCoreYaml(home) {
+    return hqDiscoveryCandidates(home).find(isValidHqRootSignature);
 }
 /**
  * True iff `dir` carries a valid hq-core `core.yaml` — canonical

package/dist/utils/plan-gate-error.d.ts

@@ -1,30 +1,44 @@
-export type PlanGateCode = "PLAN_LIMIT_EXCEEDED" | "PLAN_REQUIRED"
-/**
- * US-054: a PERSONAL scope asked for a feature the paid Individual plan
- * includes and the free tier does not. A different plan, a different price
- * and a different remedy from the company codes above, so it is its own
- * code rather than a reuse of `PLAN_REQUIRED` with company copy.
- */
- | "PERSONAL_PLAN_REQUIRED";
+export type PlanGateCode = "PLAN_LIMIT_EXCEEDED" | "PLAN_REQUIRED" | "MEETING_PLAN_REQUIRED"
+/** A PERSONAL scope asked for a feature the paid Individual plan includes. */
+ | "PERSONAL_PLAN_REQUIRED"
+/** External agent enrollment was denied by the company plan. */
+ | "BILLING_REQUIRED";
 export interface PlanGateDetails {
     resource?: string;
-    /** The refused feature, on a `PERSONAL_PLAN_REQUIRED` denial. */
     feature?: string;
     used?: number;
     limit?: number;
     upgradeUrl?: string;
-    /** Best-effort target captured by the shared HTTP client for interactive checkout. */
+    reason?: string;
+    /** Company target from request context or the server's UID-keyed billing URL. */
     companyUid?: string;
 }
+/** One renderer for server-selected upgrade links across CLI plan refusals. */
+export declare function formatUpgradeRefusal(reason: string, upgradeUrl: string | undefined, options?: {
+    urlOnly?: boolean;
+}): string;
+/** Recover a company UID only from the server's UID-keyed billing callback. */
+export declare function companyUidFromPlanUpgradeUrl(value: unknown): string | undefined;
 export declare class PlanGateError extends Error {
     readonly code: PlanGateCode;
     readonly details: PlanGateDetails;
     constructor(code: PlanGateCode, details: PlanGateDetails);
 }
 export declare function isPlanGateError(err: unknown): err is PlanGateError;
-export declare function formatPlanGateError(err: PlanGateError): string;
+/** Plain, stable CLI copy for plan-gated resource creation. */
+export declare function formatPlanGateError(err: PlanGateError, options?: {
+    urlOnly?: boolean;
+}): string;
 export declare function canOfferTeamUpgrade(argv?: readonly string[]): boolean;
-/** Ask once, only on a real interactive terminal. */
+export interface UpgradeLinkOfferDependencies {
+    ask?: (question: string) => Promise<string>;
+    openUrl?: (url: string) => Promise<void>;
+    argv?: readonly string[];
+    interactive?: boolean;
+}
+/** Ask before opening the exact URL returned by the server. */
+export declare function offerUpgradeLink(url: string, deps?: UpgradeLinkOfferDependencies): Promise<boolean>;
+/** Legacy checkout callback retained for callers outside the shared refusal paths. */
 export declare function offerTeamUpgrade(onConfirm: () => Promise<void>, deps?: {
     ask?: (question: string) => Promise<string>;
     argv?: readonly string[];
@@ -33,7 +47,7 @@ export declare function offerTeamUpgrade(onConfirm: () => Promise<void>, deps?:
 /** Decode an already-read JSON envelope from either shared HTTP client. */
 export declare function planGateErrorFromPayload(status: number, body: unknown, companyUid?: string): PlanGateError | null;
 /**
- * Decode only the two deliberate plan-gate envelopes. Malformed, unrelated,
+ * Decode the supported plan-gate envelopes. Malformed, unrelated,
  * or non-402 responses retain their existing command-specific handling.
  */
 export declare function planGateErrorFromResponse(response: Response, companyUid?: string): Promise<{

