@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/commands/mcp-registration.js

@@ -99,11 +99,6 @@ export class ConfigPermissionError extends McpRegistrationError {
  */
 export class McpNameCollisionError extends McpRegistrationError {
     code = 'McpNameCollisionError';
-    codexDiagnostics;
-    constructor(message, codexDiagnostics) {
-        super(message);
-        this.codexDiagnostics = codexDiagnostics;
-    }
 }
 /**
  * The Codex runtime is absent (`~/.codex` missing). This is a FIRST-CLASS SKIP,
@@ -242,6 +237,10 @@ export function isCodexInstalled(env) {
 export function claudeConfigPath(env) {
     return path.join(env.home, '.claude.json');
 }
+/** `~/.mcp.json` — the project-pinned Claude surface (a symlink on this host). */
+export function mcpJsonPath(env) {
+    return path.join(env.home, '.mcp.json');
+}
 /**
  * Built-in JSON {@link ConfigFormat} for the Claude surfaces. Pretty-prints with
  * a trailing newline; an empty doc is `{}`. Parsing the empty string is the
@@ -364,9 +363,9 @@ export function sanitizeParserMessage(message) {
 // Advisory O_EXCL lock (held across read->merge->write).
 // ---------------------------------------------------------------------------
 /** Default stale-lock timeout — a lock older than this whose PID is dead is broken. */
-const DEFAULT_LOCK_STALE_MS = 30_000;
+export const DEFAULT_LOCK_STALE_MS = 30_000;
 /** Default total time to wait for a held lock before giving up. */
-const DEFAULT_LOCK_WAIT_MS = 10_000;
+export const DEFAULT_LOCK_WAIT_MS = 10_000;
 /** The lockfile path for a target: `~/.<basename>.hqlock` (a sibling, hidden). */
 export function lockPathFor(target) {
     const dir = path.dirname(target);
@@ -1010,8 +1009,7 @@ function canonicalJson(v) {
  *     it — but byte-equality of the rest means {@link writeConfigAtomic} writes
  *     nothing unless the stamp itself is the only delta, which we treat as a no-op
  *     by returning the original doc.
- *   - name PRESENT, def-DIFFERS, same non-empty `_hqPack` -> replace the entry.
- *   - name PRESENT, def-DIFFERS, unmarked or different owner -> collision ABORT.
+ *   - name PRESENT, def-DIFFERS -> {@link McpNameCollisionError} ABORT.
  *
  * Never touches any OTHER server entry or any other top-level key.
  */
@@ -1025,12 +1023,6 @@ export function mergeClaudeServer(name, def) {
                 // (do not re-stamp) so a re-install is a true byte-for-byte no-op.
                 return doc;
             }
-            const existingPack = provenanceOf(existing);
-            const incomingPack = provenanceOf(def);
-            if (existingPack && existingPack === incomingPack) {
-                servers[name] = def;
-                return { ...doc, mcpServers: servers };
-            }
             throw new McpNameCollisionError(`MCP server "${name}" is already defined in ~/.claude.json with a different ` +
                 'definition — refusing to overwrite. Remove or rename the existing server, ' +
                 'or uninstall the conflicting pack, then re-install.');
@@ -1310,7 +1302,7 @@ export const CODEX_MCP_SERVERS_KEY = 'mcp_servers';
 /**
  * Serialize EXACTLY ONE server table (`[mcp_servers.<name>]` + its sub-tables)
  * by wrapping the def under `mcp_servers.<name>` and round-tripping it through
- * smol-toml. Used for appending new servers, replacing an owned table, and the
+ * smol-toml. Used both for the append path (preserve-comments) and for the
  * collision/equality comparison. The output is deterministic for a given def so a
  * re-install produces byte-identical text (idempotency depends on it).
  */
@@ -1321,15 +1313,15 @@ export function serializeOneCodexServer(name, def) {
  * The Codex `ConfigFormat`. `parse` round-trips the file through smol-toml
  * (throwing `TomlError` on malformed NON-empty input → the substrate maps it to
  * {@link ConfigParseError}, FAIL-CLOSED). `serialize` is comment-preserving: when
- * the doc carries `originalText` (the file pre-existed) it APPENDS a new server
- * table or replaces only a same-pack owned table, rather than re-serializing the
- * whole value. Only a fresh file (`null`) is serialized from scratch.
