@indigoai-us/hq-cli 5.317.0 → 5.318.1-beta.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.318.1-beta.0] — 2026-10-02
+- Let `hq access` use ACL-checked company presigned reads when STS vend rejects a truncated write-policy scope.
+- Let `hq sync now` skip unchanged server-owned cloud placeholders while keeping their warnings visible, so the sync can complete.
+
+## [5.318.0] — 2026-10-02
+- `hq lanes autopilot run` now marks missing lead registry entries as stale and includes a command to remove each stale row.
+- Keep retired policies retired regardless of YAML field order in the session helper.
+- `publish.yml` refuses a manual run with `dry_run=false` and always passes dry-run to the publish job unless the run comes from a tag push.
+
 ## [5.317.0] — 2026-10-02
 - Add native `hq core session-title`, `session-title-config`, `session-journal` and `session-project` on the fast route behind the default-off `core-native-hook-helpers` flag.
 - Build required npm self-updates outside the active prefix, then activate only after the staged package is ready, so an interrupted download or unpack leaves the installed CLI runnable.

package/assets/scaffold/core/scripts/hq-session.sh

@@ -368,12 +368,12 @@ emit_company_hard_policies() {
   lines="$(awk -v co="$co" '
     function bn(p,  n,a,b){ n=split(p,a,"/"); b=a[n]; sub(/\.md$/,"",b); return b }
     function policy_file(p,  n,a){ n=split(p,a,"/"); return a[n] }
-    function flush(){ if(enf=="hard" && rule!=""){ if(id=="")id=bn(fn); printf "- [hard] **%s**: %s Full text: `companies/%s/policies/%s`.\n", id, rule, co, policy_file(fn) } }
-    FNR==1 { if(seen) flush(); d=0;id="";enf="";rule="";rsec=0;rcap=0;fn=FILENAME;seen=1 }
+    function flush(){ if(enf=="hard" && !retired && rule!=""){ if(id=="")id=bn(fn); printf "- [hard] **%s**: %s Full text: `companies/%s/policies/%s`.\n", id, rule, co, policy_file(fn) } }
+    FNR==1 { if(seen) flush(); d=0;id="";enf="";retired=0;rule="";rsec=0;rcap=0;fn=FILENAME;seen=1 }
     /^---[ \t]*$/ { d++; next }
     d==1 && /^id:/          { s=$0; sub(/^id:[ \t]*/,"",s); gsub(/^["'"'"']|["'"'"']$/,"",s); id=s; next }
     d==1 && /^enforcement:/ { s=$0; sub(/^enforcement:[ \t]*/,"",s); gsub(/[ \t]/,"",s); enf=s; next }
-    d==1 && /^status:[ \t]*retired/ { enf="" ; next }
+    d==1 && /^status:[ \t]*retired/ { retired=1; next }
     d>=2 && /^## Rule[ \t]*$/ { rsec=1; next }
     d>=2 && rsec && /^## / { rsec=0 }
     d>=2 && rsec && !rcap && NF { line=$0; gsub(/\*\*/,"",line); if(length(line)>160)line=substr(line,1,157)"..."; rule=line; rcap=1 }

package/dist/commands/access.js

@@ -221,10 +221,20 @@ export async function runAccess(input) {
     }
     catch (err) {
         const status = httpStatusOf(err);
+        const vendError = typeof err === "object" && err !== null
+            ? err
+            : undefined;
         if (status === 403) {
             vendDenied = true;
             steps.push("vend: 403 (no-access)");
         }
+        else if ((status === 422 || vendError?.statusCode === 422) &&
+            vendError?.code === "POLICY_WRITE_SCOPE_TRUNCATED") {
+            // This failure means the company-wide STS write policy could not fit.
+            // Company reads use the separate ACL-filtered presign API, which remains
+            // the authority for listing and materializing this particular object.
+            steps.push("vend: write policy truncated; using presigned read");
+        }
         else if (status === 404) {
             steps.push("vend: 404");
         }

package/dist/commands/cloud.js

@@ -1697,6 +1697,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             hqRoot,
             progressRecorder: trackingProgressRecorder(planLimitTracker, pushProgressCompany),
             skipUnchanged: true,
+            serverOwnedPathPolicy: "skip",
             propagateDeletes: true,
             propagateDeletePolicy: resolveDeletePolicy(),
             ...(onConflict ? { onConflict } : {}),

