@indigoai-us/hq-cli 5.345.148 → 5.345.150

package/CHANGELOG.md

@@ -2,6 +2,81 @@
 
 ## [Unreleased]
 
+## [5.345.150] — 2026-10-19
+- The bundled sync engine now uses hq-cloud 6.18.90, which brings two fixes.
+- Owners and admins can now destroy one of a company's Outposts with
+  `hq outposts destroy --company <slug>`. Add `--outpost <name|id>` when the
+  company has more than one. Without `--yes`, hq shows the company, Outpost
+  name and id, and destroys it only after you type the Outpost name or `yes`.
+  A script without a terminal must pass `--yes`. With `--yes --json` it prints
+  one result object. After the request, hq keeps checking status and reports
+  whether the Outpost is destroyed or still being destroyed, instead of
+  failing on a slow or errored response. It never falls back to your personal
+  Outpost. The Company Outpost commands from the last release are unchanged:
+  `hq outposts list --company`, `--outpost <name|id>` on status, login,
+  login-code, refresh-config and the jobs commands, and `hq outposts jobs`
+  edit, pause, resume, delete and run-now.
+- HQ Sync uses much less CPU and memory on Windows when HQ holds git
+  worktrees. The sync watcher no longer watches `worktrees/` at the top of
+  HQ, `.worktrees/`, `.claude/worktrees/`, `workspace/worktrees/`,
+  `node_modules` or nested `.git` folders, including during startup. A top
+  level `worktrees/` folder and any `.worktrees/` folder also stop syncing;
+  files from them that are already in the vault are not deleted. Sync passes
+  started by local changes now run at most once every 30 seconds, and a file
+  hq just downloaded no longer triggers an upload of itself. If the sync
+  runner uses more than a quarter of a CPU core or 600 MB of memory for a
+  while, it writes one warning line to its log. You can opt in to a local
+  diagnostics capture, and `hq-sync-runner --diagnostics` prints a redacted
+  summary to paste into a bug report. Nothing is uploaded.
+- A company Outpost can now be given access to a secret. Use its `out_` id:
+  `hq secrets share <path> --with out_…` gives it that one secret, and
+  `hq groups add <group> out_…` lets it read the secrets shared with that
+  group. It gets nothing it was not explicitly given.
+- `hq members list` now shows the company Outpost as a read-only row labeled
+  "Outpost", and `--json` lists it under `outposts`. Promoting, removing or
+  revoking an Outpost is refused with a plain message.
+- `hq lanes create` now prints the new lane's `lane_id` before the list of other lanes it admitted, so a script that takes the first lane id from the output gets the lane it just created. Lane commands that accept a lane id (`hq lanes message`, `hq lanes questions list --from`, `hq lanes watch` and the other lane-target commands) still match the full id first. They now also accept a ULID prefix of 8 or more characters when it names exactly one local lane, and they refuse an ambiguous prefix with an error that lists every matching lane. `hq lanes watch` always prints full lane ids.
+- `hq lanes create --runner subagent` accepts `--provider codex` (and `grok`),
+  so Codex `spawn_agent` work from `/conduct` and `/run-project` shows on the
+  lanes board like Claude `Agent` work. A subagent lane is a board record only;
+  the provider is attribution and no process is started. The
+  `subagent_runner_requires_claude` refusal is gone.
+
+## [5.345.149] — 2026-10-19
+- `hq access` answers faster. It checks the exact path first and, on a miss,
+  looks only in the nearest folder instead of listing the whole vault. It
+  loads the member list only when it is about to send an access request.
+  Results and denial reasons are the same as before.
+- `hq access` takes several paths at once (`hq access a.md b.md`) or reads
+  them from `--stdin`, one per line. Each path gets its own result, `--json`
+  prints an array, and the exit code is the highest one across the paths.
+- A folder path now resolves to the folder, and the three spellings `docs`,
+  `docs/` and `docs/*` all check the same folder. Before, a bare folder name
+  was matched against every file in the vault and usually came back
+  ambiguous.
