@indigoai-us/hq-cli 5.297.0 → 5.298.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [5.298.0] — 2026-09-30
+- [feedback_d4a080e9-de79-4290-81c3-06ba26990a38] Preserve raw substring matches while normalizing company path searches.
+- `hq agents` now prints the Slack app settings link and the console paste link whenever an agent is waiting on its Slack app-level token, and follows the pending actions and paste URL the server returns.
+- When an app install is already running, `hq integrations connect` tells you to wait instead of showing a generic conflict error.
+- Validate policy trigger expressions when loading worker policies (feedback_3982db47-ceb8-4148-8ee0-4dd533f5138b).
+
 ## [5.297.0] — 2026-09-30
 - When enabled by hq-flags, show the quarantined work-context outbox count and latest reason in hq doctor and mesh daemon status.
 - `hq daemon` now exits after shutdown when handles remain open, and its mesh service waits when another live mesh daemon owns the process lock.

package/dist/commands/agents.js

@@ -549,13 +549,59 @@ function currentDeviceSignInAction(status) {
         code,
     };
 }
+const SLACK_APP_TOKEN_INSTRUCTION = "Create an app-level token with the connections:write scope, then paste it into HQ. HQ verifies the token and resumes setup; if Slack asks you to install the app, follow the install link shown there.";
+function consolePasteUrl(companyKey, agentUid) {
+    const base = process.env.HQ_CONSOLE_URL?.trim().replace(/\/+$/, "") || "https://hq.computer";
+    return `${base}/companies/${encodeURIComponent(companyKey)}/agents?setup=${encodeURIComponent(agentUid)}`;
+}
+function slackAppIdFromSetupState(status) {
+    const steps = recordValue(status.setupState)?.steps;
+    if (!Array.isArray(steps))
+        return null;
+    for (const step of steps) {
+        const item = recordValue(step);
+        if (item?.name !== "channels" || item.status === "done")
+            continue;
+        const match = /https:\/\/api\.slack\.com\/apps\/(A[A-Z0-9]+)/.exec(JSON.stringify(item));
+        if (match)
+            return match[1];
+    }
+    return null;
+}
+function serverPendingActions(status) {
+    if (!Array.isArray(status.pendingActions))
+        return [];
+    const actions = [];
+    for (const raw of status.pendingActions) {
+        const item = recordValue(raw);
+        const type = nonEmptyString(item?.type);
+        const title = nonEmptyString(item?.title);
+        if (!item || !type || !title)
+            continue;
+        const url = safeActionUrl(item.url) ?? undefined;
+        const pasteUrl = safeActionUrl(item.pasteUrl) ?? undefined;
+        const rawCode = nonEmptyString(item.code);
+        actions.push({
+            type,
+            title,
+            summary: title.charAt(0).toLowerCase() + title.slice(1),
+            instruction: nonEmptyString(item.instruction) ?? "Open this page and follow the instructions.",
+            ...(url ? { url, urlLabel: type === "slack-app-token" ? "Get token" : "Open" } : {}),
+            ...(pasteUrl ? { pasteUrl } : {}),
+            ...(rawCode && /^[A-Z0-9]{4,8}-[A-Z0-9]{4,8}$/i.test(rawCode) ? { code: rawCode } : {}),
+        });
+    }
+    return actions;
+}
