@indigoai-us/hq-cli 5.162.0 → 5.164.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## [Unreleased]
 
+## [5.164.0] — 2026-09-24
+
+### Fixed
+
+- When a startup import fails, hq-cli checks for an update lock, a retired package
+  directory, or install-tree changes for 1.5 seconds. If none appears, it exits
+  with `npm install -g @indigoai-us/hq-cli@latest` instead of waiting 90 seconds.
+  Sentry context replaces the home-directory prefix with `~`.
+- Sentry keeps the `guarded`, `unsettled`, `reexec-failed`, and `lock-held`
+  outcomes, adds `stale_tree` and `tree_state`, and tags `updater_source` when
+  known. The fingerprint remains `["InstallTreeTornError", "outcome:<token>"]`,
+  so the four existing outcome groups keep their keys.
+
+## [5.163.0] — 2026-09-24
+
+- Workforce plan refusals in the CLI keep direct checkout for eligible companies.
+  The server upgrade URL stays visible; personal refusals and checkout failures can
+  open it. Non-TTY and JSON runs print only the URL and exit non-zero.
+
+- `hq mesh` sends at most 25 replayed events for a session in one flush. It honors `Retry-After` on 429 and 503 responses and stops waiting when the daemon shuts down.
+
+### Added
+
+- `hq daemon` now also runs the `updater` (hq CLI and Codex updates every six hours, then restarts the daemon onto the new version), `remote-control` (`claude remote-control` in a private tmux session on outposts) and `jobs-reconcile` (the outpost jobs reconcile script every ten minutes). `hq bot`, `hq mesh daemon install` and `hq lanes reconcile install` hand their service to the daemon when it is installed instead of adding their own background unit. `hq daemon migrate --apply` stops the older HQ background units and moves their definitions aside so the daemon runs those services, and `hq daemon uninstall --restore-legacy` puts them back; The desktop app's own sync agent is never taken over.
+- `hq daemon` runs all of a machine's HQ background services under one supervisor. `hq daemon install` works out whether the machine is a desktop, self-hosted server, outpost, agent box or agent kit, installs one background service, and starts that machine type's default services (sync, mesh, heartbeat, bots, lanes cleanup, search indexing and log rotation, depending on the type). `hq daemon enable|disable <service>` changes the list for one machine. `status`, `logs`, `restart` and `trigger` manage the running services. A service that an older background unit already runs is left to that unit, and `hq daemon migrate` only lists what it would take over. The command is hidden from `hq --help` while it rolls out. It needs no feature flag.
+
 ## [5.162.0] — 2026-09-24
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -7639,6 +7639,194 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }];
     }];
+}, {
+    readonly name: "daemon";
+    readonly description: "Run all of this machine's HQ background services under one supervisor";
+    readonly aliases: readonly [];
+    readonly hidden: true;
+    readonly usage: "[options] [command]";
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "install";
+        readonly description: "Detect this machine's type, install the daemon, and start its default services";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--machine-type <type>";
+            readonly description: "desktop | self-hosted | outpost | agent-box | agent-kit (skips detection)";
+        }, {
+            readonly flags: "--hq-root <path>";
+            readonly description: "HQ folder the services work against";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "uninstall";
+        readonly description: "Stop the daemon and remove its OS unit";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--purge";
+            readonly description: "Also delete ~/.hq/daemon (settings, state and logs)";
+        }, {
+            readonly flags: "--restore-legacy";
+            readonly description: "Give the services `hq daemon migrate --apply` took over back to their original units";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "run";
+        readonly description: "Run the supervisor (this is what the OS unit starts)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--foreground";
+            readonly description: "Also print the supervisor log to the terminal";
+        }, {
+            readonly flags: "--daemon-dir <path>";
+            readonly description: "Use this folder instead of ~/.hq/daemon (how the Windows task passes HQ_DAEMON_DIR)";
+        }, {
+            readonly flags: "--managed";
+            readonly description: "Started by the OS unit, which starts the daemon again whenever it exits";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "status";
+        readonly description: "Show the machine type and each service's state";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "logs";
+        readonly description: "Print the supervisor log, or one service's log";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [unit]";
+        readonly arguments: readonly [{
+            readonly name: "unit";
+            readonly required: false;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "-f, --follow";
+            readonly description: "Keep printing new lines";
+        }, {
+            readonly flags: "-n, --lines <n>";
+            readonly description: "How many lines to print first";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "restart";
+        readonly description: "Restart one service, or every running service";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [unit]";
+        readonly arguments: readonly [{
+            readonly name: "unit";
+            readonly required: false;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "trigger";
+        readonly description: "Run a scheduled service now (for example search-index)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <unit>";
+        readonly arguments: readonly [{
+            readonly name: "unit";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "enable";
+        readonly description: "Turn services on for this machine, beyond its defaults";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <services...>";
+        readonly arguments: readonly [{
+            readonly name: "services";
+            readonly required: true;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "disable";
+        readonly description: "Turn default services off for this machine";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <services...>";
+        readonly arguments: readonly [{
+            readonly name: "services";
+            readonly required: true;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "migrate";
+        readonly description: "List the older HQ background units the daemon would take over; --apply takes them over";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--apply";
+            readonly description: "Stop the older units and let the daemon run their services";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "service";
+        readonly description: "Entry points the daemon runs for services that have no command of their own";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "self-update";
+            readonly description: "Update the hq CLI (and Codex), then restart the daemon onto the new version";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "remote-control";
+            readonly description: "Keep `claude remote-control` running in a tmux session in the HQ folder";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--claude <path>";
+                readonly description: "claude binary";
+            }, {
+                readonly flags: "--name <name>";
+                readonly description: "remote-control session name";
+            }, {
+                readonly flags: "--permission-mode <mode>";
+                readonly description: "claude --permission-mode";
+            }];
+            readonly subcommands: readonly [];
+        }];
+    }];
 }, {
     readonly name: "bot";
     readonly description: "Personal local bots that run on this computer with your own model login";

