@indigoai-us/hq-cli 5.275.0 → 5.277.0

package/dist/commands/core-ontology.js

@@ -12,7 +12,7 @@ import * as path from "node:path";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
-import { MULTI_WRITER_FLAG, planOntologyRun, } from "../lib/checkpoint-ontology/plan.js";
+import { MULTI_WRITER_FLAG, planOntologyRun, payloadOntologyCompany, } from "../lib/checkpoint-ontology/plan.js";
 import { applyOntologyRun, ApplyError } from "../lib/checkpoint-ontology/apply.js";
 import { resolveOntologyCompany, WriteBoundsError } from "../lib/checkpoint-ontology/company.js";
 import { findDuplicateGroups, summarizeMergeBack, } from "../lib/checkpoint-ontology/multi-writer.js";
@@ -85,8 +85,8 @@ export async function runOntologyPlan(hqRoot, runDirOption, deps = {}) {
 }
 export function runOntologyApply(hqRoot, runDirOption, deps = {}) {
     const runDir = requireRunDir(runDirOption);
-    const company = readPayload(runDir).company;
-    if (typeof company !== "string" || company === "") {
+    const company = payloadOntologyCompany(readPayload(runDir)).slug;
+    if (company === null) {
         throw new OntologyUsageError("ontology: the run payload names no company");
     }
     const report = applyOntologyRun({ hqRoot, runDir, company, now: deps.now?.() });

package/dist/commands/core.js

@@ -30,6 +30,7 @@
  */
 import { Option } from "commander";
 import { registerCoreCheckpointCommand } from "./core-checkpoint.js";
+import { registerCoreDelegateCommand } from "./core-delegate.js";
 import { registerCoreOntologyCommand } from "./core-ontology.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
@@ -213,6 +214,14 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/session-scope-capability.sh", root: "live", summary: "Session scope-capability lib sourced by hq-session" },
     { asset: "core/scripts/lib/session-id.sh", root: "live", summary: "Session-id resolver lib sourced by hq-session" },
     { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
+    // Wave 1a delegate shells remain bundled as the default-off rollback path.
+    // Their roots mirror the original scripts; pickup does not read an HQ root.
+    { asset: "core/scripts/hq-delegate-resolve.sh", root: "live", summary: "Rollback shell for native delegate resolve" },
+    { asset: "core/scripts/hq-delegate-pickup.sh", root: "cwd", summary: "Rollback shell for native delegate pickup (root independent)" },
+    { asset: "core/scripts/hq-delegate-repo.sh", root: "live", summary: "Rollback shell for native delegate repo" },
+    { asset: "core/scripts/hq-delegate-secrets.sh", root: "live", summary: "Rollback shell for native delegate secrets" },
+    { asset: "core/scripts/hq-delegate-transfer.sh", root: "live", summary: "Rollback shell for native delegate transfer" },
+    { asset: "core/scripts/lib/secret-patterns.sh", root: "live", summary: "Secret-pattern library sourced by the delegate rollback shells" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
         root,
@@ -288,6 +297,7 @@ export function registerCoreCommands(program) {
     registerCoreCheckpointCommand(core);
     registerCoreOntologyCommand(core);
     registerCoreCheckpointGateSettingCommand(core);
+    registerCoreDelegateCommand(core);
     // These command names intentionally own native implementations. Their
     // similarly named scaffold assets are forwarders, so sending them through
     // runEntry would recurse back into this command forever.
@@ -461,7 +471,7 @@ export function registerCoreCommands(program) {
         const chunks = [];
         for await (const chunk of process.stdin)
             chunks.push(chunk);
-        const code = timeoutGuardCommand(Buffer.concat(chunks).toString("utf8"));
+        const code = await timeoutGuardCommand(Buffer.concat(chunks).toString("utf8"));
         if (code !== 0)
             process.exit(code);
     });

