@indigoai-us/hq-cli 5.290.0 → 5.291.0

package/dist/commands/core.js

@@ -35,6 +35,7 @@ import { registerCoreHandoffCommand } from "./core-handoff.js";
 import { registerCoreOntologyCommand } from "./core-ontology.js";
 import { registerCoreKnowledgePrefsCommand } from "./core-knowledge-prefs.js";
 import { registerCorePolicyCommand } from "./core-policy.js";
+import { registerCoreJobsNativeCommand } from "./core-jobs-native.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
@@ -211,6 +212,8 @@ export const SCAFFOLD_COMMANDS = [
  * direct `hq core` command.
  */
 export const SCAFFOLD_ONLY_ASSETS = [
+    { asset: "core/scripts/jobs-schedule-parse.sh", root: "live", summary: "Rollback companion for native jobs schedule-parse" },
+    { asset: "core/scripts/jobs-validate.sh", root: "live", summary: "Rollback companion for native jobs validate" },
     // Shared shell libs sourced by the two relocated scripts (and hooks). Never
     // dispatched on their own (so no `hq core` command), but they MUST ship in the
     // tarball, or the bundled hq-session / checkpoint-stop-gate die at `source`
@@ -308,6 +311,9 @@ function runEntry(entry, scope, args) {
         args,
         cwd,
         hqRoot,
+        env: entry.asset === "core/scripts/hq-session.sh"
+            ? { HQ_HQ_SESSION_NO_CLI: "1" }
+            : undefined,
     });
     // Propagate verbatim. Several of these scripts use their exit code as their
     // interface (drift detected, lint failed), so remapping it would break the
@@ -335,6 +341,7 @@ export function registerCoreCommands(program) {
     registerCoreHandoffCommand(core);
     registerCoreKnowledgePrefsCommand(core);
     registerCorePolicyCommand(core);
+    registerCoreJobsNativeCommand(core);
     // Wave 2 handoff/worktree commands retain their byte-identical shell assets
     // as a default-off rollback path for one release. Keep the gate helper small
     // so sibling Wave 2 work can reuse it without editing this command table.

package/dist/commands/integrations-core.js

@@ -12,6 +12,7 @@ import { randomUUID } from "node:crypto";
 import chalk from "chalk";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { AuthError } from "../utils/auth-error.js";
+import { planGateErrorFromPayload } from "../utils/plan-gate-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
 import { redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
 import { connectionHealthNotice } from "../lib/integrations/health.js";
@@ -195,6 +196,12 @@ export async function raiseForResponse(res, fallback) {
     raiseIfUnauthorized(res);
     raiseIfUpstreamUnavailable(res);
     const body = (await res.json().catch(() => ({})));
+    // A plan-limit 402 is normally decoded by vaultApiFetch before it gets here.
+    // Decode it again so no integration route can print the wire token
+    // `plan_limit_reached` as its whole message; main.ts renders the typed gate.
+    const planGate = planGateErrorFromPayload(res.status, body);
+    if (planGate)
+        throw planGate;
     // hq-pro mints this error text, so it is untrusted input to a message we
     // print verbatim — scrub credentials out before it can reach a terminal or a
     // Sentry crash report (same reasoning as the gateway path below).