+- Two `hq bot create` error messages now call HQ's built-in bot "your assistant" instead of "setup bot", matching the desktop app. Using `--kind company` with the setup worker now says "HQ's assistant is always a personal bot; drop --kind company.", and using the reserved name `setup` with another worker now says the name is reserved for HQ's assistant. The reserved name and the worker are still `setup`, so commands are unchanged.
+- `hq channels list` takes `--json`, `--active-since <time|duration>` and
+  `--sort activity`. `--active-since 2h` (or an ISO time) lists only the
+  channels and group DMs with activity since then, newest first, so a sweep
+  no longer has to read all of your channels to find the busy ones. `--json`
+  includes each channel's last-activity time and unread count.
+- New `hq channels changes [--cursor <token>]` prints the channels that changed
+  since the last call's cursor, as JSON. With no cursor it prints a full
+  snapshot and a cursor to use next time.
+- `hq dm channel <channel id> --json` no longer downloads your whole channel
+  list first, so reading one channel by id takes about a second.
+- `hq billing usage` no longer prices meters for a company or personal account
+  on a flat plan (for example a Workforce company that subscribed before usage
+  pricing). It shows the readings and one line saying usage meters are not
+  billed, with no per-meter cost and no projected bill. `--json` carries
+  `onUsagePricing` and leaves out the cost fields. The plan comes from the
+  server; when an older server does not send it, the command uses the billing
+  summary, and it shows no cost when neither says.
+- `hq library add` now reaches the company vault for members in `shared` or `custom` sync mode. When the library folder is outside the membership's sync scope, the command pins it the same way `hq files get` does, so the next sync uploads the new placeholders and teammates and cloud search can find them. `all` mode and folders already covered by a grant or pin are left alone. If the sync scope cannot be read or the pin cannot be written, the command prints a warning with the exact `hq files get <folder>/ --company <co>` command to run. `--json` output reports this as `syncScope`.
+- `hq library add --to <folder>` no longer pins the whole target folder for `shared` or `custom` sync. Outside the default `library/` folder it pins only the placeholders it wrote, so the rest of that folder stays out of sync. When the pin cannot be written or the sync scope cannot be read, the warning lists the exact paths to add to `.hq/pins.json` (the `hq files get library/` command is still printed for the default folder).
+- Windows cold-install polish. The first `hq` command adds the npm folder that holds `hq.cmd` to the user PATH (HKCU only), idempotently, and broadcasts the environment change. It never edits the machine PATH. `hq doctor` still prints the exact PowerShell command when that folder is missing. npm install no longer needs a package postinstall for the mesh daemon: `hq mesh daemon install --if-stale` runs once on the first real command for that CLI version (the postinstall now only pins the native hook engine), and better-sqlite3 loads from its prebuilt binary or fails with `npm install -g @indigoai-us/hq-cli --allow-scripts=better-sqlite3`. On a Windows console that is not UTF-8, hq prints ASCII instead of a garbled em dash. `hq invite --help` and other unknown commands print `unknown command` plus a nested did-you-mean and exit non-zero, instead of the main help. When the hqd named pipe cannot be used, `hq doctor` says whether hqd is down, access was denied, the pipe is missing, or hqd did not answer. On Windows, `hq reindex` now finds the npm `codex.cmd` shim on PATH and runs it through cmd.exe, so Codex hook trust no longer fails with `spawn codex ENOENT`. When Codex is missing, reindex names it and says how to fix it. Any hook-trust failure now says that runtime will not run HQ hooks until trust succeeds and to rerun `hq reindex`. The SessionStart vault-access refresh (`hq core refresh-vault-access`) exits right away when nobody is signed in to HQ. Each child `hq` call it makes has a 30-second timeout (`HQ_VAULT_ACCESS_TIMEOUT_MS` changes it) and runs with `HQ_NO_BROWSER_LOGIN=1`, so a signed-out child fails fast instead of waiting on a browser login.
