@indigoai-us/hq-cli 5.345.151 → 5.345.153

package/CHANGELOG.md

@@ -2,6 +2,135 @@
 
 ## [Unreleased]
 
+## [5.345.153] — 2026-10-21
+- `hq-auth-refresh --min-validity-seconds N` now applies to person sessions,
+  not only machine tokens: a person session with less than N seconds left
+  (120 to 1800, default 120) is renewed. New `--force` renews a person session
+  even while it is still valid. The deploy identity resolver can use these to
+  stop returning `login_required` while `hq whoami` shows a valid session.
+- `hq doctor --fix` now rotates stale sync-manifest uploads across runs. Each
+  run starts after the last company it tried, so a machine with many stale
+  company manifests reaches all of them, and a company whose upload keeps
+  failing no longer blocks the rest. When stale journals and stale manifests
+  are both pending, one of the two network repair slots goes to a manifest
+  upload. The run still makes at most two network repairs in total.
+- Work Mesh sessions held because their company was missing now drain once
+  your membership confirms the company. Before this, after
+  `hq mesh daemon install` those sessions kept piling up in the held and
+  dead-letter queues when the session only knew the company's slug. The daemon
+  now looks the slug up through your membership, and retries the held backlog
+  every 15 minutes instead of only at start. Sessions whose company cannot be
+  confirmed stay held.
+- Each agent kit now keeps its machine sign-in tokens in its own folder
+  (`token-state/` inside the agent's directory) instead of the shared
+  `~/.hq/work-mesh/daemon/cognito-tokens.json`. Before this, an agent running on
+  your computer could write to that shared file and your own `hq` commands,
+  such as a deploy, would then act as a machine and fail with
+  `login_required`. Kits installed before this release pick up the new folder
+  without being reinstalled. A token file an agent already wrote to the shared
+  location is not removed by this change.
+- When a company's work registry is turned off, `hq doctor` no longer reports
+  the held work sessions as a login problem (`AUTH_DENIED`). It now says the
+  work registry is disabled and gives the setting a company admin can turn on:
+  `hq company --company <slug> settings set --work-registry-enabled true`.
+  Sessions held for this reason are re-sent by `hq mesh context requeue` once
+  the registry is on.
+- `hq agent enroll` on a computer that already has an enrolled bot now tells
+  you to add the new bot with `--name <bot>`, so it gets its own agent
+  identity. It no longer suggests `--replace`, which overwrites the first
+  bot's credentials. When more than one bot is enrolled on the computer,
+  enroll prints the `HQ_AGENT_DIR` value the new bot must run with. Every bot,
+  including the first one's MCP server, needs its own `HQ_AGENT_DIR`, or it
+  acts as another bot.
+- `hq doctor` no longer fails a hook just because it is left out of the
+  `minimal` hook profile on purpose. A hook must now be listed in the lowest
+  profile it appears in and every stricter one. Missing from the profile you are running
+  (`HQ_HOOK_PROFILE`, `standard` by default) is still a failure, because the
+  hook does not run; missing only from a profile you are not running is a
+  warning. A hook listed only in `strict` still fails under `standard`.
+  `hq doctor --fix` repairs both cases.
+- `hq integrations approve` now prints the provider result when the gateway
+  runs the approved call in the background. Before, the command waited for the
+  queue row to report `resumed` and then printed only "Approved — the call
+  completed.", so paid results such as Apollo matches were lost. The CLI now
+  reads the stored result back from the queue row (the call does not run
+  again) and prints it; `--json` adds it as `result`. For a call that already
+  ran, running `hq integrations approve <queueId>` again returns its stored
+  result.
+- `hq run` no longer refuses to start when varlock reports only warnings, such
+  as "Value is very short! Is it actually sensitive?" or a 2-character value
+  that is sensitive by default. Warnings are printed to stderr and the command
+  runs. Real errors still stop `hq run` with exit code 1.
+- Added `hq decide ask|list|show|answer|talk|withdraw|import-lanes` for owner Queue decisions. Release 1 accepts asks from personal local bots and lets the personal local bot import option-style questions addressed to that owner. Imported questions become read-only in legacy lanes; advanced questions are skipped with counts. Ask resolves --company and accepts --expires (default 72h), matching the US-001 decisions service contract. Requires that service before use.