- * `assertEntry` checks `mcp_servers.<name>` is present.
+ * the doc carries `originalText` (the file pre-existed) it APPENDS the new
+ * `mcp_servers.<name>` table to the original bytes rather than re-serializing the
+ * whole value; only when there is no original (`null`) does it serialize the full
+ * value from scratch. `assertEntry` checks `mcp_servers.<name>` is present.
  *
- * Because `serialize` needs to know WHICH server to append or replace, the merge
- * fn ({@link mergeCodexServer}) records the operation on the doc. For an
- * idempotent no-op (server already present, def-equal) the merge returns the doc
- * UNCHANGED, so
+ * Because `serialize` needs the merged value to know WHICH server to append, the
+ * merge fn ({@link mergeCodexServer}) records the just-added server on the doc; the
+ * append path reads it back. For an idempotent no-op (server already present,
+ * def-equal) the merge returns the doc UNCHANGED with no pending append, so
  * `serialize` reproduces the original text exactly (no write happens).
  */
 export const codexConfigFormat = {
@@ -1340,16 +1332,7 @@ export const codexConfigFormat = {
         return { value, originalText: text };
     },
     serialize(doc) {
-        const pendingDoc = doc;
-        const pendingUpdate = pendingDoc[PENDING_UPDATE];
-        if (doc.originalText !== null && pendingUpdate) {
-            const updated = replaceCodexTable(doc.originalText, pendingUpdate.name, pendingUpdate.def);
-            if (updated === null) {
-                throw new McpNameCollisionError(codexCollisionMessage(pendingUpdate.name), pendingUpdate.diagnostics);
-            }
-            return updated;
-        }
-        const pending = pendingDoc[PENDING_APPEND];
+        const pending = doc[PENDING_APPEND];
         if (doc.originalText !== null && pending) {
             // APPEND path: keep the original bytes verbatim (comments + every existing
             // table/sub-table preserved), then append the one new server table.
@@ -1379,7 +1362,6 @@ export const codexConfigFormat = {
 };
 /** Symbol carrying the pending append on a {@link CodexTomlDoc} (merge → serialize). */
 const PENDING_APPEND = Symbol('hqPendingCodexAppend');
-const PENDING_UPDATE = Symbol('hqPendingCodexUpdate');
 /** Return a copy of `value` with `mcp_servers.<name> = def` set (used for fresh-file serialize). */
 function withServer(value, name, def) {
     const servers = { ...(value[CODEX_MCP_SERVERS_KEY] ?? {}) };
@@ -1402,171 +1384,6 @@ export function appendCodexTable(originalText, name, def) {
     const body = block.endsWith('\n') ? block : `${block}\n`;
     return `${trimmed}\n\n${body}`;
 }
-/** Return the decoded table path for a valid TOML table header, or null. */
-function codexTablePath(headerLine) {
-    try {
-        const value = parseToml(headerLine);
-        const matches = [];
-        const visit = (current, pathParts) => {
-            if (current === null || typeof current !== 'object')
-                return;
-            if (Array.isArray(current)) {
-                current.forEach((item, index) => visit(item, [...pathParts, String(index)]));
-                return;
-            }
-            const table = current;
-            const entries = Object.entries(table);
-            if (entries.length === 0) {
-                matches.push(pathParts);
-                return;
-            }
-            for (const [key, child] of entries) {
-                visit(child, [...pathParts, key]);
-            }
-        };
-        visit(value, []);
-        return matches.length === 1 ? matches[0] : null;
-    }
-    catch {
-        // The caller has already parsed the whole document. Ordinary values are
-        // not table headers.
-        return null;
-    }
-}
-/**
- * Locate real table headers without mistaking bracket-like text in TOML values
- * for a header. Parsing the preceding prefix ensures a candidate is not inside
- * an unfinished multiline string or array; smol-toml decodes quoted key paths.
- */
-function codexTomlSections(text) {
-    const headers = [];
-    let offset = 0;
-    for (const line of text.match(/[^\n]*(?:\n|$)/g) ?? []) {
-        if (line.length === 0)
-            continue;
-        const content = line.replace(/\r?\n$/, '');
-        if (content.trimStart().startsWith('[')) {
-            try {
-                parseToml(text.slice(0, offset));
-                const path = codexTablePath(content);
-                if (path)
-                    headers.push({ start: offset, path });
-            }
-            catch {
-                // The prefix is incomplete TOML, so this bracket is part of a value.