package/dist/utils/plan-gate-error.js

@@ -4,19 +4,74 @@
  * message instead of every command parsing and printing a server response.
  */
 import { renderPersonalPlanFeatureNotice } from "../lib/plan-limit-nag.js";
-const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to HQ Workforce.";
+function planGateReason(code, details) {
+    if (details.reason?.trim())
+        return details.reason.trim();
+    if (code === "PLAN_LIMIT_EXCEEDED" &&
+        typeof details.resource === "string" &&
+        typeof details.used === "number" &&
+        typeof details.limit === "number") {
+        return `Starter plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`;
+    }
+    if (code === "PERSONAL_PLAN_REQUIRED") {
+        return renderPersonalPlanFeatureNotice(details.feature ?? "this feature", null);
+    }
+    if (code === "MEETING_PLAN_REQUIRED") {
+        return "HQ Workforce plan required to invite a meeting bot.";
+    }
+    if (code === "BILLING_REQUIRED") {
+        return "Upgrade the company plan before enrolling an external agent.";
+    }
+    return "HQ Workforce plan required for this feature.";
+}
+/** One renderer for server-selected upgrade links across CLI plan refusals. */
+export function formatUpgradeRefusal(reason, upgradeUrl, options = {}) {
+    const safeUrl = safeUpgradeUrl(upgradeUrl);
+    if (options.urlOnly && safeUrl)
+        return safeUrl;
+    if (!safeUrl)
+        return reason;
+    return `${reason}\nUpgrade: ${safeUrl}`;
+}
+function safeUpgradeUrl(value) {
+    if (typeof value !== "string" ||
+        value.trim() !== value ||
+        !/^https:\/\//i.test(value)) {
+        return undefined;
+    }
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" ||
+            !url.hostname ||
+            url.username ||
+            url.password) {
+            return undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return value;
+}
+/** Recover a company UID only from the server's UID-keyed billing callback. */
+export function companyUidFromPlanUpgradeUrl(value) {
+    const safeUrl = safeUpgradeUrl(value);
+    if (!safeUrl)
+        return undefined;
+    const callbackUrl = new URL(safeUrl).searchParams.get("callbackUrl");
+    if (!callbackUrl)
+        return undefined;
+    const match = /^\/api\/companies\/(cmp_[A-Za-z0-9_-]+)\/billing\/upgrade\/?$/.exec(callbackUrl);
+    return match?.[1];
+}
+function formatPlanGateErrorText(code, details) {
+    return formatUpgradeRefusal(planGateReason(code, details), details.upgradeUrl);
+}
 export class PlanGateError extends Error {
     code;
     details;
     constructor(code, details) {
-        // Commands with their own expected-error boundary commonly print
-        // `err.message`. Keeping the friendly copy here means those boundaries
-        // retain the same plan-gate voice as main.ts without per-command handling.
-        // The HQ Workforce hint is company advice; a personal denial ends at its
-        // own notice, which already names the Individual plan and its checkout.
-        super(code === "PERSONAL_PLAN_REQUIRED"
-            ? formatPlanGateDetails(code, details)
-            : [formatPlanGateDetails(code, details), TEAM_UPGRADE_HINT].join("\n"));
+        super(formatPlanGateErrorText(code, details));
         this.code = code;
         this.details = details;
         this.name = "PlanGateError";
@@ -26,56 +81,52 @@ export function isPlanGateError(err) {
     return err instanceof PlanGateError;
 }
 /** Plain, stable CLI copy for plan-gated resource creation. */
-function formatPlanGateDetails(code, details) {
-    const existingResourcesNote = "Existing resources will keep working.";
-    if (code === "PLAN_LIMIT_EXCEEDED" &&
-        typeof details.resource === "string" &&
-        typeof details.used === "number" &&
-        typeof details.limit === "number") {
-        const upgrade = typeof details.upgradeUrl === "string"
-            ? `Upgrade to HQ Workforce ($500/mo) to remove limits: ${details.upgradeUrl}`
-            : "Upgrade to HQ Workforce ($500/mo) to remove limits.";
-        return [
-            `Starter plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`,
-            upgrade,
-            existingResourcesNote,
-        ].join("\n");
-    }
-    // A personal scope is not a workspace: it has no members to trim, no $500
-    // tier to buy, and nothing of its own is paused. One line, the plan's own
-    // copy, and no company remedy.
-    if (code === "PERSONAL_PLAN_REQUIRED") {
-        return renderPersonalPlanFeatureNotice(details.feature ?? "this feature", details.upgradeUrl ?? null);
-    }
-    const upgrade = typeof details.upgradeUrl === "string"
-        ? `Upgrade to HQ Workforce ($500/mo) to remove limits: ${details.upgradeUrl}`
-        : "Upgrade to HQ Workforce ($500/mo) to remove limits.";
-    return [
-        "HQ Workforce plan required for this feature.",
-        upgrade,
-        existingResourcesNote,
-    ].join("\n");
-}
-export function formatPlanGateError(err) {
-    if (err.code === "PERSONAL_PLAN_REQUIRED") {
-        return formatPlanGateDetails(err.code, err.details);
-    }
-    return [
-        formatPlanGateDetails(err.code, err.details),
-        TEAM_UPGRADE_HINT,
-    ].join("\n");
