@indigoai-us/hq-cli 5.273.0-alpha.0 → 5.274.0

package/CHANGELOG.md

@@ -2,11 +2,70 @@
 
 ## [Unreleased]
 
-## [5.273.0-alpha.0] — 2026-09-28
+## [5.274.0] — 2026-09-28
+
+### Fixed
+
+- `hq lanes grant` and other senior-authorized actions treat a missing `senior`
+  key in valid session metadata as `user`; explicit non-user values still refuse
+  authorization with a reason.
+- Native Outpost message and resume routes now carry the owner's hire hierarchy,
+  authorize local-host resume contexts on their owner, and continue lane lookup
+  when another registered Outpost is unavailable.
+
+### Added
+
+- Guide interactive CLI users to their first work-bearing sync and confirm it
+  once, behind the `cli.first-sync-next-step` HQ flag.
+- Add `hq core commands --json` for the registered command catalog and guard the fast path, sibling references, and packaged assets.
+- Add a corpus recorder and differential runner for scaffold migration scripts.
+- Add `hq deploy comments list` and `read` for comments on apps in the caller's org.
+- Checkpoint ontology: behind `checkpoint.ontology.named-evidence` (off by
+  default), a knowledge link to the company's own company entity, or a
+  concept linked to its same-name project, needs evidence that names it as a
+  word. A name that only appears inside a path, domain, handle or tag, such as
+  `indigoai-us/hq` or `scope: company:indigo`, is rejected as
+  `unnamed_in_evidence` (CO-57).
+
+### Fixed
+
+- Add byte-for-byte checks for files fetched by `hq files get` and for
+  `company.yaml` after cloud demotion, using hq-core-staging's company seed.
+
+### Changed
+
+- Internal: moved the move, move-target and placement subcommands out of
+  `src/commands/lanes.ts`; no behaviour change.
+
+## [5.273.0] — 2026-09-28
+
+### Fixed
+
+- `hq doctor --fix` rechecks after each repair and applies newly found fixes
+  for up to three passes. It reports each repair's pass and lists every backup
+  restore command.
+- `hq doctor --fix --json` includes each repair's pass and backup, and its
+  restore command now undoes changes from every repair pass.
+- Wrapped merge commands now pass through both hold and review checks. If a
+  merge command cannot be parsed, it is allowed with an unresolved repository
+  when no enabled hold or review check applies.
+- A superseded worker still accepts messages from its recorded senior or a
+  successor lead in the same company and project. Company identity is resolved
+  from the lane or its project when the lane record has no company.
+- `hq lanes orphans` resolves null-company lanes through their senior chain and
+  can list unresolved lanes with `--unscoped`. Idle user-senior lanes without
+  open stories are reported after `--user-idle-hours` (default 72).
 
 ### Added
 
-- `hq daemon sync` reports runner ownership and health, starts an immediate sync pass, pauses or resumes sync, and sets per-company sync mode. The daemon waits for an existing desktop runner to release its lease before starting its own.
+- `hq doctor` checks whether the installed CLI meets the scaffold's declared
+  `requiresHqCli` version floor.
+
+### Removed
+
+- Removed the dead `lanes.tracker` record and import commands. Existing project
+  tracker files stay in place; `hq lanes checks` and `hq lanes report` retain
+  read-only access to the records they use.
 
 ## [5.272.0] — 2026-09-28
 
@@ -56,6 +115,10 @@
 - Company-scoped lane flags resolve ownership from a complete lane company,
   then a complete mesh company, then the lane's unique project company.
 
+- Merge hold and review checks unwrap commands through common shell wrappers.
+  Unparseable merge commands are blocked only when an enabled hold or review
+  enforcement applies.
+
 ### Added
 
 - Add `hq lanes review` records and optional reviewed-head checks to

package/README.md

@@ -7,6 +7,25 @@ npm install -g @indigoai-us/hq-cli
 hq --help
 ```
 
+## Deploy comments
+
+List comments left on an app in your current hq-deploy organization. Use the
+app's id or exact name; the CLI resolves it from the apps visible in that org.
+The list shows id, status, creation time, author display name, anchor mode and
+the first body line. `--status` accepts `open`, `resolved` or `all` (default).
+Use `--json` to print the API's comment objects with the `commentsEnabled`
+value.
+
+```bash
+hq deploy comments list <app> [--status open|resolved|all] [--json]
+hq deploy comments read <app> <commentId>
+```
+
+`read` prints the complete comment, including body, anchor, deploy id, status
+and timestamps. Reading works when comments are disabled on the app. The
+control-plane API requires the app owner or an org admin; comments are scoped
+to the caller's organization. Resolve/reopen commands are not included.
+
 ## Telemetry
 
 When you are signed in, `hq` may POST one `cli_session_started` event to
@@ -19,10 +38,14 @@ When you are signed in, `hq` may POST one `cli_session_started` event to
 - `consentBasis`: `disclosed` after the first-run notice, otherwise `no-consent`
 - `schemaVersion`: `1`
 - `properties.version`: the CLI version
+- for the optional first-sync guidance, `properties.step` (`first_sync_next_step`),
+  `properties.outcome` (`shown` or `followed`), and `properties.flagKey`
+  (`cli.first-sync-next-step`)
 
 The request is authenticated with your cached session token so the control
 plane can accept the event. The body does not include command names, arguments,
-timings, file contents, or secrets.
+timings, file contents, or secrets. The guidance fields are sent only when that
+optional feature is enabled and a person sees or follows its next step.
 
 The first signed-in interactive run (stdout is a TTY, and the command is not
 `--json`) prints this line once on stderr and records that it was shown under
@@ -32,6 +55,14 @@ The first signed-in interactive run (stdout is a TTY, and the command is not
 HQ sends a usage event when you run a signed-in command (CLI version and a timestamp, never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.
 ```
 
+When the optional first-sync guidance is enabled, the first interactive run that
+is about to send its fields prints this line once instead, and records it under
+`~/.hq/cli-telemetry-disclosed-first-sync-v1`:
+
+```
+HQ sends a usage event when you run a signed-in command (CLI version and a timestamp; when enabled, first-sync guidance shown or followed and the flag key cli.first-sync-next-step; never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.
+```
+
 Turn telemetry off:
 
 ```bash