@indigoai-us/hq-cli 5.300.0 → 5.302.0

package/CHANGELOG.md

@@ -2,8 +2,50 @@
 
 ## [Unreleased]
 
+## [5.302.0] — 2026-10-01
+
+- Generate company project indexes while preserving hand-written content unless `--accept` is used.
+
+- Follow all hq-deploy app-list pages when resolving apps for comments and report publishing.
+- Let a senior message or resume an `awaiting_input` lane when its pending question is gone or cannot be reached from the senior's host. Pending questions remain answer-first, including across registered Outpost routes.
+- A senior can resume or send a fallback message to an `awaiting_input` lane when its pending questions are addressed to another audience. Once the resume is accepted, those questions are cancelled on their owner; unreachable owners are reported while the lane continues.
+- When a blocker escalation targets a session without a registered monitor inbox, record the reason and deliver it through the lane's existing inbox instead of retrying the failed escalation every watcher pass.
+- `hq integrations disconnect` can now remove company integrations that were created outside the app catalog.
+- Lead envelopes can set `next_check_at` to defer automatic keep-alive resumes
+  until a scheduled check, with pending work continuing to resume immediately.
+- Reconcile records deduplicated keep-alive skip reasons in each lane's watcher event log.
+- Add a company-scoped reconcile gate that closes local interrupted worker lanes after 24 hours when all carried project stories are done or dropped and no pending work remains.
+- Skip refreshing failed-dispatch lane mirrors that never reached their Outpost owner.
+- Keep lane keep-alive, retry-context, and monitor history readers moving past torn JSONL records.
+- Refresh primary mirror heartbeats from fresh running Outpost reports before dead-host reconciliation.
+- Report answerable awaiting-input questions as the `hq lanes show` delivery path, and retry blocker-freshness fallback messages after a failed append.
+- Let `hq integrations connect` send an API key in a custom HTTP header.
+- Bound `hq rescue` GitHub release and tag lookups to 30 seconds with a clear timeout error.
+- hq-cli now logs live-board refresh failures and recovery while continuing to retry.
+- On Windows, background jobs started by `/handoff` and search indexing no longer open console windows.
+
+## [5.301.0] — 2026-10-01
+- `hq meetings transcript` and `hq meetings notes` stop a stalled document download after two minutes and say so, instead of waiting forever.
+
+- Keep `hq access` from reporting a denied vault path as missing or exposing matching paths.
+- Fix self-updates for npm installs whose global prefix contains spaces.
+- `hq files acl companies/<slug>` and `hq files unshare companies/<slug> --with ...` now handle ACL rows at that exact company path instead of treating it as the vault root.
+- Add native hq core job notify and remediate commands behind core-native-jobs, retaining bundled shell companions.
+- Allow owners to disconnect custom Factory connections without installation records, and send the company UID required by the revoked-connection purge endpoint.
+- Fail company provisioning when its initial sync reports per-file upload failures, while retaining the successful upload count in failure details.
+- Treat plan-limited files as initial-sync failures and keep provisioning progress snapshots updated.
+- Preserve story attribution after a message is durably queued by lane admission or an account move.
+- The token usage report accepts `--project-dir <path>` to read one Claude activity folder instead of the default folders.
+
 ## [5.300.0] — 2026-09-30
+- `hq files unshare --with agt_...` removes a grant made to an agent. Before, agent uids were rejected as invalid principals.
 - With the default-off hq-flags gate `files.share-empty-prefix-warning`, `hq files share` warns when a granted prefix has no files. A failed or timed-out list check does not block the grant.
+- Recognize pnpm v11+ global installs and handle Windows drive-path tar archives without waiting for the asynchronous feature-flag snapshot.
+- Self-update failure reports now include the npm error code and a sanitized reason.
+
+### Fixed
+
+- `hq core rebuild-index companies --company <slug>` scopes the generated write to that company (behind the default-off `cli.rebuild-index-company-scope` flag), and `--help` exits without reading or writing company indexes. The unscoped run also ignores orchestrator state tied to another company's PRD.
 
