@indigoai-us/hq-cli 5.345.152 → 5.345.154

package/dist/commands/agent-enroll.js

@@ -17,6 +17,7 @@
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as os from "node:os";
+import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
 import { DEFAULT_VAULT_API_URL, personTokenCacheFile, } from "../utils/cognito-session.js";
 import { HQ_CLIENT_NAME } from "../utils/vault-api.js";
@@ -25,7 +26,7 @@ import { queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, } from "../
 import { networkTransportErrorCode } from "../utils/network-transport-error.js";
 import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
 import { generateHostKeyPair, machineCredsFileExists, readExternalMachineCreds, writeHostKeyPair, writeMachineCreds, } from "../lib/agent-kit/creds.js";
-import { DEFAULT_LOCAL_AGENT_NAME, agentKitPaths, localAgentDir, } from "../lib/agent-kit/paths.js";
+import { DEFAULT_LOCAL_AGENT_NAME, MACHINE_CREDS_NAME, agentKitPaths, agentRootDir, listLocalAgentDirs, localAgentDir, } from "../lib/agent-kit/paths.js";
 const ENROLL_PATH = "/v1/agents/enroll";
 /** Canonical code: un-grouped, uppercase (server hashes exactly this). */
 export function normalizeEnrollmentCode(raw) {
@@ -88,8 +89,10 @@ export function refusalMessage(existing) {
                 `file is left untouched and never read.`);
         case "machine":
             return (`This host already has a machine identity at ${existing.file}` +
-                `${existing.agentUid ? ` (${existing.agentUid})` : ""}. Re-run with --replace ` +
-                `to enroll as a new agent; the old creds and host key will be overwritten.`);
+                `${existing.agentUid ? ` (${existing.agentUid})` : ""}. To add another bot beside ` +
+                `it, re-run with --name <bot>: each bot gets its own directory and its own agent ` +
+                `identity. Re-run with --replace only to swap this agent out; the old creds and ` +
+                `host key will be overwritten.`);
     }
 }
 export class EnrollError extends Error {
@@ -239,6 +242,24 @@ export function validateLocalAgentName(name) {
     }
     return trimmed;
 }
+/**
+ * Agent trees under `home` holding an identity, other than `self`. Existence
+ * checks only; no creds file is opened.
+ */
+export function otherAgentDirsOnHost(self, home = os.homedir()) {
+    const resolvedSelf = path.resolve(self);
+    const dirs = [];
+    const root = agentRootDir(home);
+    try {
+        if (fs.statSync(path.join(root, MACHINE_CREDS_NAME)).isFile())
+            dirs.push(root);
+    }
+    catch {
+        /* no identity in the root */
+    }
+    dirs.push(...listLocalAgentDirs(home));
+    return dirs.filter((dir) => path.resolve(dir) !== resolvedSelf);
+}
 /** Pure-ish orchestration so tests can drive it without a TTY or network. */
 export async function enrollHost(opts, deps = {}) {
     const env = deps.env ?? process.env;
@@ -310,6 +331,7 @@ export async function enrollHost(opts, deps = {}) {
         ...(permissionsError ? { permissionsError } : {}),
         local: target.local,
         agentDir: paths.agentDir,
+        otherAgentDirs: otherAgentDirsOnHost(paths.agentDir, deps.home ?? paths.home),
         agentUid: parsed.agentUid,
         companySlug: parsed.companySlug,
         companyUid: parsed.companyUid,
@@ -343,12 +365,23 @@ export function registerAgentEnrollCommand(agent) {
                 name: opts.name,
             });
             console.log(chalk.green(`Enrolled as ${result.agentUid} in ${result.companySlug}.`));
+            const shared = result.otherAgentDirs.length > 0;
             if (result.local) {
                 // Say it plainly: this host belongs to a person, and the bot is a
                 // guest on it. Nothing of theirs was read, moved or overwritten.
                 console.log(chalk.dim(`  This computer already has a person signed in, so this agent lives in its own\n` +
                     `  directory beside them: ${result.agentDir}. Their session was not read or changed.\n` +
-                    `  Every hq agent command finds this tree on its own — no environment to set.`));
+                    (shared
+                        ? ``
+                        : `  Every hq agent command finds this tree on its own — no environment to set.`)));
+            }
+            if (shared) {
+                // Feedback ce0b9c36: a second bot that ran without this variable
+                // signed in as the first bot. Say exactly what keeps them apart.
+                console.log(chalk.yellow(`  This computer has more than one agent (${result.otherAgentDirs.join(", ")}).\n` +
+                    `  Run this bot (its MCP server, kit install and every hq command) with\n` +
+                    `    HQ_AGENT_DIR=${result.agentDir}\n` +
+                    `  or it will act as one of the other agents. Each bot needs its own HQ_AGENT_DIR.`));
             }
             if (!result.permissionsEnforced) {
                 // Not a warning to bury: the credential is on disk and working,