+- Register the pinned native hook launcher behind the default-off hook-engine-launcher flag, with Claude exec form, Codex commandWindows, and reindex rollback to bash. Project hook files are converted in place and restored exactly, and a registration file that cannot be read no longer stops the others or their Codex trust. Codex hooks are only trusted after their file was written and verified.
+
 ## [5.345.148] — 2026-10-19
 
 - The `hq lanes` free-memory gate (`throttle.min_available_mem_mb`) now reads the same values as macOS `memory_pressure`: the system-wide free percentage and the pressure level. A Mac that `memory_pressure` reports as normal with enough free memory no longer holds new lanes. While the gate is set, new lanes wait at the warn or critical level. The old `vm_stat` reading, which leaves out purgeable and compressible memory, is used only when those values cannot be read. A memory hold is recorded as `memory_hold` in the throttle state and in `hq lanes admit` output, with the signal, the reading, the level and the threshold.

package/README.md

@@ -7,6 +7,8 @@ npm install -g @indigoai-us/hq-cli
 hq --help
 ```
 
+On Windows, the first `hq` command adds the folder that holds `hq.cmd` to your user PATH (HKCU only, not the machine PATH). You do not need to approve npm install scripts for hq itself. If the local database cannot load better-sqlite3 because npm skipped its install script, HQ tries to download the prebuilt binary. If that fails, the error names `npm install -g @indigoai-us/hq-cli --allow-scripts=better-sqlite3`.
+
 ## Marketplace package verification
 
 Marketplace packages must include an Ed25519 signature made with a platform

package/dist/command-catalog.generated.d.ts

@@ -2039,7 +2039,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "share";
-        readonly description: "Share a secret with an email address, group, or the entire company (@all)";
+        readonly description: "Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -2054,7 +2054,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Email address, group id, or @all (entire company) to share with";
+            readonly description: "Email address, group id, out_ Outpost id, or @all (entire company) to share with";
             readonly hidden: false;
         }, {
             readonly flags: "--permission <level>";
@@ -2079,7 +2079,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--from <principal>";
-            readonly description: "Email address, group id, or @all (entire company) to remove";
+            readonly description: "Email address, group id, out_ Outpost id, or @all (entire company) to remove";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
@@ -2555,7 +2555,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "add";
-        readonly description: "Add a person or agent to a group (principal: email, personUid, or agentUid)";
+        readonly description: "Add a person, agent, or company Outpost to a group (principal: email, personUid, agentUid, or out_ Outpost id)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -2577,7 +2577,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "remove";
-        readonly description: "Remove a person or agent from a group (principal: email, personUid, or agentUid)";
+        readonly description: "Remove a person, agent, or company Outpost from a group (principal: email, personUid, agentUid, or out_ Outpost id)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -3125,20 +3125,20 @@ export declare const COMMAND_CATALOG: readonly [{
     }];
 }, {
     readonly name: "access";
-    readonly description: "Tell whether a vault file exists and whether you can read it. Never a bare not-found. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.";
+    readonly description: "Tell whether a vault file exists and whether you can read it. Never a bare not-found. Takes one or more paths or queries. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly helpOption: true;
     readonly helpCommand: false;
-    readonly usage: "[options] <path-or-query>";
+    readonly usage: "[options] [vault-path...]";
     readonly helpText: readonly [{
         readonly position: "after";
-        readonly text: "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it)\n  4  ambiguous (several keys matched; pick one)\n";
+        readonly text: "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it)\n  4  ambiguous (several keys matched; pick one)\n\nWith several paths, each gets its own result block and the exit code is the\nhighest one across the paths.\n";
     }];
     readonly arguments: readonly [{
-        readonly name: "path-or-query";
-        readonly required: true;
-        readonly variadic: false;
+        readonly name: "vault-path";
+        readonly required: false;
+        readonly variadic: true;
         readonly description: "";
     }];
     readonly options: readonly [{
@@ -3151,7 +3151,11 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly hidden: false;
     }, {
         readonly flags: "--json";
-        readonly description: "Print a single JSON object";
+        readonly description: "Print a single JSON object (an array for several paths)";
+        readonly hidden: false;
+    }, {
+        readonly flags: "--stdin";
+        readonly description: "Read more paths from stdin, one per line";
         readonly hidden: false;
     }, {
         readonly flags: "--no-fix";
