@indigoai-us/hq-cli 5.345.146 → 5.345.148

package/dist/command-catalog.generated.js

@@ -1402,6 +1402,11 @@ export const COMMAND_CATALOG = [
                 "flags": "--provider <provider>",
                 "description": "OAuth provider to use: google, microsoft, or picker",
                 "hidden": false
+            },
+            {
+                "flags": "--no-browser",
+                "description": "Print the sign-in URL without opening a browser",
+                "hidden": false
             }
         ],
         "subcommands": []
@@ -1917,6 +1922,11 @@ export const COMMAND_CATALOG = [
                         "flags": "--provider <provider>",
                         "description": "OAuth provider to use: google, microsoft, or picker",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--no-browser",
+                        "description": "Print the sign-in URL without opening a browser",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -3409,7 +3419,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "unshare",
-                "description": "Remove a named file access grant, or remove an empty ACL row without --with.",
+                "description": "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -8932,9 +8942,19 @@ export const COMMAND_CATALOG = [
                         "description": "Provision the company's Outpost instead of your personal box",
                         "hidden": false
                     },
+                    {
+                        "flags": "--name <name>",
+                        "description": "With --company: not sent. This server creates the company's main Outpost and does not take a name yet",
+                        "hidden": false
+                    },
                     {
                         "flags": "--yes",
-                        "description": "Confirm the $80/month charge (required to provision)",
+                        "description": "Confirm the monthly charge (required to provision or create)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "With --company, emit one JSON object. Progress goes to stderr.",
                         "hidden": false
                     }
                 ],
@@ -8942,7 +8962,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "list",
-                "description": "List every Outpost you own",
+                "description": "List every Outpost you own, or a company's Outposts with --company",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -8951,6 +8971,11 @@ export const COMMAND_CATALOG = [
                 "helpText": [],
                 "arguments": [],
                 "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "List the company's Outposts",
+                        "hidden": false
+                    },
                     {
                         "flags": "--json",
                         "description": "Emit raw JSON",
@@ -8980,6 +9005,11 @@ export const COMMAND_CATALOG = [
                         "description": "Show the company Outpost, its jobs, and each job's run status",
                         "hidden": false
                     },
+                    {
+                        "flags": "--outpost <name|id>",
+                        "description": "Which company Outpost, when the company has more than one",
+                        "hidden": false
+                    },
                     {
                         "flags": "--json",
                         "description": "Emit raw JSON",
@@ -8990,7 +9020,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "jobs",
-                "description": "Register a job on a company Outpost",
+                "description": "Register, edit, pause, resume, delete, or run a job on a company Outpost",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -9046,6 +9076,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Optional JSON object stored with the job",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--outpost <name|id>",
+                                "description": "Which company Outpost runs the job, when the company has more than one",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--json",
                                 "description": "Emit the job id and accepted revision as JSON",
@@ -9053,6 +9088,256 @@ export const COMMAND_CATALOG = [
                             }
                         ],
                         "subcommands": []
+                    },
+                    {
+                        "name": "edit",
+                        "description": "Change a company job. Omitted fields stay as they are. Requires --revision",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] <jobId>",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "jobId",
+                                "required": true,
+                                "variadic": false,
+                                "description": "Job id from hq outposts status --company <slug>"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns the Outpost",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--outpost <name|id>",
+                                "description": "Which company Outpost, when the company has more than one",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--revision <rev>",
+                                "description": "Accepted revision you last saw. Required for edit and delete --yes",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--prompt <text>",
+                                "description": "What the job should do. Omit to keep the current prompt",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--timezone <name>",
+                                "description": "IANA timezone, such as America/New_York. Omit to keep the current timezone",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--cron <expr>",
+                                "description": "Recurring schedule: rate(N minutes|hours|days), a five-field cron with * for day of month and month (such as \"*/15 * * * *\"; translated to the AWS form), or cron(MIN HOUR ? * DOW *). Omit to keep the current schedule",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--at <iso>",
+                                "description": "One-time ISO-8601 instant. Do not combine with --cron",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--script <text>",
+                                "description": "Precondition script stored with the job. Omit to keep the current script",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--context <json>",
+                                "description": "JSON object stored with the job. Omit to keep the current context",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--clear-script",
+                                "description": "Remove the job's precondition script",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--clear-context",
+                                "description": "Remove the job's stored context",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit the result as JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "pause",
+                        "description": "Pause a company job",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] <jobId>",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "jobId",
+                                "required": true,
+                                "variadic": false,
+                                "description": "Job id from hq outposts status --company <slug>"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns the Outpost",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--outpost <name|id>",
+                                "description": "Which company Outpost, when the company has more than one",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--revision <rev>",
+                                "description": "Accepted revision you last saw. Required for edit and delete --yes",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit the result as JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "resume",