package/dist/commands/lanes.js

@@ -32,6 +32,7 @@ import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { startOutpostLaneSnapshotRefresh } from "../lib/lanes/outpost-snapshot-refresh.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
+import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
 import { getOrFetchOutpostSnapshot, OUTPOST_SNAPSHOT_CACHE_TTL_MS, outpostLaneListSnapshotKey, OutpostSnapshotInvocationMemo, } from "../lib/lanes/outpost-snapshot-cache.js";
 import { createOutpostHireGrantContext, parseOutpostHireGrantContext, selectOutpostHireGrantHierarchy, sameHireGrantSenior, } from "../lib/lanes/hire-grant-dispatch.js";
 import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } from "../lib/lanes/outpost-profile-repin.js";
@@ -2369,6 +2370,8 @@ async function emitLaneStartedForStories(ctx, company, lane, threadId, knownAbse
             failures.push(err);
             continue;
         }
+        if (!story.project_id?.trim() || !story.story_id?.trim())
+            continue;
         if (knownAbsentStories.has(storyBoardStoryKey(story.project_id, story.story_id)))
             continue;
         try {
@@ -3453,40 +3456,42 @@ async function runCreate(ctx, opts) {
                 : undefined,
         });
     }
-    printJson({
-        ok: true,
-        action: "create",
-        lane_id: started.lane_id,
-        state: started.state,
-        queued_reason: started.queued_reason ?? null,
-        priority: started.priority,
-        provider: started.provider,
-        account: started.account ?? null,
-        model: started.model ?? null,
-        effort: started.effort ?? null,
-        effort_source: started.effort_source ?? null,
-        host: started.host,
-        ...(autoPlacementSkippedHosts.length > 0
-            ? { skipped_hosts: autoPlacementSkippedHosts }
-            : {}),
-        company: started.company,
-        project_id: started.project_id,
-        story_id: started.story_id,
-        stories: laneStories(started),
-        story_warning: combinedStoryWarning(started, createStoryWarnings),
-        thread_id: started.thread_id ?? null,
-        senior: started.senior,
-        depth: started.depth,
-        timeout_secs: timeoutSecs ?? null,
-        ...(validation ? { validation } : {}),
-        ...(started.outpost_command_id
-            ? {
-                outpost_command_id: started
-                    .outpost_command_id,
-            }
-            : {}),
-        lane: started,
-    });
+    if (!opts.quiet)
+        printJson({
+            ok: true,
+            action: "create",
+            lane_id: started.lane_id,
+            state: started.state,
+            queued_reason: started.queued_reason ?? null,
+            priority: started.priority,
+            provider: started.provider,
+            account: started.account ?? null,
+            model: started.model ?? null,
+            effort: started.effort ?? null,
+            effort_source: started.effort_source ?? null,
+            host: started.host,
+            ...(autoPlacementSkippedHosts.length > 0
+                ? { skipped_hosts: autoPlacementSkippedHosts }
+                : {}),
+            company: started.company,
+            project_id: started.project_id,
+            story_id: started.story_id,
+            stories: laneStories(started),
+            story_warning: combinedStoryWarning(started, createStoryWarnings),
+            thread_id: started.thread_id ?? null,
+            senior: started.senior,
+            depth: started.depth,
+            timeout_secs: timeoutSecs ?? null,
+            ...(validation ? { validation } : {}),
+            ...(started.outpost_command_id
+                ? {
+                    outpost_command_id: started
+                        .outpost_command_id,
+                }
+                : {}),
+            lane: started,
+        });
+    return started;
 }
 async function dispatchCreatedOutpostLane(ctx, input) {
     const { hqRoot, lane, outpostId, briefText, timeout, preserveQueuedOnFailure = false, } = input;
