@indigoai-us/hq-cli 5.345.135 → 5.345.137

package/dist/commands/storage-offload.d.ts

@@ -8,13 +8,18 @@
  *     uploads each blob, verifies size + sha256 + git blob id, then hands only
  *     verified blobs to core `hq-storage.sh strip-large`, which rewrites history
  *     to the pointer text. Working-tree files are never touched.
- *   - Current files (idle big files in the working tree). NOT offloaded yet:
- *     the sync delete planner lives in @indigoai-us/hq-cloud (`computePullPlan`
- *     and the push delete planner in dist/cli/sync.js), so replacing `x.mp4`
- *     with `x.mp4.hqcloud` would still propagate as a remote delete of `x.mp4`.
- *     `--current` reports `{ available: false }` until hq-cloud learns about
- *     placeholders (CURRENT_OFFLOAD_ENABLED). `offloadCurrentFile` is built
- *     and tested but not called.
+ *   - Current files (`--current [paths...]`, idle big files in the working
+ *     tree). Each file goes to the vault that owns its path. A file under
+ *     `companies/<slug>/` is never uploaded: when HQ sync already stored this
+ *     exact version in that company's vault (journal hash + size, and the vault
+ *     object still has the journal's ETag), the file is replaced by a
+ *     placeholder pointing at that object. Otherwise it is skipped with "run
+ *     hq sync first", so sync stays the only writer of company vault keys. Any
+ *     other file points at its personal-vault sync object the same way, or is
+ *     uploaded to the personal vault's `.hq-offload/blobs/`. Current-file
+ *     offload runs only when the installed HQ sync holds every `.hqcloud`
+ *     sibling (hq-cloud CLOUD_PLACEHOLDER_HOLDS_ANY_SIBLING) and skips
+ *     `.hq-offload/`; otherwise it reports "update HQ sync".
  *
  * Fetch also reads placeholders that HQ sync rewrote after a teammate changed
  * the file (`vault: company`, the company vault key, `sha256: unknown`,
@@ -24,9 +29,10 @@
  * which writes the caller's own personal-vault copy to a file outside HQ so
  * it can never sync back.
  *
- * Tenant isolation: bytes only ever go to the caller's personal vault. The
- * personal store refuses a company vault bucket, and nothing here lists or
- * opens company memberships.
+ * Tenant isolation: uploads only ever go to the caller's personal vault, and
+ * the personal store refuses a company vault bucket. A company vault is opened
+ * read-only (HEAD and ETag-pinned GET), and only for a company the caller is
+ * an active member of.
  */
 import { GetObjectCommand, HeadObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
 import type { ScriptRunner } from "./storage.js";
@@ -37,14 +43,10 @@ export declare const POINTER_HEADER = "HQ-CLOUD-FILE v1";
 export declare const POINTER_FOOTER = "This file is stored in HQ cloud storage. Open it in HQ, or run the command above to download it.";
 export declare const DEFAULT_MIN_BYTES: number;
 export declare const DEFAULT_IDLE_DAYS = 14;
-export declare const CURRENT_BLOCKED_REASON = "Offloading current files is not available yet: HQ sync would treat the replaced file as deleted.";
-/**
- * Gate for `--current`. Stays false until the owner enables current-file
- * offload on top of hq-cloud's cloud-only placeholders (PR #919, 6.18.61).
- */
-export declare const CURRENT_OFFLOAD_ENABLED = false;
 export declare const ORPHANED_MESSAGE = "This file was deleted by a teammate. It's no longer in the cloud for your team.";
 export declare const UPDATE_SYNC = "update HQ sync";
+/** Reason on company files HQ sync has not stored in the company vault yet. */
+export declare const RUN_SYNC_FIRST = "run hq sync first";
 /** Top-level HQ-root folder that holds offloaded blobs in the personal vault. */
 export declare const OFFLOAD_TOP_LEVEL = ".hq-offload";
 /**
@@ -56,7 +58,7 @@ export declare const OFFLOAD_TOP_LEVEL = ".hq-offload";
  * @indigoai-us/hq-cloud 6.18.61 (PR #919) lists ".hq-offload" in
  * PERSONAL_VAULT_EXCLUDED_TOP_LEVEL; storage.ts passes that export here. The
  * check stays at runtime so an older bundled HQ sync still reports
- * "update HQ sync". CURRENT_OFFLOAD_ENABLED is a separate owner decision.