+                        "description": "Resume a paused company job",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] <jobId>",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "jobId",
+                                "required": true,
+                                "variadic": false,
+                                "description": "Job id from hq outposts status --company <slug>"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns the Outpost",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--outpost <name|id>",
+                                "description": "Which company Outpost, when the company has more than one",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--revision <rev>",
+                                "description": "Accepted revision you last saw. Required for edit and delete --yes",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit the result as JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "delete",
+                        "description": "Delete a company job (requires --yes)",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] <jobId>",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "jobId",
+                                "required": true,
+                                "variadic": false,
+                                "description": "Job id from hq outposts status --company <slug>"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns the Outpost",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--outpost <name|id>",
+                                "description": "Which company Outpost, when the company has more than one",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--revision <rev>",
+                                "description": "Accepted revision you last saw. Required for edit and delete --yes",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--yes",
+                                "description": "Confirm deletion of this job",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit the result as JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "run-now",
+                        "description": "Run a company job once now",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options] <jobId>",
+                        "helpText": [],
+                        "arguments": [
+                            {
+                                "name": "jobId",
+                                "required": true,
+                                "variadic": false,
+                                "description": "Job id from hq outposts status --company <slug>"
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns the Outpost",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--outpost <name|id>",
+                                "description": "Which company Outpost, when the company has more than one",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--revision <rev>",
+                                "description": "Accepted revision you last saw. Required for edit and delete --yes",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit the result as JSON",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
                     }
                 ]
             },
@@ -9245,6 +9530,35 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "refresh-config",
+                "description": "Re-apply the server's job runner configuration to the company Outpost (owner or admin)",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Company slug",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--outpost <name|id>",
+                        "description": "Which company Outpost, when the company has more than one",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Emit raw JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "codex-enable",
                 "description": "Enable (or retry) Codex on an Outpost",
@@ -9290,6 +9604,11 @@ export const COMMAND_CATALOG = [
                         "description": "Request a new sign-in link for the company's Outpost (owner or admin)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--outpost <name|id>",
+                        "description": "Which company Outpost, when the company has more than one",
+                        "hidden": false
+                    },
                     {
                         "flags": "--json",
                         "description": "Emit raw JSON",
@@ -9326,6 +9645,11 @@ export const COMMAND_CATALOG = [
                         "description": "Sign in the company's Outpost (owner or admin)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--outpost <name|id>",
+                        "description": "Which company Outpost, when the company has more than one",
+                        "hidden": false
+                    },
                     {
                         "flags": "--json",
                         "description": "Emit raw JSON",
@@ -9902,6 +10226,25 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "hook-engine-path",
+                "description": "Print the offline, version-pinned native hook engine path",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--repair",
+                        "description": "Repair the pinned copy after closing running hook processes",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "ontology",
                 "description": "Checkpoint ontology steps run by the checkpoint sibling (gated by checkpoint.ontology)",
@@ -12882,6 +13225,16 @@ export const COMMAND_CATALOG = [
                 "description": "Resolve the opt-in hq-flags gate used by the client-health report hook.",
                 "hidden": true
             },
+            {
+                "flags": "--sweep-temp-homes",
+                "description": "Delete idle temp homes (90+ minutes untouched, not in use): tmp.* folders holding .rustup or .cargo, and hq-temp-home.* folders left by the wrapper. Reports GB freed.",
+                "hidden": false
+            },
+            {
+                "flags": "--dry-run",
+                "description": "With --sweep-temp-homes, list what would be removed and delete nothing.",
+                "hidden": false
+            },
             {
                 "flags": "--yes",
                 "description": "Skip the interactive --fix confirmation (non-interactive use).",
@@ -17072,6 +17425,11 @@ export const COMMAND_CATALOG = [
                         "description": "claude | codex | grok",
                         "hidden": false
                     },
+                    {
+                        "flags": "--runner <kind>",
+                        "description": "process (default) | subagent: register a lane an in-session Claude subagent runs; skips admission and starts no process",
+                        "hidden": false
+                    },
                     {
                         "flags": "--remote-control",
                         "description": "Open a Claude lane in Remote Control using account a for login and the selected account for inference",
@@ -17151,6 +17509,47 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "progress",
+                "description": "Report on a subagent lane: a progress line, the final envelope, or a failure",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <lane-id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false,
+                        "description": "Lane id"
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--line <text>",
+                        "description": "Progress line shown as the lane's last line",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--envelope <path>",
+                        "description": "Final hq-lane-envelope.v1 file; the lane state follows its decision",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--failed <reason>",
+                        "description": "Mark the lane failed when the subagent ended without an envelope",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "approve-target",
                 "description": "",

package/dist/commands/agent-inbox.js

@@ -8,6 +8,7 @@ import chalk from "chalk";
 import * as os from "node:os";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
+import { redactAgentInboxItem } from "../lib/agent-kit/inbox-redact.js";
 import { markInboxDone, mergeAgentInbox, readDoneIds, summarizeInboxEntry } from "../lib/agent-kit/inbox-state.js";
 import { agentKitPaths } from "../lib/agent-kit/paths.js";
 import { requireExternalCreds } from "./agent-kit.js";
@@ -36,7 +37,7 @@ export function registerAgentInboxCommand(agent) {
         });
         const rows = entries
             .filter((e) => opts.all || !done.has(e.id))
-            .map((e) => summarizeInboxEntry(e, done.has(e.id)));
+            .map((e) => summarizeInboxEntry(redactAgentInboxItem(e), done.has(e.id)));
         if (opts.json) {
             console.log(JSON.stringify({ count: rows.length, messages: rows, ...(note ? { note } : {}) }, null, 2));
             return;

package/dist/commands/auth.js

@@ -14,13 +14,14 @@
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
  */
+import { loginWithBrowserPreference } from "../utils/login-browser.js";
 import { releaseCurrentPackageUseLease, releasePackageUseLeaseAfterResidentPreload } from "../utils/package-use-lease.js";
 import { preloadResidentPackageModules, reportResidentPackagePreloadFailure } from "../utils/resident-package-preload.js";
 import * as fs from "node:fs";
 import { open, realpath } from "node:fs/promises";
 import path from "node:path";
 import chalk from "chalk";
-import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
+import { clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, loadMachineCachedTokens, } from "../utils/cognito-session.js";
 // Static (node builtins only): a lazy import here would need a resident
 // preload entry for the auth-login path.
@@ -212,6 +213,7 @@ export function registerAuthCommands(program) {
         .command("login")
         .description("Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally")
         .option("--provider <provider>", "OAuth provider to use: google, microsoft, or picker")
+        .option("--no-browser", "Print the sign-in URL without opening a browser")
         .action(async (options) => {
         if (resolveCognitoTokenSource() === "machine") {
             console.log(chalk.green(`Running as ${machineIdentityLabel()} — sessions mint automatically; no browser login needed.`));
@@ -237,7 +239,7 @@ export function registerAuthCommands(program) {
             }
             const selection = resolveLoginProviderSelection(options.provider, process.env, rememberedProvider);
             await releasePackageUseLeaseAfterResidentPreload(() => preloadResidentPackageModules("auth-login"), reportResidentPackagePreloadFailure, releaseCurrentPackageUseLease);
-            const tokens = await browserLogin(selection.config);
+            const tokens = await loginWithBrowserPreference(selection.config, options.browser);
             try {
                 storeLastLoginProvider(providerFromIdToken(tokens.idToken) ?? selection.providerToRemember);
             }