package/dist/commands/cloud.d.ts

@@ -401,4 +401,21 @@ export declare function registerCloudCommands(program: Command): void;
 export declare function runSyncDoctorReconcileConflicts(hqRoot: string, yes: boolean): Promise<void>;
 /** Exported for the US-003 sync-health exit-path regression test. */
 export declare function runPullPersonal(hqRoot: string, onConflict?: ConflictStrategy): Promise<void>;
+/**
+ * Human-friendly label for a journal slug in `hq sync status`. The
+ * personal-vault fanout slot and the legacy `companies/personal` company both
+ * carry opaque slugs; everything else is a real company slug shown as-is.
+ */
+/**
+ * `hq sync status`: list local files under read-only vault prefixes that are
+ * not in the sync journal. Push never uploads them (feedback_510661bc,
+ * Shepherd #2813). Uses only the local vault-access manifest and the journals
+ * already loaded, with no network calls. Prints nothing when nothing applies.
+ */
+export declare function printReadOnlyLocalOnly(hqRoot: string, journals: ReadonlyArray<{
+    slug: string;
+    journal: {
+        files?: Record<string, unknown>;
+    };
+}>, log?: (line: string) => void): number;
 //# sourceMappingURL=cloud.d.ts.map

package/dist/commands/cloud.js

@@ -13,10 +13,11 @@
  *   hq sync status            — show local journal summary
  */
 import { isAccessDeniedError, accessDeniedKeyOf, formatAccessDenied, } from "../utils/access-denied-hint.js";
+import { findReadOnlyLocalOnly, isGrantEnforced, readVaultAccessManifest, } from "../lib/sync/read-only-local-only.js";
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, getStateDir, listJournals, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
+import { share, getStateDir, listJournals, createIgnoreFilter, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { syncLeg } from "../utils/sync-operation-lock.js";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, loadCachedTokens, } from "../utils/cognito-session.js";
 import { resolveUploadAuthor } from "../utils/upload-author.js";
@@ -1353,6 +1354,7 @@ export function registerCloudCommands(program) {
                 console.log(`      Total size:    ${formatBytes(grandBytes)}`);
                 console.log(`      Last sync:     ${grandLastSync || "never"}`);
             }
+            printReadOnlyLocalOnly(hqRoot, journals);
         }
         catch (err) {
             console.error(chalk.red("✗ Status failed:"), err instanceof Error ? err.message : String(err));
@@ -2094,6 +2096,51 @@ function readActiveCompanySlug(hqRoot) {
  * personal-vault fanout slot and the legacy `companies/personal` company both
  * carry opaque slugs; everything else is a real company slug shown as-is.
  */
+/**
+ * `hq sync status`: list local files under read-only vault prefixes that are
+ * not in the sync journal. Push never uploads them (feedback_510661bc,
+ * Shepherd #2813). Uses only the local vault-access manifest and the journals
+ * already loaded, with no network calls. Prints nothing when nothing applies.
+ */
+export function printReadOnlyLocalOnly(hqRoot, journals, log = (line) => console.log(line)) {
+    const companies = readVaultAccessManifest(hqRoot)?.companies;
+    if (!companies)
+        return 0;
+    let shouldSync;
+    let grand = 0;
+    for (const [slug, company] of Object.entries(companies)) {
+        if (!isGrantEnforced(company))
+            continue;
+        if (!fs.existsSync(path.join(hqRoot, "companies", slug)))
+            continue;
+        if (!shouldSync) {
+            try {
+                shouldSync = createIgnoreFilter(hqRoot);
+            }
+            catch {
+                shouldSync = () => true;
+            }
+        }
+        const journal = journals.find((j) => j.slug === slug)?.journal;
+        const journalKeys = new Set(Object.keys(journal?.files ?? {}));
+        const found = findReadOnlyLocalOnly({ hqRoot, slug, company, journalKeys, shouldSync });
+        if (found.total === 0)
+            continue;
+        grand += found.total;
+        log(chalk.yellow(`\n  ! ${slug}: ${found.total} local-only file(s) under read-only access will not upload`));
+        for (const f of found.files) {
+            log(`      ${f.path}${f.permission === "none" ? chalk.dim(" (no access)") : ""}`);
+        }
+        if (found.total > found.files.length) {
+            log(chalk.dim(`      ... and ${found.total - found.files.length} more`));
+        }
+    }
+    if (grand > 0) {
+        log(chalk.dim("      Copy them somewhere you can write, or ask a company admin for write access. " +
+            "Access data: .hq/vault-access.json (refresh: bash core/scripts/refresh-vault-access.sh)."));
+    }
+    return grand;
+}
 function scopeLabel(slug) {
     if (slug === PERSONAL_VAULT_JOURNAL_SLUG)
         return "personal vault";