package/dist/commands/daemon.d.ts

@@ -16,6 +16,7 @@
 import type { Command } from "commander";
 import { type LegacyUnit } from "../lib/daemon/legacy.js";
 import type { HostApp } from "../lib/daemon/supervisor.js";
+import { type SyncModeVaultClient } from "./sync-mode.js";
 import type { RunCommand } from "../lib/service-manager/launchd.js";
 export interface DaemonCommandDeps {
     env: NodeJS.ProcessEnv;
@@ -38,9 +39,12 @@ export interface DaemonCommandDeps {
     userHome: (user: string) => string;
     /** The pid is a live `hq daemon run`. */
     daemonAlive: (pid: number) => boolean;
+    /** Test seam for the company sync-mode commands. */
+    syncModeClient?: () => Promise<SyncModeVaultClient>;
     windowsUser?: string;
     windowsHeadlessLauncher?: string;
     systemUnitDir?: string;
+    systemRecordPath?: string;
 }
 /**
  * The HQ folder install records: --hq-root, else the CLI's shared resolution

package/dist/commands/daemon.js

@@ -18,7 +18,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { major as semverMajor, valid as validSemver } from "semver";
 import { DEFAULT_SERVICES, SERVICE_DESCRIPTIONS, enabledServices, hqCloudUnits } from "../lib/daemon/catalog.js";
-import { applyServiceToggle, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
+import { applyServiceToggle, effectiveSyncOwner, readDaemonConfig, writeDaemonConfig } from "../lib/daemon/config.js";
 import { daemonUnitInstalled } from "../lib/daemon/handoff.js";
 import { adoptLegacyUnits, readAdoptedUnits, restoreLegacyUnits } from "../lib/daemon/migrate.js";
 import { ROOT_REFUSAL, SYSTEM_UNIT_DIR, daemonRootRefusal, installDaemonUnit, installScopeFor, uninstallDaemonUnit, } from "../lib/daemon/install.js";
@@ -27,7 +27,10 @@ import { isDaemonProcess, runningDaemonPid } from "../lib/daemon/lock.js";
 import { bundledHqCloud } from "../lib/daemon/hq-cloud.js";
 import { MACHINE_TYPE_MARKER_PATH, detectMachineType, homeFromPasswd, } from "../lib/daemon/machine-type.js";
 import { daemonPaths } from "../lib/daemon/paths.js";
+import { processCommandLine } from "../lib/daemon/lock.js";
 import { writeControlRequest } from "../lib/daemon/requests.js";
+import { isSyncRunnerCommandLine, readWatchRunnerOwnerStatus, watchRunnerOwnerStatusPath } from "../lib/daemon/sync-runner.js";
+import { getSyncModeForCompany, setSyncMode } from "./sync-mode.js";
 import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 class DaemonCommandError extends Error {
 }
@@ -96,6 +99,8 @@ async function loadDefaults(over) {
         windowsUser: over.windowsUser ?? (platform === "win32" ? mesh.resolveWindowsUser(env) : ""),
         windowsHeadlessLauncher: over.windowsHeadlessLauncher ?? (platform === "win32" ? mesh.resolveWindowsHeadlessLauncher(env) : undefined),
         systemUnitDir: over.systemUnitDir ?? SYSTEM_UNIT_DIR,
+        syncModeClient: over.syncModeClient,
+        systemRecordPath: over.systemRecordPath ?? path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
     };
 }
 function detect(d, flag, config) {
@@ -250,7 +255,7 @@ function migrateDeps(d, paths) {
         recordPath: path.join(paths.root, "adopted.json"),
         // Box system units: root-owned, outside the login user's daemon folder (which handOver chowns to that user).
         systemAdoptedDir: path.join(SYSTEM_ADOPTED_ROOT, "adopted"),
-        systemRecordPath: path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
+        systemRecordPath: d.systemRecordPath ?? path.join(SYSTEM_ADOPTED_ROOT, "adopted.json"),
         systemUnitDir: d.systemUnitDir ?? SYSTEM_UNIT_DIR,
     };
 }
@@ -372,6 +377,135 @@ function queueRequest(d, request, what) {
     const running = runningDaemonPid(paths.lockPath, d.daemonAlive) !== null;
     d.out(running ? `Asked the daemon to ${what}.` : `Queued "${what}"; the daemon is not running, so it applies when it starts.`);
 }
+function daemonSyncModeClient(d) {
+    if (d.syncModeClient)
+        return d.syncModeClient();
+    return (async () => {
+        const [{ VaultClient }, { buildVaultConfig, ensureCognitoToken }] = await Promise.all([
+            import("@indigoai-us/hq-cloud"),
+            import("../utils/cognito-session.js"),
