@indigoai-us/hq-cli 5.289.0 → 5.291.0

package/dist/commands/core-ontology.js

@@ -17,7 +17,7 @@ import { applyOntologyRun, ApplyError } from "../lib/checkpoint-ontology/apply.j
 import { resolveOntologyCompany, WriteBoundsError } from "../lib/checkpoint-ontology/company.js";
 import { findDuplicateGroups, summarizeMergeBack, } from "../lib/checkpoint-ontology/multi-writer.js";
 import { buildEntityIndex } from "../lib/checkpoint-ontology/tree.js";
-import { MERGE_COPIES_FLAG, MERGE_VARIANTS_FLAG, mergeCopies, } from "../lib/checkpoint-ontology/merge-copies.js";
+import { MERGE_COPIES_FLAG, MERGE_REWRITE_REFS_FLAG, MERGE_VARIANTS_FLAG, mergeCopies, } from "../lib/checkpoint-ontology/merge-copies.js";
 import { callDeleteEndpoint } from "./files.js";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { registerCoreOntologyNativeCommands } from "./core-ontology-native.js";
@@ -146,11 +146,12 @@ function mergeCopiesSummary(report) {
     const held = report.plans.filter((plan) => plan.held).length;
     const lines = [
         `ontology merge-copies (${report.mode.replace("_", " ")}) in ${report.company} (${report.pair_kind}): ${report.plans.length} of ${report.copies_found} copies, ${held} held, ${report.skipped.length} skipped`,
-        `  merged ${report.merged.length}, relinked ${report.relinked.length}, deleted ${report.deleted.length}, not ready ${report.not_ready.length}, errors ${report.errors.length}`,
+        `  merged ${report.merged.length}, relinked ${report.relinked.length}${report.rewritten !== undefined ? `, rewritten ${report.rewritten.length}` : ""}, deleted ${report.deleted.length}, not ready ${report.not_ready.length}, errors ${report.errors.length}`,
         `  duplicate groups ${report.duplicate_groups_before} -> ${report.duplicate_groups_after}; broken entity links ${report.broken_links_before} -> ${report.broken_links_after}`,
     ];
-    for (const plan of report.plans.filter((entry) => entry.held))
-        lines.push(`  held ${plan.copy}: ${plan.held}`);
+    for (const plan of report.plans.filter((entry) => entry.held)) {
+        lines.push(`  held ${plan.copy}: ${plan.held}${plan.held === "external_id_conflict" ? ` (${plan.detail})` : ""}`);
+    }
     for (const error of report.errors)
         lines.push(`  error ${error.path}: ${error.error}`);
     for (const entry of report.only_unmatched ?? [])
@@ -176,7 +177,36 @@ export function readListedPairs(file) {
         })) {
         throw new OntologyUsageError("ontology: --only must be a non-empty JSON array of { copy, original } paths");
     }
-    return parsed.map((entry) => ({ copy: entry.copy, original: entry.original }));
+    return parsed.map((entry) => {
+        if (entry.resolve_external_ids === undefined)
+            return { copy: entry.copy, original: entry.original };
+        return { copy: entry.copy, original: entry.original, resolve_external_ids: readResolution(entry.copy, entry.resolve_external_ids) };
+    });
+}
+/** `{ provider: { primary, namespace, object_type? } }`, every value a non-empty string. */
+function readResolution(copy, raw) {
+    const usage = `ontology: --only entry ${copy}: resolve_external_ids must map each provider to { primary, namespace, object_type? } strings`;
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw) || Object.keys(raw).length === 0)
+        throw new OntologyUsageError(usage);
+    const out = {};
+    for (const [provider, value] of Object.entries(raw)) {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            throw new OntologyUsageError(usage);
+        const record = value;
+        const nonEmpty = (field) => typeof field === "string" && field.length > 0;
+        if (!Object.keys(record).every((key) => key === "primary" || key === "namespace" || key === "object_type") ||
+            !nonEmpty(record.primary) ||
+            !nonEmpty(record.namespace) ||
+            (record.object_type !== undefined && !nonEmpty(record.object_type))) {
+            throw new OntologyUsageError(usage);
+        }
+        out[provider] = {
+            primary: record.primary,
+            namespace: record.namespace,
+            ...(record.object_type !== undefined ? { object_type: record.object_type } : {}),
+        };
+    }
+    return out;
 }
 /**
  * `hq core ontology merge-copies`: merge `<slug> <n>.md` copies into their
@@ -185,7 +215,10 @@ export function readListedPairs(file) {
  * `checkpoint.ontology.merge-copies` and `checkpoint.ontology.multi-writer`.
  * With `--variants`, merges two-file duplicate groups whose names differ only
  * in case, spacing or punctuation instead, gated by
- * `checkpoint.ontology.merge-variants`.
+ * `checkpoint.ontology.merge-variants`. `--rewrite-refs` (flag
+ * `checkpoint.ontology.merge-rewrite-refs`) also re-points signal refs,
+ * invoice and bill links, source and knowledge links, and carries external
+ * ids and web domains.
  */
 export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
     if (options.apply && options.delete) {
@@ -200,7 +233,7 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
         throw new OntologyUsageError(`ontology: company rejected: ${resolution.reason}`);
     const company = resolution.company;
     const readFlag = deps.readFlag ?? registryFlagReader;
-    for (const flag of [options.variants ? MERGE_VARIANTS_FLAG : MERGE_COPIES_FLAG, MULTI_WRITER_FLAG]) {
+    for (const flag of [options.variants ? MERGE_VARIANTS_FLAG : MERGE_COPIES_FLAG, MULTI_WRITER_FLAG, ...(options.rewriteRefs ? [MERGE_REWRITE_REFS_FLAG] : [])]) {
         if (!(await readFlag(flag, company))) {
             return options.json ? JSON.stringify({ company: company.slug, skipped: `${flag} off` }) : `ontology merge-copies: skipped (${flag} is off)`;
         }
@@ -220,6 +253,7 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
         ...(options.variants ? { pairKind: "variants" } : {}),
         ...(options.limit !== undefined ? { limit: options.limit } : {}),
         ...(only ? { only } : {}),
+        ...(options.rewriteRefs ? { rewriteRefs: true } : {}),
         ...(deleteVaultKey ? { deleteVaultKey } : {}),
     });
     return options.json ? JSON.stringify(report, null, 2) : mergeCopiesSummary(report);
@@ -274,6 +308,7 @@ export function registerCoreOntologyCommand(core) {
         .option("--variants", "merge two-file duplicate groups whose names differ only in case, spacing or punctuation (checkpoint.ontology.merge-variants)")
         .option("--limit <n>", "handle at most this many copies", (value) => Number(value))
         .option("--only <file>", "handle only the copy -> original pairs listed in this JSON file")
+        .option("--rewrite-refs", "also re-point signal refs, invoice, source and knowledge links to the survivor and carry external ids and web domains (checkpoint.ontology.merge-rewrite-refs)")
         .option("--json", "print JSON")
         .option("--hq-root <path>", "HQ installation to operate on")
         .action(async (options) => {