+ * "update HQ sync". Current-file offload also needs syncHoldsPlaceholders.
  */
 export declare function syncExcludesOffload(excludedTopLevel: readonly string[] | undefined): boolean;
 export declare function offloadKey(gitBlobSha: string): string;
@@ -118,11 +120,16 @@ export interface OffloadS3Client {
 export declare function s3BlobStore(bucket: string, s3: OffloadS3Client): BlobStore;
 /** Read-only access to vault objects at their sync keys, pinned to an ETag. */
 export interface VaultObjectStore {
+    /** Size and unquoted ETag of `key`, or null when it is not there. */
+    head(key: string): Promise<{
+        size: number;
+        etag: string;
+    } | null>;
     /** Download `key` to `dest` only if its ETag is `etag`; returns the served ETag. */
     download(key: string, dest: string, etag: string): Promise<string>;
 }
 export interface VaultObjectS3Client {
-    send(cmd: GetObjectCommand): Promise<unknown>;
+    send(cmd: GetObjectCommand | HeadObjectCommand): Promise<unknown>;
 }
 export declare function s3VaultObjectStore(bucket: string, s3: VaultObjectS3Client): VaultObjectStore;
 export interface OffloadDeps {
@@ -152,7 +159,40 @@ export interface OffloadDeps {
         vault: "company";
         slug: string;
     }) => Promise<VaultObjectStore>;
+    /**
+     * Whether the installed HQ sync treats every `x.hqcloud` sibling as a hold
+     * on `x` in push and pull (hq-cloud CLOUD_PLACEHOLDER_HOLDS_ANY_SIBLING).
+     * Current-file offload stays off unless this returns true.
+     */
+    syncHoldsPlaceholders?: () => boolean;
+    /** What HQ sync last recorded for `target` (its journal entry), or null. */
+    syncRecord?: (target: OffloadTarget) => Promise<SyncRecord | null>;
+    /** File operations for current-file offload (tests inject to see the order). */
+    placeholderFs?: PlaceholderFs;
 }
+/** The vault that owns a working-tree path, and the object key there. */
+export type OffloadTarget = {
+    vault: "personal";
+    key: string;
+} | {
+    vault: "company";
+    slug: string;
+    key: string;
+};
+/** A sync journal entry: the version HQ sync last pushed or pulled. */
+export interface SyncRecord {
+    /** Hex sha256 of the synced bytes. */
+    hash?: string;
+    size: number;
+    remoteEtag?: string;
+}
+/**
+ * `companies/<slug>/<rest>` belongs to that company's vault at key `<rest>`.
+ * Every other path belongs to the personal vault at its HQ-root-relative path.
+ */
+export declare function resolveOffloadTarget(rel: string): OffloadTarget;
+/** Whether current-file offload can run with the installed HQ sync. */
+export declare function currentSyncReady(deps: Pick<OffloadDeps, "syncExcludesOffload" | "syncHoldsPlaceholders">): boolean;
 export declare function storageScriptPath(hqRoot: string): string;
 /** Whether the installed core script has a `case` arm for `sub`. */
 export declare function scriptSupports(hqRoot: string, sub: "large" | "strip-large"): boolean;
@@ -215,17 +255,34 @@ export interface PlaceholderFs {
 }
 export declare const durablePlaceholderFs: PlaceholderFs;
 /**
- * Offload one current file: upload and verify, write `x.hqcloud` (fsynced),
- * and only then remove `x`. With the placeholder written first, a sync
- * watcher never sees `x` missing without its placeholder, which it would
- * push as a delete.
- *
- * Not called while CURRENT_OFFLOAD_ENABLED is false.
+ * Offload one personal-scope current file by upload: upload and verify,
+ * write `x.hqcloud` (fsynced), and only then remove `x`. With the placeholder
+ * written first, a sync watcher never sees `x` missing without its
+ * placeholder. Company files never take this path (see pointCurrentFileAtVault).