 - Lane messages and resumes that switch project or story attribution now tell the provider which story is active. Reused completion artifacts no longer close the new story.
 - Make signed-out `hq sync` commands fail fast with `hq login` guidance when stdin or stdout is not a terminal, while keeping browser login in a terminal.

package/assets/scaffold/core/scripts/rebuild-projects-index.sh

@@ -11,12 +11,11 @@ set -euo pipefail
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 
+COMPANIES_DIR="companies"
 PROJECTS_DIR="personal/projects"
 OUT="${PROJECTS_DIR}/INDEX.md"
 DATE=$(date -u +%Y-%m-%d)
 
-[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
-
 sanitize_cell() {
   printf '%s' "$1" | tr '\n' ' ' | sed -e 's/|/\\|/g' -e 's/  */ /g' -e 's/^ *//' -e 's/ *$//'
 }
@@ -29,17 +28,23 @@ trunc() {
 project_status() {
   local project="$1"
   local prd="$2"
+  local fallback="${3:-—}"
+  local expected_prd="${4:-}"
   local state="workspace/orchestrator/${project}/state.json"
   if [[ -f "$state" ]]; then
-    local raw
-    raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
-    case "$raw" in
-      completed|complete) echo "complete" ;;
-      in_progress|active|started) echo "active" ;;
-      archived) echo "archived" ;;
-      *) echo "$raw" ;;
-    esac
-    return
+    local state_prd
+    state_prd=$(jq -r '.prd_path // ""' "$state" 2>/dev/null || echo "")
+    if [[ -z "$expected_prd" || "$state_prd" == "$expected_prd" ]]; then
+      local raw
+      raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
+      case "$raw" in
+        completed|complete) echo "complete" ;;
+        in_progress|active|started) echo "active" ;;
+        archived) echo "archived" ;;
+        *) echo "$raw" ;;
+      esac
+      return
+    fi
   fi
   if [[ -f "$prd" ]]; then
     local total passes
@@ -50,9 +55,91 @@ project_status() {
       return
     fi
   fi
-  echo "—"
+  echo "$fallback"
+}
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  else
+    shasum -a 256 "$1" | awk '{print $1}'
+  fi
 }
 
+stamp_generated() {
+  local input="$1" output="$2" normalized hash
+  normalized=$(mktemp)
+  sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$input" > "$normalized"
+  hash=$(sha256_file "$normalized")
+  rm -f "$normalized"
+  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$input" > "$output"
+}
+
+company_title() {
+  printf '%s\n' "$1" | awk -F'-' '{ for (i=1; i<=NF; i++) { $i = toupper(substr($i,1,1)) substr($i,2) } print }' OFS=' '
+}
+
+write_company_projects_index() {
+  local company="$1" company_root project_dir output tmp name prd description status
+  company_root="${COMPANIES_DIR}/${company}"
+  project_dir="${company_root}/projects"
+  output="${project_dir}/INDEX.md"
+  tmp=$(mktemp)
+  {
+    printf '# %s Projects\n\n' "$(company_title "$company")"
+    printf '> Auto-generated. Updated: %s\n\n' "$DATE"
+    echo '| Project | Status | Description |'
+    echo '|---------|--------|-------------|'
+    while IFS= read -r project; do
+      name=$(basename "$project")
+      [[ "$name" == _* ]] && continue
+      [[ "$name" == .* ]] && continue
+      prd="${project}/prd.json"
+      description=""
+      if [[ -f "$prd" ]]; then description=$(jq -r '.description // ""' "$prd" 2>/dev/null || echo ""); fi
+      status=$(project_status "$name" "$prd" "active" "$prd")
+      description=$(sanitize_cell "$description")
+      description=$(trunc "$description" 110)
+      [[ -z "$description" ]] && description="—"
+      printf '| `%s` | %s | %s |\n' "$name" "$status" "$description"
+    done < <(find "$project_dir" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+  } > "$tmp"
+  local existing=0 stored actual normalized
+  [[ -e "$output" ]] && existing=1
+  if [[ "$existing" == 1 ]]; then
+    if grep -q '<!-- hq:keep -->' "$output" || ! grep -q '^> Auto-generated. Updated: ' "$output"; then
+      echo "rebuild-projects-index: refused to overwrite ${output} (hand-written or kept)" >&2
+      rm -f "$tmp"
+      return 0
+    fi
+    stored=$(sed -n 's/^<!-- hq-generated-sha256: \([a-f0-9]*\) -->$/\1/p' "$output" | head -n 1)
+    if [[ -n "$stored" ]]; then
+      normalized=$(mktemp)
+      sed -e '/^<!-- hq-generated-sha256: [a-f0-9]* -->$/d' -e 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$output" > "$normalized"
+      actual=$(sha256_file "$normalized")
+      rm -f "$normalized"
+      if [[ "$stored" != "$actual" ]]; then
+        echo "rebuild-projects-index: refused to overwrite ${output} (generated content was edited)" >&2
+        rm -f "$tmp"
+        return 0
+      fi
+    fi
+  fi
+  stamp_generated "$tmp" "$output"
+  rm -f "$tmp"
+  echo "rebuild-projects-index: wrote ${output}" >&2
+}
+
+while IFS= read -r dir; do
+  co=$(basename "$dir")
+  [[ "$co" == _* ]] && continue
+  [[ "$co" == .* ]] && continue
+  project_dir="${COMPANIES_DIR}/${co}/projects"
+  [[ -d "$project_dir" ]] && write_company_projects_index "$co"
+done < <(find "$COMPANIES_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+
+[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
+
 {
   echo "# Projects"
   echo ""