+export function formatPlanGateError(err, options = {}) {
+    return formatUpgradeRefusal(planGateReason(err.code, err.details), err.details.upgradeUrl, options);
 }
 export function canOfferTeamUpgrade(argv = process.argv) {
     return Boolean(process.stdin.isTTY && process.stderr.isTTY) &&
         !process.env.CI &&
         !argv.includes("--json");
 }
-/** Ask once, only on a real interactive terminal. */
+/** Ask before opening the exact URL returned by the server. */
+export async function offerUpgradeLink(url, deps = {}) {
+    const safeUrl = safeUpgradeUrl(url);
+    if (!safeUrl)
+        return false;
+    if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
+        return false;
+    let answer;
+    if (deps.ask) {
+        answer = await deps.ask("Open upgrade link now? [y/N] ");
+    }
+    else {
+        const { createInterface } = await import("node:readline/promises");
+        const readline = createInterface({ input: process.stdin, output: process.stderr });
+        try {
+            answer = await readline.question("Open upgrade link now? [y/N] ");
+        }
+        finally {
+            readline.close();
+        }
+    }
+    if (!/^y(?:es)?$/i.test(answer.trim()))
+        return false;
+    if (deps.openUrl) {
+        await deps.openUrl(safeUrl);
+    }
+    else {
+        const { default: open } = await import("open");
+        await open(safeUrl);
+    }
+    return true;
+}
+/** Legacy checkout callback retained for callers outside the shared refusal paths. */
 export async function offerTeamUpgrade(onConfirm, deps = {}) {
     if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
         return false;
     if (deps.ask) {
-        const answer = await deps.ask("Upgrade to HQ Workforce ($500/mo) now? [y/N] ");
+        const answer = await deps.ask("Upgrade now? (opens checkout) [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();
@@ -84,7 +135,7 @@ export async function offerTeamUpgrade(onConfirm, deps = {}) {
     const { createInterface } = await import("node:readline/promises");
     const readline = createInterface({ input: process.stdin, output: process.stderr });
     try {
-        const answer = await readline.question("Upgrade to HQ Workforce ($500/mo) now? [y/N] ");
+        const answer = await readline.question("Upgrade now? (opens checkout) [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();
@@ -106,28 +157,52 @@ export function planGateErrorFromPayload(status, body, companyUid) {
     // through to the company path below (defensive consumer).
     if (payload.error === "plan_feature_unavailable" &&
         payload.scope === "personal") {
+        const upgradeUrl = safeUpgradeUrl(payload.upgradeUrl);
         return new PlanGateError("PERSONAL_PLAN_REQUIRED", {
             ...(typeof payload.feature === "string"
                 ? { feature: payload.feature }
                 : {}),
-            ...(typeof payload.upgradeUrl === "string"
-                ? { upgradeUrl: payload.upgradeUrl }
-                : {}),
+            ...(upgradeUrl ? { upgradeUrl } : {}),
         });
     }
-    if (payload.code !== "PLAN_LIMIT_EXCEEDED" && payload.code !== "PLAN_REQUIRED") {
+    const code = payload.code;
+    const upgradeUrl = safeUpgradeUrl(payload.upgradeUrl);
+    const targetCompanyUid = companyUid ?? companyUidFromPlanUpgradeUrl(upgradeUrl);
+    const planLimit = payload.planLimit !== null &&
+        typeof payload.planLimit === "object" &&
+        !Array.isArray(payload.planLimit)
+        ? payload.planLimit
+        : undefined;
+    const isTeamPlanBillingRequired = code === "BILLING_REQUIRED" && planLimit?.requiredPlan === "team";
+    if (code === "BILLING_REQUIRED") {
+        if (!isTeamPlanBillingRequired ||
+            !targetCompanyUid ||
+            !/^cmp_[A-Za-z0-9_-]+$/.test(targetCompanyUid)) {
+            return null;
+        }
+    }
+    else if (code !== "PLAN_LIMIT_EXCEEDED" &&
+        code !== "PLAN_REQUIRED" &&
+        code !== "MEETING_PLAN_REQUIRED") {
         return null;
     }
-    return new PlanGateError(payload.code, {
+    const reason = typeof payload.message === "string"
+        ? payload.message
+        : typeof payload.error === "string" && payload.error !== payload.code
+            ? payload.error
+            : undefined;
+    return new PlanGateError(code, {
         ...(typeof payload.resource === "string" ? { resource: payload.resource } : {}),
+        ...(typeof payload.feature === "string" ? { feature: payload.feature } : {}),
         ...(typeof payload.used === "number" ? { used: payload.used } : {}),
         ...(typeof payload.limit === "number" ? { limit: payload.limit } : {}),
-        ...(typeof payload.upgradeUrl === "string" ? { upgradeUrl: payload.upgradeUrl } : {}),
-        ...(companyUid ? { companyUid } : {}),
+        ...(upgradeUrl ? { upgradeUrl } : {}),
+        ...(reason ? { reason } : {}),
+        ...(targetCompanyUid ? { companyUid: targetCompanyUid } : {}),
     });
 }
 /**
- * Decode only the two deliberate plan-gate envelopes. Malformed, unrelated,
+ * Decode the supported plan-gate envelopes. Malformed, unrelated,
  * or non-402 responses retain their existing command-specific handling.
  */
 export async function planGateErrorFromResponse(response, companyUid) {