  */
 export declare function offloadCurrentFile(rel: string, store: BlobStore, deps: Pick<OffloadDeps, "hqRoot" | "now">, fsOps?: PlaceholderFs): Promise<{
     path: string;
     bytes: number;
 }>;
+/** One current file in a `--current` plan (dry run and real run). */
+export interface CurrentFilePlan {
+    path: string;
+    bytes: number;
+    idle_days: number;
+    vault: "personal" | "company";
+    company?: string;
+    /** HQ sync already stored this exact version in the owning vault. */
+    synced: boolean;
+    action: "point-at-vault" | "upload" | "skip";
+    reason?: string;
+}
+export interface CurrentOffloaded {
+    path: string;
+    bytes: number;
+    vault: "personal" | "company";
+    company?: string;
+    action: "point-at-vault" | "upload";
+}
 export interface OffloadOptions {
     minBytes: number;
     idleDays: number;
@@ -233,12 +290,16 @@ export interface OffloadOptions {
     current: boolean;
     dryRun: boolean;
     yes: boolean;
+    /** With `current`: offload files at or under these HQ paths instead of the large-file list. */
+    paths?: string[];
 }
 export interface OffloadResult {
     history: {
         uploaded: number;
         bytes: number;
         freed_bytes: number;
+        /** True when this run did not ask for history. */
+        skipped?: boolean;
         available?: boolean;
         reason?: string;
         candidates?: number;
@@ -273,13 +334,17 @@ export interface OffloadResult {
         } | null;
     };
     current: {
-        offloaded: {
-            path: string;
-            bytes: number;
-        }[];
+        offloaded: CurrentOffloaded[];
         freed_bytes: number;
         available?: boolean;
         reason?: string;
+        /** Every candidate with its target vault, sync state, and action. */
+        files?: CurrentFilePlan[];
+        /** True when this run did not ask for current files. */
+        skipped?: boolean;
+        /** Company files skipped because HQ sync has not stored this version yet. */
+        unsynced?: string[];
+        message?: string;
     };
     errors: string[];
     dry_run: boolean;

package/dist/commands/storage-offload.js

@@ -8,13 +8,18 @@
  *     uploads each blob, verifies size + sha256 + git blob id, then hands only
  *     verified blobs to core `hq-storage.sh strip-large`, which rewrites history
  *     to the pointer text. Working-tree files are never touched.
- *   - Current files (idle big files in the working tree). NOT offloaded yet:
- *     the sync delete planner lives in @indigoai-us/hq-cloud (`computePullPlan`
- *     and the push delete planner in dist/cli/sync.js), so replacing `x.mp4`
- *     with `x.mp4.hqcloud` would still propagate as a remote delete of `x.mp4`.
- *     `--current` reports `{ available: false }` until hq-cloud learns about
- *     placeholders (CURRENT_OFFLOAD_ENABLED). `offloadCurrentFile` is built
- *     and tested but not called.
+ *   - Current files (`--current [paths...]`, idle big files in the working
+ *     tree). Each file goes to the vault that owns its path. A file under
+ *     `companies/<slug>/` is never uploaded: when HQ sync already stored this
+ *     exact version in that company's vault (journal hash + size, and the vault
+ *     object still has the journal's ETag), the file is replaced by a
+ *     placeholder pointing at that object. Otherwise it is skipped with "run
+ *     hq sync first", so sync stays the only writer of company vault keys. Any
+ *     other file points at its personal-vault sync object the same way, or is
+ *     uploaded to the personal vault's `.hq-offload/blobs/`. Current-file
+ *     offload runs only when the installed HQ sync holds every `.hqcloud`
+ *     sibling (hq-cloud CLOUD_PLACEHOLDER_HOLDS_ANY_SIBLING) and skips
+ *     `.hq-offload/`; otherwise it reports "update HQ sync".
  *
  * Fetch also reads placeholders that HQ sync rewrote after a teammate changed
  * the file (`vault: company`, the company vault key, `sha256: unknown`,
@@ -24,9 +29,10 @@
  * which writes the caller's own personal-vault copy to a file outside HQ so
  * it can never sync back.
  *
- * Tenant isolation: bytes only ever go to the caller's personal vault. The
- * personal store refuses a company vault bucket, and nothing here lists or
- * opens company memberships.
+ * Tenant isolation: uploads only ever go to the caller's personal vault, and
+ * the personal store refuses a company vault bucket. A company vault is opened
+ * read-only (HEAD and ETag-pinned GET), and only for a company the caller is
+ * an active member of.
  */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
@@ -42,15 +48,12 @@ export const POINTER_HEADER = "HQ-CLOUD-FILE v1";
 export const POINTER_FOOTER = "This file is stored in HQ cloud storage. Open it in HQ, or run the command above to download it.";
 export const DEFAULT_MIN_BYTES = 50 * 1024 * 1024;
 export const DEFAULT_IDLE_DAYS = 14;
-export const CURRENT_BLOCKED_REASON = "Offloading current files is not available yet: HQ sync would treat the replaced file as deleted.";
-/**
- * Gate for `--current`. Stays false until the owner enables current-file
- * offload on top of hq-cloud's cloud-only placeholders (PR #919, 6.18.61).
- */
-export const CURRENT_OFFLOAD_ENABLED = false;
 export const ORPHANED_MESSAGE = "This file was deleted by a teammate. It's no longer in the cloud for your team.";
 const UPDATE_HQ = "update HQ";
 export const UPDATE_SYNC = "update HQ sync";
+/** Reason on company files HQ sync has not stored in the company vault yet. */
+export const RUN_SYNC_FIRST = "run hq sync first";
+const DAY_MS = 86_400_000;
 const PERSONAL_BUCKET_PREFIX = "hq-vault-prs-";
 /** Top-level HQ-root folder that holds offloaded blobs in the personal vault. */
 export const OFFLOAD_TOP_LEVEL = ".hq-offload";
@@ -63,7 +66,7 @@ export const OFFLOAD_TOP_LEVEL = ".hq-offload";
  * @indigoai-us/hq-cloud 6.18.61 (PR #919) lists ".hq-offload" in
  * PERSONAL_VAULT_EXCLUDED_TOP_LEVEL; storage.ts passes that export here. The
  * check stays at runtime so an older bundled HQ sync still reports
- * "update HQ sync". CURRENT_OFFLOAD_ENABLED is a separate owner decision.
+ * "update HQ sync". Current-file offload also needs syncHoldsPlaceholders.
  */
 export function syncExcludesOffload(excludedTopLevel) {
     return Array.isArray(excludedTopLevel) && excludedTopLevel.includes(OFFLOAD_TOP_LEVEL);
@@ -245,6 +248,17 @@ export function s3BlobStore(bucket, s3) {
 }
 export function s3VaultObjectStore(bucket, s3) {
     return {
+        async head(key) {
+            try {
+                const res = (await s3.send(new HeadObjectCommand({ Bucket: bucket, Key: key })));
+                return { size: res.ContentLength ?? -1, etag: normalizeEtag(res.ETag) };
+            }
+            catch (err) {
+                if (isNotFound(err))
+                    return null;
+                throw err;
+            }
+        },
         async download(key, dest, etag) {
             let res;
             try {
@@ -273,6 +287,21 @@ export function s3VaultObjectStore(bucket, s3) {
         },
     };
 }
+/**
+ * `companies/<slug>/<rest>` belongs to that company's vault at key `<rest>`.
+ * Every other path belongs to the personal vault at its HQ-root-relative path.
+ */
+export function resolveOffloadTarget(rel) {
+    const posix = toPosix(rel);
+    const m = /^companies\/([^/]+)\/(.+)$/.exec(posix);
+    if (m)
+        return { vault: "company", slug: m[1], key: m[2] };
+    return { vault: "personal", key: posix };
+}
+/** Whether current-file offload can run with the installed HQ sync. */
+export function currentSyncReady(deps) {
+    return deps.syncExcludesOffload() && deps.syncHoldsPlaceholders?.() === true;
+}
 // ── Core script capability ──────────────────────────────────────────────────
 export function storageScriptPath(hqRoot) {
     return path.join(hqRoot, "core", "scripts", "hq-storage.sh");
@@ -408,16 +437,17 @@ export const durablePlaceholderFs = {
     },
 };
 /**
- * Offload one current file: upload and verify, write `x.hqcloud` (fsynced),
- * and only then remove `x`. With the placeholder written first, a sync
- * watcher never sees `x` missing without its placeholder, which it would
- * push as a delete.
- *
- * Not called while CURRENT_OFFLOAD_ENABLED is false.
+ * Offload one personal-scope current file by upload: upload and verify,
+ * write `x.hqcloud` (fsynced), and only then remove `x`. With the placeholder
+ * written first, a sync watcher never sees `x` missing without its
+ * placeholder. Company files never take this path (see pointCurrentFileAtVault).
  */
 export async function offloadCurrentFile(rel, store, deps, fsOps = durablePlaceholderFs) {
     if (store.vault !== "personal")
         throw new Error("Offload only writes to your personal vault.");
+    if (resolveOffloadTarget(rel).vault === "company") {
+        throw new Error(`'${rel}' is a company file. Company files are never uploaded to your personal vault.`);
+    }
     assertRestorable(rel);
     const abs = containedPath(deps.hqRoot, rel);
     const before = await fs.promises.stat(abs);
@@ -449,23 +479,251 @@ export async function offloadCurrentFile(rel, store, deps, fsOps = durablePlaceh
     await fsOps.removeOriginal(abs);
     return { path: toPosix(rel), bytes: digest.size };
 }
+/**
+ * Point one current file at the vault object HQ sync stored for it: confirm
+ * the object still has the recorded ETag and size, write `x.hqcloud`
+ * (fsynced), and only then remove `x`. Nothing is uploaded.
+ */
+async function pointCurrentFileAtVault(file, vault, deps, fsOps) {
+    const { plan, target, stat: before, digest, record } = file;
+    if (!before || !digest || !record?.remoteEtag)
+        throw new Error(`'${plan.path}' has no synced version.`);
+    const abs = containedPath(deps.hqRoot, plan.path);
+    const head = await vault.head(target.key);
+    if (!head || head.etag !== normalizeEtag(record.remoteEtag) || head.size !== digest.size) {
+        throw new Error(`The cloud copy of '${plan.path}' changed. Nothing was replaced; ${RUN_SYNC_FIRST}.`);
+    }
+    const unchanged = async () => {
+        const st = await fs.promises.stat(abs);
+        return st.size === before.size && st.mtimeMs === before.mtimeMs;
+    };
+    const changed = new Error(`'${plan.path}' changed while offloading. Nothing was replaced.`);
+    if (!(await unchanged()))
+        throw changed;
+    const placeholder = `${abs}${PLACEHOLDER_SUFFIX}`;
+    await fsOps.writePlaceholder(placeholder, renderPointer({
+        path: plan.path,
+        size: digest.size,
+        sha256: digest.sha256,
+        vault: target.vault,
+        key: target.key,
+        offloadedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"),
+        remoteEtag: head.etag,
+    }));
+    if (!(await unchanged())) {
+        await fs.promises.rm(placeholder, { force: true });
+        throw changed;
+    }
+    await fsOps.removeOriginal(abs);
+}
+/** Whether a working-tree path is never a current-offload candidate. */
+function skippedByName(rel) {
+    const parts = rel.split("/");
+    const name = parts[parts.length - 1];
+    return (parts[0] === OFFLOAD_TOP_LEVEL ||
+        parts.includes(".git") ||
+        (parts[0] === ".claude" && parts[1] === "hooks") ||
+        name.endsWith(PLACEHOLDER_SUFFIX) ||
+        name.endsWith(".hqcloud-download"));
+}
+/**
+ * Regular files at or under each path argument, HQ-root-relative and sorted.
+ * Symlinks are not followed, and a path outside HQ throws.