package/assets/scaffold/core/scripts/token-usage-report.sh

@@ -5,6 +5,7 @@
 #   scripts/token-usage-report.sh --last 14      # last 14 days
 #   scripts/token-usage-report.sh --since 2026-05-01
 #   scripts/token-usage-report.sh --json         # machine-readable
+#   scripts/token-usage-report.sh --project-dir <path> # read one activity folder
 #
 # Effective tokens weighting (matches weekly rate-limit volume):
 #   input + 5×output + 1.25×cache_creation + 0.1×cache_read
@@ -24,6 +25,14 @@ while [ $# -gt 0 ]; do
     --last) LAST_DAYS="$2"; shift 2 ;;
     --since) SINCE="$2"; shift 2 ;;
     --json) JSON_MODE=1; shift ;;
+    --project-dir)
+      if [ "$#" -lt 2 ] || [ -z "$2" ]; then
+        echo "token-usage-report: --project-dir requires a path" >&2
+        exit 1
+      fi
+      PROJECT_DIR="$2"
+      shift 2
+      ;;
     --compare-windows) shift ;;   # flag, presence triggers compare mode via --before/--after
     --before) COMPARE_BEFORE="$2"; shift 2 ;;
     --after)  COMPARE_AFTER="$2"; shift 2 ;;

package/dist/command-catalog.generated.d.ts

@@ -1713,7 +1713,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Person uid, email address, group id, or '@all' to remove the grant";
+            readonly description: "Person uid, agent uid, email address, group id, or '@all' to remove the grant";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -3122,6 +3122,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--token-stdin";
             readonly description: "Read the API key from stdin";
+        }, {
+            readonly flags: "--auth-header <name>";
+            readonly description: "Send the API key in this HTTP header (implies --auth key)";
         }, {
             readonly flags: "--auth <mode>";
             readonly description: "Force the auth mode: none, key, or oauth (default: detect)";
@@ -5620,13 +5623,26 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
     }, {
         readonly name: "job";
-        readonly description: "Run or inspect one scheduled job";
+        readonly description: "Run, inspect, notify, or remediate one scheduled job";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] [command]";
         readonly arguments: readonly [];
         readonly options: readonly [];
         readonly subcommands: readonly [{
+            readonly name: "notify";
+            readonly description: "Send a scheduled-job status alert to its owner";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
             readonly name: "probe";
             readonly description: "Check scheduled-job requirements and report readiness";
             readonly aliases: readonly [];
@@ -5639,6 +5655,19 @@ export declare const COMMAND_CATALOG: readonly [{
             }];
             readonly options: readonly [];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "remediate";
+            readonly description: "Run bounded remediation for a scheduled-job failure";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "run";
             readonly description: "Run a scheduled job";
@@ -8582,7 +8611,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "resume";
-        readonly description: "Resume an interrupted, done or blocked lane on its recorded provider session; recover failed lanes with the senior-only --from-failed option";
+        readonly description: "Resume an interrupted, done or blocked lane, or an awaiting_input lane with no answerable question; recover failed lanes with the senior-only --from-failed option";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <lane-id>";