-            }
-        }
-        offset += line.length;
-    }
-    return headers.map((header, index) => {
-        const nextStart = headers[index + 1]?.start ?? text.length;
-        let end = nextStart;
-        const trailingLines = text.slice(header.start, nextStart).match(/[^\n]*(?:\n|$)/g) ?? [];
-        for (let lineIndex = trailingLines.length - 1; lineIndex >= 0; lineIndex -= 1) {
-            const content = trailingLines[lineIndex].replace(/\r?\n$/, '');
-            if (content.trim() === '' || content.trimStart().startsWith('#')) {
-                end -= trailingLines[lineIndex].length;
-            }
-            else {
-                break;
-            }
-        }
-        return { ...header, end };
-    });
-}
-/** Extract comment text outside TOML strings so updating an owned table drops no user notes. */
-function codexTomlComments(text) {
-    const comments = [];
-    let multiline = null;
-    let lineOffset = 0;
-    for (const lineWithEnding of text.match(/[^\n]*(?:\n|$)/g) ?? []) {
-        if (lineWithEnding.length === 0)
-            continue;
-        const line = lineWithEnding.replace(/\r?\n$/, '');
-        let quote = null;
-        let index = 0;
-        while (index < line.length) {
-            if (multiline) {
-                const delimiter = multiline === 'basic' ? '"""' : "'''";
-                if (multiline === 'basic' && line[index] === '\\') {
-                    index += 2;
-                }
-                else if (line.startsWith(delimiter, index)) {
-                    multiline = null;
-                    index += 3;
-                }
-                else {
-                    index += 1;
-                }
-                continue;
-            }
-            if (quote) {
-                const closing = quote === 'basic' ? '"' : "'";
-                if (quote === 'basic' && line[index] === '\\') {
-                    index += 2;
-                }
-                else if (line[index] === closing) {
-                    quote = null;
-                    index += 1;
-                }
-                else {
-                    index += 1;
-                }
-                continue;
-            }
-            if (line[index] === '#') {
-                comments.push({ offset: lineOffset + index, text: line.slice(index) });
-                break;
-            }
-            if (line.startsWith('"""', index)) {
-                multiline = 'basic';
-                index += 3;
-            }
-            else if (line.startsWith("'''", index)) {
-                multiline = 'literal';
-                index += 3;
-            }
-            else if (line[index] === '"') {
-                quote = 'basic';
-                index += 1;
-            }
-            else if (line[index] === "'") {
-                quote = 'literal';
-                index += 1;
-            }
-            else {
-                index += 1;
-            }
-        }
-        lineOffset += lineWithEnding.length;
-    }
-    return comments;
-}
-/** Replace all sections for one same-pack server while retaining unrelated bytes and comments. */
-function replaceCodexTable(originalText, name, def) {
-    const sections = codexTomlSections(originalText);
-    const target = sections.filter((section) => section.path[0] === CODEX_MCP_SERVERS_KEY && section.path[1] === name);
-    if (!target.some((section) => section.path.length === 2))
-        return null;
-    const newline = originalText.includes('\r\n') ? '\r\n' : '\n';
-    const comments = codexTomlComments(originalText)
-        .filter((comment) => target.some((section) => comment.offset >= section.start && comment.offset < section.end))
-        .map((comment) => comment.text);
-    let output = '';
-    let cursor = 0;
-    let inserted = false;
-    for (const section of target) {
-        output += originalText.slice(cursor, section.start);
-        if (!inserted) {
-            output += serializeOneCodexServer(name, def).replace(/\n/g, newline);
-            if (comments.length > 0)
-                output += comments.join(newline) + newline;
-            inserted = true;
-        }
-        cursor = section.end;
-    }
-    return inserted ? output + originalText.slice(cursor) : null;
-}
 /**
  * Build the Codex server table emitted as `[mcp_servers.<name>]`: pass the
  * transport fields through, resolve `${secret:}` in every argument/header/env value
@@ -1630,10 +1447,9 @@ export function buildCodexToolsTable(tools) {
  *   - name PRESENT, def-equal (provenance-ignored) → NO-OP (idempotent re-install /
  *     PARTIAL self-heal): return the doc UNCHANGED with no pending append, so the
  *     original text round-trips byte-for-byte.