package/dist/commands/bot.js

@@ -243,7 +243,7 @@ export function spawnDetachedRun(name, dir) {
         detached: true,
         windowsHide: true,
         stdio: ["ignore", fd, fd],
-        env: { ...process.env, HQ_NO_UPDATE_CHECK: "1" },
+        env: { ...process.env, HQ_NO_UPDATE_CHECK: "1", HQ_NO_ENSURE_HQ_DESKTOP: "1" },
     });
     fs.closeSync(fd);
     child.unref();

package/dist/commands/cloud.js

@@ -1074,7 +1074,8 @@ export function registerCloudCommands(program) {
                 }
             }
             else {
-                log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`));
+                const skipSummary = formatPushSkipSummary(result);
+                log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${skipSummary})`));
             }
             await syncHealth.succeeded();
             const exitCode = scopeExcludedExitCode(result.filesExcludedByScope + staleRefusalCount);
@@ -2058,6 +2059,35 @@ function scopeLabel(slug) {
         return "personal (companies/personal)";
     return slug;
 }
+function formatPushSkipSummary(result) {
+    const detail = result.filesSkippedDetail;
+    if (!detail)
+        return `${result.filesSkipped} skipped`;
+    const parts = [];
+    if (detail.upToDate > 0)
+        parts.push(`${detail.upToDate} already up to date`);
+    const otherTotal = detail.conflict + detail.brokenLink + detail.other;
+    if (otherTotal > 0) {
+        const named = [];
+        if (detail.conflict > 0) {
+            named.push(`${detail.conflict} conflict${detail.conflict === 1 ? "" : "s"}`);
+        }
+        if (detail.brokenLink > 0) {
+            named.push(`${detail.brokenLink} broken link${detail.brokenLink === 1 ? "" : "s"}`);
+        }
+        if (detail.other > 0)
+            named.push(`${detail.other} other`);
+        if (detail.conflict > 0 || detail.brokenLink > 0) {
+            parts.push(`${otherTotal} skipped (${named.join(", ")})`);
+        }
+        else {
+            parts.push(`${otherTotal} skipped`);
+        }
+    }
+    if (parts.length === 0)
+        return `${result.filesSkipped} skipped`;
+    return parts.join(", ");
+}
 function formatBytes(bytes) {
     if (bytes === 0)
         return "0 B";

package/dist/commands/core-refresh-vault-access-native.d.ts

@@ -14,8 +14,25 @@ export type RefreshVaultAccessDependencies = {
     now: () => Date;
     hqAvailable: boolean;
     runHq?: (args: string[], cwd: string) => HqResult;
+    /** How long to wait for another refresh to release the manifest lock. */
+    lockWaitMs?: number;
 };
 export declare function createRefreshVaultAccessDependencies(cwd: string, env: NodeJS.ProcessEnv, now: () => Date): RefreshVaultAccessDependencies;
 export declare function runRefreshVaultAccess(args: string[], deps: RefreshVaultAccessDependencies): UtilityOutput;
+/** Test seam: runs after a waiter has judged the lock stale and before it takes the lock over. */
+export interface ManifestLockHooks {
+    afterStaleCheck?: () => void;
+}
+/**
+ * Take the manifest lock and return its owner token, or undefined when the
+ * lock stays busy past `waitMs`. The lock file is created by hard-linking a
+ * file that already holds the token, so it never exists without an owner. A
+ * stale lock (older than LOCK_STALE_MS, or whose holder on this host has
+ * exited) is taken over through removeLockIf, so two waiters that both judge
+ * it stale cannot remove each other's new lock.
+ */
+export declare function acquireManifestLock(lock: string, waitMs: number, hooks?: ManifestLockHooks): string | undefined;
+/** Release the lock if `token` still owns it. Returns false when another process has taken it over. */
+export declare function releaseManifestLock(lock: string, token: string): boolean;
 export declare function registerCoreRefreshVaultAccessNative(core: Command): void;
 //# sourceMappingURL=core-refresh-vault-access-native.d.ts.map