package/dist/utils/self-update.d.ts

@@ -83,6 +83,8 @@ export type SelfUpdateAction =
  | "update-ineffective"
 /** Updated and the command re-ran on the new version; exit with `reexecStatus`. */
  | "reexec"
+/** Updated with no re-exec (the `hq daemon` updater restarts the daemon instead). */
+ | "updated"
 /**
  * Unattended caller: replacing the CLI in place is unsafe here, so nothing
  * was attempted and the command runs on the current version. An attended
@@ -171,4 +173,11 @@ export declare function autoUpdateAndReexec(argv: readonly string[], latest: str
  * are preserved.
  */
 export declare function selfUpdateAndReexec(argv: readonly string[], deps?: SelfUpdateDeps): Promise<SelfUpdateOutcome>;
+/**
+ * `hq daemon` updater service: update to npm latest with nobody at a terminal
+ * and no re-exec. It runs as its own short-lived child of the daemon, so no
+ * user command is waiting on the package being replaced; after an "updated"
+ * outcome the daemon restarts itself onto the new version.
+ */
+export declare function daemonSelfUpdate(deps?: SelfUpdateDeps): Promise<SelfUpdateOutcome>;
 //# sourceMappingURL=self-update.d.ts.map

package/dist/utils/self-update.js

@@ -292,6 +292,10 @@ async function updateAndReexec(argv, flavor, known, deps) {
     catch {
         // Defensive only; the default helper already absorbs manager failures.
     }
+    if (!flavor.reexec) {
+        console.error(chalk.dim(`✓ hq-cli updated to ${latest}.`));
+        return { action: "updated", latest };
+    }
     const childEnv = { ...env, [REEXEC_GUARD_ENV]: "1" };
     const status = (deps.reexec ?? reexecHq)([...argv.slice(2)], childEnv);
     if (status === null) {
@@ -309,7 +313,7 @@ async function updateAndReexec(argv, flavor, known, deps) {
  * this resolve it from the registry.
  */
 export async function autoUpdateAndReexec(argv, latest, deps = {}) {
-    return updateAndReexec(argv, { noun: "command", verbose: false, lock: true, onlyWhenAttended: true }, latest, deps);
+    return updateAndReexec(argv, { noun: "command", verbose: false, lock: true, onlyWhenAttended: true, reexec: true }, latest, deps);
 }
 /**
  * Rescue path: update to npm latest and re-exec the rescue on the new version.
@@ -318,6 +322,15 @@ export async function autoUpdateAndReexec(argv, latest, deps = {}) {
  * are preserved.
  */
 export async function selfUpdateAndReexec(argv, deps = {}) {
-    return updateAndReexec(argv, { noun: "rescue", verbose: true, lock: true, onlyWhenAttended: false }, null, deps);
+    return updateAndReexec(argv, { noun: "rescue", verbose: true, lock: true, onlyWhenAttended: false, reexec: true }, null, deps);
+}
+/**
+ * `hq daemon` updater service: update to npm latest with nobody at a terminal
+ * and no re-exec. It runs as its own short-lived child of the daemon, so no
+ * user command is waiting on the package being replaced; after an "updated"
+ * outcome the daemon restarts itself onto the new version.
+ */
+export async function daemonSelfUpdate(deps = {}) {
+    return updateAndReexec([], { noun: "daemon update", verbose: false, lock: true, onlyWhenAttended: false, reexec: false }, null, deps);
 }
 //# sourceMappingURL=self-update.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.161.0",
+  "version": "5.163.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {