@indigoai-us/hq-cli 5.345.153 → 5.345.154

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.154] — 2026-10-21
+- `hq sync status` now lists local files that sit under a vault prefix you can
+  only read and that were never synced. Sync will never upload these files, for
+  example notes written before the vault write-access hook blocked that folder.
+  The list comes from the local `.hq/vault-access.json` access data and the
+  sync journal, so the command makes no extra network calls.
+- `hq lanes resume` and `hq lanes message` without `--account` keep a Claude lane on the account it was created with via `--account`, instead of rebalancing it onto another account (which could belong to another company). Repair of an unusable account still moves the lane.
+
 ## [5.345.153] — 2026-10-21
 - `hq-auth-refresh --min-validity-seconds N` now applies to person sessions,
   not only machine tokens: a person session with less than N seconds left

package/dist/commands/cloud.d.ts

@@ -401,4 +401,21 @@ export declare function registerCloudCommands(program: Command): void;
 export declare function runSyncDoctorReconcileConflicts(hqRoot: string, yes: boolean): Promise<void>;
 /** Exported for the US-003 sync-health exit-path regression test. */
 export declare function runPullPersonal(hqRoot: string, onConflict?: ConflictStrategy): Promise<void>;
+/**
+ * Human-friendly label for a journal slug in `hq sync status`. The
+ * personal-vault fanout slot and the legacy `companies/personal` company both
+ * carry opaque slugs; everything else is a real company slug shown as-is.
+ */
+/**
+ * `hq sync status`: list local files under read-only vault prefixes that are
+ * not in the sync journal. Push never uploads them (feedback_510661bc,
+ * Shepherd #2813). Uses only the local vault-access manifest and the journals
+ * already loaded, with no network calls. Prints nothing when nothing applies.
+ */
+export declare function printReadOnlyLocalOnly(hqRoot: string, journals: ReadonlyArray<{
+    slug: string;
+    journal: {
+        files?: Record<string, unknown>;
+    };
+}>, log?: (line: string) => void): number;
 //# sourceMappingURL=cloud.d.ts.map

package/dist/commands/cloud.js

@@ -13,10 +13,11 @@
  *   hq sync status            — show local journal summary
  */
 import { isAccessDeniedError, accessDeniedKeyOf, formatAccessDenied, } from "../utils/access-denied-hint.js";
+import { findReadOnlyLocalOnly, isGrantEnforced, readVaultAccessManifest, } from "../lib/sync/read-only-local-only.js";
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, getStateDir, listJournals, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
+import { share, getStateDir, listJournals, createIgnoreFilter, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { syncLeg } from "../utils/sync-operation-lock.js";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, loadCachedTokens, } from "../utils/cognito-session.js";
 import { resolveUploadAuthor } from "../utils/upload-author.js";
@@ -1353,6 +1354,7 @@ export function registerCloudCommands(program) {
                 console.log(`      Total size:    ${formatBytes(grandBytes)}`);
                 console.log(`      Last sync:     ${grandLastSync || "never"}`);
             }
+            printReadOnlyLocalOnly(hqRoot, journals);
         }
         catch (err) {
             console.error(chalk.red("✗ Status failed:"), err instanceof Error ? err.message : String(err));
@@ -2094,6 +2096,51 @@ function readActiveCompanySlug(hqRoot) {
  * personal-vault fanout slot and the legacy `companies/personal` company both
  * carry opaque slugs; everything else is a real company slug shown as-is.
  */
+/**
+ * `hq sync status`: list local files under read-only vault prefixes that are
+ * not in the sync journal. Push never uploads them (feedback_510661bc,
+ * Shepherd #2813). Uses only the local vault-access manifest and the journals
+ * already loaded, with no network calls. Prints nothing when nothing applies.
+ */
+export function printReadOnlyLocalOnly(hqRoot, journals, log = (line) => console.log(line)) {
+    const companies = readVaultAccessManifest(hqRoot)?.companies;
+    if (!companies)
+        return 0;
+    let shouldSync;
+    let grand = 0;
+    for (const [slug, company] of Object.entries(companies)) {
+        if (!isGrantEnforced(company))
+            continue;
+        if (!fs.existsSync(path.join(hqRoot, "companies", slug)))
+            continue;
+        if (!shouldSync) {
+            try {
+                shouldSync = createIgnoreFilter(hqRoot);
+            }
+            catch {
+                shouldSync = () => true;
+            }
+        }
+        const journal = journals.find((j) => j.slug === slug)?.journal;
+        const journalKeys = new Set(Object.keys(journal?.files ?? {}));
+        const found = findReadOnlyLocalOnly({ hqRoot, slug, company, journalKeys, shouldSync });
+        if (found.total === 0)
+            continue;
+        grand += found.total;
+        log(chalk.yellow(`\n  ! ${slug}: ${found.total} local-only file(s) under read-only access will not upload`));
+        for (const f of found.files) {
+            log(`      ${f.path}${f.permission === "none" ? chalk.dim(" (no access)") : ""}`);
+        }
+        if (found.total > found.files.length) {
+            log(chalk.dim(`      ... and ${found.total - found.files.length} more`));
+        }
+    }
+    if (grand > 0) {
+        log(chalk.dim("      Copy them somewhere you can write, or ask a company admin for write access. " +
+            "Access data: .hq/vault-access.json (refresh: bash core/scripts/refresh-vault-access.sh)."));
+    }
+    return grand;
+}
 function scopeLabel(slug) {
     if (slug === PERSONAL_VAULT_JOURNAL_SLUG)
         return "personal vault";

package/dist/commands/lanes.js

@@ -7801,7 +7801,13 @@ async function selectAutomaticClaudeResumeAccount(ctx, lane, workerProfile, opti
         accountModel: lane.account === undefined ? undefined : config.providers.claude.accounts[lane.account]?.model,
         providerModel: config.providers.claude.model,
     });
-    const mayRebalance = BALANCE_MOVABLE_STATES.includes(lane.state);
+    // An account the operator chose with --account (account_source "cli") is a
+    // pin, not a balancing hint. Plain resumes and messages keep it; only a repair
+    // of an unusable account may move the lane, and only an explicit --account
+    // may pick another healthy account. Rebalancing a pinned lane moved company
+    // lanes onto another company's account (feedback_4a563e61).
+    const cliAccountPin = lane.account !== undefined && lane.account_source === "cli";
+    const mayRebalance = !cliAccountPin && BALANCE_MOVABLE_STATES.includes(lane.state);
     if (!accountNeedsRepair && !mayRebalance)
         return undefined;
     const balanceHosts = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config, {

package/dist/lib/sync/read-only-local-only.d.ts

@@ -0,0 +1,45 @@
+export type VaultGrant = {
+    path: string;
+    permission: string;
+};
+export type VaultAccessCompany = {
+    role?: string;
+    enforced?: boolean;
+    grants?: VaultGrant[];
+};
+export type VaultAccessManifest = {
+    version?: number;
+    companies?: Record<string, VaultAccessCompany>;
+};
+/** bypass | unknown | admin | write | read | none */
+export type EffectivePermission = "bypass" | "unknown" | "admin" | "write" | "read" | "none";
+export declare function readVaultAccessManifest(hqRoot: string): VaultAccessManifest | null;
+/** Whether the manifest entry is one the write hook enforces grants for. */
+export declare function isGrantEnforced(company: VaultAccessCompany | undefined): boolean;
+export declare function effectivePermission(company: VaultAccessCompany | undefined, rel: string): EffectivePermission;
+export type ReadOnlyLocalOnlyFile = {
+    path: string;
+    permission: "read" | "none";
+};
+export type ReadOnlyLocalOnlyResult = {
+    files: ReadOnlyLocalOnlyFile[];
+    total: number;
+};
+export type FindReadOnlyLocalOnlyOptions = {
+    hqRoot: string;
+    slug: string;
+    company: VaultAccessCompany;
+    /** Company-relative keys already in the sync journal (live or tombstoned). */
+    journalKeys: ReadonlySet<string>;
+    /** Engine ignore filter over absolute paths; true = would sync. */
+    shouldSync?: (absPath: string, isDir?: boolean) => boolean;
+    /** Max paths returned; `total` still counts every match. */
+    limit?: number;
+};
+/**
+ * Walk `companies/<slug>/` and return files that are not in the journal and
+ * whose effective permission is read or none. Returns an empty result for
+ * roles the hook does not enforce (owner/admin/unknown, enforced=false).
+ */
+export declare function findReadOnlyLocalOnly(opts: FindReadOnlyLocalOnlyOptions): ReadOnlyLocalOnlyResult;
+//# sourceMappingURL=read-only-local-only.d.ts.map