@@ -4026,7 +4030,35 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly usage: "[options]";
         readonly helpText: readonly [];
         readonly arguments: readonly [];
-        readonly options: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Output the channel array as JSON, including activity fields.";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--active-since <when>";
+            readonly description: "Only channels with activity at or after an ISO time or a duration back from now (30m, 2h, 1d); newest first.";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--sort <order>";
+            readonly description: "'activity' lists the most recently active channels first.";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "changes";
+        readonly description: "Print the channels that changed since a feed cursor, as JSON (no cursor → full snapshot).";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--cursor <token>";
+            readonly description: "Cursor from the previous `hq channels changes` response.";
+            readonly hidden: false;
+        }];
         readonly subcommands: readonly [];
     }, {
         readonly name: "members";
@@ -7938,6 +7970,18 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--id <outpostId>";
             readonly description: "Outpost id (defaults to your primary box)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--company <slug>";
+            readonly description: "Destroy one of the company's Outposts (owner or admin)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--outpost <name|id>";
+            readonly description: "Which company Outpost, when the company has more than one";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "With --company and --yes: print one result object on stdout";
+            readonly hidden: false;
         }, {
             readonly flags: "--yes";
             readonly description: "Confirm the irreversible teardown (required)";
@@ -8404,6 +8448,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--repair";
             readonly description: "Repair the pinned copy after closing running hook processes";
             readonly hidden: false;
+        }, {
+            readonly flags: "--for-registration";
+            readonly description: "Print a path only when the offline launcher flag is enabled";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -14331,7 +14379,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--runner <kind>";
-            readonly description: "process (default) | subagent: register a lane an in-session Claude subagent runs; skips admission and starts no process";
+            readonly description: "process (default) | subagent: register a lane an in-session subagent runs (Claude Agent, Codex spawn_agent); skips admission and starts no process";
             readonly hidden: false;
         }, {
             readonly flags: "--remote-control";

package/dist/command-catalog.generated.js

@@ -2446,7 +2446,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "share",
-                "description": "Share a secret with an email address, group, or the entire company (@all)",
+                "description": "Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -2464,7 +2464,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Email address, group id, or @all (entire company) to share with",
+                        "description": "Email address, group id, out_ Outpost id, or @all (entire company) to share with",
                         "hidden": false
                     },
                     {
@@ -2495,7 +2495,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--from <principal>",
-                        "description": "Email address, group id, or @all (entire company) to remove",
+                        "description": "Email address, group id, out_ Outpost id, or @all (entire company) to remove",
                         "hidden": false
                     }
                 ],
@@ -3071,7 +3071,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "add",
-                "description": "Add a person or agent to a group (principal: email, personUid, or agentUid)",
+                "description": "Add a person, agent, or company Outpost to a group (principal: email, personUid, agentUid, or out_ Outpost id)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -3097,7 +3097,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "remove",
-                "description": "Remove a person or agent from a group (principal: email, personUid, or agentUid)",
+                "description": "Remove a person, agent, or company Outpost from a group (principal: email, personUid, agentUid, or out_ Outpost id)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -3766,23 +3766,23 @@ export const COMMAND_CATALOG = [
     },
     {
         "name": "access",
-        "description": "Tell whether a vault file exists and whether you can read it. Never a bare not-found. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.",
+        "description": "Tell whether a vault file exists and whether you can read it. Never a bare not-found. Takes one or more paths or queries. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.",
         "aliases": [],
         "hidden": false,
         "helpOption": true,
         "helpCommand": false,
-        "usage": "[options] <path-or-query>",
