@indigoai-us/hq-cli 5.275.0 → 5.276.0

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.276.0] — 2026-09-28
+
+### Added
+
+- Suggest inviting a teammate after the billing link in an over-limit Starter
+  notice for a one-member company, behind the default-off
+  `cli.limit-invite-teammate-v1` flag.
+- Add a default-off native route for `hq core timeout-guard`, backed by a
+  private company flag snapshot and a paired CI latency benchmark.
+
+### Changed
+
+- Starter setup guidance now says it includes one integration.
+
+### Fixed
+
+- `hq core checkpoint` no longer loses the company files of a checkpoint that
+  was queued behind a busy sibling, behind the `checkpoint.ontology.queued-touches`
+  flag (off by default). The queued checkpoint records its company files, and
+  the next sibling run adds them to the ontology plan. A run whose own
+  checkpoint names no company takes the ontology step for the company whose
+  files have waited longest.
+- `hq feedback bug|feature` validates report content and the serialized request
+  size before uploading screenshots or logs, avoiding orphaned attachments when
+  the server would reject the submission.
+
+- Reconcile clears a stale `superseded` keep-alive block when no active successor
+  remains; the five-minute minimum retry delay still applies. The block is
+  cleared even when the lead then waits on backoff or a full queue, and the
+  clear does not move a done lead's retry clock past its done envelope.
+
 ## [5.275.0] — 2026-09-28
 
 ### Fixed
@@ -13,6 +44,9 @@
 
 ### Added
 
+- Track CLI feature events behind the default-off `cli.feature-used-telemetry-v1`
+  hq-flags key with a separate one-time disclosure.
+
 - Outpost daemons can take over running services after a CLI update instead
   of restarting all of them, behind the `daemon.supervisor-handoff` flag (off
   by default). On Linux, the updated daemon adopts the services the previous
@@ -45,6 +79,8 @@
   `outpost_self_target`.
 - `hq sync status` validates an explicit `--hq-root` and continues to read
   journals from the configured state directory, which it now prints.
+- Root daemon tests use a temporary system adopted-record file; the CLI still
+  defaults to `/var/lib/hq/daemon/adopted.json`.
 
 ## [5.274.1] — 2026-09-28
 

package/README.md

@@ -47,6 +47,18 @@ plane can accept the event. The body does not include command names, arguments,
 timings, file contents, or secrets. The guidance fields are sent only when that
 optional feature is enabled and a person sees or follows its next step.
 
+When the default-off hq-flags key `cli.feature-used-telemetry-v1` is enabled,
+the CLI sends `cli_feature_used` for supported secret reads (`hq secrets exec`
+and `hq run`) and lane create and resume actions. Each event carries
+`properties.kind` and `properties.outcome` (`success` or `failure`). Events also
+carry the authenticated company UID when available. hq-pro resolves the signed-in
+identity. Events omit command names and arguments, secret names and values,
+prompt text, file paths, and command lines. User hooks and skills run in the
+provider host, which hq-cli cannot see. The default signed-in notice above is
+unchanged. On interactive TTY runs, the first enabled feature event has a
+separate one-time notice naming the feature kind, outcome, and company UID
+when available.
+
 The first signed-in interactive run (stdout is a TTY, and the command is not
 `--json`) prints this line once on stderr and records that it was shown under
 `~/.hq/cli-telemetry-disclosed`:

package/assets/bot-workers/setup/context/USER-GUIDE.md

@@ -323,10 +323,10 @@ HQ/
 HQ has three plans: **Starter**, **HQ Workforce** ($500/month per workspace), and
 **Enterprise**.
 
-Starter is free. It holds up to 5 members, and it does not include integrations
-or MCP, Atlas, or telemetry. Everything else — knowledge, projects, policies,
-workers, secrets, vault storage, `hq deploy`, and `hq share` — works the same as
-on the paid plans.
+Starter is free. It holds up to 5 members and includes 1 integration. MCP,
+Atlas, and telemetry are not included. Everything else — knowledge, projects,
+policies, workers, secrets, vault storage, `hq deploy`, and `hq share` — works
+the same as on the paid plans.
 