 function pendingSlackAction(status, companySlug) {
     const agent = recordValue(status.agent);
     const configuredSlack = recordValue(recordValue(agent?.channels)?.slack);
-    const appId = nonEmptyString(configuredSlack?.appId);
+    const stepAppId = slackAppIdFromSetupState(status);
+    const appId = nonEmptyString(configuredSlack?.appId) ?? stepAppId;
     const agentUid = nonEmptyString(agent?.uid);
     const companyUid = nonEmptyString(agent?.companyUid);
-    const tokenPage = safeActionUrl(configuredSlack?.appTokenPendingUrl);
+    const tokenPage = safeActionUrl(configuredSlack?.appTokenPendingUrl) ??
+        (stepAppId ? `https://api.slack.com/apps/${stepAppId}/general` : null);
     if (tokenPage &&
         appId && /^A[A-Z0-9]+$/.test(appId) &&
         new URL(tokenPage).hostname === "api.slack.com" &&
@@ -568,10 +614,10 @@ function pendingSlackAction(status, companySlug) {
             type: "slack-app-token",
             title: `Finish ${nonEmptyString(agent?.name) ?? "the agent"}'s Slack connection`,
             summary: "connect it to Slack",
-            instruction: "Create an app-level token with the connections:write scope, then paste it into HQ. HQ verifies the token and resumes setup; if Slack asks you to install the app, follow the install link shown there.",
+            instruction: SLACK_APP_TOKEN_INSTRUCTION,
             url: `https://api.slack.com/apps/${appId}/general`,
             urlLabel: "Get token",
-            pasteUrl: `https://hq.computer/companies/${encodeURIComponent(companyUrlKey)}/agents?setup=${encodeURIComponent(agentUid)}`,
+            pasteUrl: consolePasteUrl(companyUrlKey, agentUid),
         };
     }
     const diagnostics = recordValue(agent?.channelDiagnostics);
@@ -587,6 +633,11 @@ function pendingSlackAction(status, companySlug) {
             instruction: "Open this page, create the app-level token, then provide it in the agent's Slack setup.",
             url,
             urlLabel: "Open",
+            ...(agentUid && AGENT_UID_PATTERN.test(agentUid) && companyUid && /^cmp_[A-Za-z0-9_-]+$/.test(companyUid)
+                ? {
+                    pasteUrl: consolePasteUrl(companySlug && /^[a-z0-9][a-z0-9-]*$/.test(companySlug) ? companySlug : companyUid, agentUid),
+                }
+                : {}),
         };
     }
     if (slack?.inboundCapability !== "pending-install")
@@ -606,6 +657,9 @@ function pendingSlackAction(status, companySlug) {
  * changing the renderers or command control flow.
  */
 function pendingOperatorActions(status, companySlug) {
+    const fromServer = serverPendingActions(status);
+    if (fromServer.length > 0)
+        return fromServer;
     return [
         currentDeviceSignInAction(status),
         pendingSlackAction(status, companySlug),
@@ -616,7 +670,7 @@ async function consoleCompanySlug(token, status, companyRef) {
         return companyRef;
     const agent = recordValue(status.agent);
     const slack = recordValue(recordValue(agent?.channels)?.slack);
-    if (!slack?.appTokenPendingUrl)
+    if (!slack?.appTokenPendingUrl && !slackAppIdFromSetupState(status))
         return undefined;
     const companyUid = nonEmptyString(agent?.companyUid);
     if (!companyUid)

package/dist/commands/files-browse.d.ts

@@ -502,6 +502,8 @@ export declare function resolveBrowseSession(): Promise<{
  * and registers `share`/`unshare`/`acl`; this function appends the two
  * new browse-vs-sync subcommands so they share the `--company` switch.
  */
-export declare function registerFilesBrowseCommands(filesCmd: Command): void;
+export declare function registerFilesBrowseCommands(filesCmd: Command, deps?: {
+    personalS3Factory?: S3ClientFactory;
+}): void;
 export {};
 //# sourceMappingURL=files-browse.d.ts.map

package/dist/commands/files-browse.js

@@ -192,6 +192,18 @@ export function formatBrowseTable(rows) {
         lines.push(renderRow(row));
     return lines.join("\n");
 }
+function formatSearchResults(rows, query) {
+    if (rows.length === 0) {
+        return `No files found for search ${JSON.stringify(query)}.`;
+    }
+    return formatBrowseTable(rows);
+}
+function normalizeCompanySearchPath(value) {
+    return value
+        .split("/")
+        .map((segment) => (segment === "company" ? "companies" : segment))
+        .join("/");
+}
 /** Guard: the personal path needs an S3 factory. */
 function requirePersonalS3Factory(f) {
     if (!f) {
@@ -530,7 +542,17 @@ export async function runSearch(input) {
         region: input.region,
     });
     const q = input.query.toLowerCase();
-    return rows.filter((r) => r.key.toLowerCase().includes(q));
+    // Only a leading `company/<slug>...` path form is an alias for the
+    // `companies/` anchor. A bare `company` stays a plain substring, since every
+    // company-mode key starts with `companies/<slug>/`.
+    const normalizedQuery = /^company\/[^/]+/.test(q)
+        ? normalizeCompanySearchPath(q)
+        : q;
+    return rows.filter((r) => {
+        const key = r.key.toLowerCase();
+        return (key.includes(q) ||
+            normalizeCompanySearchPath(key).includes(normalizedQuery));
+    });
 }
 /** Per-machine pin set path: `<hqRoot>/.hq/pins.json`. */
 export function pinFilePath(hqRoot) {
@@ -927,7 +949,8 @@ export async function resolveBrowseSession() {
  * and registers `share`/`unshare`/`acl`; this function appends the two
  * new browse-vs-sync subcommands so they share the `--company` switch.
  */
-export function registerFilesBrowseCommands(filesCmd) {
+export function registerFilesBrowseCommands(filesCmd, deps = {}) {
+    const personalS3Factory = deps.personalS3Factory ?? defaultS3Factory;
     filesCmd
         .command("browse [path]")
         .description("List vault objects under [path] without syncing them locally. Private-folder rows (foo/) are labelled and do not imply child access; their children are creator-only. Uses the browse-vend path (role-bypass allowed). Pass --personal to browse the caller's personal vault; otherwise [path] must start with companies/<slug>/.")
@@ -961,7 +984,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                     personalMode: true,
                     personalUid,
                     vaultClient: cognito,
-                    s3Factory: defaultS3Factory,
+                    s3Factory: personalS3Factory,
                     region: DEFAULT_COGNITO.region,
                 });
                 console.log(formatBrowseTable(result.rows));
@@ -1053,7 +1076,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                     personalMode: true,
                     personalUid,
                     vaultClient: cognito,
-                    s3Factory: defaultS3Factory,
+                    s3Factory: personalS3Factory,
                     region: DEFAULT_COGNITO.region,
                 });
                 if (result.destination.kind === "file") {
@@ -1170,10 +1193,10 @@ export function registerFilesBrowseCommands(filesCmd) {
                     personalMode: true,
                     personalUid,
                     vaultClient: cognito,
-                    s3Factory: defaultS3Factory,
+                    s3Factory: personalS3Factory,
                     region: DEFAULT_COGNITO.region,
                 });
-                console.log(formatBrowseTable(rows));
+                console.log(formatSearchResults(rows, query));
                 return;
             }
             if (!company) {
@@ -1187,7 +1210,7 @@ export function registerFilesBrowseCommands(filesCmd) {
                 companyClient: makeCompanyPresignFactory(accessToken, company),
                 region: DEFAULT_COGNITO.region,
             });
-            console.log(formatBrowseTable(rows));
+            console.log(formatSearchResults(rows, query));
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);

package/dist/commands/integrations-api.js

@@ -8,7 +8,7 @@
  * is optional and read defensively.
  */
 import { vaultApiFetch } from "../utils/vault-api.js";
-import { raiseForResponse, } from "./integrations-core.js";
+import { IntegrationsCliError, raiseForResponse, } from "./integrations-core.js";
 export async function listCatalog(token, companyUid, opts = {}) {
     const query = {
         companyUid,
@@ -59,8 +59,19 @@ export async function installIntegration(token, companyUid, input) {
         method: "POST",
         body: { companyUid, ...input },
     });
-    if (!res.ok)
-        await raiseForResponse(res, "Failed to connect the app");
+    if (!res.ok) {
+        try {
+            await raiseForResponse(res, "Failed to connect the app");
+        }
+        catch (error) {
+            if (error instanceof IntegrationsCliError &&
+                error.status === 409 &&
+                error.code === "INTEGRATION_FACTORY_INSTALL_IN_PROGRESS") {
+                throw new IntegrationsCliError("An install for this app is already running. Wait for it to finish before trying again.", { expected: true, status: 409, code: error.code });
+            }
+            throw error;
+        }
+    }
     return (await res.json());
 }
 export async function uninstallIntegration(token, companyUid, installationId) {