@@ -6464,7 +6469,7 @@ async function emitStoryTransition(ctx, lane, projectId, storyId, event, status,
         ...payload,
         lane_status: lane.state,
     });
-    if (!skipStoryStatusPatch) {
+    if (!skipStoryStatusPatch && projectId?.trim() && storyId?.trim()) {
         await ctx.mesh.patchStoryStatus(company, projectId, storyId, status === "blocked" ? "in_progress" : status);
     }
 }
@@ -7824,8 +7829,44 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
         summary.ok = false;
     }
     const terminalizedRemoteIds = new Set(remoteLost.map(({ id }) => id));
+    let autopilot;
+    try {
+        const host = reconcileHostFromCtx(ctx);
+        autopilot = await runLeadAutopilotPass({
+            hqRoot,
+            host: host.outpostId ?? "local",
+            hostname: host.hostname,
+            outpostId: host.outpostId,
+            now: ctx.now(),
+            dryRun: Boolean(opts.dryRun),
+            readFlag: readLanesRegistryFlag,
+            keepAliveResumedLeads: new Set(summary.resumed.filter((entry) => entry.reason === "keep_alive").map((entry) => entry.id)),
+            startWorker: async ({ lead, story }) => {
+                const workerCtx = { ...ctx, env: { ...ctx.env, HQ_LANE_ID: lead.lane_id } };
+                const started = await runCreate(workerCtx, {
+                    company: lead.company?.slug,
+                    project: lead.project_id,
+                    story: story.id,
+                    briefFile: story.briefPath,
+                    provider: "codex",
+                    model: "gpt-6-luna",
+                    effort: "high",
+                    senior: `lane:${lead.lane_id}`,
+                    quiet: true,
+                });
+                return { lane_id: started.lane_id };
+            },
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        summary.ok = false;
+        summary.errors.push({ code: "lead_autopilot_failed", message });
+        process.stderr.write(`hq lanes autopilot: ${message}\n`);
+    }
     printJson({
         ...summary,
+        ...(autopilot ? { autopilot } : {}),
         ...(remoteLost.length > 0 ? { remote_lost: remoteLost } : {}),
         ...(mirrorRefresh.unverifiedRemote.size > 0
             ? {
@@ -8590,6 +8631,41 @@ export function registerLanesCommand(parent, deps = {}) {
         .action(wrap(async (opts) => {
         await runPickup(ctx, opts);
     }));
+    lanes
+        .command("autopilot")
+        .description("Check registered team leads and wake them for ready work")
+        .command("run")
+        .description("Run one lead autopilot check pass")
+        .option("--dry-run", "Report proposed wakes without writing them")
+        .option("--json", "Emit JSON on stdout (default)")
+        .action(wrap(async (opts) => {
+        const host = reconcileHostFromCtx(ctx);
+        const result = await runLeadAutopilotPass({
+            hqRoot: ctx.hqRoot(),
+            host: host.outpostId ?? "local",
+            hostname: host.hostname,
+            outpostId: host.outpostId,
+            now: ctx.now(),
+            dryRun: Boolean(opts.dryRun),
+            readFlag: readLanesRegistryFlag,
+            startWorker: async ({ lead, story }) => {
+                const workerCtx = { ...ctx, env: { ...ctx.env, HQ_LANE_ID: lead.lane_id } };
+                const started = await runCreate(workerCtx, {
+                    company: lead.company?.slug,
+                    project: lead.project_id,
+                    story: story.id,
+                    briefFile: story.briefPath,
+                    provider: "codex",
+                    model: "gpt-6-luna",
+                    effort: "high",
+                    senior: `lane:${lead.lane_id}`,
+                    quiet: true,
+                });
+                return { lane_id: started.lane_id };
+            },
+        });
+        printJson(result);
+    }));
     const reconcile = lanes
         .command("reconcile", { hidden: true })
         .description("Run one machine-owned reconcile pass and exit")

package/dist/commands/members.js

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/i;
@@ -558,6 +559,10 @@ export function registerMembersCommand(program) {
             }
         }
         catch (err) {
+            // A seat-limit refusal goes to main.ts's shared plan-gate renderer:
+            // reason, usage, fix options and upgrade link, then a non-zero exit.
+            if (isPlanGateError(err))
+                throw err;
             // A 409 may refer to either an active membership or an existing
             // pending invite. Probe both views so email targets get actionable
             // guidance while preserving the terminal exit-0 behavior for bulk

package/dist/commands/mesh.js

@@ -11,7 +11,7 @@ import { readFileSync } from "node:fs";
 import { findHqRoot } from "../utils/manifest.js";
 import { CLI_VERSION } from "../cli-version.js";
 import chalk from "chalk";
-import { loadCachedTokens, isMachineIdentity } from "../utils/cognito-session.js";
+import { ensureCognitoToken, isExpiring, isMachineIdentity, loadCachedTokens, } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
 import { STORY_STATUSES, appendThreadEvent, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard, boardStoryStatus, formatStoryStatusChanges, mergeProjectStories, prdSyncEventsThatChangeBoard, } from "../lib/mesh/project-board.js";
@@ -26,7 +26,9 @@ import { CLI_KIND_TO_SCHEMA, resolveEnqueueSessionId, } from "../lib/mesh/live/i
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
 import { backfillHeldSessions } from "../lib/mesh/live/backfill-held.js";
 import { createSessionEventsPoster, resolveVaultApiBase, } from "../lib/mesh/live/session-events-client.js";
-const MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
+const ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS = 5_000;
+// Leave 500 ms of headroom inside SessionStart's 2 s process-group limit.
+const OFFLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS = 1_500;
 import { buildEmitEvidence, machineEmitDisposition } from "../lib/mesh/live/emit-evidence.js";
 import { appendHeldLine } from "../lib/mesh/live/spool.js";
 import { createEmitPoster, buildMeshEmitEvent } from "../lib/mesh/live/emit-client.js";
@@ -860,29 +862,45 @@ async function runContextReconcile(opts) {
     let offline = Boolean(opts.offline);
     let token;
     try {
-        // Offline is outbox-only delivery. It still refreshes a device default's
-        // token-backed membership so a revoked default cannot be preflighted.
-        token = await requireToken();
-        const sessionToken = token;
-        validateMembership = async (candidate) => {
-            const membership = await new Promise((resolve, reject) => {
-                const timer = setTimeout(() => reject(new Error("membership validation timed out")), MEMBERSHIP_VALIDATION_TIMEOUT_MS);
-                void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
-                    clearTimeout(timer);
-                    resolve(value);
-                }, (error) => {
-                    clearTimeout(timer);
-                    reject(error);
+        if (offline) {
+            if (isMachineIdentity()) {
+                token = await ensureCognitoToken({ tokenSource: "machine", interactive: false });
+            }
+            else {
+                const cached = loadCachedTokens();
+                if (cached && !isExpiring(cached, 120)) {
+                    token = cached.accessToken;
+                }
+            }
+        }
+        else {
+            token = await requireToken();
+        }
+        if (token) {
+            const sessionToken = token;
+            const membershipValidationTimeoutMs = offline
+                ? OFFLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS
+                : ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS;
+            validateMembership = async (candidate) => {
+                const membership = await new Promise((resolve, reject) => {
+                    const timer = setTimeout(() => reject(new Error("membership validation timed out")), membershipValidationTimeoutMs);
+                    void resolveActiveMembershipCompany(sessionToken, candidate).then((value) => {
+                        clearTimeout(timer);
+                        resolve(value);
+                    }, (error) => {
+                        clearTimeout(timer);
+                        reject(error);
+                    });
                 });
-            });
-            if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
-                return false;
+                if (!membership || typeof membership.companyUid !== "string" || !membership.companyUid) {
+                    return false;
+                }
+                return { uid: membership.companyUid };
+            };
+            if (!offline) {
+                deliver = createWorkSessionDeliverer({ token: sessionToken });
+                fetchCandidates = createCandidatesFetcher({ token: sessionToken });
             }
-            return { uid: membership.companyUid };
-        };
-        if (!offline) {
-            deliver = createWorkSessionDeliverer({ token: sessionToken });
-            fetchCandidates = createCandidatesFetcher({ token: sessionToken });
         }
     }
     catch {
@@ -900,7 +918,10 @@ async function runContextReconcile(opts) {
             log: (message) => console.error(chalk.dim(message)),
         });
         if (activation.status === "needs_choice") {
-            const interactive = !opts.machine && Boolean(process.stdin.isTTY && process.stdout.isTTY) && !isMachineIdentity();
+            const interactive = !offline &&
+                !opts.machine &&
+                Boolean(process.stdin.isTTY && process.stdout.isTTY) &&
+                !isMachineIdentity();
             if (interactive) {
                 const choices = activation.memberships
                     .map((membership, index) => `${index + 1}. ${membership.slug}`)
@@ -920,7 +941,7 @@ async function runContextReconcile(opts) {
                     rl.close();
                 }
             }
-            else if (!opts.machine) {
+            else if (!offline && !opts.machine) {
                 console.error(chalk.yellow("Multiple active memberships. Run `hq mesh context default set <slug>` to choose this device's default company."));
             }
         }