+ */
+function walkCurrentPaths(hqRoot, args) {
+    const realRoot = fs.realpathSync(path.resolve(hqRoot));
+    const out = [];
+    const seen = new Set();
+    const visit = (abs) => {
+        const rel = toPosix(path.relative(realRoot, abs));
+        if (rel === "" ? false : skippedByName(rel))
+            return;
+        const st = fs.lstatSync(abs);
+        if (st.isSymbolicLink())
+            return;
+        if (st.isDirectory()) {
+            for (const name of fs.readdirSync(abs).sort())
+                visit(path.join(abs, name));
+            return;
+        }
+        if (st.isFile() && !seen.has(rel)) {
+            seen.add(rel);
+            out.push(rel);
+        }
+    };
+    for (const arg of args) {
+        const lexical = path.resolve(realRoot, arg);
+        const abs = containedPath(hqRoot, arg);
+        if (!fs.existsSync(abs))
+            throw new Error(`'${arg}' does not exist in HQ.`);
+        if (fs.lstatSync(lexical).isSymbolicLink())
+            continue;
+        visit(abs);
+    }
+    return out;
+}
+/**
+ * Decide what `--current` does with each candidate. Read-only: stats and
+ * hashes local files, reads sync records and HEADs vault objects.
+ */
+async function planCurrentFiles(rels, opts, deps, openVault) {
+    let active;
+    const planned = [];
+    const now = deps.now().getTime();
+    for (const rel of rels) {
+        if (skippedByName(rel))
+            continue;
+        const abs = containedPath(deps.hqRoot, rel);
+        let st;
+        try {
+            st = fs.lstatSync(abs);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                continue;
+            throw err;
+        }
+        if (!st.isFile() || fs.existsSync(`${abs}${PLACEHOLDER_SUFFIX}`))
+            continue;
+        const idle = Math.max(0, Math.floor((now - st.mtimeMs) / DAY_MS));
+        if (st.size < opts.minBytes || idle < opts.idleDays)
+            continue;
+        const target = resolveOffloadTarget(rel);
+        const plan = {
+            path: rel,
+            bytes: st.size,
+            idle_days: idle,
+            vault: target.vault,
+            synced: false,
+            action: target.vault === "company" ? "skip" : "upload",
+        };
+        if (target.vault === "company") {
+            plan.company = target.slug;
+            active ??= deps.activeCompanySlugs ? await deps.activeCompanySlugs() : [];
+            if (!active.includes(target.slug)) {
+                plan.reason = `You are not an active member of '${target.slug}'.`;
+                planned.push({ plan, target });
+                continue;
+            }
+        }
+        const record = deps.syncRecord ? await deps.syncRecord(target) : null;
+        let digest;
+        if (record?.remoteEtag && record.hash && record.size === st.size) {
+            digest = await digestFile(abs);
+            if (digest.sha256 === record.hash.toLowerCase()) {
+                const head = await (await openVault(target)).head(target.key);
+                plan.synced = head !== null && head.etag === normalizeEtag(record.remoteEtag) && head.size === st.size;
+            }
+        }
+        if (plan.synced)
+            plan.action = "point-at-vault";
+        else if (target.vault === "company")
+            plan.reason = RUN_SYNC_FIRST;
+        planned.push({ plan, target, stat: st, digest, record: record ?? undefined });
+    }
+    return planned;
+}
+/** `--current`: plan, confirm, then offload each file to the vault that owns it. */
+async function runCurrent(opts, deps, result) {
+    const current = result.current;
+    if (!currentSyncReady(deps)) {
+        current.available = false;
+        current.reason = UPDATE_SYNC;
+        return "ok";
+    }
+    let rels;
+    if (opts.paths && opts.paths.length > 0) {
+        rels = walkCurrentPaths(deps.hqRoot, opts.paths);
+    }
+    else {
+        const large = await getLarge(deps, opts.minBytes);
+        if (!large.available) {
+            current.available = false;
+            current.reason = large.reason;
+            return "ok";
+        }
+        rels = large.current.map((f) => toPosix(f.path));
+    }
+    current.available = true;
+    const vaults = new Map();
+    const openVault = (t) => {
+        if (!deps.openVaultObjects)
+            throw new Error("This HQ build cannot read files stored by HQ sync.");
