@indigoai-us/hq-cli 5.345.149 → 5.345.150

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 ## [Unreleased]
 
+## [5.345.150] — 2026-10-19
+- The bundled sync engine now uses hq-cloud 6.18.90, which brings two fixes.
+- Owners and admins can now destroy one of a company's Outposts with
+  `hq outposts destroy --company <slug>`. Add `--outpost <name|id>` when the
+  company has more than one. Without `--yes`, hq shows the company, Outpost
+  name and id, and destroys it only after you type the Outpost name or `yes`.
+  A script without a terminal must pass `--yes`. With `--yes --json` it prints
+  one result object. After the request, hq keeps checking status and reports
+  whether the Outpost is destroyed or still being destroyed, instead of
+  failing on a slow or errored response. It never falls back to your personal
+  Outpost. The Company Outpost commands from the last release are unchanged:
+  `hq outposts list --company`, `--outpost <name|id>` on status, login,
+  login-code, refresh-config and the jobs commands, and `hq outposts jobs`
+  edit, pause, resume, delete and run-now.
+- HQ Sync uses much less CPU and memory on Windows when HQ holds git
+  worktrees. The sync watcher no longer watches `worktrees/` at the top of
+  HQ, `.worktrees/`, `.claude/worktrees/`, `workspace/worktrees/`,
+  `node_modules` or nested `.git` folders, including during startup. A top
+  level `worktrees/` folder and any `.worktrees/` folder also stop syncing;
+  files from them that are already in the vault are not deleted. Sync passes
+  started by local changes now run at most once every 30 seconds, and a file
+  hq just downloaded no longer triggers an upload of itself. If the sync
+  runner uses more than a quarter of a CPU core or 600 MB of memory for a
+  while, it writes one warning line to its log. You can opt in to a local
+  diagnostics capture, and `hq-sync-runner --diagnostics` prints a redacted
+  summary to paste into a bug report. Nothing is uploaded.
+- A company Outpost can now be given access to a secret. Use its `out_` id:
+  `hq secrets share <path> --with out_…` gives it that one secret, and
+  `hq groups add <group> out_…` lets it read the secrets shared with that
+  group. It gets nothing it was not explicitly given.
+- `hq members list` now shows the company Outpost as a read-only row labeled
+  "Outpost", and `--json` lists it under `outposts`. Promoting, removing or
+  revoking an Outpost is refused with a plain message.
+- `hq lanes create` now prints the new lane's `lane_id` before the list of other lanes it admitted, so a script that takes the first lane id from the output gets the lane it just created. Lane commands that accept a lane id (`hq lanes message`, `hq lanes questions list --from`, `hq lanes watch` and the other lane-target commands) still match the full id first. They now also accept a ULID prefix of 8 or more characters when it names exactly one local lane, and they refuse an ambiguous prefix with an error that lists every matching lane. `hq lanes watch` always prints full lane ids.
+- `hq lanes create --runner subagent` accepts `--provider codex` (and `grok`),
+  so Codex `spawn_agent` work from `/conduct` and `/run-project` shows on the
+  lanes board like Claude `Agent` work. A subagent lane is a board record only;
+  the provider is attribution and no process is started. The
+  `subagent_runner_requires_claude` refusal is gone.
+
 ## [5.345.149] — 2026-10-19
 - `hq access` answers faster. It checks the exact path first and, on a miss,
   looks only in the nearest folder instead of listing the whole vault. It