+        ]);
+        const token = await ensureCognitoToken();
+        return new VaultClient(buildVaultConfig(token));
+    })();
+}
+function daemonSyncStatus(d) {
+    const host = currentHost(d);
+    const { paths } = host;
+    const config = readDaemonConfig(paths.configPath);
+    const daemonPid = runningDaemonPid(paths.lockPath, d.daemonAlive);
+    const daemonState = daemonPid === null ? null : readState(paths);
+    const syncUnit = daemonState?.units.find((unit) => unit.id === "sync");
+    const hqRoot = config.hqRoot ?? d.env.HQ_ROOT?.trim();
+    let ownerStatusCandidate = null;
+    if (hqRoot) {
+        try {
+            ownerStatusCandidate = readWatchRunnerOwnerStatus(watchRunnerOwnerStatusPath(hqRoot, d.home, d.env));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            d.err(`Could not read sync runner owner status; treating it as unavailable: ${detail}`);
+        }
+    }
+    const ownerCommandLine = ownerStatusCandidate
+        ? processCommandLine(ownerStatusCandidate.pid, { platform: d.platform, run: d.run })
+        : null;
+    const ownerStatus = ownerCommandLine && isSyncRunnerCommandLine(ownerCommandLine)
+        ? ownerStatusCandidate
+        : null;
+    return {
+        running: syncUnit?.status === "running",
+        paused: config.syncPaused === true,
+        syncOwner: effectiveSyncOwner(config, host.detected.type),
+        owner: ownerStatus?.owner ?? (syncUnit?.status === "running" ? "hq-daemon" : null),
+        runnerPid: ownerStatus?.pid ?? syncUnit?.pid ?? null,
+        hqCloudVersion: ownerStatus?.version ?? null,
+        lastHeartbeat: syncUnit?.lastHeartbeatAt ?? ownerStatus?.heartbeatAt ?? null,
+        lastPassResult: syncUnit?.lastPassResult ?? null,
+        unitStatus: syncUnit?.status ?? "not-running",
+        reason: syncUnit?.reason ?? null,
+        logPath: paths.unitLogPath("sync"),
+    };
+}
+async function runDaemonSyncStatus(d, opts) {
+    const status = daemonSyncStatus(d);
+    if (opts.json) {
+        d.out(JSON.stringify(status, null, 2));
+        return;
+    }
+    d.out(`Sync ${status.running ? "running" : status.unitStatus}${status.paused ? " (paused)" : ""}.`);
+    d.out(`Configured sync owner: ${status.syncOwner}.`);
+    d.out(`Owner: ${status.owner ?? "none"}; runner pid: ${status.runnerPid ?? "none"}; hq-cloud: ${status.hqCloudVersion ?? "unknown"}.`);
+    if (status.reason)
+        d.out(`Reason: ${status.reason}`);
+    d.out(`Log: ${status.logPath}`);
+}
+function queueDaemonSyncControl(d, request) {
+    const host = currentHost(d);
+    writeControlRequest(host.paths.requestsDir, request);
+    handOver(d, host);
+    return runningDaemonPid(host.paths.lockPath, d.daemonAlive) !== null;
+}
+async function runDaemonSyncNow(d, opts) {
+    const host = currentHost(d);
+    const config = readDaemonConfig(host.paths.configPath);
+    if (config.syncPaused)
+        throw new DaemonCommandError("sync is paused; run `hq daemon sync resume` first");
+    if (!enabledServices(host.detected.type, config).includes("sync")) {
+        throw new DaemonCommandError("sync is disabled for this machine; run `hq daemon enable sync` first");
+    }
+    const running = queueDaemonSyncControl(d, { action: "restart", unit: "sync" });
+    const result = { accepted: true, action: "restart-sync-runner", daemonRunning: running };
+    d.out(opts.json ? JSON.stringify(result, null, 2) : running ? "Asked the daemon to start a fresh sync pass." : "Queued a fresh sync pass for the next daemon start.");
+}
+async function runDaemonSyncPause(d, paused, opts) {
+    const host = currentHost(d);
+    const config = readDaemonConfig(host.paths.configPath);
+    if (config.syncPaused !== paused)
+        writeDaemonConfig(host.paths.configPath, { ...config, syncPaused: paused });
+    const daemonRunning = queueDaemonSyncControl(d, { action: "reconcile" });
+    const result = { paused, persisted: true, daemonRunning };
+    d.out(opts.json ? JSON.stringify(result, null, 2) : `Sync ${paused ? "paused" : "resumed"}${daemonRunning ? "" : "; the setting will apply when the daemon starts"}.`);
+}
+async function runDaemonSyncTakeOwnership(d, opts) {