package/dist/lib/bot/prompt.d.ts

@@ -47,6 +47,8 @@ export interface WorkerPromptSource {
     contextPaths: string[];
     /** companies/<co>/policies/*.md, hqRoot-relative. */
     policyPaths: string[];
+    /** Invalid policy files excluded from policyPaths, with a safe diagnostic. */
+    policyDiagnostics?: string[];
 }
 export interface PromptSources {
     workerYaml?: string;

package/dist/lib/bot/prompt.js

@@ -20,6 +20,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
 import { packageRoot } from "../../utils/hq-roots.js";
+import { policyLoadDiagnostic } from "../policy-validator.js";
 export const MEMORY_FILE_BUDGET_BYTES = 64 * 1024;
 export const MEMORY_TOTAL_BUDGET_BYTES = 192 * 1024;
 export const CONTEXT_FILE_BUDGET_BYTES = 32 * 1024;
@@ -117,7 +118,7 @@ function resolveSkillFile(hqRoot, workerDir, name, doc, io) {
     return undefined;
 }
 function readWorkerSource(hqRoot, workerDir, workerYaml, io, companyOverride) {
-    const out = { skills: [], contextFiles: [], contextPaths: [], policyPaths: [] };
+    const out = { skills: [], contextFiles: [], contextPaths: [], policyPaths: [], policyDiagnostics: [] };
     let doc = {};
     if (workerYaml) {
         try {
@@ -197,9 +198,28 @@ function readWorkerSource(hqRoot, workerDir, workerYaml, io, companyOverride) {
             catch {
                 names = [];
             }
-            out.policyPaths = names
-                .filter((n) => n.endsWith(".md") && !n.startsWith(".") && !n.includes(".conflict-"))
-                .map((n) => path.join(policiesRel, n));
+            for (const name of names) {
+                if (!name.endsWith(".md") || name.startsWith(".") || name.includes(".conflict-"))
+                    continue;
+                const relative = path.join(policiesRel, name);
+                const absolute = insideHqRoot(hqRoot, relative);
+                if (!absolute)
+                    continue;
+                let content;
+                try {
+                    content = io.readFileSync(absolute);
+                }
+                catch {
+                    out.policyPaths.push(relative);
+                    continue;
+                }
+                const diagnostic = policyLoadDiagnostic(content, absolute);
+                if (diagnostic) {
+                    out.policyDiagnostics.push(`${relative}: ${diagnostic.split("\n", 1)[0]}`);
+                    continue;
+                }
+                out.policyPaths.push(relative);
+            }
         }
     }
     return out;
@@ -331,6 +351,11 @@ export function buildSystemPrompt(input) {
                 `Hard rules for \`${company}\`. Read the relevant ones before acting; they override anything else in this prompt.\n\n` +
                 worker.policyPaths.map((p) => `- ${p}`).join("\n"));
         }
+        if (worker.policyDiagnostics && worker.policyDiagnostics.length > 0) {
+            parts.push(`## Policy load diagnostics\n\n` +
+                `These company policy files were not loaded because their frontmatter is invalid. Correct each file before relying on its rules.\n\n` +
+                worker.policyDiagnostics.map((diagnostic) => `- ${diagnostic}`).join("\n"));
+        }
         if (worker.contextFiles.length > 0 || worker.contextPaths.length > 0) {
             const blocks = worker.contextFiles.map((c) => `### ${c.path}\n\n${c.body.trim()}`);
             const more = worker.contextPaths.length > 0

