@indigoai-us/hq-cli 5.345.149 → 5.345.151

package/dist/commands/cloud.js

@@ -28,6 +28,7 @@ import { maybeShowCliInviteNudge } from "../lib/cli-invite-nudge.js";
 import { createPlanLimitRefusalTracker, describeRefusedCount, describeRefusedFiles, mergePlanLimitRefusals, renderPlanLimitRefusalLines, trackingProgressRecorder, } from "../lib/billing/plan-limit-refusals.js";
 import { formatPlanGateError, planGateErrorFromVaultError, } from "../utils/plan-gate-error.js";
 import { personalTargetedPushPathsEnabled } from "./personal-targeted-push-flag.js";
+import { CLOUD_OFF_EXIT_CODE, VaultSyncOffError, assertEntityVaultSyncAllowed, refuseSyncForOffVaults, writeVaultRefusal, } from "./cloud-off-gate.js";
 import { resolveExplicitPersonalPushPaths } from "./personal-targeted-push-paths.js";
 /**
  * Terminal-failure signal for the sync fanout runners. The runners
@@ -295,6 +296,12 @@ function narrowNudgeExceedsSize(hqRoot, ref) {
     const threshold = resolveNarrowHintMinBytes({ hqRoot });
     return companyFolderExceedsThreshold(companyDir, threshold);
 }
+/** True when a membership's vault is switched off on this computer (US-016). */
+function isSkippedCompany(skip, slug, companyUid) {
+    if (!skip || skip.size === 0)
+        return false;
+    return skip.has(slug.toLowerCase()) || skip.has(companyUid.toLowerCase());
+}
 export async function pullAll(options, deps) {
     const memberships = await deps.vaultClient.listMyMemberships();
     const persons = await deps.vaultClient.listPersonEntities();
@@ -311,6 +318,8 @@ export async function pullAll(options, deps) {
         catch {
             // Best-effort — keep UID as the row label rather than aborting the run.
         }
+        if (isSkippedCompany(options.skipCompanies, slug, m.companyUid))
+            continue;
         plan.push({
             slug,
             companyUid: m.companyUid,
@@ -464,6 +473,8 @@ export async function pushAll(options, deps) {
         catch {
             // Best-effort — keep UID as the row label.
         }
+        if (isSkippedCompany(options.skipCompanies, slug, m.companyUid))
+            continue;
         plan.push({
             slug,
             companyUid: m.companyUid,
@@ -804,6 +815,13 @@ export function registerCloudCommands(program) {
         "a toggle, and so CLI users can opt out one-off. Ignored outside " +
         "`--all`.")
         .action(async (paths, options) => {
+        const skips = refuseSyncForOffVaults("push", {
+            all: options.all,
+            personal: options.personal,
+            company: options.company,
+            hqRoot: options.hqRoot,
+            credsFromStdin: options.credsFromStdin,
+        }, { json: options.json === true });
         try {
             configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "push");
@@ -833,7 +851,7 @@ export function registerCloudCommands(program) {
             // `--all` the flag has no effect (logged above as part of the
             // option's help text).
             await withSyncHealthReport(async () => {
-                const refused = await runPushAll(options.hqRoot, options.message, options.onConflict, options.personal === false);
+                const refused = await runPushAll(options.hqRoot, options.message, options.onConflict, skips.skipPersonal, skips.skipCompanies);
                 // A plan-limit refusal is not a sync failure, but the push did
                 // not upload everything it was asked to: exit non-zero.
                 if (refused)
@@ -891,6 +909,9 @@ export function registerCloudCommands(program) {
                 catch (e) {
                     throw new Error(`--creds-from-stdin: failed to parse stdin as JSON: ${e instanceof Error ? e.message : String(e)}`);
                 }
+                // Sync switches (US-016): with no --company the target is only
+                // known now. Check it before any login or transfer.
+                assertEntityVaultSyncAllowed("push", entityContext, options.hqRoot);
                 // Upload creds are pre-vended in entityContext, but prefix filtering
                 // still needs vault-service membership/grant resolution.
                 const accessToken = await ensureSyncCognitoToken();
@@ -1085,6 +1106,11 @@ export function registerCloudCommands(program) {
             }
         }
         catch (err) {
+            if (err instanceof VaultSyncOffError) {
+                // Not a sync failure: the target vault is switched off.
+                writeVaultRefusal(err.refusal, { json: jsonMode });
+                process.exit(CLOUD_OFF_EXIT_CODE);
+            }
             if (syncHealth)
                 await syncHealth.failed();
             const message = formatSyncFailure(err);
@@ -1128,6 +1154,12 @@ export function registerCloudCommands(program) {
         "disk and only un-tracked from sync; clean out-of-scope files are " +
         "quarantined under .hq/scope-quarantine/ (recoverable).")
         .action(async (options) => {
+        const skips = refuseSyncForOffVaults("pull", {
+            all: options.all,
+            personal: options.personal,
+            company: options.company,
+            hqRoot: options.hqRoot,
+        });
         try {
             configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "pull");
@@ -1140,7 +1172,7 @@ export function registerCloudCommands(program) {
             // `options.personal === false` is Commander's auto-negation of
             // `--personal`; in `--all` mode that means "drop the personal
             // leg from the fanout" (see `--no-personal` option above).
-            await withSyncHealthReport(() => runPullAll(options.hqRoot, options.onConflict, options.modeAll === true, options.personal === false, options.forceScopeShrink === true));
+            await withSyncHealthReport(() => runPullAll(options.hqRoot, options.onConflict, options.modeAll === true, skips.skipPersonal, options.forceScopeShrink === true, skips.skipCompanies));
             return;
         }
         if (options.personal) {
@@ -1352,6 +1384,12 @@ export function registerCloudCommands(program) {
         "anyway. Dirty files are KEPT on disk (only un-tracked); clean " +
         "out-of-scope files are quarantined under .hq/scope-quarantine/.")
         .action(async (options) => {
+        const skips = refuseSyncForOffVaults("now", {
+            all: options.all,
+            personal: options.personal,
+            company: options.company,
+            hqRoot: options.hqRoot,
+        });
         try {
             configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "now");
@@ -1360,7 +1398,7 @@ export function registerCloudCommands(program) {
                 // of `--personal`; in `--all` mode that means "drop the
                 // personal leg from both legs of the bidirectional fanout"
                 // (see `--no-personal` option above).
-                await withSyncHealthReport(() => runNowAll(options.hqRoot, options.message, options.onConflict, options.modeAll === true, options.personal === false, options.forceScopeShrink === true));
+                await withSyncHealthReport(() => runNowAll(options.hqRoot, options.message, options.onConflict, options.modeAll === true, skips.skipPersonal, options.forceScopeShrink === true, skips.skipCompanies));
                 return;
             }
             await withSyncHealthReport(() => runNowSingle(options.hqRoot, options.company, options.personal === true, options.message, options.onConflict, options.modeAll === true, options.forceScopeShrink === true));
@@ -1446,13 +1484,19 @@ export async function runSyncDoctorReconcileConflicts(hqRoot, yes) {
         console.log(chalk.dim("  Re-run with --yes to apply the plan above."));
     }
 }
-async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink) {
+/** Banner lines for the vaults an `--all` run leaves out. */
+function logVaultSkips(skipPersonal, skipCompanies) {
+    if (skipPersonal)
+        console.log(`  Personal: skipped (sync is off for it, or --no-personal)`);
+    if (skipCompanies && skipCompanies.size > 0) {
+        console.log(`  Skipped:  ${[...skipCompanies].sort().join(", ")} (sync is off on this computer)`);
+    }
+}
+async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink, skipCompanies) {
     console.log(chalk.bold("\nHQ Sync — Pull (all)"));
     console.log(`  HQ root:  ${hqRoot}`);
     console.log(`  Strategy: ${onConflict ?? "(interactive)"}`);
-    if (skipPersonal) {
-        console.log(`  Personal: skipped (--no-personal)`);
-    }
+    logVaultSkips(skipPersonal, skipCompanies);
     console.log("");
     let result;
     try {
@@ -1480,6 +1524,7 @@ async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, for
             ...(modeAllOverride ? { modeAllOverride: true } : {}),
             ...(skipPersonal ? { skipPersonal: true } : {}),
             ...(forceScopeShrink ? { forceScopeShrink: true } : {}),
+            ...(skipCompanies && skipCompanies.size > 0 ? { skipCompanies } : {}),
         }, {
             vaultClient: adapter,
             // DEV-1768: resolve each company's REAL pull scope (mode + prefixSet)
@@ -1587,13 +1632,11 @@ export async function runPullPersonal(hqRoot, onConflict) {
  * limit refused across every target (null when none were), so the caller can
  * refuse to report success; hard failures still throw {@link SyncExitError}.
  */
-async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
+async function runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompanies) {
     console.log(chalk.bold("\nHQ Sync — Push (all)"));
     console.log(`  HQ root:  ${hqRoot}`);
     console.log(`  Strategy: ${onConflict ?? "(interactive)"}`);
-    if (skipPersonal) {
-        console.log(`  Personal: skipped (--no-personal)`);
-    }
+    logVaultSkips(skipPersonal, skipCompanies);
     console.log("");
     let result;
     try {
@@ -1618,6 +1661,7 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
             ...(onConflict ? { onConflict } : {}),
             ...(message ? { message } : {}),
             ...(skipPersonal ? { skipPersonal: true } : {}),
+            ...(skipCompanies && skipCompanies.size > 0 ? { skipCompanies } : {}),
         }, {
             vaultClient: adapter,
             resolveScope: (companyUid, slug) => resolvePullScope(realClient, companyUid, slug, hqRoot),
@@ -1998,24 +2042,22 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         throw new SyncExitError(1);
     }
 }
-async function runNowAll(hqRoot, message, onConflict, modeAllOverride, skipPersonal, forceScopeShrink) {
+async function runNowAll(hqRoot, message, onConflict, modeAllOverride, skipPersonal, forceScopeShrink, skipCompanies) {
     console.log(chalk.bold("\nHQ Sync — Now (all)"));
     console.log(`  HQ root:  ${hqRoot}`);
     console.log(`  Strategy: ${onConflict ?? "(interactive)"}`);
-    if (skipPersonal) {
-        console.log(`  Personal: skipped (--no-personal)`);
-    }
+    logVaultSkips(skipPersonal, skipCompanies);
     console.log("");
     // Push first (matches runner), then pull. Re-uses the per-leg orchestrators
     // so the per-target rendering, error isolation, and exit codes are
     // identical to running `push --all` then `pull --all` back-to-back.
     console.log(chalk.dim("→ push --all"));
-    const refused = await runPushAll(hqRoot, message, onConflict, skipPersonal);
+    const refused = await runPushAll(hqRoot, message, onConflict, skipPersonal, skipCompanies);
     console.log(chalk.dim("\n→ pull --all"));
     // US-011: forward --mode-all so the strict refusal applies to the
     // pull leg (push doesn't need a narrow-hint — the narrow ritual is
     // pull-side).
-    await runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink);
+    await runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, forceScopeShrink, skipCompanies);
     if (refused) {
         // A refused push does not stop the pull, but the run must not end looking
         // like a clean sync. Its per-target details were printed above.

package/dist/commands/core-handoff.js

@@ -13,6 +13,7 @@ import { defaultBackgroundDependencies, runBackgroundLauncher, } from "../lib/se
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
+import { CLOUD_OFF_EXIT_CODE } from "./cloud-off-gate.js";
 import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { fingerprintTrailerArgs, offlineFingerprint } from "../lib/fingerprint/offline.js";
 import { compactJson, isRecord, jqTruthy, prettyJson, runHandoffOpenSteps, shellDate, } from "./core-handoff-open-steps.js";
@@ -1057,7 +1058,11 @@ export function runHandoffPostWorker(args, context) {
                 stdout: typeof pushed.stdout === "string" ? pushed.stdout : "",
                 stderr: typeof pushed.stderr === "string" ? pushed.stderr : "",
             });
-            log(pushed.status === 0 ? `workspace-sync: pushed companies/${company}/workspace` : `workspace-sync: failed companies/${company}/workspace`);
+            log(pushed.status === 0
+                ? `workspace-sync: pushed companies/${company}/workspace`
+                : pushed.status === CLOUD_OFF_EXIT_CODE
+                    ? `workspace-sync: skipped (sync is off) companies/${company}/workspace`
+                    : `workspace-sync: failed companies/${company}/workspace`);
         }
     }
     else if (threadFile && fs.existsSync(threadFile))

package/dist/commands/groups.js

@@ -1,12 +1,12 @@
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
-import { GROUP_ID_PATTERN } from "./_patterns.js";
+import { GROUP_ID_PATTERN, OUTPOST_UID_PATTERN } from "./_patterns.js";
 import { maxLength } from "../utils/table-width.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/;
-const INVALID_PRINCIPAL_HINT = "must be an email address, a personUid (prs_…), or an agentUid (agt_…)";
+const INVALID_PRINCIPAL_HINT = "must be an email address, a personUid (prs_…), an agentUid (agt_…), or a company Outpost id (out_…)";
 export function detectPrincipalType(principal) {
     if (EMAIL_PATTERN.test(principal)) {
         // Server normalizes email again; we normalize here so local validation /
@@ -15,8 +15,11 @@ export function detectPrincipalType(principal) {
     }
     // Agent uids ride the same personUid wire slot as people — that is the
     // server contract (group members, DM recipients, and memberships all carry
-    // agt_* in the personUid field; see hq-pro handlers).
-    if (PERSON_UID_PATTERN.test(principal) || AGENT_UID_PATTERN.test(principal)) {
+    // agt_* in the personUid field; see hq-pro handlers). The company Outpost
+    // (out_*) rides it too; the server checks it is the active Outpost.
+    if (PERSON_UID_PATTERN.test(principal) ||
+        AGENT_UID_PATTERN.test(principal) ||
+        OUTPOST_UID_PATTERN.test(principal)) {
         return { granteeType: "person", granteeId: principal };
     }
     return null;
@@ -128,7 +131,7 @@ export function registerGroupsCommand(program) {
     });
     groups
         .command("add <groupId> <principal>")
-        .description("Add a person or agent to a group (principal: email, personUid, or agentUid)")
+        .description("Add a person, agent, or company Outpost to a group (principal: email, personUid, agentUid, or out_ Outpost id)")
         .action(async (groupId, principal) => {
         try {
             if (!GROUP_ID_PATTERN.test(groupId)) {
@@ -178,7 +181,7 @@ export function registerGroupsCommand(program) {
     });
     groups
         .command("remove <groupId> <principal>")
-        .description("Remove a person or agent from a group (principal: email, personUid, or agentUid)")
+        .description("Remove a person, agent, or company Outpost from a group (principal: email, personUid, agentUid, or out_ Outpost id)")
         .action(async (groupId, principal) => {
         try {
             if (!GROUP_ID_PATTERN.test(groupId)) {

package/dist/commands/lanes-questions.js

@@ -2,7 +2,7 @@ import * as path from "node:path";
 import { buildOutpostQuestionAnswerCommand, buildOutpostQuestionCancelCommand, buildOutpostQuestionShowCommand, dispatchErrorMessage } from "../lib/lanes/outpost-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { appendCappedHistory, createQuestion, isLanesError, listSessionLiveness, parseLivenessState, parseQuestionRecord, parseQuestionStatus, readDaemonPresenceConnected, readLane, readQuestion, wakeAnsweredLaneNow, sessionLiveness, appendDropboxMessage, answerDropboxMessage, laneAcceptsDropboxDelivery, laneIdForAnswerDelivery, writeQuestionBody } from "../lib/lanes/index.js";
+import { appendCappedHistory, createQuestion, expandLocalLaneIdPrefix, isLanesError, listSessionLiveness, parseLivenessState, parseQuestionRecord, parseQuestionStatus, readDaemonPresenceConnected, readLane, readQuestion, wakeAnsweredLaneNow, sessionLiveness, appendDropboxMessage, answerDropboxMessage, laneAcceptsDropboxDelivery, laneIdForAnswerDelivery, writeQuestionBody } from "../lib/lanes/index.js";
 import { resolveQuestionCompanyWithFallback } from "../lib/lanes/questions.js";
 import { LanesError } from "../lib/lanes/errors.js";
 import { applyLoopStallAnswer, findLoopStallResult } from "../lib/lanes/loop.js";
@@ -565,6 +565,9 @@ export function createLaneQuestionsHandlers(deps) {
         const hqRoot = ctx.hqRoot();
         const status = opts.status ? parseQuestionStatus(opts.status) : undefined;
         const forFilter = opts.for ? parseForFilter(opts.for, ctx) : undefined;
+        // --from matches the full lane id; a short prefix expands only when it
+        // names exactly one local lane (ambiguous prefixes are refused).
+        const from = opts.from ? (expandLocalLaneIdPrefix(hqRoot, opts.from) ?? opts.from) : undefined;
         const company = opts.company
             ? await ctx.resolveCompany(opts.company)
             : await resolveActiveQuestionCompany(ctx, "Cannot access lane questions because the active HQ company could not be resolved; re-run with --company <slug>");
@@ -574,7 +577,7 @@ export function createLaneQuestionsHandlers(deps) {
             .filter((q) => {
             if (status && q.status !== status)
                 return false;
-            if (opts.from && q.lane_id !== opts.from && q.origin.id !== opts.from)
+            if (from && q.lane_id !== from && q.origin.id !== from)
                 return false;
             if (opts.project && q.project_id !== opts.project)
                 return false;
@@ -618,7 +621,7 @@ export function createLaneQuestionsHandlers(deps) {
             ? await loadPrimaryOwnedOutpostQuestions(ctx, hqRoot, company, undefined, {
                 sessionId: currentSessionId ?? undefined,
                 for: opts.for,
-                from: opts.from,
+                from,
                 project: opts.project,
                 story: opts.story,
                 status: opts.status,
@@ -651,7 +654,7 @@ export function createLaneQuestionsHandlers(deps) {
                 .filter(({ question: q, lane, audience }) => {
                 if (status && q.status !== status)
                     return false;
-                if (opts.from && q.lane_id !== opts.from && q.origin.id !== opts.from)
+                if (from && q.lane_id !== from && q.origin.id !== from)
                     return false;
                 if (opts.project && q.project_id !== opts.project)
                     return false;

package/dist/commands/lanes.js

@@ -78,7 +78,7 @@ import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { listLaneReviews } from "../lib/lanes/reviews.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
 import { remoteControlSelectionConfig, remoteControlSessionHome } from "../lib/lanes/remote-control-lane.js";
-import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, syncLaneToProjectStoryLedger, removeLaneFromProjectStoryLedger, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, isLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, isFailedQuotaKeepAliveLane, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, isFinishedResumableHireChild, childrenHoldingHireGrantCarve, laneHoldsHireGrantCarve, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, syncLaneToProjectStoryLedger, removeLaneFromProjectStoryLedger, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, expandLocalLaneIdPrefix, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, isLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readAllLanes, readLane, sanitizeHostComponent, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, DEAD_HOST_MS, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, isFailedQuotaKeepAliveLane, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, readWorkerRunResult, resumeCommandRefusal, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { admitQueuedNow } from "../lib/lanes/reconcile.js";
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
@@ -1979,6 +1979,11 @@ async function resolveCommandLaneTarget(ctx, laneId, options = {}) {
         if (localMatch)
             return { lane: readLane(ctx.hqRoot(), localMatch), remoteOnly: false };
     }
+    // A short prefix expands only to exactly one local lane; more than one is
+    // refused with the candidates listed (lane_id_ambiguous).
+    const prefixMatch = expandLocalLaneIdPrefix(ctx.hqRoot(), laneId);
+    if (prefixMatch)
+        return { lane: readLane(ctx.hqRoot(), prefixMatch), remoteOnly: false };
     const separator = laneId.lastIndexOf("_");
     const hostSuffix = separator < 0 ? "" : laneId.slice(separator + 1);
     const ownerLookupGate = !hostSuffix && requestedUlid !== undefined && options.allowHostlessOwnerLookup
@@ -4561,7 +4566,8 @@ async function runCreate(ctx, opts) {
         printJson({
             ok: true,
             action: "create",
-            admitted,
+            // lane_id stays ahead of `admitted`: callers that take the first lane id
+            // in this output must get the lane they created, not one it admitted.
             lane_id: started.lane_id,
             state: started.state,
             queued_reason: started.queued_reason ?? null,
@@ -4603,6 +4609,7 @@ async function runCreate(ctx, opts) {
                         .outpost_command_id,
                 }
                 : {}),
+            admitted,
             lane: started,
         });
     return started;
@@ -8942,10 +8949,10 @@ async function runCreateSubagent(ctx, opts) {
         }
         assertNoSecretText("focus override reason", opts.focusOverride.trim());
     }
+    // A subagent lane is a board record for work the senior session runs with
+    // its own host's subagent tool (Claude's Agent, Codex's spawn_agent). No
+    // process is spawned, so any provider is only attribution.
     const provider = opts.provider ? parseLaneProvider(opts.provider) : "claude";
-    if (provider !== "claude") {
-        throw new LanesError("subagent_runner_requires_claude", "--runner subagent records a Claude subagent; use --provider claude or omit it", { provider });
-    }
     if (ctx.env.HQ_LANE_ID?.trim()) {
         throw new LanesError("subagent_runner_requires_session", "A subagent lane belongs to the session that runs the subagent; a lane worker cannot register one", { caller_lane_id: ctx.env.HQ_LANE_ID.trim() });
     }
@@ -10277,7 +10284,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--fresh-thread", "Skip worker continuity and start a cold provider session")
         .option("--loop", "Keep one worker lane registered to process queued phase envelopes")
         .option("--provider <name>", "claude | codex | grok")
-        .option("--runner <kind>", "process (default) | subagent: register a lane an in-session Claude subagent runs; skips admission and starts no process")
+        .option("--runner <kind>", "process (default) | subagent: register a lane an in-session subagent runs (Claude Agent, Codex spawn_agent); skips admission and starts no process")
         .option("--remote-control", "Open a Claude lane in Remote Control using account a for login and the selected account for inference")
         .option("--title <text>", "Human-readable Claude Remote Control session title; required with --remote-control")
         .option("--account <id>", "Provider account id, or 'auto' to pick the account with the most room (all accounts are one pool across companies)")

package/dist/commands/meetings.js

@@ -658,9 +658,13 @@ export function registerMeetingsCommand(program) {
         try {
             const token = await ensureCognitoToken();
             const companySlug = meetings.opts().company;
-            const query = {};
-            if (companySlug)
-                query.companyId = await getCompanyUid(token, companySlug);
+            // Always name a company. With no companyId the backend files the bot
+            // under Personal, which can never record, so an entitled user would
+            // get the HQ Workforce upgrade prompt. Without --company this uses the
+            // caller's only active company, or asks them to pick one.
+            const query = {
+                companyId: await getCompanyUid(token, companySlug),
+            };
             const res = await vaultApiFetch({
                 token,
                 method: "POST",

package/dist/commands/members.d.ts

@@ -30,6 +30,23 @@ export interface ActiveMember {
     personName?: string;
     personSlug?: string;
 }
+/**
+ * The company's active Outpost, as listed beside the members by
+ * `GET /membership/company/{companyUid}`. It is read-only: it can be granted
+ * secrets (`hq secrets share --with out_…`, `hq groups add`), but it cannot be
+ * invited, promoted or removed.
+ */
+export interface CompanyOutpostMember {
+    uid: string;
+    kind: "outpost";
+    label: string;
+    outpostId: string;
+    readOnly: true;
+}
+export interface CompanyRoster {
+    members: ActiveMember[];
+    outposts: CompanyOutpostMember[];
+}
 export interface InviteOptions {
     target: string;
     role: string;
@@ -165,7 +182,25 @@ export declare function pendingInviteJson(inv: PendingInvite): {
     invited_at: string;
     membership_key: string;
 };
+/** JSON row for a company Outpost in `hq members list --json`. */
+export declare function companyOutpostJson(o: CompanyOutpostMember): {
+    person_id: string;
+    kind: "outpost";
+    label: string;
+    outpost_id: string;
+    read_only: true;
+};
 export declare function listActiveMembers(token: string, companyUid: string): Promise<ActiveMember[]>;
+/**
+ * Active members plus the company's active Outpost. Servers that predate
+ * Outpost listing omit `outposts`; that reads as none.
+ */
+export declare function listCompanyRoster(token: string, companyUid: string): Promise<CompanyRoster>;
+/**
+ * The company Outpost is listed read-only. hq-pro rejects promote, remove and
+ * revoke for it (OUTPOST_MEMBER_READ_ONLY); say so before any request goes out.
+ */
+export declare const OUTPOST_READ_ONLY_MESSAGE: string;
 /**
  * Resolve a role-change target to an active membership key.
  *

package/dist/commands/members.js

@@ -4,6 +4,7 @@ import { gateApiKeyCapabilities } from "../utils/api-key-command-gate.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
 import { queueCliFeatureUsed } from "../utils/cli-telemetry.js";
+import { OUTPOST_UID_PATTERN } from "./_patterns.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/i;
@@ -261,7 +262,24 @@ export function pendingInviteJson(inv) {
         membership_key: inv.membershipKey,
     };
 }
+/** JSON row for a company Outpost in `hq members list --json`. */
+export function companyOutpostJson(o) {
+    return {
+        person_id: o.uid,
+        kind: "outpost",
+        label: o.label || "Outpost",
+        outpost_id: o.outpostId,
+        read_only: true,
+    };
+}
 export async function listActiveMembers(token, companyUid) {
+    return (await listCompanyRoster(token, companyUid)).members;
+}
+/**
+ * Active members plus the company's active Outpost. Servers that predate
+ * Outpost listing omit `outposts`; that reads as none.
+ */
+export async function listCompanyRoster(token, companyUid) {
     const res = await vaultApiFetch({
         token,
         path: `/membership/company/${encodeURIComponent(companyUid)}`,
@@ -270,10 +288,26 @@ export async function listActiveMembers(token, companyUid) {
         const err = (await res.json().catch(() => ({})));
         throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
-    // Server schema: `{ members: [...] }` — active members only, enriched with
-    // resolved person metadata (personEmail / personName / personSlug).
+    // Server schema: `{ members: [...], outposts: [...] }` — active members
+    // only, enriched with resolved person metadata (personEmail / personName /
+    // personSlug), plus the read-only company Outpost rows.
     const data = (await res.json());
-    return data?.members ?? [];
+    const outposts = (data?.outposts ?? []).filter((o) => o?.kind === "outpost" &&
+        typeof o.uid === "string" &&
+        OUTPOST_UID_PATTERN.test(o.uid));
+    return { members: data?.members ?? [], outposts };
+}
+/**
+ * The company Outpost is listed read-only. hq-pro rejects promote, remove and
+ * revoke for it (OUTPOST_MEMBER_READ_ONLY); say so before any request goes out.
+ */
+export const OUTPOST_READ_ONLY_MESSAGE = "An Outpost is shown read-only and cannot be invited, promoted or removed. " +
+    "To change what it can read, use `hq secrets share` / `hq secrets unshare` or `hq groups`.";
+function assertNotOutpost(target) {
+    const uid = (target.split("#")[0] ?? "").trim();
+    if (OUTPOST_UID_PATTERN.test(uid)) {
+        throw new Error(OUTPOST_READ_ONLY_MESSAGE);
+    }
 }
 /**
  * Resolve a role-change target to an active membership key.
@@ -283,6 +317,7 @@ export async function listActiveMembers(token, companyUid) {
  * active member list instead of synthesizing an `email:...#company` key.
  */
 export async function resolveRoleChangeTarget(token, companyUid, target) {
+    assertNotOutpost(target);
     if (target.includes("#"))
         return target;
     const detected = detectTarget(target);
@@ -325,6 +360,7 @@ export async function resolveRoleChangeTarget(token, companyUid, target) {
  * that exact email was just shown by `hq members list`.
  */
 export function resolveRevokeTargetToMembershipKey(arg, companyUid) {
+    assertNotOutpost(arg);
     if (arg.includes("#"))
         return arg;
     const detected = detectTarget(arg);
@@ -820,33 +856,48 @@ export function registerMembersCommand(program) {
             }
             // Default: list ACTIVE members so their emails drop straight into
             // `hq secrets share <path> --with <email>`.
-            const activeMembers = await listActiveMembers(token, companyUid);
+            // The company Outpost is listed after the people, read-only; its
+            // out_ id drops into `hq secrets share <path> --with out_…`.
+            const { members: activeMembers, outposts } = await listCompanyRoster(token, companyUid);
             if (opts.json) {
                 console.log(JSON.stringify({
                     company_uid: companyUid,
                     members: activeMembers.map(activeMemberJson),
+                    outposts: outposts.map(companyOutpostJson),
                 }, null, 2));
                 return;
             }
-            if (activeMembers.length === 0) {
+            if (activeMembers.length === 0 && outposts.length === 0) {
                 console.log(chalk.gray("No active members found for this company."));
                 return;
             }
-            const emailW = Math.max(5, ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length));
-            const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
-            const idW = Math.max(9, ...activeMembers.map((m) => m.personUid.length));
+            const rows = [
+                ...activeMembers.map((m) => ({
+                    email: m.personEmail ?? m.personUid,
+                    role: m.role,
+                    id: m.personUid,
+                    name: m.personName ?? m.personSlug ?? "",
+                })),
+                ...outposts.map((o) => ({
+                    email: o.uid,
+                    role: "outpost",
+                    id: o.uid,
+                    name: `${o.label || "Outpost"} (read-only)`,
+                })),
+            ];
+            const emailW = Math.max(5, ...rows.map((r) => r.email.length));
+            const roleW = Math.max(4, ...rows.map((r) => r.role.length));
+            const idW = Math.max(9, ...rows.map((r) => r.id.length));
             const header = ["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW)];
             if (opts.ids)
                 header.push("PERSON_ID".padEnd(idW));
             header.push("NAME");
             console.log(chalk.bold(header.join("  ")));
-            for (const m of activeMembers) {
-                const email = m.personEmail ?? m.personUid;
-                const name = m.personName ?? m.personSlug ?? "";
-                const row = [email.padEnd(emailW), m.role.padEnd(roleW)];
+            for (const r of rows) {
+                const row = [r.email.padEnd(emailW), r.role.padEnd(roleW)];
                 if (opts.ids)
-                    row.push(m.personUid.padEnd(idW));
-                row.push(name);
+                    row.push(r.id.padEnd(idW));
+                row.push(r.name);
                 console.log(row.join("  "));
             }
         }

package/dist/commands/secrets.d.ts

@@ -13,6 +13,11 @@ export { vaultApiFetch, getCompanyUid, getEntityUid };
  */
 export declare const HQ_PRO_RESOURCE_SURFACES: readonly ["api", "bot_invite", "bot_join_now", "calendar_auto_schedule", "calendar_preferences", "cli_secrets_set", "console_secrets_form", "deploy_precheck", "external_connection", "factory_install", "integrations_connect", "oauth_callback", "plan_limit_check", "secrets_input_link", "web"];
 export declare const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
+interface SecretAclPrincipal {
+    granteeType: "email" | "group" | "company-wide" | "person";
+    granteeId: string;
+}
+export declare function parseSecretAclPrincipal(principal: string): SecretAclPrincipal | null;
 export interface SecretInjectionRecipe {
     header: string;
     scheme: "raw" | "bearer";