package/dist/commands/core-policy.js

@@ -311,7 +311,7 @@ function epochFromDate(value) {
         return 0;
     return Math.floor(parsed.getTime() / 1000);
 }
-function countLedgerRows(directory, withMtime, recursive, awkPath) {
+function countLedgerRows(directory, withMtime, recursive, awkPath, platform) {
     const counts = new Map();
     const newest = new Map();
     let anyFiles = false;
@@ -344,7 +344,7 @@ function countLedgerRows(directory, withMtime, recursive, awkPath) {
             catch (error) {
                 const code = error.code;
                 if (withMtime && (code === 'EACCES' || code === 'EPERM')) {
-                    stderr += awkCannotOpenFileDiagnostic(full, 'Permission denied', 1, process.platform, awkPath);
+                    stderr += awkCannotOpenFileDiagnostic(full, 'Permission denied', 1, platform, awkPath);
                     continue;
                 }
                 if (expectedFsMiss(error))
@@ -449,8 +449,8 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
     const ledgerDir = env.HQ_POLICY_LEDGER_DIR || path.join(root, 'workspace/orchestrator/policy-trigger-state');
     const retrievalDir = env.HQ_POLICY_RETRIEVAL_LEDGER_DIR || path.join(root, 'workspace/orchestrator/policy-retrieval-state');
     const awkPath = env.PATH ?? '/usr/bin:/bin';
-    const usage = countLedgerRows(ledgerDir, true, true, awkPath);
-    const retrieval = countLedgerRows(retrievalDir, false, false, awkPath);
+    const usage = countLedgerRows(ledgerDir, true, true, awkPath, platform);
+    const retrieval = countLedgerRows(retrievalDir, false, false, awkPath, platform);
     const dirs = parsed.dirs.length > 0 ? parsed.dirs : [path.join(root, 'personal/policies'), path.join(root, 'core/policies')];
     const rows = [];
     let stderr = usage.stderr + retrieval.stderr;