+- Company members can now add apps with `hq integrations connect`, `catalog`,
+  `inspect`, `discover`, `import`, and `reconnect --connect`; guests are still
+  refused by the server. Removing and governing apps is unchanged.
+- When a member tries to reconnect or replace an app someone else connected,
+  the CLI explains that an owner or admin has to reconnect it, instead of
+  printing the raw `INTEGRATION_RECONNECT_FORBIDDEN` refusal.
+- `hq integrations connect <app>` on an app someone else connected now tells a
+  member to ask an owner or admin, rather than suggesting `reconnect` or
+  `--force`, which the server would refuse.
+- `hq integrations import` skips a connector that someone else already
+  connected and keeps importing the rest.
+- `hq lanes message --project <p>` and `hq lanes resume --project <p>` now
+  work on a lane that has no story. Before this, moving a no-story lane to
+  another project appended a stories entry with an empty story id, the lane
+  schema rejected it, and the whole write rolled back. The lane now moves to
+  the new project, keeps its no-story reason, and gains no story entry.
+  `hq lanes stories add` refuses an empty story id with `missing_story`.
+- The unit suite now passes on a developer Mac with a temporary HOME. A setup file gives every test worker the canonical macOS temp directory (`/private/var/...`) and strips HQ, Claude Code and Codex session variables, so a run started from inside an HQ session behaves like CI. Local macOS runs use at most 4 workers unless `--maxWorkers` is passed. Tests no longer pick up Homebrew bash, `/opt/homebrew/bin`, an installed HQ.app, or BSD `stat` differences, and node stubs work when node's path contains a space. Every test worker also puts a stand-in `crontab` first on PATH, and a test fails if `crontab` would resolve to anything else, so no test can edit the real user crontab (a temp HOME does not isolate it). The agent-kit fallback install test now injects its own crontab runner. Linux-only tests (Linux login-home lanes accounts) and the clean-clone checks that need a case-sensitive, non-normalizing filesystem are skipped with a stated reason where they cannot run.
+- The daemon policy index notices a policy file added or removed even when the file watcher misses the event, which macOS FSEvents can do right after a watcher starts. `list()` compares directory stamps taken at the last rebuild.
+- An autopilot lock records the real time it was taken, not the injected clock value.
+- The registry canonicalises directories with the native realpath on macOS, so `/var` and `/private/var` spellings of one directory map to the same key. A registry entry saved with letter case that differs from the disk may need re-registering.
+- The provider wrapper's perl timeout fallback (used where `timeout` is not installed, such as macOS) no longer prints "Alarm clock" to the terminal. The exit status is still 142.
+- `hq core policy` age report prints the awk error for the platform it ran on, and the differential corpus recorder maps both macOS spellings of `$HOME` to `<HOME>`.
+- `hq mesh context organize` now lists fresh candidates when the session's pending decision has expired, instead of returning the same expired decision. Choosing an option or `--create-project` after that no longer fails with `DECISION_EXPIRED` or `DECISION_WINDOW_MISSING`.
+- The published core E2E harness tears down reliably on macOS.
+- Windows lock acquisition now waits out transient EPERM/EBUSY instead of failing early.
+- Worker registry rebuild no longer walks into nested git checkouts. A folder below the scan root that holds a `.git` file (linked worktree) or `.git` folder (clone) is treated as a separate checkout: a `worker.yaml` directly inside it still registers, but nothing beneath it is read. `workspace/worktrees/`, `node_modules/`, and `.git/` folders are skipped wherever they appear. A company folder (`companies/<slug>`) or its `workers/` folder kept as its own repository still registers every worker. The worker-id clash check in `hq core scan-packages` uses the same rule.
+
+## [5.345.152] — 2026-10-20
+- The bundled sync engine now uses hq-cloud 6.18.91. When a company Outpost
+  fails to start and the server has already cleaned it up,
+  `hq outposts provision --company <slug>` (and `create --company --name`)