+        const id = t.vault === "company" ? `company:${t.slug}` : "personal";
+        let v = vaults.get(id);
+        if (!v) {
+            v = deps.openVaultObjects(t.vault === "company" ? { vault: "company", slug: t.slug } : { vault: "personal" });
+            vaults.set(id, v);
+        }
+        return v;
+    };
+    const planned = await planCurrentFiles(rels, opts, deps, openVault);
+    current.files = planned.map((p) => p.plan);
+    const unsynced = planned.filter((p) => p.plan.reason === RUN_SYNC_FIRST).map((p) => p.plan.path);
+    if (unsynced.length > 0) {
+        current.unsynced = unsynced;
+        current.message =
+            `${unsynced.length} company file(s) are not in the company vault yet, so they were left as they are. ` +
+                `To offload them, ${RUN_SYNC_FIRST}, then run offload again: ${unsynced.join(", ")}`;
+    }
+    const todo = planned.filter((p) => p.plan.action !== "skip");
+    if (opts.dryRun || todo.length === 0)
+        return "ok";
+    if (!opts.yes) {
+        const ok = await deps.confirm(`Replace ${todo.length} current file(s) with links to their HQ cloud copies and remove the local copies?`);
+        if (!ok) {
+            deps.log("Aborted - nothing was uploaded or changed.");
+            return "aborted";
+        }
+    }
+    const fsOps = deps.placeholderFs ?? durablePlaceholderFs;
+    let personal;
+    for (const file of todo) {
+        const { plan } = file;
+        try {
+            if (plan.action === "point-at-vault") {
+                await pointCurrentFileAtVault(file, await openVault(file.target), deps, fsOps);
+            }
+            else {
+                personal ??= await deps.openPersonal();
+                await offloadCurrentFile(plan.path, personal, deps, fsOps);
+            }
+            const done = {
+                path: plan.path,
+                bytes: plan.bytes,
+                vault: plan.vault,
+                action: plan.action === "point-at-vault" ? "point-at-vault" : "upload",
+            };
+            if (plan.company)
+                done.company = plan.company;
+            current.offloaded.push(done);
+            current.freed_bytes += plan.bytes;
+        }
+        catch (err) {
+            result.errors.push(`${plan.path}: ${err.message}`);
+        }
+    }
+    return "ok";
+}
 export async function runOffload(opts, deps) {
-    const both = !opts.history && !opts.current;
-    const doHistory = both || opts.history;
-    const doCurrent = both || opts.current;
+    // Current files are offloaded only on request; a bare run touches history only.
+    const doHistory = opts.history || !opts.current;
+    const doCurrent = opts.current;
     const result = {
         history: { uploaded: 0, bytes: 0, freed_bytes: 0 },
         current: { offloaded: [], freed_bytes: 0 },
         errors: [],
         dry_run: opts.dryRun,
     };
-    if (doCurrent) {
-        result.current.available = false;
-        result.current.reason = CURRENT_BLOCKED_REASON;
-    }
+    if (!doCurrent)
+        result.current.skipped = true;
+    if (doCurrent && (await runCurrent(opts, deps, result)) === "aborted")
+        return undefined;
     const script = storageScriptPath(deps.hqRoot);
-    if (!doHistory)
+    if (!doHistory) {
+        result.history.skipped = true;
         return result;
+    }
     if (!deps.syncExcludesOffload()) {
         result.history.available = false;
         result.history.reason = UPDATE_SYNC;
@@ -843,8 +1101,6 @@ async function fetchGitBlob(sha, out, deps) {
 }
 /** Current-file offload availability, shared by status and its error fallback. */
 export function currentAvailability(syncReady) {
-    if (!CURRENT_OFFLOAD_ENABLED)
-        return { current_available: false, current_reason: CURRENT_BLOCKED_REASON };
     if (!syncReady)
         return { current_available: false, current_reason: UPDATE_SYNC };
     return { current_available: true };
@@ -854,7 +1110,7 @@ export async function getOffloadStatus(deps, opts) {
         history_candidates: { count: 0, bytes: 0 },
         current_candidates: { count: 0, bytes: 0 },
         placeholders: { count: 0, bytes: 0 },
-        ...currentAvailability(deps.syncExcludesOffload()),
+        ...currentAvailability(currentSyncReady(deps)),
     };
     for (const rel of await deps.listPlaceholders()) {
         const pointer = readPointerFile(containedPath(deps.hqRoot, rel));