+        "usage": "[options] [vault-path...]",
         "helpText": [
             {
                 "position": "after",
-                "text": "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it)\n  4  ambiguous (several keys matched; pick one)\n"
+                "text": "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it)\n  4  ambiguous (several keys matched; pick one)\n\nWith several paths, each gets its own result block and the exit code is the\nhighest one across the paths.\n"
             }
         ],
         "arguments": [
             {
-                "name": "path-or-query",
-                "required": true,
-                "variadic": false,
+                "name": "vault-path",
+                "required": false,
+                "variadic": true,
                 "description": ""
             }
         ],
@@ -3799,7 +3799,12 @@ export const COMMAND_CATALOG = [
             },
             {
                 "flags": "--json",
-                "description": "Print a single JSON object",
+                "description": "Print a single JSON object (an array for several paths)",
+                "hidden": false
+            },
+            {
+                "flags": "--stdin",
+                "description": "Read more paths from stdin, one per line",
                 "hidden": false
             },
             {
@@ -4872,7 +4877,42 @@ export const COMMAND_CATALOG = [
                 "usage": "[options]",
                 "helpText": [],
                 "arguments": [],
-                "options": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Output the channel array as JSON, including activity fields.",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--active-since <when>",
+                        "description": "Only channels with activity at or after an ISO time or a duration back from now (30m, 2h, 1d); newest first.",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--sort <order>",
+                        "description": "'activity' lists the most recently active channels first.",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "changes",
+                "description": "Print the channels that changed since a feed cursor, as JSON (no cursor → full snapshot).",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--cursor <token>",
+                        "description": "Cursor from the previous `hq channels changes` response.",
+                        "hidden": false
+                    }
+                ],
                 "subcommands": []
             },
             {
@@ -9674,6 +9714,21 @@ export const COMMAND_CATALOG = [
                         "description": "Outpost id (defaults to your primary box)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Destroy one of the company's Outposts (owner or admin)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--outpost <name|id>",
+                        "description": "Which company Outpost, when the company has more than one",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "With --company and --yes: print one result object on stdout",
+                        "hidden": false
+                    },
                     {
                         "flags": "--yes",
                         "description": "Confirm the irreversible teardown (required)",
@@ -10241,6 +10296,11 @@ export const COMMAND_CATALOG = [
                         "flags": "--repair",
                         "description": "Repair the pinned copy after closing running hook processes",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--for-registration",
+                        "description": "Print a path only when the offline launcher flag is enabled",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []
@@ -17427,7 +17487,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--runner <kind>",
-                        "description": "process (default) | subagent: register a lane an in-session Claude subagent runs; skips admission and starts no process",
+                        "description": "process (default) | subagent: register a lane an in-session subagent runs (Claude Agent, Codex spawn_agent); skips admission and starts no process",
                         "hidden": false
                     },
                     {

package/dist/command-help.js

@@ -1,6 +1,7 @@
 import { Command } from "commander";
 import { CLI_VERSION } from "./cli-version.js";
 import { registerCommandCatalog } from "./lazy-commands.js";
+import { argvWithoutHelpOnUnknownCommand } from "./unknown-command.js";
 export async function runCommandHelp(argv) {
     const program = new Command()
         .name("hq")
@@ -10,6 +11,6 @@ export async function runCommandHelp(argv) {
     registerCommandCatalog(program);
     const { hideStorageInCatalog } = await import("./lib/storage-feature-flag.js");
     hideStorageInCatalog(program);
-    await program.parseAsync([...argv]);
+    await program.parseAsync(argvWithoutHelpOnUnknownCommand([...argv]));
 }
 //# sourceMappingURL=command-help.js.map

package/dist/commands/_patterns.d.ts

@@ -1,6 +1,12 @@
 export declare const SECRET_NAME_PATTERN: RegExp;
 export declare const GROUP_ID_PATTERN: RegExp;
 export declare const EMAIL_PATTERN: RegExp;
+/**
+ * A company Outpost identity: `out_` plus a 26-character Crockford ULID, the
+ * same shape hq-pro accepts as an Outpost grantee. It rides the `person`
+ * grantee slot on the wire.