package/dist/commands/personal-targeted-push-flag.d.ts

@@ -0,0 +1,4 @@
+export declare const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
+/** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
+export declare function personalTargetedPushPathsEnabled(): boolean;
+//# sourceMappingURL=personal-targeted-push-flag.d.ts.map

package/dist/commands/personal-targeted-push-flag.js

@@ -0,0 +1,7 @@
+import { resolveProcessFlagGate } from "../lib/flag-registry.js";
+export const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
+/** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
+export function personalTargetedPushPathsEnabled() {
+    return resolveProcessFlagGate(CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=personal-targeted-push-flag.js.map

package/dist/commands/personal-targeted-push-paths.d.ts

@@ -0,0 +1,3 @@
+/** Resolve explicit --personal paths against the same roots as a full personal push. */
+export declare function resolveExplicitPersonalPushPaths(hqRoot: string, requestedPaths: readonly string[], cwd?: string): string[];
+//# sourceMappingURL=personal-targeted-push-paths.d.ts.map

package/dist/commands/personal-targeted-push-paths.js

@@ -0,0 +1,67 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { computePersonalVaultPaths, matchPersonalVaultExclusion, } from "@indigoai-us/hq-cloud";
+function isWithin(parent, candidate) {
+    const relative = path.relative(parent, candidate);
+    return relative === "" ||
+        (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+function rejectPath(input, reason) {
+    throw new Error(`--personal cannot push path "${input}": ${reason}`);
+}
+/** Resolve explicit --personal paths against the same roots as a full personal push. */
+export function resolveExplicitPersonalPushPaths(hqRoot, requestedPaths, cwd = process.cwd()) {
+    let realRoot;
+    try {
+        realRoot = fs.realpathSync.native(hqRoot);
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+        throw new Error(`--personal cannot resolve HQ root "${hqRoot}" (${code})`);
+    }
+    const allowedRoots = computePersonalVaultPaths(realRoot)
+        .map((allowedPath) => {
+        try {
+            return fs.realpathSync.native(allowedPath);
+        }
+        catch (error) {
+            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+            throw new Error(`--personal personal-vault scope changed at "${allowedPath}" (${code})`);
+        }
+    })
+        .filter((allowedPath) => isWithin(realRoot, allowedPath));
+    const resolved = [];
+    for (const input of requestedPaths) {
+        const normalizedInput = path.resolve(cwd, input);
+        let realPath;
+        try {
+            realPath = fs.realpathSync.native(normalizedInput);
+        }
+        catch (error) {
+            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+            rejectPath(input, `path cannot be resolved (${code})`);
+        }
+        if (!isWithin(realRoot, realPath)) {
+            rejectPath(input, "resolved path escapes the HQ root");
+        }
+        let isDirectory;
+        try {
+            isDirectory = fs.statSync(realPath).isDirectory();
+        }
+        catch (error) {
+            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
+            rejectPath(input, `path cannot be inspected (${code})`);
+        }
+        const relativePath = path.relative(realRoot, realPath).split(path.sep).join("/");
+        const exclusion = matchPersonalVaultExclusion(relativePath, isDirectory);
+        if (exclusion) {
+            rejectPath(input, `excluded by personal-vault rule ${exclusion.id}`);
+        }
+        if (!allowedRoots.some((allowedRoot) => isWithin(allowedRoot, realPath))) {
+            rejectPath(input, "resolved path is outside the personal-vault paths");
+        }
+        resolved.push(realPath);
+    }
+    return resolved;
+}
+//# sourceMappingURL=personal-targeted-push-paths.js.map

package/dist/commands/secrets.js

@@ -5,6 +5,7 @@ import { cognitoCachePrincipalUid, ensureCognitoToken } from "../utils/cognito-s
 import { isAuthError } from "../utils/auth-error.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
+import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
@@ -988,6 +989,11 @@ export function registerSecretsCommand(program) {
             }
         }
         catch (err) {
+            // A plan-limit refusal goes to main.ts's shared renderer, which prints
+            // the reason, usage, fix options and upgrade link, offers the upgrade
+            // interactively, and exits non-zero.
+            if (isPlanGateError(err))
+                throw err;
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
             process.exit(1);
         }
@@ -1650,6 +1656,9 @@ export function registerSecretsCommand(program) {
             console.log(chalk.dim("  One-time use — link is invalidated after first submission."));
         }
         catch (err) {
+            // Same shared plan-limit renderer as `secrets set` (see main.ts).
+            if (isPlanGateError(err))
+                throw err;
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
             process.exit(1);
         }

package/dist/commands/skill.d.ts

@@ -18,6 +18,7 @@ import { Command } from "commander";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
+import { type PlanLimitRefusalSummary } from "../lib/billing/plan-limit-refusals.js";
 export declare const SKILL_UID_PATTERN: RegExp;
 export declare const SKILL_SLUG_PATTERN: RegExp;
 interface SkillSyncInput {
@@ -30,6 +31,8 @@ interface SkillSyncResult {
     filesUploaded: number;
     filesSkipped: number;
     aborted: boolean;
+    /** Set when a plan limit refused the upload; absent or null otherwise. */
+    planLimit?: PlanLimitRefusalSummary | null;
 }
 export declare function parseSkillUid(markdown: string): string | undefined;
 export declare function readActiveCompanySlug(hqRoot: string): string | undefined;

package/dist/commands/skill.js

@@ -27,25 +27,47 @@ import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
 import { AuthError } from "../utils/auth-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
 import { stampVaultAccessDenied, vaultAccessDeniedDiagnostics, } from "../utils/vault-access-denied-error.js";
+import { PlanGateError } from "../utils/plan-gate-error.js";
+import { createPlanLimitRefusalTracker, trackingProgressRecorder, } from "../lib/billing/plan-limit-refusals.js";
 export const SKILL_UID_PATTERN = /^skl_[A-Za-z0-9]+$/;
 export const SKILL_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
 const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
 async function defaultSyncFile(input) {
+    // The runner reports a plan-limit refusal as an event, not a throw, and still
+    // returns normally. Track it so the command cannot claim "Sync: complete".
+    const tracker = createPlanLimitRefusalTracker({ companySlug: input.companySlug });
     const result = await share({
         paths: [input.filePath],
         company: input.companySlug,
         hqRoot: input.hqRoot,
         vaultConfig: buildVaultConfig(input.token),
         onConflict: "abort",
+        progressRecorder: trackingProgressRecorder(tracker, input.companySlug),
     });
     return {
         filesUploaded: result.filesUploaded,
         filesSkipped: result.filesSkipped,
         aborted: result.aborted,
+        planLimit: tracker.summary(),
     };
 }
+/**
+ * The upload of a stamped skill file was refused by a plan limit. Registration
+ * and the local stamp already succeeded, so say that on stderr, then return a
+ * typed plan gate for main.ts to render (reason and upgrade link) and exit
+ * non-zero. Never "Skill ready … Sync: complete".
+ */
+function skillUploadRefused(skillUid, filePath, companySlug, refused) {
+    console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${filePath}', but the upload was refused by your plan limit.`));
+    return new PlanGateError("PLAN_LIMIT_EXCEEDED", {
+        reason: `${refused.message ?? "New files are paused by your plan limit."} ` +
+            "The skill file was not uploaded. Once the limit is sorted, upload it with: " +
+            `hq sync push --company ${companySlug} '${filePath}'`,
+        ...(refused.upgradeUrl ? { upgradeUrl: refused.upgradeUrl } : {}),
+    });
+}
 export function parseSkillUid(markdown) {
     const match = markdown.match(FRONTMATTER_RE);
     if (!match)
@@ -575,6 +597,9 @@ export function registerSkillCommand(program, deps = {}) {
                 // Sentry rather than filing a crash on its first occurrence.
                 throw localSkillError(`Skill ${registered.skillUid} is stamped locally at '${filePath}', but sync aborted because the remote file conflicts.`);
             }
+            if (syncResult.planLimit) {
+                throw skillUploadRefused(registered.skillUid, filePath, companySlug, syncResult.planLimit);
+            }
         }
         console.log(chalk.green(`Skill ready: ${registered.skillUid}`));
         console.log(`  File:     ${filePath}`);
@@ -739,6 +764,9 @@ export function registerSkillCommand(program, deps = {}) {
             if (syncResult.aborted) {
                 throw localSkillError(`Skill ${skillUid} is stamped locally at '${canonicalPath}', but sync aborted because the remote file conflicts.`);
             }
+            if (syncResult.planLimit) {
+                throw skillUploadRefused(skillUid, canonicalPath, companySlug, syncResult.planLimit);
+            }
         }
         console.log(chalk.green(`Skill promoted: ${skillUid}`));
         console.log(`  File:     ${canonicalPath}`);

package/dist/fast-core.js

@@ -54,6 +54,7 @@ export async function runFastCore(argv) {
         args: parsed.args,
         cwd: process.cwd(),
         hqRoot,
+        env: parsed.entry.name === "hq-session" ? { HQ_HQ_SESSION_NO_CLI: "1" } : undefined,
     });
     // Propagate verbatim: these scripts use their exit code as their interface.
     process.exit(code);

package/dist/lib/billing/free-month.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The free-month offer hq-pro attaches to Starter plan-limit payloads (the
+ * usage-limits nag and the hard-stop 402 body). Kept in a leaf module with no
+ * imports so the plan-gate error decoder can reuse the one parser without
+ * pulling in the HTTP layer that itself imports the decoder.
+ */
+export interface PlanLimitFreeMonth {
+    eligible: boolean;
+    trialDays?: number;
+    url?: string;
+}
+/**
+ * Parse `freeMonth` off a server payload. Anything but an explicit
+ * `eligible: true` is "no offer": an absent or malformed field never invents
+ * one.
+ */
+export declare function parseFreeMonth(value: unknown): PlanLimitFreeMonth | undefined;
+//# sourceMappingURL=free-month.d.ts.map

package/dist/lib/billing/free-month.js

@@ -0,0 +1,31 @@
+/**
+ * The free-month offer hq-pro attaches to Starter plan-limit payloads (the
+ * usage-limits nag and the hard-stop 402 body). Kept in a leaf module with no
+ * imports so the plan-gate error decoder can reuse the one parser without
+ * pulling in the HTTP layer that itself imports the decoder.
+ */
+/**
+ * Parse `freeMonth` off a server payload. Anything but an explicit
+ * `eligible: true` is "no offer": an absent or malformed field never invents
+ * one.
+ */
+export function parseFreeMonth(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    const rec = value;
+    if (rec.eligible !== true)
+        return undefined;
+    const url = typeof rec.url === "string" && rec.url.trim().length > 0
+        ? rec.url.trim()
+        : undefined;
+    const trialDays = typeof rec.trialDays === "number" && Number.isFinite(rec.trialDays)
+        ? rec.trialDays
+        : undefined;
+    return {
+        eligible: true,
+        ...(trialDays !== undefined ? { trialDays } : {}),
+        ...(url ? { url } : {}),
+    };
+}
+//# sourceMappingURL=free-month.js.map