 ### When a workspace goes over
 

package/dist/commands/core-checkpoint.d.ts

@@ -45,8 +45,10 @@ export declare const SIBLING_PROMPT_TEMPLATE = "You are the HQ checkpoint siblin
  * Rendered into the sibling prompt only when the payload names a company. The
  * flag check happens inside `hq core ontology plan`, in the sibling, because
  * the checkpoint parent performs no network I/O. Only this run's own payload
- * gets the step; claimed queue payloads are covered by the next run, since the
- * plan works from file hashes rather than from the payload's file list.
+ * gets the step. A queued payload's company files are recorded as queued
+ * touches when it is queued (CO-59), and a later plan for that company takes
+ * them while checkpoint.ontology.queued-touches is on; a run with no company
+ * of its own gets the step for the company whose touches waited longest.
  */
 export declare const SIBLING_ONTOLOGY_STEP = "5b. ONTOLOGY (this run's own payload only; skip it for claimed queue payloads).\n   Run: hq core ontology plan --run-dir \"<runDir>\" --hq-root \"<hqRoot>\"\n   If it prints \"ontology: skipped\", do nothing more for this step. Otherwise\n   read <runDir>/ontology-plan.json, follow its \"instructions\" exactly, and\n   write <runDir>/ontology-candidates.json. Read only the files and line\n   ranges the plan lists. Then run:\n   hq core ontology apply --run-dir \"<runDir>\" --hq-root \"<hqRoot>\"\n   Never write under the company's ontology/ folder yourself, and never edit\n   payload.json or ontology-plan.json. Copy the command's one-line output into\n   the report. If either command fails, record the error and continue.\n";
 export declare function renderSiblingPrompt(runDir: string, payloadPath: string, options?: {

package/dist/commands/core-checkpoint.js

@@ -17,6 +17,7 @@ import { toHqStateWriteError } from "../utils/hq-state-write-error.js";
 import { checkpointStampWriteErrorFor, isCheckpointStampWriteError, } from "../utils/checkpoint-stamp-write-error.js";
 import { readBackendPreference } from "../lib/checkpoint-ontology/plan.js";
 import { resolveOntologyCompany } from "../lib/checkpoint-ontology/company.js";
+import { markBorrowed, oldestQueuedCompany, recordQueuedTouches } from "../lib/checkpoint-ontology/queued-touches.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 const DEFAULT_TRIGGER = "stop-gate";
 const BACKENDS = new Set(["auto", "claude", "codex", "grok", "none"]);
@@ -189,8 +190,10 @@ report instead of guessing.
  * Rendered into the sibling prompt only when the payload names a company. The
  * flag check happens inside `hq core ontology plan`, in the sibling, because
  * the checkpoint parent performs no network I/O. Only this run's own payload
- * gets the step; claimed queue payloads are covered by the next run, since the
- * plan works from file hashes rather than from the payload's file list.
+ * gets the step. A queued payload's company files are recorded as queued
+ * touches when it is queued (CO-59), and a later plan for that company takes
+ * them while checkpoint.ontology.queued-touches is on; a run with no company
+ * of its own gets the step for the company whose touches waited longest.
  */
 export const SIBLING_ONTOLOGY_STEP = `5b. ONTOLOGY (this run's own payload only; skip it for claimed queue payloads).
    Run: hq core ontology plan --run-dir "<runDir>" --hq-root "<hqRoot>"
@@ -1001,15 +1004,43 @@ function startSibling(liveRoot, input, threadPath, backend) {
     fs.mkdirSync(siblingRoot, { recursive: true });
     if (activePid !== null) {
         const depth = appendPending(pendingPath, payload);
+        try {
+            recordQueuedTouches(liveRoot, payload.company, payload.files, new Date());
+        }
+        catch {
+            // Queued touches only help a later ontology plan; they must never fail
+            // the checkpoint itself.
+        }
         printResult(`checkpoint: sibling busy — payload queued (${depth} pending)`);
         return;
     }
     const runDir = path.join(siblingRoot, `${formatTimestamp(new Date())}-${summarySlug(input.summary ?? "checkpoint")}`);
     fs.mkdirSync(runDir, { recursive: true });
     payload.pending_payloads = claimPending(pendingPath, path.join(runDir, "pending-claimed.jsonl"));
+    if (!payload.company) {
+        let queued;
+        try {
+            queued = oldestQueuedCompany(liveRoot);
+        }
+        catch {
+            queued = null;
+        }
+        if (queued) {
+            payload.ontology_company = queued;
+            try {
+                markBorrowed(liveRoot, queued, new Date());
+            }
+            catch {
+                // A borrowed-company marker must never fail the checkpoint.
+            }
+        }
+    }
     const payloadPath = path.join(runDir, "payload.json");
     fs.writeFileSync(payloadPath, `${JSON.stringify(payload, null, 2)}\n`);
-    const prompt = renderSiblingPrompt(runDir, payloadPath, { company: payload.company, hqRoot: liveRoot });
+    const prompt = renderSiblingPrompt(runDir, payloadPath, {
+        company: payload.company ?? payload.ontology_company ?? null,
+        hqRoot: liveRoot,
+    });
     fs.writeFileSync(path.join(runDir, "prompt.md"), prompt);
     const logPath = path.join(runDir, "run.log");
     const logFd = fs.openSync(logPath, "a");