package/dist/command-catalog.generated.js

@@ -9880,6 +9880,241 @@ export const COMMAND_CATALOG = [
             }
         ]
     },
+    {
+        "name": "daemon",
+        "description": "Run all of this machine's HQ background services under one supervisor",
+        "aliases": [],
+        "hidden": true,
+        "usage": "[options] [command]",
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "install",
+                "description": "Detect this machine's type, install the daemon, and start its default services",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--machine-type <type>",
+                        "description": "desktop | self-hosted | outpost | agent-box | agent-kit (skips detection)"
+                    },
+                    {
+                        "flags": "--hq-root <path>",
+                        "description": "HQ folder the services work against"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "uninstall",
+                "description": "Stop the daemon and remove its OS unit",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--purge",
+                        "description": "Also delete ~/.hq/daemon (settings, state and logs)"
+                    },
+                    {
+                        "flags": "--restore-legacy",
+                        "description": "Give the services `hq daemon migrate --apply` took over back to their original units"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "run",
+                "description": "Run the supervisor (this is what the OS unit starts)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--foreground",
+                        "description": "Also print the supervisor log to the terminal"
+                    },
+                    {
+                        "flags": "--daemon-dir <path>",
+                        "description": "Use this folder instead of ~/.hq/daemon (how the Windows task passes HQ_DAEMON_DIR)"
+                    },
+                    {
+                        "flags": "--managed",
+                        "description": "Started by the OS unit, which starts the daemon again whenever it exits"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "status",
+                "description": "Show the machine type and each service's state",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "logs",
+                "description": "Print the supervisor log, or one service's log",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [unit]",
+                "arguments": [
+                    {
+                        "name": "unit",
+                        "required": false,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "-f, --follow",
+                        "description": "Keep printing new lines"
+                    },
+                    {
+                        "flags": "-n, --lines <n>",
+                        "description": "How many lines to print first"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "restart",
+                "description": "Restart one service, or every running service",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [unit]",
+                "arguments": [
+                    {
+                        "name": "unit",
+                        "required": false,
+                        "variadic": false
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "trigger",
+                "description": "Run a scheduled service now (for example search-index)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <unit>",
+                "arguments": [
+                    {
+                        "name": "unit",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "enable",
+                "description": "Turn services on for this machine, beyond its defaults",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <services...>",
+                "arguments": [
+                    {
+                        "name": "services",
+                        "required": true,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "disable",
+                "description": "Turn default services off for this machine",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <services...>",
+                "arguments": [
+                    {
+                        "name": "services",
+                        "required": true,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "migrate",
+                "description": "List the older HQ background units the daemon would take over; --apply takes them over",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--apply",
+                        "description": "Stop the older units and let the daemon run their services"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "service",
+                "description": "Entry points the daemon runs for services that have no command of their own",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "self-update",
+                        "description": "Update the hq CLI (and Codex), then restart the daemon onto the new version",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "remote-control",
+                        "description": "Keep `claude remote-control` running in a tmux session in the HQ folder",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--claude <path>",
+                                "description": "claude binary"
+                            },
+                            {
+                                "flags": "--name <name>",
+                                "description": "remote-control session name"
+                            },
+                            {
+                                "flags": "--permission-mode <mode>",
+                                "description": "claude --permission-mode"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            }
+        ]
+    },
     {
         "name": "bot",
         "description": "Personal local bots that run on this computer with your own model login",