package/dist/lib/lanes/profile.js

@@ -10,6 +10,7 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parseUserYaml } from "../../utils/user-yaml-error.js";
+import { policyLoadDiagnostic } from "../policy-validator.js";
 import { WorkerResolutionError } from "./errors.js";
 import { PROVIDER_EFFORT_LEVELS } from "./effort.js";
 import { LANE_PROVIDERS, isLaneProvider, } from "./types.js";
@@ -261,6 +262,10 @@ function validatePolicyFrontmatter(id, profileDir, relative) {
         frontmatter.on.some((value) => typeof value !== "string" || value.trim().length === 0)) {
         throw new WorkerResolutionError("worker_policy_invalid", `Worker policy ${filePath} frontmatter must include a non-empty on string array`, { worker: id, file: filePath, field: "on" });
     }
+    const diagnostic = policyLoadDiagnostic(content, filePath);
+    if (diagnostic) {
+        throw new WorkerResolutionError("worker_policy_invalid", `Worker policy ${filePath} failed policy validation: ${diagnostic.split("\n", 1)[0]}`, { worker: id, file: filePath, field: "frontmatter", diagnostic });
+    }
 }
 function readSettings(id, dir) {
     const filePath = path.join(dir, PROFILE_SETTINGS);

package/dist/lib/policy-validator.d.ts

@@ -1,2 +1,7 @@
+/**
+ * Load-time validation: reject policy files that cannot participate in the
+ * trigger system. Authoring-only hard-policy constraints remain in the hook.
+ */
+export declare function policyLoadDiagnostic(content: string, filePath: string): string | undefined;
 export declare function policyValidatorDiagnostic(content: string, filePath: string, env: NodeJS.ProcessEnv): string | undefined;
 //# sourceMappingURL=policy-validator.d.ts.map