package/dist/commands/core-session-project-native.js

@@ -249,6 +249,13 @@ export function runSessionProjectFast(argv, stdin, cwd, root, dependencies = {})
             return error?.code !== "ESRCH";
         }
     }
+    // Windows keeps a just-released lock directory or pid file in a delete-pending
+    // state while another waiter still holds a handle on it. Creating the same
+    // name in that window fails with EPERM, EACCES or EBUSY instead of EEXIST, so
+    // it is lock contention and the waiter keeps polling until its deadline.
+    function isTransientWindowsLockError(error) {
+        return process.platform === "win32" && ["EPERM", "EACCES", "EBUSY"].includes(error?.code);
+    }
     function acquireProjectWriteLock(prdPath) {
         const lock = `${prdPath}.write-lock`;
         const ownerFile = path.join(lock, "pid");
@@ -260,14 +267,21 @@ export function runSessionProjectFast(argv, stdin, cwd, root, dependencies = {})
                 try {
                     fs.writeFileSync(ownerFile, `${process.pid}\n`, { flag: "wx" });
                 }
-                catch {
-                    fs.rmSync(lock, { recursive: true, force: true });
-                    return undefined;
+                catch (error) {
+                    fs.rmSync(lock, { recursive: true, force: true, maxRetries: 10, retryDelay: 10 });
+                    if (!isTransientWindowsLockError(error))
+                        return undefined;
+                    sleepSync(20);
+                    continue;
                 }
                 process.once("exit", () => releaseProjectWriteLock(lock));
                 return lock;
             }
             catch (error) {
+                if (isTransientWindowsLockError(error)) {
+                    sleepSync(20);
+                    continue;
+                }
                 if (error?.code !== "EEXIST")
                     return undefined;
                 let owner = 0;
@@ -299,8 +313,9 @@ export function runSessionProjectFast(argv, stdin, cwd, root, dependencies = {})
     function releaseProjectWriteLock(lock) {
         try {
             const owner = Number.parseInt(fs.readFileSync(path.join(lock, "pid"), "utf8"), 10);
+            // Retry so a waiter's open handle on the pid file cannot leave an ownerless lock directory behind.
             if (owner === process.pid)
-                fs.rmSync(lock, { recursive: true, force: true });
+                fs.rmSync(lock, { recursive: true, force: true, maxRetries: 10, retryDelay: 10 });
         }
         catch { /* lock cleanup is best-effort; stale owners are reclaimed */ }
     }

package/dist/commands/decide.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "commander";
+import { DecisionsClient } from "../lib/decisions/client.js";
+export interface DecideDeps {
+    client: DecisionsClient;
+    audience: () => Promise<string>;
+    importAudience: () => Promise<string>;
+    root: () => string;
+    company: (ref?: string) => Promise<string>;
+    now: () => number;
+    print: (value: string) => void;
+}
+export declare function registerDecideCommand(program: Command, overrides?: Partial<DecideDeps>): void;
+//# sourceMappingURL=decide.d.ts.map

package/dist/commands/decide.js

@@ -0,0 +1,74 @@
+import { getCompanyUid } from "../utils/vault-api.js";
+import { resolveActiveCompany } from "./workers.js";
+import { decisionExpiry } from "../lib/decisions/expiry.js";
+import { Option } from "commander";
+import { ensureCognitoToken, resolveDefaultHqRoot } from "../utils/cognito-session.js";
+import { DecisionsClient, DecisionError, parseOptions } from "../lib/decisions/client.js";
+import { askAudience, importAudience } from "../lib/decisions/principal.js";
+import { importLaneQuestions } from "../lib/decisions/import-lanes.js";
+export function registerDecideCommand(program, overrides = {}) {
+    const token = () => ensureCognitoToken({ interactive: false });
+    const deps = {
+        client: new DecisionsClient(token), audience: async () => askAudience(await token()),
+        importAudience: async () => importAudience(await token()),
+        company: async (ref) => getCompanyUid(await token(), ref ?? resolveActiveCompany(deps.root())),
+        now: () => Date.now(),
+        root: () => resolveDefaultHqRoot(), print: value => console.log(value), ...overrides,
+    };
+    const decide = program.command("decide").description("Ask and answer owner decisions in the HQ Queue");
+    const repeat = (value, previous) => [...previous, value];
+    decide.command("ask").description("Create an option-choice owner decision as the personal local bot").argument("<statement>")
+        .addOption(new Option("--to <audience>", "Decision audience").choices(["me"]).default("me"))
+        .option("--option <id|label>", "Choice, repeatable", repeat, [])
+        .option("--recommend <id>", "Recommended option id")
+        .option("--context-link <url>", "Context link, repeatable", repeat, [])
+        .option("--context <text>", "Short context brief", "")
+        .option("--company <slug|uid>", "Company (defaults to the active company)")
+        .option("--expires <duration|iso>", "Expiry duration (m, h, d) or ISO date-time", "72h")
+        .option("--commitment <id>", "Related commitment")
+        .option("--json", "Print the decision record")
+        .action(async (statement, opts) => {
+        if (!statement.trim())
+            throw new DecisionError("invalid_statement", "Statement must not be empty");
+        const options = parseOptions(opts.option, opts.recommend);
+        for (const link of opts.contextLink) {
+            let valid = false;
+            try {
+                valid = ["https:", "http:"].includes(new URL(link).protocol);
+            }
+            catch { /* invalid URL */ }
+            if (!valid)
+                throw new DecisionError("invalid_context_link", "Context links must be HTTP(S) URLs");
+        }
+        const expiresAt = decisionExpiry(opts.expires, deps.now());
+        const owner = await deps.audience();
+        const companyUid = await deps.company(opts.company);
+        const record = await deps.client.ask({ companyUid, expiresAt, audience: { kind: "person", personUid: owner }, statement, options, context: {
+                links: opts.contextLink, brief: opts.context, commitmentId: opts.commitment ?? null,
+            } });
+        deps.print(opts.json ? JSON.stringify(record, null, 2) : record.id);
+    });
+    decide.command("list").description("Read your decisions across companies, oldest first").option("--open", "List open decisions").option("--json", "Print JSON")
+        .action(async (opts) => {
+        const decisions = await deps.client.list(opts.open);
+        deps.print(opts.json ? JSON.stringify(decisions, null, 2) : decisions.map(record => `${record.id}\t${record.state}\t${record.statement}`).join("\n"));
+    });
+    decide.command("show").description("Show a visible decision, including its options and answer").argument("<id>").action(async (id) => deps.print(JSON.stringify(await deps.client.show(id), null, 2)));
+    decide.command("answer").description("Answer with an option ID; the server enforces expiry and first answer").argument("<id>").requiredOption("--choice <id>", "Option id")
+        .addOption(new Option("--source <source>", "Answer surface").choices(["desktop", "thread"]).default("desktop"))
+        .action(async (id, opts) => {
+        if (!opts.choice.trim())
+            throw new DecisionError("invalid_choice", "Choice must not be empty");
+        deps.print((await deps.client.answer(id, opts.choice, opts.source)).state);
+    });
+    for (const action of ["talk", "withdraw"]) {
+        decide.command(action).description(action === "talk" ? "Open the decision's bot conversation" : "Withdraw a decision you asked").argument("<id>").action(async (id) => deps.print((await deps.client.transition(id, action)).state));
+    }
+    decide.command("import-lanes").description("Import option-style legacy questions once; report skipped advanced questions")
+        .option("--json", "Print import counts and skipped question reasons")
+        .action(async (opts) => {
+        const counts = await importLaneQuestions(deps.root(), await deps.importAudience(), deps.client);
+        deps.print(opts.json ? JSON.stringify(counts, null, 2) : `Imported ${counts.imported}; already imported ${counts.alreadyImported}; skipped ${counts.skipped}`);
+    });
+}
+//# sourceMappingURL=decide.js.map