+  stops right away and says nothing was left running, you were not charged,
+  and it is safe to run the same command again. `hq outposts status --company`
+  shows the same line, and `--json` adds `code: "failed_cleaned_up"` and
+  `retrySafe: true`. Other blocked reasons keep their existing text.
+- CI: the "changelog entry" check sets up Node before it runs, so it no longer
+  fails with "node: command not found" on the self-hosted ARM runners. No change
+  to the `hq` command itself.
+- `hq files share --with out_…` and `hq files unshare --with out_…` now accept
+  a company Outpost id, with read or write. `hq files acl` shows the grantee as
+  `Outpost (out_…)`; `--json` output is unchanged.
+- `hq secrets share --with out_…` now refuses write or admin for a company
+  Outpost with "Company Outposts can only be given read access to a secret."
+  before anything is sent. Leaving out `--permission` for an Outpost gives it
+  read. A server refusal for the same reason shows the same message.
+- `hq rescue` (and so `/update-hq`) now re-trusts HQ's own Codex hooks after a
+  successful rescue. Before this, an update that changed a hook command left
+  Codex holding the old trusted hash, so Codex skipped that hook until you ran
+  `hq reindex`. Rescue trusts a hook only when its entry in the HQ root's
+  `.codex/hooks.json` or `.codex/config.toml` matches the copy shipped in the
+  installed core release, which it reads from GitHub at the synced commit.
+  It reads that copy only from `indigoai-us/hq-core` or
+  `indigoai-us/hq-core-staging`; if `core/core.yaml` names any other repo
+  (for example after `hq rescue --source <fork>`), rescue trusts nothing.
+  Hooks you added to those files by hand, or shipped entries you edited, are
+  never trusted. User and managed hooks are left alone, and hooks that are
+  already trusted are not rewritten. Rescue does not re-enable a shipped hook
+  you disabled; it only refreshes that hook's trust (`hq reindex` still
+  re-enables shipped hooks). Nothing happens when Codex is not installed, and
+  `--check` never touches hook trust. Rescue prints a warning that points at
+  `hq reindex` and keeps its exit status when the shipped files cannot be
+  read, when the release does not ship a file an HQ hook comes from, when a
+  shipped file does not parse, when the repo is not an HQ core repo, or when
+  the trust step fails.
+- `hq secrets exec` run without a session id (no `HQ_SESSION_ID`, `CLAUDE_CODE_SESSION_ID`, `CLAUDE_SESSION_ID`, `CODEX_SESSION_ID`, `CODEX_THREAD_ID` or `GROK_SESSION_ID`), such as a launchd or cron job, no longer borrows the company lock of whichever interactive session last wrote the sessions `.current` pointer. Before this, a job could load the same-named secret from that session's company. Such a job must now pass `--company <slug>` or `--personal`. Otherwise it prints how to fix the call and exits 78 without reading the vault. An `HQ_API_KEY` (`hqk_`) caller is unaffected because its key is bound to one company. A caller with its own session id keeps the existing lock rules: `--company` can only pick a company inside that session's lock.
+- Defines the Windows acceptance bar for the native hook engine and checks it before a release. Hook checks whose stories are not merged yet are reported as pending and do not block other releases. A failed check still blocks the release.
+- A pass requires runner evidence for that commit. Counts written into corpus files, a source-text match, or a signed-off latency number with no report stay pending and do not block a release.
+
 ## [5.345.151] — 2026-10-20
 - `hq lanes link _deliver` no longer hands a conductor message to a subagent. Subagent hook events share the root session id, so a subagent tool call used to claim the message and the root session never saw it. Child payloads, including Grok child sessions (`subagent_type`) and Codex child threads, now get nothing and the message stays queued until the root session's next tool call or stop. SubagentStop no longer delivers. A parent session id alone does not mark a child, so resumed, forked, or launcher-spawned Grok roots still receive their messages.
 - If you leave out `--company`, `hq meetings invite <url>` now uses your only active company. If you belong to several companies, it lists them and asks you to pick one. The command used to send the invite as Personal instead. Personal can never record, so you saw the HQ Workforce upgrade prompt even when your company already had meeting recording.