package/dist/commands/core-command-catalog.d.ts

@@ -22,11 +22,13 @@ export declare function describeCoreCommand(command: Command, metadata: CoreComm
 export declare function registeredCoreCommandListing(core: Command): CoreCommandListingEntry[];
 export declare function fastScaffoldListingMismatches(listing: readonly CoreCommandListingEntry[], fastScripts: readonly {
     name: string;
-    asset: string;
+    kind: "shell" | "native";
+    asset?: string;
 }[]): string[];
 export declare function assertFastScaffoldListingParity(listing: readonly CoreCommandListingEntry[], fastScripts: readonly {
     name: string;
-    asset: string;
+    kind: "shell" | "native";
+    asset?: string;
 }[]): void;
 export {};
 //# sourceMappingURL=core-command-catalog.d.ts.map

package/dist/commands/core-command-catalog.js

@@ -43,8 +43,11 @@ export function fastScaffoldListingMismatches(listing, fastScripts) {
         if (!listed) {
             mismatches.push(`${fast.name} is missing from hq core commands`);
         }
-        else if (listed.asset !== fast.asset) {
-            mismatches.push(`${fast.name} lists ${listed.asset ?? "no asset"}, fast path uses ${fast.asset}`);
+        else if (fast.kind === "shell" && listed.asset !== fast.asset) {
+            mismatches.push(`${fast.name} lists ${listed.asset ?? "no asset"}, fast path uses ${fast.asset ?? "no asset"}`);
+        }
+        else if (fast.kind === "native" && (listed.execution !== "native" || listed.asset)) {
+            mismatches.push(`${fast.name} is native in the fast path but not in the command catalog`);
         }
     }
     return mismatches;

package/dist/commands/core-ontology.js

@@ -12,7 +12,7 @@ import * as path from "node:path";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
-import { MULTI_WRITER_FLAG, planOntologyRun, } from "../lib/checkpoint-ontology/plan.js";
+import { MULTI_WRITER_FLAG, planOntologyRun, payloadOntologyCompany, } from "../lib/checkpoint-ontology/plan.js";
 import { applyOntologyRun, ApplyError } from "../lib/checkpoint-ontology/apply.js";
 import { resolveOntologyCompany, WriteBoundsError } from "../lib/checkpoint-ontology/company.js";
 import { findDuplicateGroups, summarizeMergeBack, } from "../lib/checkpoint-ontology/multi-writer.js";
@@ -85,8 +85,8 @@ export async function runOntologyPlan(hqRoot, runDirOption, deps = {}) {
 }
 export function runOntologyApply(hqRoot, runDirOption, deps = {}) {
     const runDir = requireRunDir(runDirOption);
-    const company = readPayload(runDir).company;
-    if (typeof company !== "string" || company === "") {
+    const company = payloadOntologyCompany(readPayload(runDir)).slug;
+    if (company === null) {
         throw new OntologyUsageError("ontology: the run payload names no company");
     }
     const report = applyOntologyRun({ hqRoot, runDir, company, now: deps.now?.() });

package/dist/commands/core.js

@@ -461,7 +461,7 @@ export function registerCoreCommands(program) {
         const chunks = [];
         for await (const chunk of process.stdin)
             chunks.push(chunk);
-        const code = timeoutGuardCommand(Buffer.concat(chunks).toString("utf8"));
+        const code = await timeoutGuardCommand(Buffer.concat(chunks).toString("utf8"));
         if (code !== 0)
             process.exit(code);
     });

package/dist/commands/daemon.d.ts

@@ -41,6 +41,7 @@ export interface DaemonCommandDeps {
     windowsUser?: string;
     windowsHeadlessLauncher?: string;
     systemUnitDir?: string;
+    systemRecordPath?: string;
 }
 /**
  * The HQ folder install records: --hq-root, else the CLI's shared resolution

package/dist/commands/daemon.js

@@ -96,6 +96,7 @@ async function loadDefaults(over) {
         windowsUser: over.windowsUser ?? (platform === "win32" ? mesh.resolveWindowsUser(env) : ""),
         windowsHeadlessLauncher: over.windowsHeadlessLauncher ?? (platform === "win32" ? mesh.resolveWindowsHeadlessLauncher(env) : undefined),
         systemUnitDir: over.systemUnitDir ?? SYSTEM_UNIT_DIR,
+        systemRecordPath: over.systemRecordPath ?? path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
     };
 }
 function detect(d, flag, config) {
@@ -250,7 +251,7 @@ function migrateDeps(d, paths) {
         recordPath: path.join(paths.root, "adopted.json"),
         // Box system units: root-owned, outside the login user's daemon folder (which handOver chowns to that user).
         systemAdoptedDir: path.join(SYSTEM_ADOPTED_ROOT, "adopted"),
-        systemRecordPath: path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
+        systemRecordPath: d.systemRecordPath ?? path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
         systemUnitDir: d.systemUnitDir ?? SYSTEM_UNIT_DIR,
     };
 }

package/dist/commands/feedback.d.ts

@@ -3,6 +3,8 @@ import { type DiagnosticsBlob } from "../utils/feedback-diagnostics.js";
 import { collectFeedbackLogs, feedbackLogsEnabled } from "../utils/feedback-logs.js";
 import { type LogBundleRef } from "../utils/feedback-log-bundle.js";
 export declare const BODY_MAX_BYTES: number;
+/** Validate fields that must be valid before feedback attachments are uploaded. */
+export declare function validateFeedbackContent(title: string, body: string): void;
 /**
  * Mirror of the server's `MAX_BODY_BYTES` in hq-pro
  * `src/vault-service/handlers/feedback.ts`, which rejects the WHOLE request
@@ -36,6 +38,10 @@ export interface FeedbackSubmitOptions {
      * stays a summary and this carries the rest.
      */
     logBundle?: LogBundleRef;
+    /** Diagnostics collected before uploads by the command path. */
+    diagnostics?: DiagnosticsBlob;
+    /** Precomputed setting so environment lookup happens before attachments upload. */
+    logsEnabled?: boolean;
 }
 export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
 /**

package/dist/commands/feedback.js

@@ -1,12 +1,25 @@
 import * as fs from "node:fs";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { assertVaultApiRequestSupported, vaultApiFetch, } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
 import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 import { FEEDBACK_LOGS_MAX_TOTAL_BYTES, FEEDBACK_LOGS_MIN_USEFUL_BYTES, collectFeedbackLogs, feedbackLogsEnabled, } from "../utils/feedback-logs.js";
 import { uploadLogBundle } from "../utils/feedback-log-bundle.js";
 export const BODY_MAX_BYTES = 64 * 1024;
+/** Validate fields that must be valid before feedback attachments are uploaded. */
+export function validateFeedbackContent(title, body) {
+    if (title.trim().length === 0) {
+        throw new Error("title must not be empty. Provide a short, non-whitespace title via --title.");
+    }
+    if (body.trim().length === 0) {
+        throw new Error("body must not be empty. Provide at least one non-whitespace character.");
+    }
+    const bodyBytes = Buffer.byteLength(body, "utf8");
+    if (bodyBytes > BODY_MAX_BYTES) {
+        throw new Error(`Body exceeds 64 KiB limit (${bodyBytes} bytes). Reduce the body size before submitting.`);
+    }
+}
 /**
  * Mirror of the server's `MAX_BODY_BYTES` in hq-pro
  * `src/vault-service/handlers/feedback.ts`, which rejects the WHOLE request
@@ -16,12 +29,36 @@ export const BODY_MAX_BYTES = 64 * 1024;
  * logs are budgeted against whatever headroom is left between them.
  */
 export const REQUEST_MAX_BYTES = 64 * 1024;
+/** Reject JSON envelopes that hq-pro would refuse with HTTP 413. */
+function validateFeedbackRequestSize(requestBody) {
+    const requestBytes = Buffer.byteLength(JSON.stringify(requestBody), "utf8");
+    if (requestBytes > REQUEST_MAX_BYTES) {
+        throw new Error(`Request exceeds 64 KiB limit (${requestBytes} bytes). Reduce the feedback content before submitting.`);
+    }
+}
 /**
  * Headroom held back for the `"logs":{...}` JSON envelope itself — its keys,
  * braces, and the escaping of the tail text. The final size is re-measured
  * after attaching, so this reserve only needs to be roughly right.
  */
 const LOGS_ENVELOPE_RESERVE_BYTES = 1024;
+function buildFeedbackRequestBody(opts) {
+    const requestBody = {
+        type: opts.type,
+        title: opts.title,
+        body: opts.body,
+        diagnostics: opts.diagnostics,
+    };
+    if (opts.company) {
+        requestBody.company = opts.company;
+    }
+    if (opts.screenshots && opts.screenshots.length > 0) {
+        requestBody.screenshots = opts.screenshots;
+    }
+    if (opts.logBundle)
+        requestBody.logBundle = opts.logBundle;
+    return requestBody;
+}
 export async function readBodyFile(bodyFile, stdin) {
     if (bodyFile === "-") {
         const stream = stdin ?? process.stdin;
@@ -79,48 +116,32 @@ export function attachDebugLogs(requestBody, diagnostics, enabled, deps = {}) {
     }
 }
 export async function submitFeedback(opts) {
-    // Validate the title locally, symmetric with the body check below. Commander's
-    // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
-    // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
-    // to nothing) passes the flag check, then the server rejects it with a 400
-    // "title (non-empty string) is required" that floods Sentry as a context-free
-    // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
-    // and the bad request never reaches the server.
-    if (opts.title.trim().length === 0) {
-        throw new Error("title must not be empty. Provide a short, non-whitespace title via --title.");
-    }
-    if (opts.body.trim().length === 0) {
-        throw new Error("body must not be empty. Provide at least one non-whitespace character.");
-    }
-    const bodyBytes = Buffer.byteLength(opts.body, "utf8");
-    if (bodyBytes > BODY_MAX_BYTES) {
-        throw new Error(`Body exceeds 64 KiB limit (${bodyBytes} bytes). Reduce the body size before submitting.`);
-    }
-    const diagnostics = collectDiagnostics();
-    const requestBody = {
+    // Keep submitFeedback safe for direct callers as well as the command path,
+    // which invokes the same validator before uploading any attachments.
+    validateFeedbackContent(opts.title, opts.body);
+    const diagnostics = opts.diagnostics ?? collectDiagnostics();
+    const requestBody = buildFeedbackRequestBody({
         type: opts.type,
         title: opts.title,
         body: opts.body,
+        company: opts.company,
         diagnostics,
-    };
-    if (opts.company) {
-        requestBody.company = opts.company;
-    }
-    if (opts.screenshots && opts.screenshots.length > 0) {
-        requestBody.screenshots = opts.screenshots;
-    }
-    // The bundle reference is four small fields, so unlike the inline logs below
-    // it needs no budgeting — but it is added BEFORE attachDebugLogs so those
-    // bytes are counted against the inline budget rather than overrunning it.
-    if (opts.logBundle) {
-        requestBody.logBundle = opts.logBundle;
-    }
+        screenshots: opts.screenshots,
+        logBundle: opts.logBundle,
+    });
+    // Direct callers can supply attachment references; ensure the complete base
+    // envelope still fits before adding optional inline logs or making a request.
+    validateFeedbackRequestSize(requestBody);
     // Debug logs are attached LAST and sized against the headroom the rest of
     // the request left behind. The server 413s the whole body over 64 KiB, so a
     // fixed log budget would turn a previously-working large-body submission
     // into a hard failure. Measuring the real serialized envelope — the exact
     // bytes vaultApiFetch will send — is what makes that impossible.
-    attachDebugLogs(requestBody, diagnostics, opts.includeLogs !== false);
+    attachDebugLogs(requestBody, diagnostics, opts.includeLogs !== false, {
+        envEnabled: opts.logsEnabled === undefined
+            ? feedbackLogsEnabled
+            : () => opts.logsEnabled === true,
+    });
     const res = await vaultApiFetch({
         token: opts.token,
         path: "/v1/feedback",
@@ -155,8 +176,34 @@ function registerSubcommand(feedbackCmd, type) {
         try {
             const token = await ensureCognitoToken({ interactive: false });
             const body = await readBodyFile(opts.bodyFile);
-            // Validate + upload screenshots (direct-to-S3 via presigned PUT)
-            // before submitting, so the row references uploaded objects.
+            validateFeedbackContent(opts.title, body);
+            // Resolve every required local input before creating S3 objects. These
+            // diagnostics are passed through so submitFeedback does not collect
+            // them again after attachments have been uploaded.
+            const diagnostics = collectDiagnostics();
+            const logsEnabled = opts.logs !== false && feedbackLogsEnabled();
+            // Validate the serialized server request envelope before screenshots
+            // or the log bundle can create remote objects. Attachment references
+            // are added and checked again inside submitFeedback after upload.
+            validateFeedbackRequestSize(buildFeedbackRequestBody({
+                type,
+                title: opts.title,
+                body,
+                company: opts.company,
+                diagnostics,
+            }));
+            // vaultApiFetch can reject an hqk_ token or an invalid API base URL
+            // locally before fetch. Check the mandatory POST, and the screenshot
+            // presign when requested, before any upload can create an orphan.
+            assertVaultApiRequestSupported({ token, path: "/v1/feedback" });
+            if ((opts.screenshot ?? []).length > 0) {
+                assertVaultApiRequestSupported({
+                    token,
+                    path: "/v1/feedback/screenshots/presign",
+                });
+            }
+            // Upload screenshots (direct-to-S3 via presigned PUT) before the
+            // submission, so the row references uploaded objects.
             const screenshots = await uploadScreenshots({
                 paths: opts.screenshot ?? [],
                 token,
@@ -167,7 +214,7 @@ function registerSubcommand(feedbackCmd, type) {
             // this resolves undefined and the report still carries inline logs.
             const logBundle = await uploadLogBundle({
                 token,
-                enabled: opts.logs !== false && feedbackLogsEnabled(),
+                enabled: logsEnabled,
             });
             const result = await submitFeedback({
                 type,
@@ -178,6 +225,8 @@ function registerSubcommand(feedbackCmd, type) {
                 screenshots,
                 includeLogs: opts.logs !== false,
                 logBundle,
+                diagnostics,
+                logsEnabled,
             });
             console.log(`Submitted: ${result.id}`);
         }

package/dist/commands/lanes.js

@@ -27,6 +27,7 @@ import { registerLaneReportCommands } from "./lanes-report.js";
 import { registerLaneRepoMergeHoldCommand } from "./lanes-hold.js";
 import { registerLaneReviewCommand } from "./lanes-review.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
@@ -6911,7 +6912,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--placement <mode>", "local | auto | outpost:<id>")
         .option("--default-placement <mode>", "Default placement for lanes launched by this lane: local | auto | outpost:<id>")
         .action(wrap(async (opts) => {
-        await runCreate(ctx, opts);
+        await withCliFeatureUsed("lane_create", () => runCreate(ctx, opts));
     }));
     lanes
         .command("approve-target", { hidden: true })
@@ -7215,7 +7216,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--mesh-company <slug>", "Attach Work Mesh attribution after verifying company membership")
         .option("--no-compact", "Skip the resume-time compaction check for this resume")
         .action(wrap(async (laneId, opts) => {
-        await resumeHandlers.runResume(ctx, laneId, opts);
+        await withCliFeatureUsed("lane_resume", () => resumeHandlers.runResume(ctx, laneId, opts));
     }));
     lanes
         .command("reparent")

package/dist/commands/run-feature-telemetry.d.ts

@@ -0,0 +1,3 @@
+/** Attribute hq run's batch secret read to its resolved company UID. */
+export declare function withRunSecretReadTelemetry<T>(companyUid: string, action: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=run-feature-telemetry.d.ts.map

package/dist/commands/run-feature-telemetry.js

@@ -0,0 +1,6 @@
+import { withCliFeatureUsed } from '../utils/cli-telemetry.js';
+/** Attribute hq run's batch secret read to its resolved company UID. */
+export function withRunSecretReadTelemetry(companyUid, action) {
+    return withCliFeatureUsed('secret_read', action, companyUid);
+}
+//# sourceMappingURL=run-feature-telemetry.js.map

package/dist/commands/run.js

@@ -11,6 +11,7 @@ import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
 import { assertEnvGraphLoaded, resolveEnvValuesOrThrow, EnvGraphLoadError, EnvResolutionError, } from '../run/env-graph-guard.js';
 import { hadFatalRejection } from '../unhandled-rejection-boundary.js';
+import { withRunSecretReadTelemetry } from './run-feature-telemetry.js';
 const SECRET_LOAD_TIMEOUT_MS = 30_000;
 export async function buildRunUsage(scriptPath, scriptId) {
     if (scriptId && !scriptPath) {
@@ -87,7 +88,7 @@ export function registerRunCommand(program) {
                 allowOfflineScopeFallback: true,
             });
             const usage = await buildRunUsage(opts.script, opts.scriptId);
-            const fetchBatch = async (companyUid, names, requestUsage) => {
+            const fetchBatch = async (companyUid, names, requestUsage) => withRunSecretReadTelemetry(companyUid, async () => {
                 const res = await vaultApiFetch({
                     token,
                     path: `/secrets/${encodeURIComponent(companyUid)}/load`,
@@ -113,7 +114,7 @@ export function registerRunCommand(program) {
                     throw new Error(`Failed to batch-load secrets: ${message}`);
                 }
                 return res.json();
-            };
+            });
             const pluginOpts = {
                 companyOverride: opts.company,
                 principalUid: cognitoCachePrincipalUid(token) ?? undefined,

package/dist/commands/secrets.js

@@ -4,6 +4,7 @@ import { spawn } from "node:child_process";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { cognitoCachePrincipalUid, ensureCognitoToken } from "../utils/cognito-session.js";
+import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
@@ -1498,9 +1499,14 @@ export function registerSecretsCommand(program) {
             const companyUid = cred.kind === "api-key"
                 ? "__api_key__"
                 : await getEntityUid(cred.token, scopeOpts(secrets.opts()), { allowOfflineScopeFallback: true });
-            const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
+            const readSecrets = async () => loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
                 ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
                 : undefined, { allowOfflineFallback: true });
+            // API-key auth has no signed-in person identity for the CLI telemetry
+            // endpoint. Do not attribute that read to an unrelated cached session.
+            const revealed = cred.kind === "cognito"
+                ? await withCliFeatureUsed("secret_read", readSecrets, companyUid)
+                : await readSecrets();
             const secretEnv = {};
             for (const key of keys) {
                 const value = revealed.get(key);

package/dist/commands/whoami.d.ts

@@ -3,6 +3,7 @@
  */
 import { Command } from 'commander';
 import { type PlanLimitStatus } from "../lib/billing/plan-lock.js";
+export declare const CLI_LIMIT_INVITE_TEAMMATE_FLAG = "cli.limit-invite-teammate-v1";
 export interface WhoamiTokenIdentity {
     email?: string;
     sub?: string;
@@ -20,11 +21,8 @@ export interface WhoamiDisplayIdentity {
  * email with the token subject of the delegating machine.
  */
 export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
-/**
- * Human rendering of the plan state: the full over-limit block when the
- * workspace is over its Starter limits, the one-line `Plan: Starter — …`
- * orientation when it is Starter and healthy, and nothing at all otherwise.
- */
-export declare function renderWhoamiPlanBlock(status: PlanLimitStatus): string | null;
+export declare function renderWhoamiPlanBlock(status: PlanLimitStatus, opts?: {
+    inviteTeammateEnabled?: boolean;
+}): string | null;
 export declare function registerWhoamiCommand(program: Command): void;
 //# sourceMappingURL=whoami.d.ts.map