package/dist/commands/integrations-connect.js

@@ -1228,6 +1228,18 @@ export function findAlreadyConnected(connections, app) {
         return wantSlug !== "" && displayNameSlug(displayName) === wantSlug;
     });
 }
+/**
+ * True when a member (not an owner or admin) is looking at a connection another
+ * person created. An unknown viewer or creator is never treated as someone
+ * else's, so older servers keep the ordinary hints.
+ */
+function connectedBySomeoneElse(connection, viewer) {
+    if (!viewer?.personUid || !connection.createdBy)
+        return false;
+    if (viewer.role === "owner" || viewer.role === "admin")
+        return false;
+    return connection.createdBy !== viewer.personUid;
+}
 /**
  * Report an app as already connected instead of opening a second sign-in.
  * Returns true when the connect should stop here.
@@ -1239,8 +1251,11 @@ async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
     if (!app || opts.force || opts.mcpUrl || opts.docsUrl || opts.entryId)
         return false;
     let connections;
+    let viewer;
     try {
-        connections = (await fetchAdminSurface(token, companyUid)).connections ?? [];
+        const surface = await fetchAdminSurface(token, companyUid);
+        connections = surface.connections ?? [];
+        viewer = surface.viewer;
     }
     catch {
         // Never let this convenience check block a connect. If the list cannot be
@@ -1263,6 +1278,14 @@ async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
     }
     const label = redactUrlsInText(existing.installation?.displayName ?? slug);
     console.log(chalk.green(`${label} is already connected.`));
+    if (connectedBySomeoneElse(existing, viewer)) {
+        // Members may add apps and reconnect their own, but replacing a connection
+        // someone else created stays with an owner or admin: the server refuses
+        // both the reconnect and the --force re-add with INTEGRATION_RECONNECT_FORBIDDEN.
+        console.log(chalk.dim("  Someone else connected it. To sign it in again, ask a company owner or admin to run:\n" +
+            `    hq integrations reconnect --provider ${slug}`));
+        return true;
+    }
     console.log(chalk.dim(`  Sign in again:  hq integrations reconnect --provider ${slug}\n` +
         `  Add a second:   hq integrations connect ${shellQuote(app)} --force`));
     return true;