+    const host = currentHost(d);
+    const config = readDaemonConfig(host.paths.configPath);
+    if (config.syncOwner !== "daemon")
+        writeDaemonConfig(host.paths.configPath, { ...config, syncOwner: "daemon" });
+    const daemonRunning = queueDaemonSyncControl(d, { action: "reconcile" });
+    const result = { syncOwner: "daemon", persisted: true, daemonRunning };
+    d.out(opts.json ? JSON.stringify(result, null, 2) : `Daemon sync ownership persisted${daemonRunning ? "; asked the daemon to reconcile" : "; it applies when the daemon starts"}.`);
+}
+async function runDaemonSyncModeGet(d, companySlug, opts) {
+    const result = await getSyncModeForCompany({ companySlug, vaultClient: await daemonSyncModeClient(d) });
+    const value = {
+        companySlug: result.companySlug,
+        membershipId: result.membershipId,
+        mode: result.config.syncMode,
+        isDefault: result.config.isDefault,
+        ...(result.config.updatedAt ? { updatedAt: result.config.updatedAt } : {}),
+    };
+    d.out(opts.json ? JSON.stringify(value, null, 2) : `${value.companySlug}: ${value.mode}${value.isDefault ? " (default)" : ""}`);
+}
+async function runDaemonSyncModeSet(d, companySlug, mode, opts) {
+    if (mode !== "all" && mode !== "shared") {
+        throw new DaemonCommandError(`Invalid sync mode '${mode}'. Use all or shared.`);
+    }
+    const result = await setSyncMode({
+        mode,
+        companySlug,
+        vaultClient: await daemonSyncModeClient(d),
+    });
+    const value = {
+        companySlug: result.companySlug,
+        membershipId: result.membershipId,
+        previousMode: result.previousMode,
+        mode: result.newMode,
+        isDefault: result.newConfig.isDefault,
+        ...(result.newConfig.updatedAt ? { updatedAt: result.newConfig.updatedAt } : {}),
+    };
+    d.out(opts.json ? JSON.stringify(value, null, 2) : `${value.companySlug}: ${value.previousMode} → ${value.mode}`);
+}
 async function runToggle(d, action, services) {
     const host = currentHost(d);
     const { paths } = host;
@@ -608,6 +742,45 @@ export function registerDaemonCommand(program, over = {}) {
         .description("Show the machine type and each service's state")
         .option("--json", "Print machine-readable JSON")
         .action(wrap((d, opts) => runStatus(d, opts)));
+    const sync = daemon
+        .command("sync")
+        .description("Inspect and control the daemon's company sync runner");
+    sync
+        .command("status")
+        .description("Show sync ownership, heartbeat, last pass and log path")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, opts) => runDaemonSyncStatus(d, opts)));
+    sync
+        .command("now")
+        .description("Start a fresh sync pass immediately")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, opts) => runDaemonSyncNow(d, opts)));
+    sync
+        .command("pause")
+        .description("Pause daemon sync until resumed")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, opts) => runDaemonSyncPause(d, true, opts)));
+    sync
+        .command("resume")
+        .description("Resume daemon sync after a pause")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, opts) => runDaemonSyncPause(d, false, opts)));
+    sync
+        .command("take-ownership")
+        .description("Persist daemon ownership of desktop sync and reconcile")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, opts) => runDaemonSyncTakeOwnership(d, opts)));
+    const mode = sync.command("mode").description("Read or change a company's sync footprint");
+    mode
+        .command("get <company>")
+        .description("Read a company's current all/shared sync mode")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, company, opts) => runDaemonSyncModeGet(d, company, opts)));
+    mode
+        .command("set <company> <mode>")
+        .description("Set a company's sync mode to all or shared")
+        .option("--json", "Print machine-readable JSON")
+        .action(wrap((d, company, mode, opts) => runDaemonSyncModeSet(d, company, mode, opts)));
     daemon
         .command("logs [unit]")
         .description("Print the supervisor log, or one service's log")