- *   - name PRESENT, def-DIFFERS, same `_hqPack` owner → update that owned table
- *     while preserving unrelated TOML bytes and comments.
- *   - name PRESENT, def-DIFFERS, any other owner → {@link McpNameCollisionError}
- *     ABORT with value-free diagnostics.
+ *   - name PRESENT, def-DIFFERS → {@link McpNameCollisionError} ABORT (never mutate
+ *     an existing table — which is also what keeps the comment-preserving append
+ *     sound: we only ever ADD).
  *
  * Never touches any OTHER server table or any other top-level table.
  */
@@ -1647,23 +1463,9 @@ export function mergeCodexServer(name, def) {
                 // so serialize reproduces the original text exactly.
                 return doc;
             }
-            const diagnostics = codexCollisionDiagnostics(name, existing, def);
-            const existingPack = isTomlTable(existing)
-                ? existing[HQ_PACK_PROVENANCE_KEY]
-                : undefined;
-            if (doc.originalText !== null &&
-                isTomlTable(existing) &&
-                typeof existingPack === 'string' &&
-                existingPack.length > 0 &&
-                existingPack === def[HQ_PACK_PROVENANCE_KEY]) {
-                const next = {
-                    value: withServer(doc.value, name, def),
-                    originalText: doc.originalText,
-                    [PENDING_UPDATE]: { name, def, diagnostics },
-                };
-                return next;
-            }
-            throw new McpNameCollisionError(codexCollisionMessage(name), diagnostics);
+            throw new McpNameCollisionError(`MCP server "${name}" is already defined in ~/.codex/config.toml with a different ` +
+                'definition — refusing to overwrite. Remove or rename the existing server, ' +
+                'or uninstall the conflicting pack, then re-install.');
         }
         // Insert into the value (for verify-after-write) AND record the pending append
         // (for comment-preserving serialize).
@@ -1676,41 +1478,6 @@ export function mergeCodexServer(name, def) {
         return next;
     };
 }
-function isTomlTable(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function codexCollisionMessage(name) {
-    return `MCP server "${name}" is already defined in ~/.codex/config.toml with a different ` +
-        'definition — refusing to overwrite. Remove or rename the existing server, ' +
-        'or uninstall the conflicting pack, then re-install.';
-}
-function codexCollisionDiagnostics(name, existing, incoming) {
-    const existingTable = isTomlTable(existing) ? existing : {};
-    const owner = typeof existingTable[HQ_PACK_PROVENANCE_KEY] === 'string' &&
-        existingTable[HQ_PACK_PROVENANCE_KEY].length > 0
-        ? 'hq'
-        : 'unknown';
-    const keys = new Set([...Object.keys(existingTable), ...Object.keys(incoming)]);
-    keys.delete(HQ_PACK_PROVENANCE_KEY);
-    const fields = new Set();
-    for (const key of keys) {
-        const existingHasKey = Object.prototype.hasOwnProperty.call(existingTable, key);
-        const incomingHasKey = Object.prototype.hasOwnProperty.call(incoming, key);
-        if (existingHasKey === incomingHasKey &&
-            canonicalJson(existingTable[key]) === canonicalJson(incoming[key])) {
-            continue;
-        }
-        fields.add(key === 'command' || key === 'args' || key === 'env' || key === 'url'
-            ? key
-            : 'other');
-    }
-    return {
-        client: 'codex',
-        serverName: name,
-        existingEntryOwner: owner,
-        diffFields: [...fields].sort(),
-    };
-}
 /**
  * Emit ONE server into the GLOBAL Codex surface (`~/.codex/config.toml`
  * `[mcp_servers.<name>]`) via {@link writeConfigAtomic}. A FIRST-CLASS SKIP when the

package/dist/commands/mcp-status.js

@@ -374,7 +374,6 @@ export function registerMcpCommand(program) {
         .description('MCP pack observability (read-only) across Claude + Codex');
     mcp
         .command('status')
-        .alias('list')
         .description('Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)')
         .option('--json', 'Emit the structured report as JSON (for CI / scripting)')
         .action((opts) => {

package/dist/commands/meetings.js

@@ -2,26 +2,6 @@ import chalk from "chalk";
 import { readFile } from "node:fs/promises";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid, resolveCallerPersonUid, } from "../utils/vault-api.js";
-import { isPlanGateError, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
-// Two minutes gives a large transcript time to arrive over a slow connection,
-// while keeping the interactive command from waiting indefinitely.