package/dist/command-catalog.generated.js

@@ -2185,7 +2185,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Person uid, email address, group id, or '@all' to remove the grant"
+                        "description": "Person uid, agent uid, email address, group id, or '@all' to remove the grant"
                     }
                 ],
                 "subcommands": []
@@ -4013,6 +4013,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--token-stdin",
                         "description": "Read the API key from stdin"
                     },
+                    {
+                        "flags": "--auth-header <name>",
+                        "description": "Send the API key in this HTTP header (implies --auth key)"
+                    },
                     {
                         "flags": "--auth <mode>",
                         "description": "Force the auth mode: none, key, or oauth (default: detect)"
@@ -7246,13 +7250,29 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "job",
-                "description": "Run or inspect one scheduled job",
+                "description": "Run, inspect, notify, or remediate one scheduled job",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] [command]",
                 "arguments": [],
                 "options": [],
                 "subcommands": [
+                    {
+                        "name": "notify",
+                        "description": "Send a scheduled-job status alert to its owner",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[args...]",
+                        "arguments": [
+                            {
+                                "name": "args",
+                                "required": false,
+                                "variadic": true
+                            }
+                        ],
+                        "options": [],
+                        "subcommands": []
+                    },
                     {
                         "name": "probe",
                         "description": "Check scheduled-job requirements and report readiness",
@@ -7269,6 +7289,22 @@ export const COMMAND_CATALOG = [
                         "options": [],
                         "subcommands": []
                     },
+                    {
+                        "name": "remediate",
+                        "description": "Run bounded remediation for a scheduled-job failure",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[args...]",
+                        "arguments": [
+                            {
+                                "name": "args",
+                                "required": false,
+                                "variadic": true
+                            }
+                        ],
+                        "options": [],
+                        "subcommands": []
+                    },
                     {
                         "name": "run",
                         "description": "Run a scheduled job",
@@ -11068,7 +11104,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "resume",
-                "description": "Resume an interrupted, done or blocked lane on its recorded provider session; recover failed lanes with the senior-only --from-failed option",
+                "description": "Resume an interrupted, done or blocked lane, or an awaiting_input lane with no answerable question; recover failed lanes with the senior-only --from-failed option",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <lane-id>",

package/dist/commands/__fixtures__/access-vault.d.ts

@@ -82,6 +82,8 @@ export interface MakeAccessFixtureOptions {
      * without read on the prefix — the server refuses to enumerate.
      */
     listDenied?: boolean;
+    /** present-denied only: let a test isolate list denial from vend denial. */
+    vendDenied?: boolean;
     /** Deny only the ROOT (prefix "") list — the caller can read the prefix but not enumerate the bucket. */
     rootListDenied?: boolean;
 }

package/dist/commands/__fixtures__/access-vault.js

@@ -93,7 +93,7 @@ export function makeAccessFixture(opts) {
         if (opts.state === "missing") {
             throw attachStatus(new Error("not found (404)"), 404);
         }
-        if (opts.state === "present-denied") {
+        if (opts.state === "present-denied" && opts.vendDenied !== false) {
             throw attachStatus(new Error("caller lacks read on this prefix (403)"), 403);
         }
         return FAKE_VEND;

package/dist/commands/access.d.ts

@@ -122,7 +122,8 @@ export interface RunAccessResult {
     outcome: AccessOutcome;
     path: string;
     company: string;
-    exists: boolean;
+    /** Omitted when an authorization denial leaves vault existence unknown. */
+    exists?: boolean;
     grantor?: AccessGrantor;
     candidates?: string[];
     steps: string[];