package/dist/bin/hq-auth-refresh.d.ts

@@ -6,6 +6,9 @@
  * shell out to a plain binary instead of a subcommand. Equivalent to
  * `hq auth refresh`.
  *
+ * Flags: `--min-validity-seconds N` renews a person session that has less than
+ * N seconds left (default 120); `--force` renews it even when still valid.
+ *
  * Exit 0 if a valid session is ensured now (healthy cache hit, refresh, or
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
@@ -16,6 +19,7 @@ import "../node-network-compat.js";
 import type { refreshCachedSession } from "../utils/cognito-session.js";
 type RefreshSession = (options?: {
     minValiditySeconds?: number;
+    force?: boolean;
 }) => ReturnType<typeof refreshCachedSession>;
 export declare function runAuthRefresh(refreshSession?: RefreshSession): Promise<number>;
 export declare function startAuthRefresh(acquireLease?: typeof acquireCurrentPackageUseLease, updateRequestPending?: () => boolean): Promise<number>;

package/dist/bin/hq-auth-refresh.js

@@ -6,6 +6,9 @@
  * shell out to a plain binary instead of a subcommand. Equivalent to
  * `hq auth refresh`.
  *
+ * Flags: `--min-validity-seconds N` renews a person session that has less than
+ * N seconds left (default 120); `--force` renews it even when still valid.
+ *
  * Exit 0 if a valid session is ensured now (healthy cache hit, refresh, or
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
@@ -17,6 +20,7 @@ import { acquireCurrentPackageUseLease, currentPackageUseUpdatePending, } from "
 import "../node-network-compat.js";
 import { isMainModule } from "../utils/is-main-module.js";
 const MIN_VALIDITY_FLAG = "--min-validity-seconds";
+const FORCE_FLAG = "--force";
 function parseMinimumValiditySeconds(argv, env) {
     let raw;
     let fromFlag = false;
@@ -53,7 +57,11 @@ export async function runAuthRefresh(refreshSession) {
     let exitCode = 1;
     try {
         const minValiditySeconds = parseMinimumValiditySeconds(process.argv.slice(2), process.env);
-        const result = await (refreshSession ?? refresh)(minValiditySeconds === undefined ? {} : { minValiditySeconds });
+        const force = process.argv.slice(2).includes(FORCE_FLAG);
+        const result = await (refreshSession ?? refresh)({
+            ...(minValiditySeconds === undefined ? {} : { minValiditySeconds }),
+            ...(force ? { force } : {}),
+        });
         if (result.refreshed) {
             exitCode = 0;
         }

package/dist/command-catalog.generated.d.ts

@@ -27,6 +27,191 @@ export type CommandCatalogEntry = {
     readonly subcommands: readonly CommandCatalogEntry[];
 };
 export declare const COMMAND_CATALOG: readonly [{
+    readonly name: "decide";
+    readonly description: "Ask and answer owner decisions in the HQ Queue";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly helpOption: true;
+    readonly helpCommand: true;
+    readonly usage: "[options] [command]";
+    readonly helpText: readonly [];
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "ask";
+        readonly description: "Create an option-choice owner decision as the personal local bot";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <statement>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "statement";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--to <audience>";
+            readonly description: "Decision audience";
+            readonly hidden: false;
+            readonly choices: readonly ["me"];
+            readonly defaultValue: "me";
+        }, {
+            readonly flags: "--option <id|label>";
+            readonly description: "Choice, repeatable";
+            readonly hidden: false;
+            readonly defaultValue: readonly [];
+        }, {
+            readonly flags: "--recommend <id>";
+            readonly description: "Recommended option id";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--context-link <url>";
+            readonly description: "Context link, repeatable";
+            readonly hidden: false;
+            readonly defaultValue: readonly [];
+        }, {
+            readonly flags: "--context <text>";
+            readonly description: "Short context brief";
+            readonly hidden: false;
+            readonly defaultValue: "";
+        }, {
+            readonly flags: "--company <slug|uid>";
+            readonly description: "Company (defaults to the active company)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--expires <duration|iso>";
+            readonly description: "Expiry duration (m, h, d) or ISO date-time";
+            readonly hidden: false;
+            readonly defaultValue: "72h";
+        }, {
+            readonly flags: "--commitment <id>";
+            readonly description: "Related commitment";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the decision record";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "list";
+        readonly description: "Read your decisions across companies, oldest first";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--open";
+            readonly description: "List open decisions";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "show";
+        readonly description: "Show a visible decision, including its options and answer";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "answer";
+        readonly description: "Answer with an option ID; the server enforces expiry and first answer";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--choice <id>";
+            readonly description: "Option id";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--source <source>";
+            readonly description: "Answer surface";
+            readonly hidden: false;
+            readonly choices: readonly ["desktop", "thread"];
+            readonly defaultValue: "desktop";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "talk";
+        readonly description: "Open the decision's bot conversation";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "withdraw";
+        readonly description: "Withdraw a decision you asked";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "import-lanes";
+        readonly description: "Import option-style legacy questions once; report skipped advanced questions";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print import counts and skipped question reasons";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }];
+}, {
     readonly name: "modules";
     readonly description: "Module management commands";
     readonly aliases: readonly [];
@@ -2058,7 +2243,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--permission <level>";
-            readonly description: "Permission level: read | write | admin";
+            readonly description: "Permission level: read | write | admin (required, except for a company Outpost, which can only be given read and defaults to it)";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
@@ -2813,7 +2998,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Email address, group id, or '@all' to share with every active company member";
+            readonly description: "Email address, group id, company Outpost id (out_...), or '@all' to share with every active company member";
             readonly hidden: false;
         }, {
             readonly flags: "--permission <level>";
@@ -2859,7 +3044,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--with <principal>";
-            readonly description: "Person uid, agent uid, email address, group id, or '@all' to remove the grant";
+            readonly description: "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];