package/dist/commands/dm.d.ts

@@ -368,5 +368,7 @@ export declare function agentCallerUid(token: string, machine?: () => boolean):
 export declare const AGENT_THREAD_UNAVAILABLE: string;
 /** One-line summary of an agent inbox item (DM, email, … — shapes vary by channel). Pure. */
 export declare function formatAgentInboxItem(item: Record<string, unknown>): string;
+/** Remove delegated execution context before agent inbox items can be emitted. */
+export declare function redactAgentInboxItem<T extends object>(item: T): Omit<T, "actingContext">;
 export declare function registerDmCommand(program: Command): void;
 //# sourceMappingURL=dm.d.ts.map

package/dist/commands/dm.js

@@ -1064,16 +1064,22 @@ export function formatAgentInboxItem(item) {
     const text = str("text") || str("body") || str("subject");
     return `${chalk.bold(from)} ${chalk.dim(`[${channel}] ${id}${when ? ` ${when}` : ""}`)}\n  ${firstLine(text)}`;
 }
+/** Remove delegated execution context before agent inbox items can be emitted. */
+export function redactAgentInboxItem(item) {
+    const { actingContext: _actingContext, ...safe } = item;
+    return safe;
+}
 async function runAgentInbox(token, agentUid, opts) {
     const route = `/v1/agents/${encodeURIComponent(agentUid)}/inbox`;
     const res = await vaultApiFetch({ token, path: route });
     if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        console.error(chalk.red(`GET ${route} → ${res.status}${text ? `: ${text.slice(0, 300)}` : ""}`));
+        // Error bodies are not constrained to the success response shape. Do not
+        // echo them: a proxy or partial failure could include inbox items.
+        console.error(chalk.red(`GET ${route} → ${res.status}`));
         process.exit(1);
     }
     const data = (await res.json().catch(() => ({})));
-    let items = Array.isArray(data.messages) ? data.messages : [];
+    let items = (Array.isArray(data.messages) ? data.messages : []).map(redactAgentInboxItem);
     if (opts.limit && Number(opts.limit) > 0)
         items = items.slice(0, Number(opts.limit));
     if (opts.json) {
@@ -1251,7 +1257,8 @@ async function runDmChannel(target, opts) {
         }
         const data = (await res.json());
         const messages = data.messages ?? [];
-        const ordered = [...messages].reverse(); // oldest-first for reading
+        const agentCaller = agentCallerUid(token) !== null;
+        const ordered = [...messages].reverse().map((message) => agentCaller ? redactAgentInboxItem(message) : message); // oldest-first for reading; agent JSON must not expose delegated context
         if (opts.json) {
             console.log(JSON.stringify(ordered, null, 2));
         }

package/dist/commands/feedback.d.ts

@@ -3,6 +3,8 @@ import { type DiagnosticsBlob } from "../utils/feedback-diagnostics.js";
 import { collectFeedbackLogs, feedbackLogsEnabled } from "../utils/feedback-logs.js";
 import { type LogBundleRef } from "../utils/feedback-log-bundle.js";
 export declare const BODY_MAX_BYTES: number;
+/** Validate fields that must be valid before feedback attachments are uploaded. */
+export declare function validateFeedbackContent(title: string, body: string): void;
 /**
  * Mirror of the server's `MAX_BODY_BYTES` in hq-pro
  * `src/vault-service/handlers/feedback.ts`, which rejects the WHOLE request
@@ -36,6 +38,10 @@ export interface FeedbackSubmitOptions {
      * stays a summary and this carries the rest.
      */
     logBundle?: LogBundleRef;
+    /** Diagnostics collected before uploads by the command path. */
+    diagnostics?: DiagnosticsBlob;
+    /** Precomputed setting so environment lookup happens before attachments upload. */
+    logsEnabled?: boolean;
 }
 export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
 /**