package/dist/commands/access.js

@@ -52,7 +52,7 @@ export function formatAccessOutcome(result) {
             lines.push(result.path);
             break;
         case "no-access":
-            lines.push(`The file exists in the vault, but you do not have read access.`);
+            lines.push(`You do not have read access to this path.`);
             lines.push(result.path);
             break;
         case "pending-confirmation":
@@ -236,72 +236,81 @@ export async function runAccess(input) {
     const bucket = entity?.bucketName ?? `hq-vault-cmp-${slug}`;
     const s3 = deps.companyClient({ companyUid: deps.companyUid });
     let listDenied = false;
-    const prefixList = await listKeys(s3, bucket, relative);
-    const exact = prefixList.keys.find((k) => k === relative);
     let key;
-    if (prefixList.denied) {
-        // The server refused to enumerate — the caller has no read on this
-        // prefix. Keep the target as the key so the request rung can still name
-        // it for the grantor.
+    if (vendDenied) {
+        // The caller is denied at the company boundary. Do not use list results to
+        // resolve or disclose matching keys, even if a separate listing succeeds.
         listDenied = true;
         key = relative;
-        steps.push("list: 403 (no-access)");
-    }
-    else if (exact) {
-        key = exact;
-        steps.push("resolve: exact key");
-        steps.push("list: 1 hit");
+        steps.push("list: skipped after vend 403 (no-access)");
     }
     else {
-        const allList = await listKeys(s3, bucket, "");
-        const q = relative.toLowerCase();
-        // A root-list 403 only says the caller cannot enumerate the WHOLE bucket.
-        // The prefix list above succeeded, so fuzzy-match within it first; the
-        // root denial is the verdict only when the readable prefix has no match.
-        const pool = allList.denied ? prefixList.keys : allList.keys;
-        const fuzzy = pool.filter((k) => k.toLowerCase().includes(q));
-        if (allList.denied && fuzzy.length === 0) {
+        const prefixList = await listKeys(s3, bucket, relative);
+        const exact = prefixList.keys.find((k) => k === relative);
+        if (prefixList.denied) {
+            // The server refused to enumerate — the caller has no read on this
+            // prefix. Keep the target as the key so the request rung can still name
+            // it for the grantor.
             listDenied = true;
             key = relative;
             steps.push("list: 403 (no-access)");
         }
-        else if (fuzzy.length === 0) {
-            steps.push("list: 0 hits");
-            const result = finish("never-existed", {
-                path: anchored(relative) || input.target,
-                company: slug,
-                exists: false,
-                steps,
-            }, finishCtx);
-            emit(input, result, log);
-            return result;
-        }
-        else if (fuzzy.length === 1) {
-            key = fuzzy[0];
-            steps.push("resolve: fuzzy (1 hit)");
+        else if (exact) {
+            key = exact;
+            steps.push("resolve: exact key");
             steps.push("list: 1 hit");
         }
         else {
-            const candidates = fuzzy.map(anchored);
-            steps.push(`list: ${fuzzy.length} hits`);
-            let picked = null;
-            if (deps.pick) {
-                picked = await deps.pick(candidates);
+            const allList = await listKeys(s3, bucket, "");
+            const q = relative.toLowerCase();
+            // A root-list 403 only says the caller cannot enumerate the WHOLE bucket.
+            // The prefix list above succeeded, so fuzzy-match within it first; the
+            // root denial is the verdict only when the readable prefix has no match.
+            const pool = allList.denied ? prefixList.keys : allList.keys;
+            const fuzzy = pool.filter((k) => k.toLowerCase().includes(q));
+            if (allList.denied && fuzzy.length === 0) {
+                listDenied = true;
+                key = relative;
+                steps.push("list: 403 (no-access)");
             }
-            if (!picked) {
-                const result = finish("ambiguous", {
-                    path: input.target,
+            else if (fuzzy.length === 0) {
+                steps.push("list: 0 hits");
+                const result = finish("never-existed", {
+                    path: anchored(relative) || input.target,
                     company: slug,
                     exists: false,
-                    candidates,
                     steps,
                 }, finishCtx);
                 emit(input, result, log);
                 return result;
             }
-            const stripped = normalizeTarget(picked, slug);
-            key = stripped;
-            steps.push("resolve: pick");
+            else if (fuzzy.length === 1) {
+                key = fuzzy[0];
+                steps.push("resolve: fuzzy (1 hit)");
+                steps.push("list: 1 hit");
+            }
+            else {
+                const candidates = fuzzy.map(anchored);
+                steps.push(`list: ${fuzzy.length} hits`);
+                let picked = null;
+                if (deps.pick) {
+                    picked = await deps.pick(candidates);
+                }
+                if (!picked) {
+                    const result = finish("ambiguous", {
+                        path: input.target,
+                        company: slug,
+                        exists: false,
+                        candidates,
+                        steps,
+                    }, finishCtx);
+                    emit(input, result, log);
+                    return result;
+                }
+                const stripped = normalizeTarget(picked, slug);
+                key = stripped;
+                steps.push("resolve: pick");
+            }
         }
     }
     const resolvedKey = key;
@@ -524,7 +533,7 @@ export async function runAccess(input) {
     const result = finish(outcome, {
         path: resolvedPath,
         company: slug,
-        exists: true,
+        ...(vendDenied || listDenied ? {} : { exists: true }),
         steps,
         ...(fixed ? { fixed, localPath } : {}),
         ...(grantor ? { grantor } : {}),
@@ -541,7 +550,7 @@ function emit(input, result, log) {
             outcome: result.outcome,
             path: result.path,
             company: result.company,
-            exists: result.exists,
+            ...(result.exists !== undefined ? { exists: result.exists } : {}),
             steps: result.steps,
         };
         if (result.grantor)