package/dist/lib/policy-validator.js

@@ -80,13 +80,21 @@ function hasValidTriggerGrammar(expression) {
     skip();
     return valid && position === input.length;
 }
-export function policyValidatorDiagnostic(content, filePath, env) {
-    if (!isPolicyPath(filePath))
-        return undefined;
+const MISSING_TRIGGER_HELP = `Every policy under */policies/ must declare BOTH:
+  when: <expression>   # e.g.  always  |  git && push  |  deploy || share
+  on:   [<events>]     # any of PreToolUse, PostToolUse, UserPromptSubmit, AssistantIntent, SessionStart
+These drive just-in-time policy injection. See
+core/knowledge/public/hq-core/policies-spec.md ("Trigger Expressions").
+Add both fields to the frontmatter, then retry.
+${VALIDATION_NOTE}`;
+function inspectPolicyTriggerFrontmatter(content) {
     const normalized = normalizeValidatorText(content);
     const match = /^\s*---[ \t]*\n([\s\S]*?)\n---[ \t]*(\n|$)/.exec(normalized);
-    if (!match)
-        return `BLOCKED: policy file is missing required trigger frontmatter (missing: no-frontmatter).\n\nEvery policy under */policies/ must declare BOTH:\n  when: <expression>   # e.g.  always  |  git && push  |  deploy || share\n  on:   [<events>]     # any of PreToolUse, PostToolUse, UserPromptSubmit, AssistantIntent, SessionStart\nThese drive just-in-time policy injection. See\ncore/knowledge/public/hq-core/policies-spec.md ("Trigger Expressions").\nAdd both fields to the frontmatter, then retry.\n${VALIDATION_NOTE}`;
+    if (!match) {
+        return {
+            diagnostic: `BLOCKED: policy file is missing required trigger frontmatter (missing: no-frontmatter).\n\n${MISSING_TRIGGER_HELP}`,
+        };
+    }
     const frontmatter = match[1];
     const whenLines = [...frontmatter.matchAll(/^[ \t]*when:[ \t]*(.*)$/gm)].map((entry) => entry[1] ?? '');
     const hasWhen = whenLines.some((line) => /\S/.test(line));
@@ -96,8 +104,46 @@ export function policyValidatorDiagnostic(content, filePath, env) {
         missing.push('when');
     if (!onMatch)
         missing.push('on');
-    if (missing.length > 0)
-        return `BLOCKED: policy file is missing required trigger frontmatter (missing: ${missing.join(',')}).\n\nEvery policy under */policies/ must declare BOTH:\n  when: <expression>   # e.g.  always  |  git && push  |  deploy || share\n  on:   [<events>]     # any of PreToolUse, PostToolUse, UserPromptSubmit, AssistantIntent, SessionStart\nThese drive just-in-time policy injection. See\ncore/knowledge/public/hq-core/policies-spec.md ("Trigger Expressions").\nAdd both fields to the frontmatter, then retry.\n${VALIDATION_NOTE}`;
+    if (missing.length > 0) {
+        return {
+            diagnostic: `BLOCKED: policy file is missing required trigger frontmatter (missing: ${missing.join(',')}).\n\n${MISSING_TRIGGER_HELP}`,
+            whenLines,
+        };
+    }
+    return { parsed: { normalized, match, frontmatter, whenLines }, whenLines };
+}
+function malformedTriggerDiagnostic(whenLines) {
+    let malformedWhen;
+    for (const when of whenLines) {
+        if (!hasValidTriggerGrammar(when))
+            malformedWhen = when;
+    }
+    if (malformedWhen === undefined)
+        return undefined;
+    const when = malformedWhen;
+    return `BLOCKED: policy file has a malformed when: trigger expression:\n\n  when: ${when}\n\nThe canonical trigger evaluator rejected it. A space is NOT an AND, and quoted\nphrases are NOT tokens. Use explicit boolean operators instead:\n  "pull request"  -> (pull && request)\n  "force-push"    -> force-push\n\nUse only identifiers joined by the documented boolean grammar:\n  when: <identifier>                 # e.g.  always  |  git  |  /deep-plan\n  when: <expr> && <expr>             # AND\n  when: <expr> || <expr>             # OR\n  when: ! <expr>                     # NOT\n  when: ( <expr> )                   # grouping\nIdentifiers may contain letters, digits, _, ., /, and internal -. Quotes,\nYAML block scalars, adjacent identifiers without an operator, and other\npunctuation are not valid. See core/knowledge/public/hq-core/policies-spec.md\n("Trigger Expressions"). Fix the expression, then retry.\n${VALIDATION_NOTE}`;
+}
+/**
+ * Load-time validation: reject policy files that cannot participate in the
+ * trigger system. Authoring-only hard-policy constraints remain in the hook.
+ */
+export function policyLoadDiagnostic(content, filePath) {
+    if (!isPolicyPath(filePath))
+        return undefined;
+    // Partial frontmatter (for example `when:` without `on:`) still has its
+    // `when:` grammar checked, so a malformed expression is never loaded.
+    const { whenLines } = inspectPolicyTriggerFrontmatter(content);
+    if (!whenLines)
+        return undefined;
+    return malformedTriggerDiagnostic(whenLines);
+}