package/dist/command-catalog.generated.js

@@ -1,5 +1,232 @@
 // This file is generated by scripts/generate-command-catalog.mjs. Do not edit.
 export const COMMAND_CATALOG = [
+    {
+        "name": "decide",
+        "description": "Ask and answer owner decisions in the HQ Queue",
+        "aliases": [],
+        "hidden": false,
+        "helpOption": true,
+        "helpCommand": true,
+        "usage": "[options] [command]",
+        "helpText": [],
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "ask",
+                "description": "Create an option-choice owner decision as the personal local bot",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <statement>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "statement",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--to <audience>",
+                        "description": "Decision audience",
+                        "hidden": false,
+                        "choices": [
+                            "me"
+                        ],
+                        "defaultValue": "me"
+                    },
+                    {
+                        "flags": "--option <id|label>",
+                        "description": "Choice, repeatable",
+                        "hidden": false,
+                        "defaultValue": []
+                    },
+                    {
+                        "flags": "--recommend <id>",
+                        "description": "Recommended option id",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--context-link <url>",
+                        "description": "Context link, repeatable",
+                        "hidden": false,
+                        "defaultValue": []
+                    },
+                    {
+                        "flags": "--context <text>",
+                        "description": "Short context brief",
+                        "hidden": false,
+                        "defaultValue": ""
+                    },
+                    {
+                        "flags": "--company <slug|uid>",
+                        "description": "Company (defaults to the active company)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--expires <duration|iso>",
+                        "description": "Expiry duration (m, h, d) or ISO date-time",
+                        "hidden": false,
+                        "defaultValue": "72h"
+                    },
+                    {
+                        "flags": "--commitment <id>",
+                        "description": "Related commitment",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print the decision record",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "list",
+                "description": "Read your decisions across companies, oldest first",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--open",
+                        "description": "List open decisions",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "show",
+                "description": "Show a visible decision, including its options and answer",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "answer",
+                "description": "Answer with an option ID; the server enforces expiry and first answer",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--choice <id>",
+                        "description": "Option id",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--source <source>",
+                        "description": "Answer surface",
+                        "hidden": false,
+                        "choices": [
+                            "desktop",
+                            "thread"
+                        ],
+                        "defaultValue": "desktop"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "talk",
+                "description": "Open the decision's bot conversation",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "withdraw",
+                "description": "Withdraw a decision you asked",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "import-lanes",
+                "description": "Import option-style legacy questions once; report skipped advanced questions",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print import counts and skipped question reasons",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            }
+        ]
+    },
     {
         "name": "modules",
         "description": "Module management commands",
@@ -2469,7 +2696,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--permission <level>",
-                        "description": "Permission level: read | write | admin",
+                        "description": "Permission level: read | write | admin (required, except for a company Outpost, which can only be given read and defaults to it)",
                         "hidden": false
                     }
                 ],
@@ -3380,7 +3607,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Email address, group id, or '@all' to share with every active company member",
+                        "description": "Email address, group id, company Outpost id (out_...), or '@all' to share with every active company member",
                         "hidden": false
                     },
                     {
@@ -3437,7 +3664,7 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--with <principal>",
-                        "description": "Person uid, agent uid, email address, group id, or '@all' to remove the grant",
+                        "description": "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant",
                         "hidden": false
                     }
                 ],