package/dist/command-catalog.generated.d.ts

@@ -2039,7 +2039,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "share";
-        readonly description: "Share a secret with an email address, group, or the entire company (@all)";
+        readonly description: "Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -2054,7 +2054,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Email address, group id, or @all (entire company) to share with";
+            readonly description: "Email address, group id, out_ Outpost id, or @all (entire company) to share with";
             readonly hidden: false;
         }, {
             readonly flags: "--permission <level>";
@@ -2079,7 +2079,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--from <principal>";
-            readonly description: "Email address, group id, or @all (entire company) to remove";
+            readonly description: "Email address, group id, out_ Outpost id, or @all (entire company) to remove";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
@@ -2555,7 +2555,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "add";
-        readonly description: "Add a person or agent to a group (principal: email, personUid, or agentUid)";
+        readonly description: "Add a person, agent, or company Outpost to a group (principal: email, personUid, agentUid, or out_ Outpost id)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -2577,7 +2577,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "remove";
-        readonly description: "Remove a person or agent from a group (principal: email, personUid, or agentUid)";
+        readonly description: "Remove a person, agent, or company Outpost from a group (principal: email, personUid, agentUid, or out_ Outpost id)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -7970,6 +7970,18 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--id <outpostId>";
             readonly description: "Outpost id (defaults to your primary box)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--company <slug>";
+            readonly description: "Destroy one of the company's Outposts (owner or admin)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--outpost <name|id>";
+            readonly description: "Which company Outpost, when the company has more than one";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "With --company and --yes: print one result object on stdout";
+            readonly hidden: false;
         }, {
             readonly flags: "--yes";
             readonly description: "Confirm the irreversible teardown (required)";
@@ -14367,7 +14379,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--runner <kind>";
-            readonly description: "process (default) | subagent: register a lane an in-session Claude subagent runs; skips admission and starts no process";
+            readonly description: "process (default) | subagent: register a lane an in-session subagent runs (Claude Agent, Codex spawn_agent); skips admission and starts no process";
             readonly hidden: false;
         }, {
             readonly flags: "--remote-control";

package/dist/command-catalog.generated.js

@@ -2446,7 +2446,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "share",
-                "description": "Share a secret with an email address, group, or the entire company (@all)",
+                "description": "Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -2464,7 +2464,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Email address, group id, or @all (entire company) to share with",
+                        "description": "Email address, group id, out_ Outpost id, or @all (entire company) to share with",
                         "hidden": false
                     },
                     {
@@ -2495,7 +2495,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--from <principal>",
-                        "description": "Email address, group id, or @all (entire company) to remove",
+                        "description": "Email address, group id, out_ Outpost id, or @all (entire company) to remove",
                         "hidden": false
                     }
                 ],
@@ -3071,7 +3071,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "add",
-                "description": "Add a person or agent to a group (principal: email, personUid, or agentUid)",
+                "description": "Add a person, agent, or company Outpost to a group (principal: email, personUid, agentUid, or out_ Outpost id)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -3097,7 +3097,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "remove",
-                "description": "Remove a person or agent from a group (principal: email, personUid, or agentUid)",
+                "description": "Remove a person, agent, or company Outpost from a group (principal: email, personUid, agentUid, or out_ Outpost id)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -9714,6 +9714,21 @@ export const COMMAND_CATALOG = [
                         "description": "Outpost id (defaults to your primary box)",
                         "hidden": false
                     },
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Destroy one of the company's Outposts (owner or admin)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--outpost <name|id>",
+                        "description": "Which company Outpost, when the company has more than one",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "With --company and --yes: print one result object on stdout",
+                        "hidden": false
+                    },
                     {
                         "flags": "--yes",
                         "description": "Confirm the irreversible teardown (required)",
@@ -17472,7 +17487,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--runner <kind>",
-                        "description": "process (default) | subagent: register a lane an in-session Claude subagent runs; skips admission and starts no process",
+                        "description": "process (default) | subagent: register a lane an in-session subagent runs (Claude Agent, Codex spawn_agent); skips admission and starts no process",
                         "hidden": false
                     },
                     {

package/dist/commands/_patterns.d.ts

@@ -1,6 +1,12 @@
 export declare const SECRET_NAME_PATTERN: RegExp;
 export declare const GROUP_ID_PATTERN: RegExp;
 export declare const EMAIL_PATTERN: RegExp;
+/**
+ * A company Outpost identity: `out_` plus a 26-character Crockford ULID, the
+ * same shape hq-pro accepts as an Outpost grantee. It rides the `person`
+ * grantee slot on the wire.
+ */
+export declare const OUTPOST_UID_PATTERN: RegExp;
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/_patterns.js

@@ -1,6 +1,12 @@
 export const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/;
 export const GROUP_ID_PATTERN = /^grp_[A-Za-z0-9_-]+$/;
 export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+/**
+ * A company Outpost identity: `out_` plus a 26-character Crockford ULID, the
+ * same shape hq-pro accepts as an Outpost grantee. It rides the `person`
+ * grantee slot on the wire.
+ */
+export const OUTPOST_UID_PATTERN = /^out_[0-9A-HJKMNP-TV-Z]{26}$/;
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/groups.js

@@ -1,12 +1,12 @@
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
-import { GROUP_ID_PATTERN } from "./_patterns.js";
+import { GROUP_ID_PATTERN, OUTPOST_UID_PATTERN } from "./_patterns.js";
 import { maxLength } from "../utils/table-width.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/;
-const INVALID_PRINCIPAL_HINT = "must be an email address, a personUid (prs_…), or an agentUid (agt_…)";
+const INVALID_PRINCIPAL_HINT = "must be an email address, a personUid (prs_…), an agentUid (agt_…), or a company Outpost id (out_…)";
 export function detectPrincipalType(principal) {
     if (EMAIL_PATTERN.test(principal)) {
         // Server normalizes email again; we normalize here so local validation /
@@ -15,8 +15,11 @@ export function detectPrincipalType(principal) {
     }
     // Agent uids ride the same personUid wire slot as people — that is the
     // server contract (group members, DM recipients, and memberships all carry
-    // agt_* in the personUid field; see hq-pro handlers).
-    if (PERSON_UID_PATTERN.test(principal) || AGENT_UID_PATTERN.test(principal)) {
+    // agt_* in the personUid field; see hq-pro handlers). The company Outpost
+    // (out_*) rides it too; the server checks it is the active Outpost.
+    if (PERSON_UID_PATTERN.test(principal) ||
+        AGENT_UID_PATTERN.test(principal) ||
+        OUTPOST_UID_PATTERN.test(principal)) {
         return { granteeType: "person", granteeId: principal };
     }
     return null;
@@ -128,7 +131,7 @@ export function registerGroupsCommand(program) {
     });
     groups
         .command("add <groupId> <principal>")
-        .description("Add a person or agent to a group (principal: email, personUid, or agentUid)")
+        .description("Add a person, agent, or company Outpost to a group (principal: email, personUid, agentUid, or out_ Outpost id)")
         .action(async (groupId, principal) => {
         try {
             if (!GROUP_ID_PATTERN.test(groupId)) {
@@ -178,7 +181,7 @@ export function registerGroupsCommand(program) {
     });
     groups
         .command("remove <groupId> <principal>")
-        .description("Remove a person or agent from a group (principal: email, personUid, or agentUid)")
+        .description("Remove a person, agent, or company Outpost from a group (principal: email, personUid, agentUid, or out_ Outpost id)")
         .action(async (groupId, principal) => {
         try {
             if (!GROUP_ID_PATTERN.test(groupId)) {

package/dist/commands/lanes-questions.js

@@ -2,7 +2,7 @@ import * as path from "node:path";
 import { buildOutpostQuestionAnswerCommand, buildOutpostQuestionCancelCommand, buildOutpostQuestionShowCommand, dispatchErrorMessage } from "../lib/lanes/outpost-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { appendCappedHistory, createQuestion, isLanesError, listSessionLiveness, parseLivenessState, parseQuestionRecord, parseQuestionStatus, readDaemonPresenceConnected, readLane, readQuestion, wakeAnsweredLaneNow, sessionLiveness, appendDropboxMessage, answerDropboxMessage, laneAcceptsDropboxDelivery, laneIdForAnswerDelivery, writeQuestionBody } from "../lib/lanes/index.js";
+import { appendCappedHistory, createQuestion, expandLocalLaneIdPrefix, isLanesError, listSessionLiveness, parseLivenessState, parseQuestionRecord, parseQuestionStatus, readDaemonPresenceConnected, readLane, readQuestion, wakeAnsweredLaneNow, sessionLiveness, appendDropboxMessage, answerDropboxMessage, laneAcceptsDropboxDelivery, laneIdForAnswerDelivery, writeQuestionBody } from "../lib/lanes/index.js";
 import { resolveQuestionCompanyWithFallback } from "../lib/lanes/questions.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { applyLoopStallAnswer, findLoopStallResult } from "../lib/lanes/loop.js";
@@ -565,6 +565,9 @@ export function createLaneQuestionsHandlers(deps) {
         const hqRoot = ctx.hqRoot();
         const status = opts.status ? parseQuestionStatus(opts.status) : undefined;
         const forFilter = opts.for ? parseForFilter(opts.for, ctx) : undefined;
+        // --from matches the full lane id; a short prefix expands only when it
+        // names exactly one local lane (ambiguous prefixes are refused).
+        const from = opts.from ? (expandLocalLaneIdPrefix(hqRoot, opts.from) ?? opts.from) : undefined;
         const company = opts.company
             ? await ctx.resolveCompany(opts.company)
             : await resolveActiveQuestionCompany(ctx, "Cannot access lane questions because the active HQ company could not be resolved; re-run with --company <slug>");
@@ -574,7 +577,7 @@ export function createLaneQuestionsHandlers(deps) {
             .filter((q) => {
             if (status && q.status !== status)
                 return false;
-            if (opts.from && q.lane_id !== opts.from && q.origin.id !== opts.from)
+            if (from && q.lane_id !== from && q.origin.id !== from)
                 return false;
             if (opts.project && q.project_id !== opts.project)
                 return false;
@@ -618,7 +621,7 @@ export function createLaneQuestionsHandlers(deps) {
             ? await loadPrimaryOwnedOutpostQuestions(ctx, hqRoot, company, undefined, {
                 sessionId: currentSessionId ?? undefined,
                 for: opts.for,
-                from: opts.from,
+                from,
                 project: opts.project,
                 story: opts.story,
                 status: opts.status,
@@ -651,7 +654,7 @@ export function createLaneQuestionsHandlers(deps) {
                 .filter(({ question: q, lane, audience }) => {
                 if (status && q.status !== status)
                     return false;
-                if (opts.from && q.lane_id !== opts.from && q.origin.id !== opts.from)
+                if (from && q.lane_id !== from && q.origin.id !== from)
                     return false;
                 if (opts.project && q.project_id !== opts.project)
                     return false;

package/dist/commands/lanes.js

@@ -78,7 +78,7 @@ import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
 import { remoteControlSelectionConfig, remoteControlSessionHome } from "../lib/lanes/remote-control-lane.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, syncLaneToProjectStoryLedger, removeLaneFromProjectStoryLedger, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, isLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, isFailedQuotaKeepAliveLane, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, syncLaneToProjectStoryLedger, removeLaneFromProjectStoryLedger, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, expandLocalLaneIdPrefix, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, isLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, isFailedQuotaKeepAliveLane, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { admitQueuedNow } from "../lib/lanes/reconcile.js";
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
@@ -1979,6 +1979,11 @@ async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
         if (localMatch)
             return { lane: readLane(ctx.hqRoot(), localMatch), remoteOnly: false };
     }
+    // A short prefix expands only to exactly one local lane; more than one is
+    // refused with the candidates listed (lane_id_ambiguous).
+    const prefixMatch = expandLocalLaneIdPrefix(ctx.hqRoot(), laneId);
+    if (prefixMatch)
+        return { lane: readLane(ctx.hqRoot(), prefixMatch), remoteOnly: false };
     const separator = laneId.lastIndexOf("_");
     const hostSuffix = separator < 0 ? "" : laneId.slice(separator + 1);
     const ownerLookupGate = !hostSuffix && requestedUlid !== undefined && options.allowHostlessOwnerLookup
@@ -4561,7 +4566,8 @@ async function runCreate(ctx, opts) {
         printJson({
             ok: true,
             action: "create",
-            admitted,
+            // lane_id stays ahead of `admitted`: callers that take the first lane id
+            // in this output must get the lane they created, not one it admitted.
             lane_id: started.lane_id,
             state: started.state,
             queued_reason: started.queued_reason ?? null,
@@ -4603,6 +4609,7 @@ async function runCreate(ctx, opts) {
                         .outpost_command_id,
                 }
                 : {}),
+            admitted,
             lane: started,
         });
     return started;
@@ -8942,10 +8949,10 @@ async function runCreateSubagent(ctx, opts) {
         }
         assertNoSecretText("focus override reason", opts.focusOverride.trim());
     }
+    // A subagent lane is a board record for work the senior session runs with
+    // its own host's subagent tool (Claude's Agent, Codex's spawn_agent). No
+    // process is spawned, so any provider is only attribution.
     const provider = opts.provider ? parseLaneProvider(opts.provider) : "claude";
-    if (provider !== "claude") {
-        throw new LanesError("subagent_runner_requires_claude", "--runner subagent records a Claude subagent; use --provider claude or omit it", { provider });
-    }
     if (ctx.env.HQ_LANE_ID?.trim()) {
         throw new LanesError("subagent_runner_requires_session", "A subagent lane belongs to the session that runs the subagent; a lane worker cannot register one", { caller_lane_id: ctx.env.HQ_LANE_ID.trim() });
     }
@@ -10277,7 +10284,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--fresh-thread", "Skip worker continuity and start a cold provider session")
         .option("--loop", "Keep one worker lane registered to process queued phase envelopes")
         .option("--provider <name>", "claude | codex | grok")
-        .option("--runner <kind>", "process (default) | subagent: register a lane an in-session Claude subagent runs; skips admission and starts no process")
+        .option("--runner <kind>", "process (default) | subagent: register a lane an in-session subagent runs (Claude Agent, Codex spawn_agent); skips admission and starts no process")
         .option("--remote-control", "Open a Claude lane in Remote Control using account a for login and the selected account for inference")
         .option("--title <text>", "Human-readable Claude Remote Control session title; required with --remote-control")
         .option("--account <id>", "Provider account id, or 'auto' to pick the account with the most room (all accounts are one pool across companies)")

package/dist/commands/members.d.ts

@@ -30,6 +30,23 @@ export interface ActiveMember {
     personName?: string;
     personSlug?: string;
 }
+/**
+ * The company's active Outpost, as listed beside the members by
+ * `GET /membership/company/{companyUid}`. It is read-only: it can be granted
+ * secrets (`hq secrets share --with out_…`, `hq groups add`), but it cannot be
+ * invited, promoted or removed.
+ */
+export interface CompanyOutpostMember {
+    uid: string;
+    kind: "outpost";
+    label: string;
+    outpostId: string;
+    readOnly: true;
+}
+export interface CompanyRoster {
+    members: ActiveMember[];
+    outposts: CompanyOutpostMember[];
+}
 export interface InviteOptions {
     target: string;
     role: string;
@@ -165,7 +182,25 @@ export declare function pendingInviteJson(inv: PendingInvite): {
     invited_at: string;
     membership_key: string;
 };
+/** JSON row for a company Outpost in `hq members list --json`. */
+export declare function companyOutpostJson(o: CompanyOutpostMember): {
+    person_id: string;
+    kind: "outpost";
+    label: string;
+    outpost_id: string;
+    read_only: true;
+};
 export declare function listActiveMembers(token: string, companyUid: string): Promise<ActiveMember[]>;
+/**
+ * Active members plus the company's active Outpost. Servers that predate
+ * Outpost listing omit `outposts`; that reads as none.
+ */
+export declare function listCompanyRoster(token: string, companyUid: string): Promise<CompanyRoster>;
+/**
+ * The company Outpost is listed read-only. hq-pro rejects promote, remove and
+ * revoke for it (OUTPOST_MEMBER_READ_ONLY); say so before any request goes out.
+ */
+export declare const OUTPOST_READ_ONLY_MESSAGE: string;
 /**
  * Resolve a role-change target to an active membership key.
  *

package/dist/commands/members.js

@@ -4,6 +4,7 @@ import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { queueCliFeatureUsed } from "../utils/cli-telemetry.js";
+import { OUTPOST_UID_PATTERN } from "./_patterns.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/i;
@@ -261,7 +262,24 @@ export function pendingInviteJson(inv) {
         membership_key: inv.membershipKey,
     };
 }
+/** JSON row for a company Outpost in `hq members list --json`. */
+export function companyOutpostJson(o) {
+    return {
+        person_id: o.uid,
+        kind: "outpost",
+        label: o.label || "Outpost",
+        outpost_id: o.outpostId,
+        read_only: true,
+    };
+}
 export async function listActiveMembers(token, companyUid) {
+    return (await listCompanyRoster(token, companyUid)).members;
+}
+/**
+ * Active members plus the company's active Outpost. Servers that predate
+ * Outpost listing omit `outposts`; that reads as none.
+ */
+export async function listCompanyRoster(token, companyUid) {
     const res = await vaultApiFetch({
         token,
         path: `/membership/company/${encodeURIComponent(companyUid)}`,
@@ -270,10 +288,26 @@ export async function listActiveMembers(token, companyUid) {
         const err = (await res.json().catch(() => ({})));
         throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
-    // Server schema: `{ members: [...] }` — active members only, enriched with
-    // resolved person metadata (personEmail / personName / personSlug).
+    // Server schema: `{ members: [...], outposts: [...] }` — active members
+    // only, enriched with resolved person metadata (personEmail / personName /
+    // personSlug), plus the read-only company Outpost rows.
     const data = (await res.json());
-    return data?.members ?? [];
+    const outposts = (data?.outposts ?? []).filter((o) => o?.kind === "outpost" &&
+        typeof o.uid === "string" &&
+        OUTPOST_UID_PATTERN.test(o.uid));
+    return { members: data?.members ?? [], outposts };
+}
+/**
+ * The company Outpost is listed read-only. hq-pro rejects promote, remove and
+ * revoke for it (OUTPOST_MEMBER_READ_ONLY); say so before any request goes out.
+ */
+export const OUTPOST_READ_ONLY_MESSAGE = "An Outpost is shown read-only and cannot be invited, promoted or removed. " +
+    "To change what it can read, use `hq secrets share` / `hq secrets unshare` or `hq groups`.";
+function assertNotOutpost(target) {
+    const uid = (target.split("#")[0] ?? "").trim();
+    if (OUTPOST_UID_PATTERN.test(uid)) {
+        throw new Error(OUTPOST_READ_ONLY_MESSAGE);
+    }
 }
 /**
  * Resolve a role-change target to an active membership key.
@@ -283,6 +317,7 @@ export async function listActiveMembers(token, companyUid) {
  * active member list instead of synthesizing an `email:...#company` key.
  */
 export async function resolveRoleChangeTarget(token, companyUid, target) {
+    assertNotOutpost(target);
     if (target.includes("#"))
         return target;
     const detected = detectTarget(target);
@@ -325,6 +360,7 @@ export async function resolveRoleChangeTarget(token, companyUid, target) {
  * that exact email was just shown by `hq members list`.
  */
 export function resolveRevokeTargetToMembershipKey(arg, companyUid) {
+    assertNotOutpost(arg);
     if (arg.includes("#"))
         return arg;
     const detected = detectTarget(arg);
@@ -820,33 +856,48 @@ export function registerMembersCommand(program) {
             }
             // Default: list ACTIVE members so their emails drop straight into
             // `hq secrets share <path> --with <email>`.
-            const activeMembers = await listActiveMembers(token, companyUid);
+            // The company Outpost is listed after the people, read-only; its
+            // out_ id drops into `hq secrets share <path> --with out_…`.
+            const { members: activeMembers, outposts } = await listCompanyRoster(token, companyUid);
             if (opts.json) {
                 console.log(JSON.stringify({
                     company_uid: companyUid,
                     members: activeMembers.map(activeMemberJson),
+                    outposts: outposts.map(companyOutpostJson),
                 }, null, 2));
                 return;
             }
-            if (activeMembers.length === 0) {
+            if (activeMembers.length === 0 && outposts.length === 0) {
                 console.log(chalk.gray("No active members found for this company."));
                 return;
             }
-            const emailW = Math.max(5, ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length));
-            const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
-            const idW = Math.max(9, ...activeMembers.map((m) => m.personUid.length));
+            const rows = [
+                ...activeMembers.map((m) => ({
+                    email: m.personEmail ?? m.personUid,
+                    role: m.role,
+                    id: m.personUid,
+                    name: m.personName ?? m.personSlug ?? "",
+                })),
+                ...outposts.map((o) => ({
+                    email: o.uid,
+                    role: "outpost",
+                    id: o.uid,
+                    name: `${o.label || "Outpost"} (read-only)`,
+                })),
+            ];
+            const emailW = Math.max(5, ...rows.map((r) => r.email.length));
+            const roleW = Math.max(4, ...rows.map((r) => r.role.length));
+            const idW = Math.max(9, ...rows.map((r) => r.id.length));
             const header = ["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW)];
             if (opts.ids)
                 header.push("PERSON_ID".padEnd(idW));
             header.push("NAME");
             console.log(chalk.bold(header.join("  ")));
-            for (const m of activeMembers) {
-                const email = m.personEmail ?? m.personUid;
-                const name = m.personName ?? m.personSlug ?? "";
-                const row = [email.padEnd(emailW), m.role.padEnd(roleW)];
+            for (const r of rows) {
+                const row = [r.email.padEnd(emailW), r.role.padEnd(roleW)];
                 if (opts.ids)
-                    row.push(m.personUid.padEnd(idW));
-                row.push(name);
+                    row.push(r.id.padEnd(idW));
+                row.push(r.name);
                 console.log(row.join("  "));
             }
         }