+ */
+export declare const OUTPOST_UID_PATTERN: RegExp;
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/_patterns.js

@@ -1,6 +1,12 @@
 export const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/;
 export const GROUP_ID_PATTERN = /^grp_[A-Za-z0-9_-]+$/;
 export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+/**
+ * A company Outpost identity: `out_` plus a 26-character Crockford ULID, the
+ * same shape hq-pro accepts as an Outpost grantee. It rides the `person`
+ * grantee slot on the wire.
+ */
+export const OUTPOST_UID_PATTERN = /^out_[0-9A-HJKMNP-TV-Z]{26}$/;
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/access.d.ts

@@ -1,5 +1,5 @@
 /**
- * `hq access <path-or-query>` — existence + ACL probe with a self-healing
+ * `hq access <path-or-query...>` — existence + ACL probe with a self-healing
  * ladder: resolve, list, probe ACL, then (with --fix) download / pin / repair
  * sync or request access from the grantor.
  *
@@ -74,10 +74,19 @@ export interface AccessDeps {
     fetchAclTree: (prefix: string) => Promise<AccessAclTree | null>;
     /** Active members (owner/admin/member/guest) — used for grantor resolution. */
     listMembers: () => Promise<AccessMember[]>;
+    /** The caller, or a loader for it. A loader runs only when a request is sent. */
     requester: {
         email: string;
         name?: string;
-    };
+    } | (() => Promise<{
+        email: string;
+        name?: string;
+    }>);
+    /**
+     * Batch POST acl/resolve: permission per company-relative target (null when
+     * the resolver grants nothing). Used by batch mode only.
+     */
+    resolveAcl?: (targets: string[]) => Promise<Map<string, string | null>>;
     dm?: {
         send(msg: {
             recipient: string;
@@ -150,7 +159,34 @@ export declare function outcomeExitCode(outcome: AccessOutcome): 0 | 2 | 3 | 4;
 export declare function formatAccessOutcome(result: RunAccessResult): string;
 export declare function resolveGrantor(tree: AccessAclTree | null, members: AccessMember[]): AccessGrantor | null;
 export declare function runAccess(input: RunAccessInput): Promise<RunAccessResult>;
+export interface RunAccessBatchInput {
+    targets: string[];
+    fix: boolean;
+    json: boolean;
+    yes?: boolean;
+    deps: AccessDeps;
+    /** Parallel existence checks. Default 4. */
+    concurrency?: number;
+}
+export interface RunAccessBatchResult {
+    results: Array<{
+        target: string;
+        result: RunAccessResult;
+    }>;
+    /** Highest exit code across the targets. */
+    exitCode: 0 | 2 | 3 | 4;
+}
+/**
+ * Several targets in one company: one vend, one bucket lookup, and one
+ * acl/resolve call for all of them, then bounded-concurrency existence
+ * checks. Requests (DM rung) run one at a time in input order so prompts and
+ * grantor lines never interleave. Several fuzzy hits are reported as
+ * ambiguous; the interactive picker is single-path only.
+ */
+export declare function runAccessBatch(input: RunAccessBatchInput): Promise<RunAccessBatchResult>;
 export declare function registerAccessCommand(program: Command): void;
+/** One target per non-blank line; surrounding whitespace is ignored. */
+export declare function parseTargetLines(text: string): string[];
 /**
  * Resolve the company `hq access` runs against: explicit `company` (the
  * ladder forwards the slug stamped on a 403), else the slug anchored in the
@@ -173,4 +209,11 @@ export declare function runAccessForPath(path: string, opts?: {
     yes?: boolean;
     fix?: boolean;
 }): Promise<RunAccessResult>;
+export declare function runAccessForPaths(paths: string[], opts?: {
+    company?: string;
+    hqRoot?: string;
+    json?: boolean;
+    yes?: boolean;
+    fix?: boolean;
+}): Promise<RunAccessBatchResult>;
 //# sourceMappingURL=access.d.ts.map