+export function policyValidatorDiagnostic(content, filePath, env) {
+    if (!isPolicyPath(filePath))
+        return undefined;
+    const inspected = inspectPolicyTriggerFrontmatter(content);
+    if (inspected.diagnostic)
+        return inspected.diagnostic;
+    const { normalized, match, frontmatter, whenLines } = inspected.parsed;
     const enforcement = /^[ \t]*enforcement:[ \t]*["']?([A-Za-z]+)["']?/m.exec(frontmatter)?.[1]?.toLowerCase();
     if (enforcement === 'hard') {
         const tautological = whenLines.some((line) => !/[&!]/.test(line.toLowerCase()) && /(^|[^A-Za-z0-9_./-])always([^A-Za-z0-9_./-]|$)/i.test(line));
@@ -105,7 +151,21 @@ export function policyValidatorDiagnostic(content, filePath, env) {
         const reactive = ['PreToolUse', 'PostToolUse', 'UserPromptSubmit', 'AssistantIntent'].filter((event) => onLine.includes(event));
         if (tautological && reactive.length > 0) {
             const events = reactive.join(', ');
-            return `BLOCKED: an enforcement: hard policy pairs an unconditional \`when:\` with a\nreactive event (${events}).\n\n\`when: always\` is TRUE for every command, prompt, and message. On a reactive\nevent the injector ranks that as an event-specific match, so it takes the\nsession cap slot of a policy that genuinely matched the thing you are doing —\nthe loose trigger crowds out the precise one.\n\nPick one:\n  when: always          + on: [SessionStart]        # ambient governance rule\n  when: <real signal>   + on: [PreToolUse, ...]     # e.g. deploy || publish\n\nName the word(s) that actually appear when the rule is relevant. See\ncore/knowledge/public/hq-core/policies-spec.md ("Trigger Expressions").\n${VALIDATION_NOTE}`;
+            return `BLOCKED: an enforcement: hard policy pairs an unconditional \`when:\` with a
+reactive event (${events}).
+
+\`when: always\` is TRUE for every command, prompt, and message. On a reactive
+event the injector ranks that as an event-specific match, so it takes the
+session cap slot of a policy that genuinely matched the thing you are doing —
+the loose trigger crowds out the precise one.
+
+Pick one:
+  when: always          + on: [SessionStart]        # ambient governance rule
+  when: <real signal>   + on: [PreToolUse, ...]     # e.g. deploy || publish
+
+Name the word(s) that actually appear when the rule is relevant. See
+core/knowledge/public/hq-core/policies-spec.md ("Trigger Expressions").
+${VALIDATION_NOTE}`;
         }
         const after = normalized.slice(match.index + match[0].length);
         const binding = [];
@@ -122,15 +182,6 @@ export function policyValidatorDiagnostic(content, filePath, env) {
             return `BLOCKED: enforcement: hard policy body is ${byteCount} bytes; the limit is ${rawMax}.\n\nA hard policy is injected VERBATIM into the session, so its length is a\nrecurring context cost for every session it fires in. Keep the binding rule\ntight and move the reasoning out of the injected span: everything from the\nfirst \`## Rationale\` / \`## Background\` / \`## Change history\` /\n\`## Examples\` / \`## References\` heading onward is NOT counted and NOT\ninjected, so long-form context belongs there.\n\nIf the rule genuinely needs more than that, either split it into separate\npolicies with distinct triggers, or raise HQ_POLICY_HARD_RULE_MAX_BYTES in\n.claude/settings.local.json "env".\n${VALIDATION_NOTE}`;
         }
     }
-    let malformedWhen;
-    for (const when of whenLines) {
-        if (!hasValidTriggerGrammar(when))
-            malformedWhen = when;
-    }
-    if (malformedWhen !== undefined) {
-        const when = malformedWhen;
-        return `BLOCKED: policy file has a malformed when: trigger expression:\n\n  when: ${when}\n\nThe canonical trigger evaluator rejected it. A space is NOT an AND, and quoted\nphrases are NOT tokens. Use explicit boolean operators instead:\n  "pull request"  -> (pull && request)\n  "force-push"    -> force-push\n\nUse only identifiers joined by the documented boolean grammar:\n  when: <identifier>                 # e.g.  always  |  git  |  /deep-plan\n  when: <expr> && <expr>             # AND\n  when: <expr> || <expr>             # OR\n  when: ! <expr>                     # NOT\n  when: ( <expr> )                   # grouping\nIdentifiers may contain letters, digits, _, ., /, and internal -. Quotes,\nYAML block scalars, adjacent identifiers without an operator, and other\npunctuation are not valid. See core/knowledge/public/hq-core/policies-spec.md\n("Trigger Expressions"). Fix the expression, then retry.\n${VALIDATION_NOTE}`;
-    }
-    return undefined;
+    return malformedTriggerDiagnostic(whenLines);
 }
 //# sourceMappingURL=policy-validator.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.297.0",
+  "version": "5.298.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {