@indigoai-us/hq-cli 5.345.150 → 5.345.152

package/CHANGELOG.md

@@ -2,6 +2,53 @@
 
 ## [Unreleased]
 
+## [5.345.152] — 2026-10-20
+- The bundled sync engine now uses hq-cloud 6.18.91. When a company Outpost
+  fails to start and the server has already cleaned it up,
+  `hq outposts provision --company <slug>` (and `create --company --name`)
+  stops right away and says nothing was left running, you were not charged,
+  and it is safe to run the same command again. `hq outposts status --company`
+  shows the same line, and `--json` adds `code: "failed_cleaned_up"` and
+  `retrySafe: true`. Other blocked reasons keep their existing text.
+- CI: the "changelog entry" check sets up Node before it runs, so it no longer
+  fails with "node: command not found" on the self-hosted ARM runners. No change
+  to the `hq` command itself.
+- `hq files share --with out_…` and `hq files unshare --with out_…` now accept
+  a company Outpost id, with read or write. `hq files acl` shows the grantee as
+  `Outpost (out_…)`; `--json` output is unchanged.
+- `hq secrets share --with out_…` now refuses write or admin for a company
+  Outpost with "Company Outposts can only be given read access to a secret."
+  before anything is sent. Leaving out `--permission` for an Outpost gives it
+  read. A server refusal for the same reason shows the same message.
+- `hq rescue` (and so `/update-hq`) now re-trusts HQ's own Codex hooks after a
+  successful rescue. Before this, an update that changed a hook command left
+  Codex holding the old trusted hash, so Codex skipped that hook until you ran
+  `hq reindex`. Rescue trusts a hook only when its entry in the HQ root's
+  `.codex/hooks.json` or `.codex/config.toml` matches the copy shipped in the
+  installed core release, which it reads from GitHub at the synced commit.
+  It reads that copy only from `indigoai-us/hq-core` or
+  `indigoai-us/hq-core-staging`; if `core/core.yaml` names any other repo
+  (for example after `hq rescue --source <fork>`), rescue trusts nothing.
+  Hooks you added to those files by hand, or shipped entries you edited, are
+  never trusted. User and managed hooks are left alone, and hooks that are
+  already trusted are not rewritten. Rescue does not re-enable a shipped hook
+  you disabled; it only refreshes that hook's trust (`hq reindex` still
+  re-enables shipped hooks). Nothing happens when Codex is not installed, and
+  `--check` never touches hook trust. Rescue prints a warning that points at
+  `hq reindex` and keeps its exit status when the shipped files cannot be
+  read, when the release does not ship a file an HQ hook comes from, when a
+  shipped file does not parse, when the repo is not an HQ core repo, or when
+  the trust step fails.
+- `hq secrets exec` run without a session id (no `HQ_SESSION_ID`, `CLAUDE_CODE_SESSION_ID`, `CLAUDE_SESSION_ID`, `CODEX_SESSION_ID`, `CODEX_THREAD_ID` or `GROK_SESSION_ID`), such as a launchd or cron job, no longer borrows the company lock of whichever interactive session last wrote the sessions `.current` pointer. Before this, a job could load the same-named secret from that session's company. Such a job must now pass `--company <slug>` or `--personal`. Otherwise it prints how to fix the call and exits 78 without reading the vault. An `HQ_API_KEY` (`hqk_`) caller is unaffected because its key is bound to one company. A caller with its own session id keeps the existing lock rules: `--company` can only pick a company inside that session's lock.
+- Defines the Windows acceptance bar for the native hook engine and checks it before a release. Hook checks whose stories are not merged yet are reported as pending and do not block other releases. A failed check still blocks the release.
+- A pass requires runner evidence for that commit. Counts written into corpus files, a source-text match, or a signed-off latency number with no report stay pending and do not block a release.
+
+## [5.345.151] — 2026-10-20
+- `hq lanes link _deliver` no longer hands a conductor message to a subagent. Subagent hook events share the root session id, so a subagent tool call used to claim the message and the root session never saw it. Child payloads, including Grok child sessions (`subagent_type`) and Codex child threads, now get nothing and the message stays queued until the root session's next tool call or stop. SubagentStop no longer delivers. A parent session id alone does not mark a child, so resumed, forked, or launcher-spawned Grok roots still receive their messages.
+- If you leave out `--company`, `hq meetings invite <url>` now uses your only active company. If you belong to several companies, it lists them and asks you to pick one. The command used to send the invite as Personal instead. Personal can never record, so you saw the HQ Workforce upgrade prompt even when your company already had meeting recording.
+- `hq sync push`, `pull` and `now` honour the HQ app's Settings > Sync switches on this computer. A command aimed at a vault whose sync is off (the personal vault, one company vault, or every vault with "Turn off all cloud sync") prints `Sync is off for <vault>` with how to turn it back on, and exits 3 without signing in or touching the vault. The target is the `--company` value, else `activeCompany` or `companySlug` in `.hq/config.json`; a `cmp_*` uid is matched through `companies/manifest.yaml`, and an unmatched uid is refused while any company vault is off. `--creds-from-stdin` is checked once stdin is read. With `--json`, the refusal is a `{"type":"skipped","reason":"sync_off"}` line on stderr. `--all` skips the off vaults and syncs the rest. The `hq daemon` background sync skips off vaults the same way and stays stopped while all cloud sync is off; a switch change restarts it once the current sync pass finishes. A settings file that cannot be read prints a warning (and logs one in the daemon) instead of silently syncing everything. `/handoff` still finishes locally and logs a skipped push as skipped.
+- If you already had the HQ app's personal-files switch off (`personalSyncEnabled: false`) or a company's sync off (`workspaceSyncEnabled.<slug>: false`), `hq sync` now refuses those vaults too. That includes the `/handoff` personal publish, the `/startwork` and `/resumework` prefetch, and `/delegate` for those vaults. Turn the vault back on in HQ Settings > Sync to sync it from the command line again.
+
 ## [5.345.150] — 2026-10-19
 - The bundled sync engine now uses hq-cloud 6.18.90, which brings two fixes.
 - Owners and admins can now destroy one of a company's Outposts with

package/dist/command-catalog.generated.d.ts

@@ -2058,7 +2058,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--permission <level>";
-            readonly description: "Permission level: read | write | admin";
+            readonly description: "Permission level: read | write | admin (required, except for a company Outpost, which can only be given read and defaults to it)";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
@@ -2813,7 +2813,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Email address, group id, or '@all' to share with every active company member";
+            readonly description: "Email address, group id, company Outpost id (out_...), or '@all' to share with every active company member";
             readonly hidden: false;
         }, {
             readonly flags: "--permission <level>";
@@ -2859,7 +2859,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Person uid, agent uid, email address, group id, or '@all' to remove the grant";
+            readonly description: "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];

package/dist/command-catalog.generated.js

@@ -2469,7 +2469,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--permission <level>",
-                        "description": "Permission level: read | write | admin",
+                        "description": "Permission level: read | write | admin (required, except for a company Outpost, which can only be given read and defaults to it)",
                         "hidden": false
                     }
                 ],
@@ -3380,7 +3380,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Email address, group id, or '@all' to share with every active company member",
+                        "description": "Email address, group id, company Outpost id (out_...), or '@all' to share with every active company member",
                         "hidden": false
                     },
                     {
@@ -3437,7 +3437,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Person uid, agent uid, email address, group id, or '@all' to remove the grant",
+                        "description": "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant",
                         "hidden": false
                     }
                 ],

package/dist/commands/cloud-off-gate.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Sync switch gate for the manual `hq sync push|pull|now` commands
+ * (usage-only-pricing US-016).
+ *
+ * The desktop app's Settings > Sync section has one switch per vault plus one
+ * "Turn off all cloud sync" switch (see `../lib/vault-sync-switches.ts`). The
+ * switches affect only this computer. The app gates its own sync paths, but
+ * skills and scripts call these CLI commands directly (`/handoff`, the
+ * `/startwork` and `/resumework` prefetch, `/delegate`, job remediation). This
+ * gate makes those calls honour the same switches: a command aimed at an off
+ * vault refuses, and an `--all` run skips the off vaults while the rest sync.
+ *
+ * How the target vault is found, before any login or network call:
+ * - `--personal`, or a `prs_*` uid, is the personal vault;
+ * - `--company <ref>`, else the active company in `<hq-root>/.hq/config.json`
+ *   (`activeCompany ?? companySlug`, the same order hq-cloud's resolver uses);
+ * - a `cmp_*` uid is mapped to its slug through `companies/manifest.yaml`
+ *   (`cloud_uid`). A uid that cannot be mapped while any company vault is off
+ *   is refused (fail closed): the gate cannot prove it is not an off vault.
+ * - `--creds-from-stdin`: the target is the parsed EntityContext, checked
+ *   after stdin is read (`refusalForEntity`) and still before any transfer.
+ *
+ * The daemon's own `syncPaused` is not read here: it pauses background sync
+ * only (`hq daemon sync pause`, the tray pause), and a manual push while
+ * background sync is paused is expected to run.
+ */
+import { readVaultSyncSwitches, vaultSkipEnv, type VaultSyncSwitches } from "../lib/vault-sync-switches.js";
+export { readVaultSyncSwitches, vaultSkipEnv, type VaultSyncSwitches };
+/**
+ * Exit code for "skipped because sync is off". Distinct from 1 (sync failed)
+ * so a caller can tell the two apart; every non-zero exit still means "nothing
+ * was synced", which is what `/delegate` and job remediation need to see.
+ */
+export declare const CLOUD_OFF_EXIT_CODE = 3;
+export type GatedSyncCommand = "push" | "pull" | "now";
+/** True when "Turn off all cloud sync" is on. Never throws. */
+export declare function isCloudOff(home?: string): boolean;
+/** True when `company` (a slug) is a company vault whose switch is off. */
+export declare function isCompanyVaultOff(switches: VaultSyncSwitches, company: string): boolean;
+/**
+ * The refusal text when every vault is off. The first line keeps the phrase
+ * "refused immediately": `handoff-sync-prefetch` (shell and native) reports
+ * `skipped` rather than `error:<code>` when the pull log contains it, so
+ * released HQ versions treat this exit as skipped with no script change.
+ */
+export declare function cloudOffMessage(command: GatedSyncCommand): string;
+/** The refusal text when the one vault a command targets is off. */
+export declare function vaultOffMessage(command: GatedSyncCommand, vaultName: string): string;
+/** The refusal text when a company uid cannot be mapped while some vault is off. */
+export declare function unresolvedVaultMessage(command: GatedSyncCommand, ref: string): string;
+/** Which vaults a `push|pull|now` invocation targets. */
+export interface SyncSelection {
+    all?: boolean;
+    /** `true` for `--personal`; `false` is `--no-personal` (only meaningful with `--all`). */
+    personal?: boolean;
+    company?: string;
+    /** Used to find the active company and the uid-to-slug manifest. */
+    hqRoot?: string;
+    /** `--creds-from-stdin`: the target is checked after stdin is parsed. */
+    credsFromStdin?: boolean;
+}
+/** What an `--all` run must leave out. */
+export interface VaultSkips {
+    skipPersonal: boolean;
+    skipCompanies: ReadonlySet<string>;
+}
+/** A refusal: the text, and the vault it names (for JSON output). */
+export interface VaultRefusal {
+    message: string;
+    vault: string;
+}
+/** The vault a company reference or entity uid names. */
+export type ResolvedVault = {
+    kind: "personal";
+} | {
+    kind: "company";
+    slug: string;
+} | {
+    kind: "unknown";
+    ref: string;
+};
+/**
+ * Active company from `<hqRoot>/.hq/config.json`, best effort. Uses
+ * `activeCompany ?? companySlug`, the order hq-cloud's `resolveActiveCompany`
+ * uses, so a config with only `companySlug` is still gated.
+ */
+export declare function readActiveCompanyRef(hqRoot: string | undefined): string | undefined;
+/** Map a slug, `cmp_*` uid or `prs_*` uid to the vault it names. */
+export declare function resolveVaultRef(ref: string, hqRoot: string | undefined): ResolvedVault;
+/**
+ * The refusal for `selection`, or null when it may run. `--all` never
+ * refuses for one vault: it skips the off vaults (see {@link vaultSkips}).
+ * With `--creds-from-stdin` and no `--company`, the target is unknown until
+ * stdin is parsed; {@link refusalForEntity} checks it then.
+ */
+export declare function refusalFor(command: GatedSyncCommand, selection: SyncSelection, switches: VaultSyncSwitches): VaultRefusal | null;
+/**
+ * The refusal for a pre-vended EntityContext read from stdin. A `prs_*` uid
+ * is the personal vault; otherwise the slug (or the uid, through the
+ * manifest) names the company.
+ */
+export declare function refusalForEntity(command: GatedSyncCommand, entity: {
+    uid?: unknown;
+    slug?: unknown;
+}, hqRoot: string | undefined, switches: VaultSyncSwitches): VaultRefusal | null;
+/** The vaults an `--all` run leaves out. */
+export declare function vaultSkips(selection: SyncSelection, switches: VaultSyncSwitches): VaultSkips;
+/** Thrown after stdin is parsed when its target vault is off. */
+export declare class VaultSyncOffError extends Error {
+    readonly refusal: VaultRefusal;
+    constructor(refusal: VaultRefusal);
+}
+export interface CloudOffGateDeps {
+    home?: string;
+    writeErr?: (text: string) => void;
+    exit?: (code: number) => never;
+    /** `--json`: stderr is a JSON Lines stream, so write events, not prose. */
+    json?: boolean;
+}
+/** Write a refusal: plain text, or one JSON Lines event in `--json` mode. */
+export declare function writeVaultRefusal(refusal: VaultRefusal, deps?: Pick<CloudOffGateDeps, "writeErr" | "json">): void;
+/**
+ * Print the refusal and exit {@link CLOUD_OFF_EXIT_CODE} when `selection`
+ * targets an off vault (or every vault is off); otherwise return what an
+ * `--all` run must skip. Runs before any login, lock or network work, and
+ * outside the client-health report, so a refusal is not counted as a failed
+ * sync. Warns when the settings file is unreadable.
+ */
+export declare function refuseSyncForOffVaults(command: GatedSyncCommand, selection: SyncSelection, deps?: CloudOffGateDeps): VaultSkips;
+/**
+ * `--creds-from-stdin` check: throw {@link VaultSyncOffError} when the parsed
+ * EntityContext targets an off vault. The caller writes it and exits 3.
+ */
+export declare function assertEntityVaultSyncAllowed(command: GatedSyncCommand, entity: {
+    uid?: unknown;
+    slug?: unknown;
+}, hqRoot: string | undefined, home?: string): void;
+//# sourceMappingURL=cloud-off-gate.d.ts.map

package/dist/commands/cloud-off-gate.js

@@ -0,0 +1,234 @@
+/**
+ * Sync switch gate for the manual `hq sync push|pull|now` commands
+ * (usage-only-pricing US-016).
+ *
+ * The desktop app's Settings > Sync section has one switch per vault plus one
+ * "Turn off all cloud sync" switch (see `../lib/vault-sync-switches.ts`). The
+ * switches affect only this computer. The app gates its own sync paths, but
+ * skills and scripts call these CLI commands directly (`/handoff`, the
+ * `/startwork` and `/resumework` prefetch, `/delegate`, job remediation). This
+ * gate makes those calls honour the same switches: a command aimed at an off
+ * vault refuses, and an `--all` run skips the off vaults while the rest sync.
+ *
+ * How the target vault is found, before any login or network call:
+ * - `--personal`, or a `prs_*` uid, is the personal vault;
+ * - `--company <ref>`, else the active company in `<hq-root>/.hq/config.json`
+ *   (`activeCompany ?? companySlug`, the same order hq-cloud's resolver uses);
+ * - a `cmp_*` uid is mapped to its slug through `companies/manifest.yaml`
+ *   (`cloud_uid`). A uid that cannot be mapped while any company vault is off
+ *   is refused (fail closed): the gate cannot prove it is not an off vault.
+ * - `--creds-from-stdin`: the target is the parsed EntityContext, checked
+ *   after stdin is read (`refusalForEntity`) and still before any transfer.
+ *
+ * The daemon's own `syncPaused` is not read here: it pauses background sync
+ * only (`hq daemon sync pause`, the tray pause), and a manual push while
+ * background sync is paused is expected to run.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { readCompaniesManifestMap } from "../lib/work-context/repo-remote.js";
+import { readVaultSyncSwitches, unreadableSwitchesWarning, vaultSkipEnv, } from "../lib/vault-sync-switches.js";
+export { readVaultSyncSwitches, vaultSkipEnv };
+/**
+ * Exit code for "skipped because sync is off". Distinct from 1 (sync failed)
+ * so a caller can tell the two apart; every non-zero exit still means "nothing
+ * was synced", which is what `/delegate` and job remediation need to see.
+ */
+export const CLOUD_OFF_EXIT_CODE = 3;
+/** True when "Turn off all cloud sync" is on. Never throws. */
+export function isCloudOff(home) {
+    return readVaultSyncSwitches(home).allOff;
+}
+/** True when `company` (a slug) is a company vault whose switch is off. */
+export function isCompanyVaultOff(switches, company) {
+    return switches.offCompanies.has(company.trim().toLowerCase());
+}
+const HOW_TO_TURN_ON = "To turn it back on, open HQ and go to Settings > Sync.";
+const NOTHING_MOVED = "Nothing was uploaded or downloaded. Your local files are unchanged.";
+/**
+ * The refusal text when every vault is off. The first line keeps the phrase
+ * "refused immediately": `handoff-sync-prefetch` (shell and native) reports
+ * `skipped` rather than `error:<code>` when the pull log contains it, so
+ * released HQ versions treat this exit as skipped with no script change.
+ */
+export function cloudOffMessage(command) {
+    return [
+        `Cloud sync is off for every vault on this computer, so \`hq sync ${command}\` was refused immediately.`,
+        NOTHING_MOVED,
+        HOW_TO_TURN_ON,
+    ].join("\n");
+}
+/** The refusal text when the one vault a command targets is off. */
+export function vaultOffMessage(command, vaultName) {
+    return [
+        `Sync is off for ${vaultName} on this computer, so \`hq sync ${command}\` was refused immediately.`,
+        NOTHING_MOVED,
+        HOW_TO_TURN_ON,
+    ].join("\n");
+}
+/** The refusal text when a company uid cannot be mapped while some vault is off. */
+export function unresolvedVaultMessage(command, ref) {
+    return [
+        `Sync is off for one or more company vaults on this computer, and \`hq sync ${command}\` could not tell which vault ${ref} is, so it was refused immediately.`,
+        NOTHING_MOVED,
+        `Run it with --company <slug>, or turn the vaults back on in HQ Settings > Sync.`,
+    ].join("\n");
+}
+const COMPANY_UID = /^cmp_/i;
+const PERSON_UID = /^prs_/i;
+/**
+ * Active company from `<hqRoot>/.hq/config.json`, best effort. Uses
+ * `activeCompany ?? companySlug`, the order hq-cloud's `resolveActiveCompany`
+ * uses, so a config with only `companySlug` is still gated.
+ */
+export function readActiveCompanyRef(hqRoot) {
+    if (!hqRoot)
+        return undefined;
+    try {
+        const cfg = JSON.parse(fs.readFileSync(path.join(hqRoot, ".hq", "config.json"), "utf8"));
+        for (const value of [cfg?.activeCompany, cfg?.companySlug]) {
+            if (typeof value === "string" && value.trim())
+                return value.trim();
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Map a slug, `cmp_*` uid or `prs_*` uid to the vault it names. */
+export function resolveVaultRef(ref, hqRoot) {
+    const trimmed = ref.trim();
+    if (PERSON_UID.test(trimmed))
+        return { kind: "personal" };
+    if (!COMPANY_UID.test(trimmed))
+        return { kind: "company", slug: trimmed };
+    const manifest = hqRoot ? readCompaniesManifestMap(hqRoot) : null;
+    for (const [slug, entry] of Object.entries(manifest ?? {})) {
+        const uid = entry?.cloud_uid;
+        if (typeof uid === "string" && uid.toLowerCase() === trimmed.toLowerCase()) {
+            return { kind: "company", slug };
+        }
+    }
+    return { kind: "unknown", ref: trimmed };
+}
+function refusalForVault(command, vault, switches) {
+    switch (vault.kind) {
+        case "personal":
+            return switches.personalOff
+                ? { message: vaultOffMessage(command, "your personal vault"), vault: "personal" }
+                : null;
+        case "company":
+            return isCompanyVaultOff(switches, vault.slug)
+                ? { message: vaultOffMessage(command, vault.slug), vault: vault.slug }
+                : null;
+        case "unknown":
+            // Fail closed: with any company vault off, an unmapped uid may be it.
+            return switches.offCompanies.size > 0
+                ? { message: unresolvedVaultMessage(command, vault.ref), vault: vault.ref }
+                : null;
+    }
+}
+/**
+ * The refusal for `selection`, or null when it may run. `--all` never
+ * refuses for one vault: it skips the off vaults (see {@link vaultSkips}).
+ * With `--creds-from-stdin` and no `--company`, the target is unknown until
+ * stdin is parsed; {@link refusalForEntity} checks it then.
+ */
+export function refusalFor(command, selection, switches) {
+    if (switches.allOff)
+        return { message: cloudOffMessage(command), vault: "all" };
+    if (selection.all)
+        return null;
+    if (selection.personal === true) {
+        return refusalForVault(command, { kind: "personal" }, switches);
+    }
+    const ref = selection.company ?? (selection.credsFromStdin ? undefined : readActiveCompanyRef(selection.hqRoot));
+    if (!ref)
+        return null;
+    return refusalForVault(command, resolveVaultRef(ref, selection.hqRoot), switches);
+}
+/**
+ * The refusal for a pre-vended EntityContext read from stdin. A `prs_*` uid
+ * is the personal vault; otherwise the slug (or the uid, through the
+ * manifest) names the company.
+ */
+export function refusalForEntity(command, entity, hqRoot, switches) {
+    if (switches.allOff)
+        return { message: cloudOffMessage(command), vault: "all" };
+    const uid = typeof entity.uid === "string" ? entity.uid : "";
+    const slug = typeof entity.slug === "string" ? entity.slug : "";
+    if (PERSON_UID.test(uid))
+        return refusalForVault(command, { kind: "personal" }, switches);
+    if (slug.trim())
+        return refusalForVault(command, { kind: "company", slug }, switches);
+    if (uid.trim())
+        return refusalForVault(command, resolveVaultRef(uid, hqRoot), switches);
+    return null;
+}
+/** The vaults an `--all` run leaves out. */
+export function vaultSkips(selection, switches) {
+    return {
+        skipPersonal: selection.personal === false || switches.personalOff,
+        skipCompanies: switches.offCompanies,
+    };
+}
+/** Thrown after stdin is parsed when its target vault is off. */
+export class VaultSyncOffError extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal.message);
+        this.refusal = refusal;
+        this.name = "VaultSyncOffError";
+    }
+}
+/** Write a refusal: plain text, or one JSON Lines event in `--json` mode. */
+export function writeVaultRefusal(refusal, deps = {}) {
+    const writeErr = deps.writeErr ?? ((text) => process.stderr.write(text));
+    if (deps.json) {
+        writeErr(`${JSON.stringify({
+            type: "skipped",
+            reason: "sync_off",
+            vault: refusal.vault,
+            exitCode: CLOUD_OFF_EXIT_CODE,
+            message: refusal.message,
+        })}\n`);
+    }
+    else {
+        writeErr(`${refusal.message}\n`);
+    }
+}
+function warnIfUnreadable(switches, deps) {
+    if (!switches.unreadable)
+        return;
+    const writeErr = deps.writeErr ?? ((text) => process.stderr.write(text));
+    const message = unreadableSwitchesWarning(switches.unreadable);
+    writeErr(deps.json ? `${JSON.stringify({ type: "warning", message })}\n` : `${message}\n`);
+}
+/**
+ * Print the refusal and exit {@link CLOUD_OFF_EXIT_CODE} when `selection`
+ * targets an off vault (or every vault is off); otherwise return what an
+ * `--all` run must skip. Runs before any login, lock or network work, and
+ * outside the client-health report, so a refusal is not counted as a failed
+ * sync. Warns when the settings file is unreadable.
+ */
+export function refuseSyncForOffVaults(command, selection, deps = {}) {
+    const switches = readVaultSyncSwitches(deps.home);
+    warnIfUnreadable(switches, deps);
+    const refusal = refusalFor(command, selection, switches);
+    if (refusal) {
+        writeVaultRefusal(refusal, deps);
+        (deps.exit ?? ((code) => process.exit(code)))(CLOUD_OFF_EXIT_CODE);
+    }
+    return vaultSkips(selection, switches);
+}
+/**
+ * `--creds-from-stdin` check: throw {@link VaultSyncOffError} when the parsed
+ * EntityContext targets an off vault. The caller writes it and exits 3.
+ */
+export function assertEntityVaultSyncAllowed(command, entity, hqRoot, home) {
+    const refusal = refusalForEntity(command, entity, hqRoot, readVaultSyncSwitches(home));
+    if (refusal)
+        throw new VaultSyncOffError(refusal);
+}
+//# sourceMappingURL=cloud-off-gate.js.map

package/dist/commands/cloud.d.ts

@@ -196,6 +196,11 @@ export interface PullAllOptions {
      * personal vault from the run without touching the rest of the plan.
      */
     skipPersonal?: boolean;
+    /**
+     * Lowercased company slugs (or uids) to leave out: vaults whose sync is off
+     * on this computer (desktop Settings > Sync, US-016).
+     */
+    skipCompanies?: ReadonlySet<string>;
     /**
      * Forward `--force-scope-shrink` to each company leg: when a scope shrink
      * would un-track locally-modified files, proceed anyway (dirty files KEPT on
@@ -263,6 +268,8 @@ export interface PushAllOptions {
      * `hq sync push --all --no-personal`.
      */
     skipPersonal?: boolean;
+    /** Lowercased company slugs (or uids) to leave out (US-016). */
+    skipCompanies?: ReadonlySet<string>;
 }
 export interface PushAllRow {
     slug: string;