package/dist/command-registration-plan.d.ts

@@ -407,6 +407,13 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly module: "./commands/lanes.js";
     readonly exportName: "registerLanesCommand";
     readonly hidden: true;
+}, {
+    readonly type: "registrar";
+    readonly root: "daemon";
+    readonly parent: "program";
+    readonly module: "./commands/daemon.js";
+    readonly exportName: "registerDaemonCommand";
+    readonly hidden: true;
 }, {
     readonly type: "registrar";
     readonly root: "bot";

package/dist/command-registration-plan.js

@@ -70,6 +70,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "doctor", parent: "program", module: "./commands/doctor.js", exportName: "registerDoctorCommand" },
     { type: "registrar", root: "mesh", parent: "program", module: "./commands/mesh.js", exportName: "registerMeshCommand" },
     { type: "registrar", root: "lanes", parent: "program", module: "./commands/lanes.js", exportName: "registerLanesCommand", hidden: true },
+    { type: "registrar", root: "daemon", parent: "program", module: "./commands/daemon.js", exportName: "registerDaemonCommand", hidden: true },
     { type: "registrar", root: "bot", parent: "program", module: "./commands/bot.js", exportName: "registerBotCommand" },
     { type: "registrar", root: "report", parent: "program", module: "./commands/report.js", exportName: "registerReportCommand" },
 ];

package/dist/commands/agent-enroll.d.ts

@@ -48,14 +48,19 @@ export declare function refusalMessage(existing: ExistingIdentity): string | nul
 export declare class EnrollError extends Error {
     readonly status?: number | undefined;
     readonly code?: string | undefined;
-    constructor(message: string, status?: number | undefined, code?: string | undefined);
+    readonly upgradeUrl?: string | undefined;
+    constructor(message: string, status?: number | undefined, code?: string | undefined, upgradeUrl?: string | undefined);
 }
+export declare function formatEnrollFailureMessage(error: EnrollError, options?: {
+    urlOnly?: boolean;
+}): string;
 /** Map a non-2xx enroll response to an actionable message (contract codes). */
 export declare function mapEnrollFailure(status: number, body: {
     code?: unknown;
     error?: unknown;
     message?: unknown;
     attemptsRemaining?: unknown;
+    upgradeUrl?: unknown;
 }, headers?: {
     retryAfter?: string | null;
 }): EnrollError;

package/dist/commands/agent-enroll.js

@@ -21,6 +21,7 @@ import { CLI_VERSION } from "../cli-version.js";
 import { DEFAULT_VAULT_API_URL, personTokenCacheFile, } from "../utils/cognito-session.js";
 import { HQ_CLIENT_NAME } from "../utils/vault-api.js";
 import { networkTransportErrorCode } from "../utils/network-transport-error.js";
+import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 import { generateHostKeyPair, machineCredsFileExists, readExternalMachineCreds, writeHostKeyPair, writeMachineCreds, } from "../lib/agent-kit/creds.js";
 import { DEFAULT_LOCAL_AGENT_NAME, agentKitPaths, localAgentDir, } from "../lib/agent-kit/paths.js";
 export const ENROLL_PATH = "/v1/agents/enroll";
@@ -81,13 +82,18 @@ export function refusalMessage(existing) {
 export class EnrollError extends Error {
     status;
     code;
-    constructor(message, status, code) {
+    upgradeUrl;
+    constructor(message, status, code, upgradeUrl) {
         super(message);
         this.status = status;
         this.code = code;
+        this.upgradeUrl = upgradeUrl;
         this.name = "EnrollError";
     }
 }
+export function formatEnrollFailureMessage(error, options = {}) {
+    return formatUpgradeRefusal(error.message, error.upgradeUrl, options);
+}
 /** Map a non-2xx enroll response to an actionable message (contract codes). */
 export function mapEnrollFailure(status, body, headers) {
     const code = typeof body.code === "string" ? body.code : undefined;
@@ -119,7 +125,7 @@ export function mapEnrollFailure(status, body, headers) {
     }
     if (status === 402 || code === "billing_required") {
         return new EnrollError(`External agents are available on paid HQ plans only. A company admin must ` +
-            `upgrade the plan (\`hq billing\` or the console billing page) before enrolling.${suffix}`, status, code);
+            `upgrade the plan (\`hq billing\` or the console billing page) before enrolling.${suffix}`, status, code, typeof body.upgradeUrl === "string" ? body.upgradeUrl : undefined);
     }
     if (status === 429 || code === "rate_limited") {
         const retryAfter = headers?.retryAfter?.trim();
@@ -253,6 +259,9 @@ export async function enrollHost(opts, deps = {}) {
     }
     const body = (await res.json().catch(() => ({})));
     if (!res.ok) {
+        const planGate = planGateErrorFromPayload(res.status, body);
+        if (planGate)
+            throw planGate;
         throw mapEnrollFailure(res.status, body, { retryAfter: res.headers.get("retry-after") });
     }
     const parsed = parseEnrollResponse(body);
@@ -322,7 +331,25 @@ export function registerAgentEnrollCommand(agent) {
             console.log("  hq agent probe           # end-to-end check, reported to the console");
         }
         catch (err) {
-            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+            if (isPlanGateError(err)) {
+                throw err;
+            }
+            else if (err instanceof EnrollError && err.upgradeUrl) {
+                const interactive = canOfferTeamUpgrade();
+                console.error(chalk.red(formatEnrollFailureMessage(err, { urlOnly: !interactive })));
+                if (interactive) {
+                    try {
+                        await offerUpgradeLink(err.upgradeUrl, { interactive: true });
+                    }
+                    catch (openErr) {
+                        const message = openErr instanceof Error ? openErr.message : String(openErr);
+                        console.error(chalk.dim(`Could not open the upgrade link automatically: ${message}`));
+                    }
+                }
+            }
+            else {
+                console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+            }
             process.exit(1);
         }
     });