-const MEETING_DOCUMENT_DOWNLOAD_TIMEOUT_MS = 120_000;
-async function downloadMeetingDocument(url, readBody) {
-    const signal = AbortSignal.timeout(MEETING_DOCUMENT_DOWNLOAD_TIMEOUT_MS);
-    try {
-        const response = await fetch(url, { signal });
-        if (!response.ok)
-            return { response, ok: false };
-        return { response, ok: true, body: await readBody(response) };
-    }
-    catch (err) {
-        if ((signal.aborted && signal.reason instanceof DOMException && signal.reason.name === "TimeoutError") ||
-            (err instanceof DOMException && err.name === "TimeoutError")) {
-            throw new Error(`Meeting document download timed out after ${MEETING_DOCUMENT_DOWNLOAD_TIMEOUT_MS / 1000} seconds. Check your network connection and try again.`);
-        }
-        throw err;
-    }
-}
 function formatDuration(seconds) {
     const h = Math.floor(seconds / 3600);
     const m = Math.floor((seconds % 3600) / 60);
@@ -118,9 +98,6 @@ async function resolveShortId(token, prefix, query) {
 }
 async function handleApiError(res, json = false) {
     const body = (await res.json().catch(() => ({})));
-    const planGate = planGateErrorFromPayload(res.status, body);
-    if (planGate)
-        throw planGate;
     if (json) {
         console.log(JSON.stringify(body, null, 2));
     }
@@ -134,20 +111,14 @@ async function handleApiError(res, json = false) {
         console.error(chalk.red(body.error ?? "Not found"));
     }
     else if (res.status === 402) {
-        console.error(chalk.red("Meeting notetaker bots require the $500/mo HQ Workforce plan."));
-        console.error(chalk.dim(body.message ?? body.error ?? "Upgrade your company to HQ Workforce to record meetings."));
+        console.error(chalk.red("Meeting notetaker bots require the $500/mo HQ Team plan."));
+        console.error(chalk.dim(body.message ?? body.error ?? "Upgrade your company to HQ Team to record meetings."));
     }
     else {
         console.error(chalk.red(`API error (${res.status}): ${body.error ?? res.statusText}`));
     }
     process.exit(1);
 }
-function handleMeetingsCommandError(err) {
-    if (isPlanGateError(err))
-        throw err;
-    console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-    process.exit(1);
-}
 function printMeetingTable(meetings) {
     if (meetings.length === 0) {
         console.log(chalk.dim("  No meetings found."));
@@ -241,7 +212,8 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
     // ── hq meetings invite <meeting-url> ──────────────────────────────
@@ -294,7 +266,8 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
     meetings
@@ -329,7 +302,8 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
     // ── hq meetings get <id> ──────────────────────────────────────────
@@ -400,7 +374,8 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
     // ── hq meetings set-company <id> ──────────────────────────────────
@@ -454,7 +429,8 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
     // ── hq meetings search <query> ─────────────────────────────────────
@@ -485,7 +461,8 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
     // ── hq meetings transcript <id> ────────────────────────────────────
@@ -514,12 +491,12 @@ export function registerMeetingsCommand(program) {
                     console.error(chalk.red("No document available for this meeting."));
                     process.exit(1);
                 }
-                const download = await downloadMeetingDocument(documentUrl, (response) => response.text());
-                if (!download.ok) {
-                    console.error(chalk.red(`Failed to download meeting document (${download.response.status})`));
+                const docRes = await fetch(documentUrl);
+                if (!docRes.ok) {
+                    console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
                     process.exit(1);
                 }
-                const markdown = download.body;
+                const markdown = await docRes.text();
                 if (meetings.opts().json) {
                     console.log(JSON.stringify({ meetingId: detail.meetingId, sourceShape: "markdown", markdown }, null, 2));
                     return;
@@ -532,12 +509,12 @@ export function registerMeetingsCommand(program) {
                 console.error(chalk.red("No document URL available for this meeting."));
                 process.exit(1);
             }
-            const download = await downloadMeetingDocument(detail.documentUrl, (response) => response.json());
-            if (!download.ok) {
-                console.error(chalk.red(`Failed to download meeting document (${download.response.status})`));
+            const docRes = await fetch(detail.documentUrl);
+            if (!docRes.ok) {
+                console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
                 process.exit(1);
             }