package/dist/commands/secrets.d.ts

@@ -13,6 +13,11 @@ export { vaultApiFetch, getCompanyUid, getEntityUid };
  */
 export declare const HQ_PRO_RESOURCE_SURFACES: readonly ["api", "bot_invite", "bot_join_now", "calendar_auto_schedule", "calendar_preferences", "cli_secrets_set", "console_secrets_form", "deploy_precheck", "external_connection", "factory_install", "integrations_connect", "oauth_callback", "plan_limit_check", "secrets_input_link", "web"];
 export declare const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
+interface SecretAclPrincipal {
+    granteeType: "email" | "group" | "company-wide" | "person";
+    granteeId: string;
+}
+export declare function parseSecretAclPrincipal(principal: string): SecretAclPrincipal | null;
 export interface SecretInjectionRecipe {
     header: string;
     scheme: "raw" | "bearer";

package/dist/commands/secrets.js

@@ -60,7 +60,7 @@ import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
-import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN, OUTPOST_UID_PATTERN, } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
@@ -277,7 +277,7 @@ function promptSecretInteractively() {
         process.stdin.resume();
     });
 }
-function parseSecretAclPrincipal(principal) {
+export function parseSecretAclPrincipal(principal) {
     const p = principal.trim();
     if (p === "@all") {
         // Company-wide grant: every active member of the company. The server
@@ -290,7 +290,12 @@ function parseSecretAclPrincipal(principal) {
     if (GROUP_ID_PATTERN.test(p)) {
         return { granteeType: "group", granteeId: p };
     }
-    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric, underscore, hyphen>`));
+    if (OUTPOST_UID_PATTERN.test(p)) {
+        // The company Outpost rides the person grantee slot; the server checks
+        // that this id is the company's active Outpost.
+        return { granteeType: "person", granteeId: p };
+    }
+    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a group id matching grp_<alphanumeric, underscore, hyphen>, or a company Outpost id (out_…)`));
     return null;
 }
 function describeSecretAclPrincipal(principal) {
@@ -1312,8 +1317,8 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("share <path>")
-        .description("Share a secret with an email address, group, or the entire company (@all)")
-        .requiredOption("--with <principal>", "Email address, group id, or @all (entire company) to share with")
+        .description("Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)")
+        .requiredOption("--with <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to share with")
         .requiredOption("--permission <level>", "Permission level: read | write | admin")
         .action(async (path, opts) => {
         try {
@@ -1376,7 +1381,7 @@ export function registerSecretsCommand(program) {
     secrets
         .command("unshare <path>")
         .description("Remove a grant from a secret")
-        .requiredOption("--from <principal>", "Email address, group id, or @all (entire company) to remove")
+        .requiredOption("--from <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to remove")
         .action(async (path, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "unshare");