package/dist/commands/agents.js

@@ -27,7 +27,6 @@
  * the caller's single active membership (same as `members.ts`).
  */
 import chalk from "chalk";
-import open from "open";
 import { randomUUID } from "node:crypto";
 import * as readline from "node:readline";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
@@ -37,7 +36,7 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { consoleOrigin } from "./integrations-connect.js";
 import { launchSessionManagerPlugin, SessionManagerPluginLaunchError, TerminalSessionTimeoutError, waitForTerminalSession, } from "@indigoai-us/hq-cloud/outposts/node";
 import { peekIdToken } from "../utils/id-token.js";
-import { isPlanGateError } from "../utils/plan-gate-error.js";
+import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, } from "../utils/plan-gate-error.js";
 import { AGENT_UID_PATTERN, isAgentUid } from "../lib/notify-recipient.js";
 import { confirmChargeOrExit, formatUsd, parseBillingPayload, surfaceBillingBlocked, } from "../utils/billing-gate.js";
 /** Reasoning-effort values hq-pro accepts on `runtime-config`. */
@@ -120,40 +119,34 @@ function formatServerPrice(amountMinor, currency) {
         currency,
     }).format(amountMinor / 100);
 }
-function canOfferAgentCheckout(json) {
-    return json !== true &&
-        process.stdin.isTTY === true &&
-        process.stdout.isTTY === true &&
-        !process.env.CI;
-}
 async function offerAgentCheckout(url) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     try {
-        const answer = await new Promise((resolve) => rl.question("Open the payment page now? [y/N] ", resolve));
-        if (!/^y(?:es)?$/i.test(answer.trim()))
-            return;
+        await offerUpgradeLink(url, {
+            interactive: true,
+            ask: (question) => new Promise((resolve) => rl.question(question, resolve)),
+        });
+    }
+    catch {
+        console.error("Could not open the upgrade page automatically. Use the URL above.");
     }
     finally {
         rl.close();
     }
-    try {
-        await open(url);
-    }
-    catch {
-        console.error("Could not open the payment page automatically. Use the URL above.");
-    }
 }
 /** Print a server-priced plan block without minting or rewriting its URL. */
 export async function surfaceAgentCreatePlanLimit(planLimit, opts = {}) {
     const price = `${formatServerPrice(planLimit.amountMinor, planLimit.currency)}/month`;
-    console.error(`Payment required: your plan does not include agents. Upgrade to ${planLimit.requiredPlan} costs ${price}.`);
+    const reason = `HQ Workforce plan required to create an agent (${price}).`;
+    const argv = opts.json ? [...process.argv, "--json"] : process.argv;
+    const interactive = canOfferTeamUpgrade(argv);
     if (!planLimit.checkoutUrl) {
+        console.error(reason);
         console.error("Ask a company owner to upgrade before creating an agent.");
         return;
     }
-    // Deliberately plain and on its own line so terminals make this clickable.
-    console.log(planLimit.checkoutUrl);
-    if (canOfferAgentCheckout(opts.json))
+    console.error(formatUpgradeRefusal(reason, planLimit.checkoutUrl, { urlOnly: !interactive }));
+    if (interactive)
         await offerAgentCheckout(planLimit.checkoutUrl);
 }
 /**