package/dist/commands/core-policy.js

@@ -205,6 +205,28 @@ function extractRulePaths(file) {
     }
     return [...paths].sort();
 }
+function shellReferenceStem(reference) {
+    const lastDot = reference.lastIndexOf('.');
+    return lastDot === -1 ? reference : reference.slice(0, lastDot);
+}
+function shellLsExtensionGlobHasMatch(root, stem) {
+    const patternPath = path.join(root, `${stem}.*`);
+    const directory = path.dirname(patternPath);
+    const basenamePattern = path.basename(patternPath);
+    const literalPrefix = basenamePattern.slice(0, -1);
+    let entries;
+    try {
+        entries = fs.readdirSync(directory);
+    }
+    catch (error) {
+        if (expectedFsMiss(error))
+            return false;
+        throw error;
+    }
+    // Bash 5.2 enables globskipdots by default, so `.*` only matches when the
+    // directory has an actual hidden entry. readdir omits `.` and `..`.
+    return entries.some((entry) => entry.startsWith(literalPrefix));
+}
 function refSummary(file, root) {
     const refs = extractRulePaths(file);
     const judged = refs.filter((reference) => {
@@ -228,11 +250,8 @@ function refSummary(file, root) {
         }
         if (fs.existsSync(path.join(root, reference)))
             continue;
-        const extension = path.posix.extname(reference);
-        const stem = extension ? reference.slice(0, -extension.length) : reference;
-        const parent = path.join(root, path.posix.dirname(stem));
-        const basename = path.posix.basename(stem);
-        const hasSibling = listFiles(parent).some((name) => name.startsWith(`${basename}.`));
+        const stem = shellReferenceStem(reference);
+        const hasSibling = shellLsExtensionGlobHasMatch(root, stem);
         if (hasSibling)
             renamed.push(reference);
         else

package/dist/commands/core.js

@@ -31,9 +31,11 @@
 import { Option } from "commander";
 import { registerCoreCheckpointCommand } from "./core-checkpoint.js";
 import { registerCoreDelegateCommand } from "./core-delegate.js";
+import { registerCoreHandoffCommand } from "./core-handoff.js";
 import { registerCoreOntologyCommand } from "./core-ontology.js";
 import { registerCoreKnowledgePrefsCommand } from "./core-knowledge-prefs.js";
 import { registerCorePolicyCommand } from "./core-policy.js";
+import { registerCoreJobsNativeCommand } from "./core-jobs-native.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
@@ -210,6 +212,8 @@ export const SCAFFOLD_COMMANDS = [
  * direct `hq core` command.
  */
 export const SCAFFOLD_ONLY_ASSETS = [
+    { asset: "core/scripts/jobs-schedule-parse.sh", root: "live", summary: "Rollback companion for native jobs schedule-parse" },
+    { asset: "core/scripts/jobs-validate.sh", root: "live", summary: "Rollback companion for native jobs validate" },
     // Shared shell libs sourced by the two relocated scripts (and hooks). Never
     // dispatched on their own (so no `hq core` command), but they MUST ship in the
     // tarball, or the bundled hq-session / checkpoint-stop-gate die at `source`
@@ -241,7 +245,7 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/ontology-source-worklist.sh", root: "live", summary: "Rollback companion for native ontology source worklist" },
     { asset: "core/scripts/source-yaml-validate.sh", root: "cwd", summary: "Rollback companion for native source YAML validation" },
     // Shared by native knowledge-prefs and the ontology candidate shell fallback.
-    { asset: "core/scripts/knowledge-prefs.sh", root: "live", summary: "Rollback companion for native knowledge-prefs and ontology candidate" },
+    { asset: "core/scripts/knowledge-prefs.sh", root: "live", summary: "Sibling dependency for ontology candidate rollback companion" },
     // Rollback companions for the default-off native knowledge and policy routes.
     // policy-retire also runs the scaffold validator in-process when native, but
     // its bundled shell fallback needs both helper assets at these exact paths.
@@ -250,6 +254,11 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/read-policy-frontmatter.sh", root: "cwd", summary: "Rollback companion for native policy frontmatter" },
     { asset: "core/scripts/eval-trigger.sh", root: "live", summary: "Trigger grammar helper used by the policy validator companion" },
     { asset: ".claude/hooks/validate-policy-frontmatter.sh", root: "live", summary: "Policy validator companion used by policy-retire rollback" },
+    // Wave 2a handoff shells remain bundled as the default-off rollback path.
+    { asset: "core/scripts/handoff-finalize.sh", root: "live", summary: "Rollback shell for native handoff finalize" },
+    { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },
+    { asset: "core/scripts/handoff-open-steps.sh", root: "live", summary: "Rollback shell for native handoff open-steps" },
+    { asset: "core/scripts/qmd-reindex-bg.sh", root: "live", summary: "Rollback handoff reindex forwarder" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
         root,
@@ -302,6 +311,9 @@ function runEntry(entry, scope, args) {
         args,
         cwd,
         hqRoot,
+        env: entry.asset === "core/scripts/hq-session.sh"
+            ? { HQ_HQ_SESSION_NO_CLI: "1" }
+            : undefined,
     });
     // Propagate verbatim. Several of these scripts use their exit code as their
     // interface (drift detected, lint failed), so remapping it would break the
@@ -326,8 +338,10 @@ export function registerCoreCommands(program) {
     registerCoreOntologyCommand(core);
     registerCoreCheckpointGateSettingCommand(core);
     registerCoreDelegateCommand(core);
+    registerCoreHandoffCommand(core);
     registerCoreKnowledgePrefsCommand(core);
     registerCorePolicyCommand(core);
+    registerCoreJobsNativeCommand(core);
     // Wave 2 handoff/worktree commands retain their byte-identical shell assets
     // as a default-off rollback path for one release. Keep the gate helper small
     // so sibling Wave 2 work can reuse it without editing this command table.

package/dist/commands/integrations-core.js

@@ -12,6 +12,7 @@ import { randomUUID } from "node:crypto";
 import chalk from "chalk";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
+import { planGateErrorFromPayload } from "../utils/plan-gate-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
 import { redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
 import { connectionHealthNotice } from "../lib/integrations/health.js";
@@ -195,6 +196,12 @@ export async function raiseForResponse(res, fallback) {
     raiseIfUnauthorized(res);
     raiseIfUpstreamUnavailable(res);
     const body = (await res.json().catch(() => ({})));
+    // A plan-limit 402 is normally decoded by vaultApiFetch before it gets here.
+    // Decode it again so no integration route can print the wire token
+    // `plan_limit_reached` as its whole message; main.ts renders the typed gate.
+    const planGate = planGateErrorFromPayload(res.status, body);
+    if (planGate)
+        throw planGate;
     // hq-pro mints this error text, so it is untrusted input to a message we
     // print verbatim — scrub credentials out before it can reach a terminal or a
     // Sentry crash report (same reasoning as the gateway path below).

package/dist/commands/lanes.js

@@ -32,6 +32,7 @@ import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { startOutpostLaneSnapshotRefresh } from "../lib/lanes/outpost-snapshot-refresh.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
+import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
 import { getOrFetchOutpostSnapshot, OUTPOST_SNAPSHOT_CACHE_TTL_MS, outpostLaneListSnapshotKey, OutpostSnapshotInvocationMemo, } from "../lib/lanes/outpost-snapshot-cache.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, selectOutpostHireGrantHierarchy, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
@@ -2369,6 +2370,8 @@ async function emitLaneStartedForStories(ctx, company, lane, threadId, knownAbse
             failures.push(err);
             continue;
         }
+        if (!story.project_id?.trim() || !story.story_id?.trim())
+            continue;
         if (knownAbsentStories.has(storyBoardStoryKey(story.project_id, story.story_id)))
             continue;
         try {
@@ -3453,40 +3456,42 @@ async function runCreate(ctx, opts) {
                 : undefined,
         });
     }
-    printJson({
-        ok: true,
-        action: "create",
-        lane_id: started.lane_id,
-        state: started.state,
-        queued_reason: started.queued_reason ?? null,
-        priority: started.priority,
-        provider: started.provider,
-        account: started.account ?? null,
-        model: started.model ?? null,
-        effort: started.effort ?? null,
-        effort_source: started.effort_source ?? null,
-        host: started.host,
-        ...(autoPlacementSkippedHosts.length > 0
-            ? { skipped_hosts: autoPlacementSkippedHosts }
-            : {}),
-        company: started.company,
-        project_id: started.project_id,
-        story_id: started.story_id,
-        stories: laneStories(started),
-        story_warning: combinedStoryWarning(started, createStoryWarnings),
-        thread_id: started.thread_id ?? null,
-        senior: started.senior,
-        depth: started.depth,
-        timeout_secs: timeoutSecs ?? null,
-        ...(validation ? { validation } : {}),
-        ...(started.outpost_command_id
-            ? {
-                outpost_command_id: started
-                    .outpost_command_id,
-            }
-            : {}),
-        lane: started,
-    });
+    if (!opts.quiet)
+        printJson({
+            ok: true,
+            action: "create",
+            lane_id: started.lane_id,
+            state: started.state,
+            queued_reason: started.queued_reason ?? null,
+            priority: started.priority,
+            provider: started.provider,
+            account: started.account ?? null,
+            model: started.model ?? null,
+            effort: started.effort ?? null,
+            effort_source: started.effort_source ?? null,
+            host: started.host,
+            ...(autoPlacementSkippedHosts.length > 0
+                ? { skipped_hosts: autoPlacementSkippedHosts }
+                : {}),
+            company: started.company,
+            project_id: started.project_id,
+            story_id: started.story_id,
+            stories: laneStories(started),
+            story_warning: combinedStoryWarning(started, createStoryWarnings),
+            thread_id: started.thread_id ?? null,
+            senior: started.senior,
+            depth: started.depth,
+            timeout_secs: timeoutSecs ?? null,
+            ...(validation ? { validation } : {}),
+            ...(started.outpost_command_id
+                ? {
+                    outpost_command_id: started
+                        .outpost_command_id,
+                }
+                : {}),
+            lane: started,
+        });
+    return started;
 }
 async function dispatchCreatedOutpostLane(ctx, input) {
     const { hqRoot, lane, outpostId, briefText, timeout, preserveQueuedOnFailure = false, } = input;
@@ -6464,7 +6469,7 @@ async function emitStoryTransition(ctx, lane, projectId, storyId, event, status,
         ...payload,
         lane_status: lane.state,
     });
-    if (!skipStoryStatusPatch) {
+    if (!skipStoryStatusPatch && projectId?.trim() && storyId?.trim()) {
         await ctx.mesh.patchStoryStatus(company, projectId, storyId, status === "blocked" ? "in_progress" : status);
     }
 }
@@ -7824,8 +7829,44 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
         summary.ok = false;
     }
     const terminalizedRemoteIds = new Set(remoteLost.map(({ id }) => id));
+    let autopilot;
+    try {
+        const host = reconcileHostFromCtx(ctx);
+        autopilot = await runLeadAutopilotPass({
+            hqRoot,
+            host: host.outpostId ?? "local",
+            hostname: host.hostname,
+            outpostId: host.outpostId,
+            now: ctx.now(),
+            dryRun: Boolean(opts.dryRun),
+            readFlag: readLanesRegistryFlag,
+            keepAliveResumedLeads: new Set(summary.resumed.filter((entry) => entry.reason === "keep_alive").map((entry) => entry.id)),
+            startWorker: async ({ lead, story }) => {
+                const workerCtx = { ...ctx, env: { ...ctx.env, HQ_LANE_ID: lead.lane_id } };
+                const started = await runCreate(workerCtx, {
+                    company: lead.company?.slug,
+                    project: lead.project_id,
+                    story: story.id,
+                    briefFile: story.briefPath,
+                    provider: "codex",
+                    model: "gpt-6-luna",
+                    effort: "high",
+                    senior: `lane:${lead.lane_id}`,
+                    quiet: true,
+                });
+                return { lane_id: started.lane_id };
+            },
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        summary.ok = false;
+        summary.errors.push({ code: "lead_autopilot_failed", message });
+        process.stderr.write(`hq lanes autopilot: ${message}\n`);
+    }
     printJson({
         ...summary,
+        ...(autopilot ? { autopilot } : {}),
         ...(remoteLost.length > 0 ? { remote_lost: remoteLost } : {}),
         ...(mirrorRefresh.unverifiedRemote.size > 0
             ? {
@@ -8590,6 +8631,41 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runPickup(ctx, opts);
     }));
+    lanes
+        .command("autopilot")
+        .description("Check registered team leads and wake them for ready work")
+        .command("run")
+        .description("Run one lead autopilot check pass")
+        .option("--dry-run", "Report proposed wakes without writing them")
+        .option("--json", "Emit JSON on stdout (default)")
+        .action(wrap(async (opts) => {
+        const host = reconcileHostFromCtx(ctx);
+        const result = await runLeadAutopilotPass({
+            hqRoot: ctx.hqRoot(),
+            host: host.outpostId ?? "local",
+            hostname: host.hostname,
+            outpostId: host.outpostId,
+            now: ctx.now(),
+            dryRun: Boolean(opts.dryRun),
+            readFlag: readLanesRegistryFlag,
+            startWorker: async ({ lead, story }) => {
+                const workerCtx = { ...ctx, env: { ...ctx.env, HQ_LANE_ID: lead.lane_id } };
+                const started = await runCreate(workerCtx, {
+                    company: lead.company?.slug,
+                    project: lead.project_id,
+                    story: story.id,
+                    briefFile: story.briefPath,
+                    provider: "codex",
+                    model: "gpt-6-luna",
+                    effort: "high",
+                    senior: `lane:${lead.lane_id}`,
+                    quiet: true,
+                });
+                return { lane_id: started.lane_id };
+            },
+        });
+        printJson(result);
+    }));
     const reconcile = lanes
         .command("reconcile", { hidden: true })
         .description("Run one machine-owned reconcile pass and exit")

package/dist/commands/members.js

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/i;
@@ -558,6 +559,10 @@ export function registerMembersCommand(program) {
             }
         }
         catch (err) {
+            // A seat-limit refusal goes to main.ts's shared plan-gate renderer:
+            // reason, usage, fix options and upgrade link, then a non-zero exit.
+            if (isPlanGateError(err))
+                throw err;
             // A 409 may refer to either an active membership or an existing
             // pending invite. Probe both views so email targets get actionable
             // guidance while preserving the terminal exit-0 behavior for bulk

package/dist/commands/mesh.js

@@ -11,7 +11,7 @@ import { readFileSync } from "node:fs";
 import { findHqRoot } from "../utils/manifest.js";
 import { CLI_VERSION } from "../cli-version.js";
 import chalk from "chalk";
-import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
+import { ensureCognitoToken, isExpiring, isMachineIdentity, loadCachedTokens, } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
 import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard, boardStoryStatus, formatStoryStatusChanges, mergeProjectStories, prdSyncEventsThatChangeBoard, } from "../lib/mesh/project-board.js";
@@ -26,7 +26,9 @@ import { CLI_KIND_TO_SCHEMA, resolveEnqueueSessionId, } from "../lib/mesh/live/i
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
 import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
-const MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
+const ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
+// Leave 500 ms of headroom inside SessionStart's 2 s process-group limit.
+const OFFLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS = 1_500;
 import { buildEmitEvidence, machineEmitDisposition } from "../lib/mesh/live/emit-evidence.js";
 import { appendHeldLine } from "../lib/mesh/live/spool.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
@@ -860,29 +862,45 @@ async function runContextReconcile(opts) {
     let offline = Boolean(opts.offline);
     let token;
     try {
-        // Offline is outbox-only delivery. It still refreshes a device default's
-        // token-backed membership so a revoked default cannot be preflighted.
-        token = await requireToken();
-        const sessionToken = token;
-        validateMembership = async (candidate) => {
-            const membership = await new Promise((resolve, reject) => {
-                const timer = setTimeout(() => reject(new Error("membership validation timed out")), MEMBERSHIP_VALIDATION_TIMEOUT_MS);
-                void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
-                    clearTimeout(timer);
-                    resolve(value);
-                }, (error) => {
-                    clearTimeout(timer);
-                    reject(error);
+        if (offline) {
+            if (isMachineIdentity()) {
+                token = await ensureCognitoToken({ tokenSource: "machine", interactive: false });
+            }
+            else {
+                const cached = loadCachedTokens();
+                if (cached && !isExpiring(cached, 120)) {
+                    token = cached.accessToken;
+                }
+            }
+        }
+        else {
+            token = await requireToken();
+        }
+        if (token) {
+            const sessionToken = token;
+            const membershipValidationTimeoutMs = offline
+                ? OFFLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS
+                : ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS;
+            validateMembership = async (candidate) => {
+                const membership = await new Promise((resolve, reject) => {
+                    const timer = setTimeout(() => reject(new Error("membership validation timed out")), membershipValidationTimeoutMs);
+                    void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
+                        clearTimeout(timer);
+                        resolve(value);
+                    }, (error) => {
+                        clearTimeout(timer);
+                        reject(error);
+                    });
                 });
-            });
-            if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
-                return false;
+                if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
+                    return false;
+                }
+                return { uid: membership.companyUid };
+            };
+            if (!offline) {
+                deliver = createWorkSessionDeliverer({ token: sessionToken });
+                fetchCandidates = createCandidatesFetcher({ token: sessionToken });
             }
-            return { uid: membership.companyUid };
-        };
-        if (!offline) {
-            deliver = createWorkSessionDeliverer({ token: sessionToken });
-            fetchCandidates = createCandidatesFetcher({ token: sessionToken });
         }
     }
     catch {
@@ -900,7 +918,10 @@ async function runContextReconcile(opts) {
             log: (message) => console.error(chalk.dim(message)),
         });
         if (activation.status === "needs_choice") {
-            const interactive = !opts.machine && Boolean(process.stdin.isTTY && process.stdout.isTTY) && !isMachineIdentity();
+            const interactive = !offline &&
+                !opts.machine &&
+                Boolean(process.stdin.isTTY && process.stdout.isTTY) &&
+                !isMachineIdentity();
             if (interactive) {
                 const choices = activation.memberships
                     .map((membership, index) => `${index + 1}. ${membership.slug}`)
@@ -920,7 +941,7 @@ async function runContextReconcile(opts) {
                     rl.close();
                 }
             }
-            else if (!opts.machine) {
+            else if (!offline && !opts.machine) {
                 console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
             }
         }

package/dist/commands/personal-targeted-push-flag.d.ts

@@ -0,0 +1,4 @@
+export declare const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
+/** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
+export declare function personalTargetedPushPathsEnabled(): boolean;
+//# sourceMappingURL=personal-targeted-push-flag.d.ts.map

package/dist/commands/personal-targeted-push-flag.js

@@ -0,0 +1,7 @@
+import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+export const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
+/** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
+export function personalTargetedPushPathsEnabled() {
+    return resolveProcessFlagGate(CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=personal-targeted-push-flag.js.map

package/dist/commands/personal-targeted-push-paths.d.ts

@@ -0,0 +1,3 @@
+/** Resolve explicit --personal paths against the same roots as a full personal push. */
+export declare function resolveExplicitPersonalPushPaths(hqRoot: string, requestedPaths: readonly string[], cwd?: string): string[];
+//# sourceMappingURL=personal-targeted-push-paths.d.ts.map

package/dist/commands/personal-targeted-push-paths.js

@@ -0,0 +1,67 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { computePersonalVaultPaths, matchPersonalVaultExclusion, } from "@indigoai-us/hq-cloud";
+function isWithin(parent, candidate) {
+    const relative = path.relative(parent, candidate);
+    return relative === "" ||
+        (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+function rejectPath(input, reason) {
+    throw new Error(`--personal cannot push path "${input}": ${reason}`);
+}
+/** Resolve explicit --personal paths against the same roots as a full personal push. */
+export function resolveExplicitPersonalPushPaths(hqRoot, requestedPaths, cwd = process.cwd()) {
+    let realRoot;
+    try {
+        realRoot = fs.realpathSync.native(hqRoot);
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+        throw new Error(`--personal cannot resolve HQ root "${hqRoot}" (${code})`);
+    }
+    const allowedRoots = computePersonalVaultPaths(realRoot)
+        .map((allowedPath) => {
+        try {
+            return fs.realpathSync.native(allowedPath);
+        }
+        catch (error) {
+            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+            throw new Error(`--personal personal-vault scope changed at "${allowedPath}" (${code})`);
+        }
+    })
+        .filter((allowedPath) => isWithin(realRoot, allowedPath));
+    const resolved = [];
+    for (const input of requestedPaths) {
+        const normalizedInput = path.resolve(cwd, input);
+        let realPath;
+        try {
+            realPath = fs.realpathSync.native(normalizedInput);
+        }
+        catch (error) {
+            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+            rejectPath(input, `path cannot be resolved (${code})`);
+        }
+        if (!isWithin(realRoot, realPath)) {
+            rejectPath(input, "resolved path escapes the HQ root");
+        }
+        let isDirectory;
+        try {
+            isDirectory = fs.statSync(realPath).isDirectory();
+        }
+        catch (error) {
+            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+            rejectPath(input, `path cannot be inspected (${code})`);
+        }
+        const relativePath = path.relative(realRoot, realPath).split(path.sep).join("/");
+        const exclusion = matchPersonalVaultExclusion(relativePath, isDirectory);
+        if (exclusion) {
+            rejectPath(input, `excluded by personal-vault rule ${exclusion.id}`);
+        }
+        if (!allowedRoots.some((allowedRoot) => isWithin(allowedRoot, realPath))) {
+            rejectPath(input, "resolved path is outside the personal-vault paths");
+        }
+        resolved.push(realPath);
+    }
+    return resolved;
+}
+//# sourceMappingURL=personal-targeted-push-paths.js.map