package/dist/lib/sync/read-only-local-only.js

@@ -0,0 +1,122 @@
+/**
+ * Local-only files under read-only vault prefixes (feedback_510661bc, Shepherd #2813).
+ *
+ * A teammate with a read-only share can still hold local files under that
+ * prefix — for example files written before the enforce-vault-write-access
+ * hook existed. Push will never upload them, so `hq sync status` lists them.
+ *
+ * Read-only and network-free: the access data is the local manifest at
+ * `<hqRoot>/.hq/vault-access.json` (written by refresh-vault-access), and the
+ * "already synced" set is the company's sync journal the caller already has.
+ * Permission resolution mirrors `effective_permission` in
+ * `.claude/hooks/enforce-vault-write-access.sh`.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function readVaultAccessManifest(hqRoot) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(hqRoot, ".hq", "vault-access.json"), "utf-8"));
+        return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+    }
+    catch {
+        return null;
+    }
+}
+function rank(permission) {
+    if (permission === "admin")
+        return 3;
+    if (permission === "write")
+        return 2;
+    if (permission === "read")
+        return 1;
+    return 0;
+}
+function grantMatches(grant, rel) {
+    const p = grant.path;
+    if (typeof p !== "string")
+        return false;
+    if (p === "*" || p === rel)
+        return true;
+    if (p.endsWith("/*")) {
+        return rel.startsWith(p.slice(0, -1)) || rel === p.slice(0, -2);
+    }
+    if (p.endsWith("/") && (grant.permission === "write" || grant.permission === "admin") && rel.startsWith(p)) {
+        const child = rel.slice(p.length);
+        return child.length > 0 && !child.includes("/");
+    }
+    return false;
+}
+/** Whether the manifest entry is one the write hook enforces grants for. */
+export function isGrantEnforced(company) {
+    if (!company)
+        return false;
+    const role = company.role ?? "unknown";
+    if (role !== "member" && role !== "guest")
+        return false;
+    return company.enforced !== false;
+}
+export function effectivePermission(company, rel) {
+    if (!company)
+        return "unknown";
+    const role = company.role ?? "unknown";
+    if (role === "owner" || role === "admin")
+        return "bypass";
+    if (company.enforced === false)
+        return "bypass";
+    if (role !== "member" && role !== "guest")
+        return "unknown";
+    const matches = (company.grants ?? []).filter((g) => g && grantMatches(g, rel));
+    if (matches.length === 0)
+        return "none";
+    matches.sort((a, b) => a.path.length - b.path.length || rank(a.permission) - rank(b.permission));
+    const best = matches[matches.length - 1].permission;
+    return best === "admin" || best === "write" || best === "read" ? best : "none";
+}
+/**
+ * Walk `companies/<slug>/` and return files that are not in the journal and
+ * whose effective permission is read or none. Returns an empty result for
+ * roles the hook does not enforce (owner/admin/unknown, enforced=false).
+ */
+export function findReadOnlyLocalOnly(opts) {
+    if (!isGrantEnforced(opts.company))
+        return { files: [], total: 0 };
+    const found = [];
+    const root = path.join(opts.hqRoot, "companies", opts.slug);
+    const limit = opts.limit ?? 20;
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const abs = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (entry.name === ".git" || entry.name === "node_modules")
+                    continue;
+                if (opts.shouldSync && !opts.shouldSync(abs, true))
+                    continue;
+                stack.push(abs);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (opts.shouldSync && !opts.shouldSync(abs, false))
+                continue;
+            const rel = path.relative(root, abs).split(path.sep).join("/");
+            if (opts.journalKeys.has(rel))
+                continue;
+            const permission = effectivePermission(opts.company, rel);
+            if (permission !== "read" && permission !== "none")
+                continue;
+            found.push({ path: rel, permission });
+        }
+    }
+    found.sort((a, b) => a.path.localeCompare(b.path));
+    return { files: found.slice(0, limit), total: found.length };
+}
+//# sourceMappingURL=read-only-local-only.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.153",
+  "version": "5.345.154",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.153",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.153",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.153",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.153",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.153",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.153"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.154",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.154",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.154",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.154",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.154",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.154"
   }
 }