-            const doc = download.body;
+            const doc = (await docRes.json());
             if (meetings.opts().json) {
                 console.log(JSON.stringify(doc.transcript, null, 2));
                 return;
@@ -554,7 +531,8 @@ export function registerMeetingsCommand(program) {
             }
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
     // ── hq meetings notes <id> ─────────────────────────────────────────
@@ -592,12 +570,12 @@ export function registerMeetingsCommand(program) {
                     console.log(chalk.yellow("No notes available for this meeting."));
                     return;
                 }
-                const download = await downloadMeetingDocument(documentUrl, (response) => response.text());
-                if (!download.ok) {
-                    console.error(chalk.red(`Failed to download meeting document (${download.response.status})`));
+                const docRes = await fetch(documentUrl);
+                if (!docRes.ok) {
+                    console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
                     process.exit(1);
                 }
-                const markdown = download.body;
+                const markdown = await docRes.text();
                 if (meetings.opts().json) {
                     console.log(JSON.stringify({ meetingId: detail.meetingId, sourceShape: "markdown", markdown }, null, 2));
                     return;
@@ -610,12 +588,12 @@ export function registerMeetingsCommand(program) {
                 console.error(chalk.red("No document URL available for this meeting."));
                 process.exit(1);
             }
-            const download = await downloadMeetingDocument(detail.documentUrl, (response) => response.json());
-            if (!download.ok) {
-                console.error(chalk.red(`Failed to download meeting document (${download.response.status})`));
+            const docRes = await fetch(detail.documentUrl);
+            if (!docRes.ok) {
+                console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
                 process.exit(1);
             }
-            const doc = download.body;
+            const doc = (await docRes.json());
             if (meetings.opts().json) {
                 console.log(JSON.stringify(doc.notes, null, 2));
                 return;
@@ -662,7 +640,8 @@ export function registerMeetingsCommand(program) {
             console.log();
         }
         catch (err) {
-            handleMeetingsCommandError(err);
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
         }
     });
 }

package/dist/commands/members.js

@@ -2,7 +2,6 @@ import chalk from "chalk";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
-import { isPlanGateError } from "../utils/plan-gate-error.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/i;
@@ -559,10 +558,6 @@ export function registerMembersCommand(program) {
             }
         }
         catch (err) {
-            // A seat-limit refusal goes to main.ts's shared plan-gate renderer:
-            // reason, usage, fix options and upgrade link, then a non-zero exit.
-            if (isPlanGateError(err))
-                throw err;
             // A 409 may refer to either an active membership or an existing
             // pending invite. Probe both views so email targets get actionable
             // guidance while preserving the terminal exit-0 behavior for bulk
@@ -672,6 +667,7 @@ export function registerMembersCommand(program) {
                 const name = m.personName ?? m.personSlug ?? "";
                 console.log([email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "));
             }
+            console.log(chalk.gray("Share a secret with a member: hq secrets share <path> --with <email>"));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {

package/dist/commands/mesh.d.ts

@@ -7,8 +7,6 @@
  */
 import { Command } from "commander";
 import { type MeshCompany, type MeshThread } from "../lib/mesh/api.js";
-import { type DaemonInstallPlatform, type InstallPaths } from "../lib/mesh/live/daemon/index.js";
-import { type RunCommand } from "../lib/service-manager/launchd.js";
 export declare function formatCheckLines(threads: MeshThread[], company: MeshCompany, projectId?: string): string[];
 /** Injectable confirmation seam for `hq mesh context correct` (stubbed in tests). */
 export type MeshConfirmFn = (message: string) => Promise<boolean>;
@@ -26,13 +24,4 @@ export declare function runContextCorrect(opts: {
     confirm?: MeshConfirmFn;
 }): Promise<void>;
 export declare function registerMeshCommand(program: Command): void;
-export declare function runDaemonStatus(opts: {
-    json?: boolean;
-}, deps?: {
-    platform?: DaemonInstallPlatform;
-    paths?: InstallPaths;
-    /** launchctl/systemctl runner for the loaded probe (tests inject). */
-    run?: RunCommand;
-    uid?: number;
-}): Promise<void>;
 //# sourceMappingURL=mesh.d.ts.map