package/dist/commands/bot.js

@@ -228,6 +228,7 @@ export function spawnDetachedRun(name, dir) {
     const fd = fs.openSync(botLogPath(dir), "a");
     const child = spawn(process.execPath, [entry, "bot", "run", name], {
         detached: true,
+        windowsHide: true,
         stdio: ["ignore", fd, fd],
         env: { ...process.env, HQ_NO_UPDATE_CHECK: "1" },
     });

package/dist/commands/cloud-provision.js

@@ -32,7 +32,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
 import { parseUserYaml } from "../utils/user-yaml-error.js";
-import { share } from "@indigoai-us/hq-cloud";
+import { createSyncProgressRecorder, share, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 /** Custom error class so the CLI runner can map to exit codes. */
 export class ProvisionError extends Error {
@@ -421,7 +421,32 @@ async function safeBody(res) {
     }
 }
 // ── Default initial-sync runner (wraps share()) ──────────────────────────────
+const INITIAL_SYNC_ERROR_FIELD_LIMIT = 240;
+function truncateInitialSyncErrorField(value) {
+    return value.length <= INITIAL_SYNC_ERROR_FIELD_LIMIT
+        ? value
+        : `${value.slice(0, INITIAL_SYNC_ERROR_FIELD_LIMIT - 1)}…`;
+}
+class InitialSyncUploadFailureError extends Error {
+    filesUploaded;
+    constructor(filesUploaded, failureCount, firstFailure) {
+        const detail = `${truncateInitialSyncErrorField(firstFailure.path)}: ` +
+            truncateInitialSyncErrorField(firstFailure.message);
+        const failureLabel = failureCount === 1
+            ? "upload failure"
+            : "upload failures";
+        super(`${failureCount} ${failureLabel}; first failure: ${detail}`);
+        this.filesUploaded = filesUploaded;
+        this.name = "InitialSyncUploadFailureError";
+    }
+}
 async function defaultRunInitialSync(args) {
+    let failureCount = 0;
+    let firstFailure;
+    const recordProgress = createSyncProgressRecorder({
+        company: args.slug,
+        phase: "push",
+    });
     const result = await share({
         paths: [companyDirPath(args.hqRoot, args.slug)],
         company: args.slug,
@@ -429,7 +454,25 @@ async function defaultRunInitialSync(args) {
         onConflict: "keep",
         vaultConfig: buildVaultConfig(args.accessToken),
         hqRoot: args.hqRoot,
+        progressRecorder: (event) => {
+            recordProgress(event);
+            if (event.type === "plan-limit") {
+                failureCount += Math.max(1, event.count ?? 0, event.paths?.length ?? 0);
+                firstFailure ??= {
+                    path: event.paths?.[0] ?? "plan limit",
+                    message: event.message ?? "plan limit refused upload",
+                };
+                return;
+            }
+            if (event.type !== "error" || event.diagnostic === true)
+                return;
+            failureCount++;
+            firstFailure ??= { path: event.path, message: event.message };
+        },
     });
+    if (failureCount > 0 && firstFailure) {
+        throw new InitialSyncUploadFailureError(result.filesUploaded, failureCount, firstFailure);
+    }
     return {
         filesUploaded: result.filesUploaded,
         bytesUploaded: result.bytesUploaded,
@@ -654,7 +697,13 @@ export async function provisionCompany(options) {
                 created_entity: createdEntity,
                 manifest_patched: true,
                 config_written: true,
-                initial_sync: { ok: false, error: msg },
+                initial_sync: {
+                    ok: false,
+                    error: msg,
+                    ...(err instanceof InitialSyncUploadFailureError
+                        ? { files_uploaded: err.filesUploaded }
+                        : {}),
+                },
             });
         }
     }