package/dist/commands/feedback.js

@@ -1,12 +1,25 @@
 import * as fs from "node:fs";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { assertVaultApiRequestSupported, vaultApiFetch, } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
 import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 import { FEEDBACK_LOGS_MAX_TOTAL_BYTES, FEEDBACK_LOGS_MIN_USEFUL_BYTES, collectFeedbackLogs, feedbackLogsEnabled, } from "../utils/feedback-logs.js";
 import { uploadLogBundle } from "../utils/feedback-log-bundle.js";
 export const BODY_MAX_BYTES = 64 * 1024;
+/** Validate fields that must be valid before feedback attachments are uploaded. */
+export function validateFeedbackContent(title, body) {
+    if (title.trim().length === 0) {
+        throw new Error("title must not be empty. Provide a short, non-whitespace title via --title.");
+    }
+    if (body.trim().length === 0) {
+        throw new Error("body must not be empty. Provide at least one non-whitespace character.");
+    }
+    const bodyBytes = Buffer.byteLength(body, "utf8");
+    if (bodyBytes > BODY_MAX_BYTES) {
+        throw new Error(`Body exceeds 64 KiB limit (${bodyBytes} bytes). Reduce the body size before submitting.`);
+    }
+}
 /**
  * Mirror of the server's `MAX_BODY_BYTES` in hq-pro
  * `src/vault-service/handlers/feedback.ts`, which rejects the WHOLE request
@@ -16,12 +29,36 @@ export const BODY_MAX_BYTES = 64 * 1024;
  * logs are budgeted against whatever headroom is left between them.
  */
 export const REQUEST_MAX_BYTES = 64 * 1024;
+/** Reject JSON envelopes that hq-pro would refuse with HTTP 413. */
+function validateFeedbackRequestSize(requestBody) {
+    const requestBytes = Buffer.byteLength(JSON.stringify(requestBody), "utf8");
+    if (requestBytes > REQUEST_MAX_BYTES) {
+        throw new Error(`Request exceeds 64 KiB limit (${requestBytes} bytes). Reduce the feedback content before submitting.`);
+    }
+}
 /**
  * Headroom held back for the `"logs":{...}` JSON envelope itself — its keys,
  * braces, and the escaping of the tail text. The final size is re-measured
  * after attaching, so this reserve only needs to be roughly right.
  */
 const LOGS_ENVELOPE_RESERVE_BYTES = 1024;
+function buildFeedbackRequestBody(opts) {
+    const requestBody = {
+        type: opts.type,
+        title: opts.title,
+        body: opts.body,
+        diagnostics: opts.diagnostics,
+    };
+    if (opts.company) {
+        requestBody.company = opts.company;
+    }
+    if (opts.screenshots && opts.screenshots.length > 0) {
+        requestBody.screenshots = opts.screenshots;
+    }
+    if (opts.logBundle)
+        requestBody.logBundle = opts.logBundle;
+    return requestBody;
+}
 export async function readBodyFile(bodyFile, stdin) {
     if (bodyFile === "-") {
         const stream = stdin ?? process.stdin;
@@ -79,48 +116,32 @@ export function attachDebugLogs(requestBody, diagnostics, enabled, deps = {}) {
     }
 }
 export async function submitFeedback(opts) {
-    // Validate the title locally, symmetric with the body check below. Commander's
-    // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
-    // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
-    // to nothing) passes the flag check, then the server rejects it with a 400
-    // "title (non-empty string) is required" that floods Sentry as a context-free
-    // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
-    // and the bad request never reaches the server.
-    if (opts.title.trim().length === 0) {
-        throw new Error("title must not be empty. Provide a short, non-whitespace title via --title.");
-    }
-    if (opts.body.trim().length === 0) {
-        throw new Error("body must not be empty. Provide at least one non-whitespace character.");
-    }
-    const bodyBytes = Buffer.byteLength(opts.body, "utf8");
-    if (bodyBytes > BODY_MAX_BYTES) {
-        throw new Error(`Body exceeds 64 KiB limit (${bodyBytes} bytes). Reduce the body size before submitting.`);
-    }
-    const diagnostics = collectDiagnostics();
-    const requestBody = {
+    // Keep submitFeedback safe for direct callers as well as the command path,
+    // which invokes the same validator before uploading any attachments.
+    validateFeedbackContent(opts.title, opts.body);
+    const diagnostics = opts.diagnostics ?? collectDiagnostics();
+    const requestBody = buildFeedbackRequestBody({
         type: opts.type,
         title: opts.title,
         body: opts.body,
+        company: opts.company,
         diagnostics,
-    };
-    if (opts.company) {
-        requestBody.company = opts.company;
-    }
-    if (opts.screenshots && opts.screenshots.length > 0) {
-        requestBody.screenshots = opts.screenshots;
-    }
-    // The bundle reference is four small fields, so unlike the inline logs below
-    // it needs no budgeting — but it is added BEFORE attachDebugLogs so those
-    // bytes are counted against the inline budget rather than overrunning it.
-    if (opts.logBundle) {
-        requestBody.logBundle = opts.logBundle;
-    }
+        screenshots: opts.screenshots,
+        logBundle: opts.logBundle,
+    });
+    // Direct callers can supply attachment references; ensure the complete base
+    // envelope still fits before adding optional inline logs or making a request.
+    validateFeedbackRequestSize(requestBody);
     // Debug logs are attached LAST and sized against the headroom the rest of
     // the request left behind. The server 413s the whole body over 64 KiB, so a
     // fixed log budget would turn a previously-working large-body submission
     // into a hard failure. Measuring the real serialized envelope — the exact
     // bytes vaultApiFetch will send — is what makes that impossible.
-    attachDebugLogs(requestBody, diagnostics, opts.includeLogs !== false);
+    attachDebugLogs(requestBody, diagnostics, opts.includeLogs !== false, {
+        envEnabled: opts.logsEnabled === undefined
+            ? feedbackLogsEnabled
+            : () => opts.logsEnabled === true,
+    });
     const res = await vaultApiFetch({
         token: opts.token,
         path: "/v1/feedback",
@@ -155,8 +176,34 @@ function registerSubcommand(feedbackCmd, type) {
         try {
             const token = await ensureCognitoToken({ interactive: false });
             const body = await readBodyFile(opts.bodyFile);
-            // Validate + upload screenshots (direct-to-S3 via presigned PUT)
-            // before submitting, so the row references uploaded objects.
+            validateFeedbackContent(opts.title, body);
+            // Resolve every required local input before creating S3 objects. These
+            // diagnostics are passed through so submitFeedback does not collect
+            // them again after attachments have been uploaded.
+            const diagnostics = collectDiagnostics();
+            const logsEnabled = opts.logs !== false && feedbackLogsEnabled();
+            // Validate the serialized server request envelope before screenshots
+            // or the log bundle can create remote objects. Attachment references
+            // are added and checked again inside submitFeedback after upload.
+            validateFeedbackRequestSize(buildFeedbackRequestBody({
+                type,
+                title: opts.title,
+                body,
+                company: opts.company,
+                diagnostics,
+            }));
+            // vaultApiFetch can reject an hqk_ token or an invalid API base URL
+            // locally before fetch. Check the mandatory POST, and the screenshot
+            // presign when requested, before any upload can create an orphan.
+            assertVaultApiRequestSupported({ token, path: "/v1/feedback" });
+            if ((opts.screenshot ?? []).length > 0) {
+                assertVaultApiRequestSupported({
+                    token,
+                    path: "/v1/feedback/screenshots/presign",
+                });
+            }
+            // Upload screenshots (direct-to-S3 via presigned PUT) before the
+            // submission, so the row references uploaded objects.
             const screenshots = await uploadScreenshots({
                 paths: opts.screenshot ?? [],
                 token,
@@ -167,7 +214,7 @@ function registerSubcommand(feedbackCmd, type) {
             // this resolves undefined and the report still carries inline logs.
             const logBundle = await uploadLogBundle({
                 token,
-                enabled: opts.logs !== false && feedbackLogsEnabled(),
+                enabled: logsEnabled,
             });
             const result = await submitFeedback({
                 type,
@@ -178,6 +225,8 @@ function registerSubcommand(feedbackCmd, type) {
                 screenshots,
                 includeLogs: opts.logs !== false,
                 logBundle,
+                diagnostics,
+                logsEnabled,
             });
             console.log(`Submitted: ${result.id}`);
         }