package/dist/commands/integrations-core.d.ts

@@ -104,6 +104,12 @@ export interface AdminSurface {
         role: string;
         canManageGovernance: boolean;
         canManageIntegrations?: boolean;
+        /**
+         * Owners, admins, and members may add apps; guests may not. Removing and
+         * governing apps stays with `canManageIntegrations` / `canManageGovernance`.
+         * Absent on servers that predate members connecting apps.
+         */
+        canAddIntegrations?: boolean;
     };
     connections: AdminConnection[];
     audit: AdminAuditEvent[];
@@ -207,6 +213,14 @@ export declare function upstreamUnavailableMessage(status: number): string;
  */
 export declare function raiseIfUpstreamUnavailable(res: Response): void;
 export declare function raiseIfUnauthorized(res: Response): void;
+/**
+ * A member connected, reinstalled, or signed in to an app that someone else
+ * already connected for the company. Members may add apps and reconnect their
+ * own, but replacing another person's company connection stays with an owner
+ * or admin, so the server refuses it with this 403.
+ */
+export declare const INTEGRATION_RECONNECT_FORBIDDEN_CODE = "INTEGRATION_RECONNECT_FORBIDDEN";
+export declare const INTEGRATION_RECONNECT_FORBIDDEN_MESSAGE: string;
 /**
  * Single non-2xx funnel for the REST (non-JSON-RPC) integration routes. Applies
  * the auth and upstream-availability guards in order, then raises the server's

package/dist/commands/integrations-core.js

@@ -259,6 +259,23 @@ export function raiseIfUnauthorized(res) {
     if (res.status === 401)
         throw new AuthError();
 }
+/**
+ * A member connected, reinstalled, or signed in to an app that someone else
+ * already connected for the company. Members may add apps and reconnect their
+ * own, but replacing another person's company connection stays with an owner
+ * or admin, so the server refuses it with this 403.
+ */
+export const INTEGRATION_RECONNECT_FORBIDDEN_CODE = "INTEGRATION_RECONNECT_FORBIDDEN";
+export const INTEGRATION_RECONNECT_FORBIDDEN_MESSAGE = "This app is already connected for the company by someone else, so you can't reconnect or replace it. " +
+    "Ask a company owner or admin to reconnect it, or ask them to share the existing connection with you " +
+    "(`hq integrations list` shows the apps you can use).";
+/**
+ * CLI wording for server error codes whose response text alone does not tell
+ * the person what to run next. Unlisted codes keep the server's own text.
+ */
+const CLI_ERROR_MESSAGES = new Map([
+    [INTEGRATION_RECONNECT_FORBIDDEN_CODE, INTEGRATION_RECONNECT_FORBIDDEN_MESSAGE],
+]);
 /**
  * Single non-2xx funnel for the REST (non-JSON-RPC) integration routes. Applies
  * the auth and upstream-availability guards in order, then raises the server's
@@ -279,7 +296,8 @@ export async function raiseForResponse(res, fallback) {
     // hq-pro mints this error text, so it is untrusted input to a message we
     // print verbatim — scrub credentials out before it can reach a terminal or a
     // Sentry crash report (same reasoning as the gateway path below).
-    const detail = redactErrorText(body.error ?? "");
+    const detail = (body.code ? CLI_ERROR_MESSAGES.get(body.code) : undefined) ??
+        redactErrorText(body.error ?? "");
     const redirectUri = httpsUrlOrNull(body.redirectUri);
     throw new IntegrationsCliError(detail || `${fallback} (HTTP ${res.status})`, {
         expected: isClientError(res.status),

package/dist/commands/integrations-import.js

@@ -11,7 +11,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken, ensureCognitoToken, resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
-import { bareProvider, IntegrationsCliError, printJson } from "./integrations-core.js";
+import { bareProvider, INTEGRATION_RECONNECT_FORBIDDEN_CODE, IntegrationsCliError, printJson, } from "./integrations-core.js";
 import { installIntegration, startOAuth } from "./integrations-api.js";
 import { loadRevealedSecrets } from "./secrets.js";
 import { registerServer } from "./mcp-registration.js";
@@ -147,6 +147,9 @@ function oauthRequired(error) {
     return error instanceof IntegrationsCliError &&
         (error.code === OAUTH_REQUIRED_CODE || error.oauthProtected === true);
 }
+function reconnectForbidden(error) {
+    return error instanceof IntegrationsCliError && error.code === INTEGRATION_RECONNECT_FORBIDDEN_CODE;
+}
 function reconnectCommand(name, provider) {
     return `hq integrations reconnect ${name} --provider ${bareProvider(provider)}`;
 }
@@ -190,6 +193,24 @@ async function importRemote(token, companyUid, name, entry, dryRun) {
     if (dryRun)
         return { name, status: "imported", reason: "would connect remote MCP endpoint", provider };
     const credential = staticCredential(entry);
+    try {
+        return await installRemote(token, companyUid, name, provider, entry, credential);
+    }
+    catch (error) {
+        // Members may import connectors, but not over an app someone else already
+        // connected for the company. Skip that one connector and keep importing
+        // the rest rather than aborting the whole run.
+        if (!reconnectForbidden(error))
+            throw error;
+        return {
+            name,
+            status: "skipped",
+            provider,
+            reason: "already connected by someone else; ask a company owner or admin to reconnect it",
+        };
+    }
+}
+async function installRemote(token, companyUid, name, provider, entry, credential) {
     try {
         const result = await installIntegration(token, companyUid, {
             mcpUrl: entry.url,

package/dist/commands/integrations.js

@@ -297,6 +297,31 @@ export async function waitForApprovalTerminal(token, companyUid, queueId, option
     }
     return null;
 }
+/**
+ * Read the stored result of an approved call that already ran. The confirm
+ * route answers an approve for a `resumed` row from the queue row
+ * (alreadyResumed) without calling the provider again. Returns undefined when
+ * the result cannot be read; that never fails the approve.
+ */
+async function fetchStoredApprovalResult(token, companyUid, connectionId, queueId) {
+    try {
+        const res = await vaultApiFetch({
+            token,
+            path: `/v1/integrations/confirm/${encodeURIComponent(queueId)}/approve`,
+            method: "POST",
+            body: { companyUid, connectionId },
+        });
+        if (!res.ok)
+            return undefined;
+        const body = (await res.json().catch(() => ({})));
+        if (body.status !== "resumed" || body.alreadyResumed !== true)
+            return undefined;
+        return { result: body.result };
+    }
+    catch {
+        return undefined;
+    }
+}
 function isPendingApprovalResponse(status) {
     return ["pending", "approved", "approved_pending_run", "in_progress"].includes(status ?? "");
 }
@@ -563,8 +588,18 @@ export function registerIntegrationsCommand(program) {
                     }
                     return;
                 }
-                if (opts.json)
-                    printJson(terminal);
+                // feedback_3bf0f73f-1537-4d32-a143-9dfc43bc293f: the async worker
+                // stores the provider result on the queue row, but the history
+                // rows this poll reads carry no result. Re-posting approve for a
+                // `resumed` row does not run the call again: the gateway answers
+                // it from the stored row with alreadyResumed and the cached result.
+                const ran = terminal.status === "resumed";
+                const stored = ran
+                    ? await fetchStoredApprovalResult(token, companyUid, connection.id, queueId)
+                    : undefined;
+                if (opts.json) {
+                    printJson(stored && stored.result !== undefined ? { ...terminal, result: stored.result } : terminal);
+                }
                 else if (approvalOutcomeFailed(terminal)) {
                     const unknown = terminal.status === "write_unknown" || terminal.outcome === "unknown";
                     console.log(chalk.red(unknown
@@ -573,6 +608,12 @@ export function registerIntegrationsCommand(program) {
                 }
                 else if (terminal.status === "resumed" || terminal.status === "completed" || terminal.outcome === "ran") {
                     console.log(chalk.green("Approved — the call completed."));
+                    if (stored && stored.result !== undefined && stored.result !== null) {
+                        printJson(unwrapGatewayResult(stored.result));
+                    }
+                    else if (ran) {
+                        console.log(chalk.yellow(`The call's result could not be read back. Run \`hq integrations approve ${queueId}\` again to fetch it; the call will not run twice.`));
+                    }
                 }
                 else {
                     console.log(chalk.yellow(`Approval ended with status ${terminal.status ?? terminal.outcome ?? "unknown"}.`));

package/dist/commands/lanes-message.js

@@ -8,7 +8,7 @@ import { parseOutpostHireGrantContext, sameHireGrantSenior } from "../lib/lanes/
 import { dispatchLaneDelivery } from "../lib/lanes/delivery-core.js";
 import { dropboxInboxHasMessages, drainDropbox, formatDropboxMessages, formatMonitorEvent, requeueDropboxMessages } from "../lib/lanes/dropbox.js";
 import { isPidAlive, runWatcherLoop, WATCHER_OUT_MAX_BYTES, watcherOutLogPath, writeWatcherDecision } from "../lib/lanes/watcher.js";
-import { laneStories, laneStory, storyWarning } from "../lib/lanes/stories.js";
+import { attributedStoryRow, laneStories, storiesAfterAttribution, storyWarning } from "../lib/lanes/stories.js";
 import { artifactIdentityKeys, rollbackStorySwitchAttribution, storySwitchNotice } from "../lib/lanes/story-switch.js";
 import { laneRunDir, probePidRecord, readPidRecord, readProcStarttime, spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { findRetiredLaneEntry, keepAliveExclusion, keepAliveSupersededBy, LANE_RUNNING_SUPERSEDED_MESSAGE_DELIVERY_FLAG, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds } from "../lib/lanes/keep-alive.js";
@@ -630,15 +630,13 @@ export function createLaneMessageHandlers(deps) {
                         if (attributionChanged) {
                             const already = current.attribution_history.some((entry) => entry.message_id === messageId);
                             if (!already) {
-                                const existingStory = laneStory(current, projectId, storyId);
+                                const addedStory = attributedStoryRow(current, projectId, storyId, at);
                                 storySwitchRollback = {
                                     message_id: messageId,
                                     project_id: current.project_id,
                                     story_id: current.story_id,
                                     no_story_reason: current.no_story_reason,
-                                    ...(!existingStory ? {
-                                        added_story: { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at },
-                                    } : {}),
+                                    ...(addedStory ? { added_story: addedStory } : {}),
                                     story_switch_unacknowledged: current.story_switch_unacknowledged,
                                 };
                                 next = {
@@ -646,12 +644,7 @@ export function createLaneMessageHandlers(deps) {
                                     project_id: projectId,
                                     story_id: storyId,
                                     no_story_reason: storyId ? undefined : current.no_story_reason,
-                                    stories: laneStory(current, projectId, storyId)
-                                        ? laneStories(current)
-                                        : [
-                                            ...laneStories(current),
-                                            { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at },
-                                        ],
+                                    stories: storiesAfterAttribution(current, projectId, storyId, at),
                                     attribution_history: appendCappedHistory(current.attribution_history, {
                                         project_id: projectId,
                                         story_id: storyId,

package/dist/commands/lanes-questions.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { isQuestionImported } from "../lib/lanes/imported-question.js";
 import { buildOutpostQuestionAnswerCommand, buildOutpostQuestionCancelCommand, buildOutpostQuestionShowCommand, dispatchErrorMessage } from "../lib/lanes/outpost-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
@@ -639,6 +640,7 @@ export function createLaneQuestionsHandlers(deps) {
                 const visibleQuestion = deliveredLocalQuestions.get(q.question_id) ?? q;
                 const row = {
                     ...visibleQuestion,
+                    ...(isQuestionImported(hqRoot, q.question_id) ? { status_display: "moved to hq decide", moved_to: "hq decide" } : {}),
                     priority: visibleQuestion.priority ?? null,
                     priority_display: visibleQuestion.priority ?? "-",
                     audience: resolveAudience(hqRoot, visibleQuestion, ctx),
@@ -741,6 +743,7 @@ export function createLaneQuestionsHandlers(deps) {
             ok: true,
             action: "questions.show",
             question,
+            ...(isQuestionImported(hqRoot, question.question_id) ? { status_display: "moved to hq decide", moved_to: "hq decide" } : {}),
             audience: resolveAudience(hqRoot, question, ctx),
             body,
         });