package/dist/commands/core-hq-session-native.js

@@ -318,6 +318,7 @@ function hardPolicyLines(root, company, deps) {
         let delimiters = 0;
         let id = "";
         let enforcement = "";
+        let retired = false;
         let ruleSection = false;
         let rule = "";
         for (const line of lines) {
@@ -335,7 +336,7 @@ function hardPolicyLines(root, company, deps) {
                 if (enforceMatch)
                     enforcement = (enforceMatch[1] ?? "").replace(/[\t ]/g, "");
                 if (/^status:[\t ]*retired/.test(line))
-                    enforcement = "";
+                    retired = true;
             }
             if (delimiters >= 2 && line === "## Rule") {
                 ruleSection = true;
@@ -351,7 +352,7 @@ function hardPolicyLines(root, company, deps) {
                     rule = `${rule.slice(0, 157)}...`;
             }
         }
-        if (enforcement !== "hard" || !rule)
+        if (enforcement !== "hard" || retired || !rule)
             continue;
         const policyId = id || basename.replace(/\.md$/, "");
         result.push(`- [hard] **${policyId}**: ${rule} Full text: \`companies/${company}/policies/${basename}\`.`);

package/dist/lib/lanes/autopilot.d.ts

@@ -83,6 +83,13 @@ export interface AutopilotPassResult {
     skipped: Array<{
         lead_lane: string;
         reason: string;
+        status?: undefined;
+        fix_command?: undefined;
+    } | {
+        lead_lane: string;
+        reason: "lead_lane_missing";
+        status: "stale";
+        fix_command: string;
     } | {
         lane_id: string;
         error: string;

package/dist/lib/lanes/autopilot.js

@@ -35,6 +35,13 @@ function isOpenProjectStory(story) {
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function staleLeadFixCommand(laneId) {
+    const registryTemp = `${LEAD_REGISTRY_REL}.tmp`;
+    return `jq --arg lane ${shellQuote(laneId)} '(.juniors) |= map(select(.lane != $lane))' ${shellQuote(LEAD_REGISTRY_REL)} > ${shellQuote(registryTemp)} && mv ${shellQuote(registryTemp)} ${shellQuote(LEAD_REGISTRY_REL)}`;
+}
 function readJsonFile(filePath, code) {
     let text;
     try {
@@ -755,9 +762,23 @@ async function runLeadAutopilotPassUnlocked(input) {
     const stateFile = path.join(hqRoot, "workspace", "lane-briefs", "autopilot-state.json");
     const state = readState(stateFile);
     for (const registered of leads) {
+        const registeredLocalHost = registered.host === "local" || registered.host === input.hostname;
         const lead = byId.get(registered.lane) ?? lanes.find((candidate) => candidate.lane_id.startsWith(`${registered.lane}_`));
         if (!lead) {
-            result.skipped.push({ lead_lane: registered.lane, reason: "lead_lane_missing" });
+            // A row for another host has no lane record here; that host's pass owns it.
+            const registryTargetsThisHost = registeredLocalHost
+                ? effectiveOutpostId === null
+                : input.outpostId === registered.host;
+            if (!registryTargetsThisHost) {
+                result.skipped.push({ lead_lane: registered.lane, reason: "lead_host_mismatch" });
+                continue;
+            }
+            result.skipped.push({
+                lead_lane: registered.lane,
+                reason: "lead_lane_missing",
+                status: "stale",
+                fix_command: staleLeadFixCommand(registered.lane),
+            });
             continue;
         }
         const company = resolveLaneCompany(hqRoot, lead).company;
@@ -765,7 +786,6 @@ async function runLeadAutopilotPassUnlocked(input) {
             result.skipped.push({ lead_lane: lead.lane_id, reason: "lead_company_unresolved" });
             continue;
         }
-        const registeredLocalHost = registered.host === "local" || registered.host === input.hostname;
         const hostMatchesRegistry = registeredLocalHost
             ? lead.host.kind === "local"
             : lead.host.kind === "outpost" && lead.host.id === registered.host && input.outpostId === registered.host;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.317.0",
+  "version": "5.318.1-beta.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {