@indigoai-us/hq-cli 5.345.156 → 5.345.159

package/dist/command-registration-plan.d.ts

@@ -400,6 +400,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/mcp-status.js";
     readonly exportName: "registerMcpCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "repo";
+    readonly parent: "program";
+    readonly module: "./commands/repo.js";
+    readonly exportName: "registerRepoCommand";
 }, {
     readonly type: "registrar";
     readonly root: "crm";
@@ -533,6 +539,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "deploy";
     readonly module: "./commands/deploy-list.js";
     readonly exportName: "registerDeployListCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "deploy";
+    readonly parent: "deploy";
+    readonly module: "./commands/deploy-access.js";
+    readonly exportName: "registerDeployAccessCommand";
 }, {
     readonly type: "group";
     readonly root: "staff";
@@ -551,6 +563,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "staff";
     readonly module: "./commands/staff/test-account.js";
     readonly exportName: "registerTestAccountCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "staff";
+    readonly parent: "staff";
+    readonly module: "./commands/staff/listings.js";
+    readonly exportName: "registerListingsCommand";
 }];
 export declare function registerAllCommands(program: Command): Promise<void>;
 export declare function registerCommandRoot(program: Command, root: string): Promise<boolean>;

package/dist/command-registration-plan.js

@@ -69,6 +69,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "reindex", parent: "program", module: "./commands/reindex.js", exportName: "registerReindexCommand" },
     { type: "registrar", root: "rescue", parent: "program", module: "./commands/rescue.js", exportName: "registerRescueCommand" },
     { type: "registrar", root: "mcp", parent: "program", module: "./commands/mcp-status.js", exportName: "registerMcpCommand" },
+    { type: "registrar", root: "repo", parent: "program", module: "./commands/repo.js", exportName: "registerRepoCommand" },
     { type: "registrar", root: "crm", parent: "program", module: "./commands/crm.js", exportName: "registerCrmCommand" },
     { type: "registrar", root: "company", parent: "program", module: "./commands/company.js", exportName: "registerCompanyCommand" },
     { type: "registrar", root: "agents", parent: "program", module: "./commands/agents.js", exportName: "registerAgentsCommand" },
@@ -91,12 +92,15 @@ export const REGISTRATION_PLAN = [
     { type: "group", root: "deploy", id: "deploy", name: "deploy", description: "Manage deployments in hq-deploy" },
     { type: "registrar", root: "deploy", parent: "deploy", module: "./commands/deploy-comments.js", exportName: "registerDeployCommentsCommand" },
     { type: "registrar", root: "deploy", parent: "deploy", module: "./commands/deploy-list.js", exportName: "registerDeployListCommand" },
+    { type: "registrar", root: "deploy", parent: "deploy", module: "./commands/deploy-access.js", exportName: "registerDeployAccessCommand" },
     // onboarding-test-accounts US-007 — super-admin staff CLI wrappers over the
     // hq-pro admin surface. New wrappers land under this group; the reset
     // command mirrors POST /v1/admin/test-account/reset.
     { type: "group", root: "staff", id: "staff", name: "staff", description: "Staff-only commands (super-admin required)" },
     { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/reset-test-account.js", exportName: "registerResetTestAccountCommand" },
     { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/test-account.js", exportName: "registerTestAccountCommand" },
+    // Marketplace moderation: queue / approve / reject over /v1/moderation.
+    { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/listings.js", exportName: "registerListingsCommand" },
 ];
 async function executePlan(program, steps) {
     const parents = new Map([["program", program]]);

package/dist/commands/_patterns.d.ts

@@ -7,6 +7,23 @@ export declare const EMAIL_PATTERN: RegExp;
  * grantee slot on the wire.
  */
 export declare const OUTPOST_UID_PATTERN: RegExp;
+/**
+ * A fleet agent uid: `agt_` plus a 26-character Crockford ULID, upper-case,
+ * the same shape as OUTPOST_UID_PATTERN. A typo (wrong length, lower-case,
+ * or a letter outside the Crockford alphabet: I, L, O, U) fails locally.
+ */
+export declare const AGENT_UID_PATTERN: RegExp;
+/**
+ * The machine email a fleet agent signs in with:
+ * `agt-<ulid>@agents.getindigo.ai`, lower-cased. The CLI sends this email as
+ * the grantee; hq-pro canonicalizes it onto the agent's `agt_…` principal
+ * when the agent is an active member of the company.
+ */
+export declare function agentMachineEmail(agentUid: string): string;
+/** Matches a fleet agent machine email; group 1 is the lower-case ULID. */
+export declare const AGENT_MACHINE_EMAIL_PATTERN: RegExp;
+/** The `agt_…` uid behind a machine email, or null when it is not one. */
+export declare function agentUidFromMachineEmail(email: string): string | null;
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/_patterns.js

@@ -7,6 +7,28 @@ export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
  * grantee slot on the wire.
  */
 export const OUTPOST_UID_PATTERN = /^out_[0-9A-HJKMNP-TV-Z]{26}$/;
+/**
+ * A fleet agent uid: `agt_` plus a 26-character Crockford ULID, upper-case,
+ * the same shape as OUTPOST_UID_PATTERN. A typo (wrong length, lower-case,
+ * or a letter outside the Crockford alphabet: I, L, O, U) fails locally.
+ */
+export const AGENT_UID_PATTERN = /^agt_[0-9A-HJKMNP-TV-Z]{26}$/;
+/**
+ * The machine email a fleet agent signs in with:
+ * `agt-<ulid>@agents.getindigo.ai`, lower-cased. The CLI sends this email as
+ * the grantee; hq-pro canonicalizes it onto the agent's `agt_…` principal
+ * when the agent is an active member of the company.
+ */
+export function agentMachineEmail(agentUid) {
+    return `agt-${agentUid.slice(4).toLowerCase()}@agents.getindigo.ai`;
+}
+/** Matches a fleet agent machine email; group 1 is the lower-case ULID. */
+export const AGENT_MACHINE_EMAIL_PATTERN = /^agt-([0-9a-hjkmnp-tv-z]{26})@agents\.getindigo\.ai$/i;
+/** The `agt_…` uid behind a machine email, or null when it is not one. */
+export function agentUidFromMachineEmail(email) {
+    const m = AGENT_MACHINE_EMAIL_PATTERN.exec(email.trim());
+    return m ? `agt_${m[1].toUpperCase()}` : null;
+}
 /**
  * Keep an ACL pattern exactly as the caller supplied it.
  *

package/dist/commands/agent-kit.js

@@ -17,6 +17,7 @@
  * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.
  */
+import { createWakeSecretResolver } from "../lib/agent-kit/wake-secrets.js";
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -37,7 +38,7 @@ import { serviceLogPath } from "../lib/agent-kit/paths.js";
 import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { spawn } from "node:child_process";
 import { pendingInbox } from "../lib/agent-kit/inbox-state.js";
-import { buildWakeNotice, clearWakeConfig, currentWakeState, DEFAULT_WAKE_RETRY_MS, describeWake, fireWake, readWakeConfig, validateWakeUrl, writeWakeConfig, } from "../lib/agent-kit/wake.js";
+import { parseHeaderSecrets, buildWakeNotice, clearWakeConfig, currentWakeState, DEFAULT_WAKE_RETRY_MS, describeWake, fireWake, readWakeConfig, validateWakeUrl, writeWakeConfig, } from "../lib/agent-kit/wake.js";
 import { runSyncLoop } from "../lib/agent-kit/run/sync.js";
 import { resolveHqBinary, resolveNodeBinary, } from "../lib/mesh/live/daemon/install.js";
 import { installServices, servicesStatus, uninstallServices, } from "../lib/service-manager/index.js";
@@ -380,6 +381,7 @@ export function registerAgentKitCommand(agent) {
         .description("POST a notice to a webhook URL (e.g. a Grok Bot routine webhook) when mail is pending. Prefer --stdin so the URL stays out of shell history")
         .option("--stdin", "Read the URL from stdin")
         .option("--retry-minutes <n>", "Re-wake while items stay pending (default 10, minimum 1)")
+        .option("--header-secret <Header=SECRET>", "Send a header using a stored company secret (repeatable; value resolved at wake time)", (value, previous) => [...previous, value], [])
         .action(async (url, opts) => {
         try {
             const paths = agentKitPaths(os.homedir(), process.env);
@@ -393,7 +395,8 @@ export function registerAgentKitCommand(agent) {
             }
             if (!raw)
                 throw new Error("Provide the URL as an argument or with --stdin");
-            const config = { kind: "url", url: validateWakeUrl(raw), retryMs: retryMsFrom(opts.retryMinutes) };
+            const headerSecrets = parseHeaderSecrets(opts.headerSecret);
+            const config = { kind: "url", url: validateWakeUrl(raw), retryMs: retryMsFrom(opts.retryMinutes), ...(Object.keys(headerSecrets).length ? { headerSecrets } : {}) };
             writeWakeConfig(paths, config);
             console.log(chalk.green(`Wake set: ${describeWake(config)}`));
             console.log("Test it: hq agent kit wake test");
@@ -450,15 +453,14 @@ export function registerAgentKitCommand(agent) {
         .description("Fire the wake once now with the current pending count")
         .action(async () => {
         try {
-            const paths = agentKitPaths(os.homedir(), process.env);
-            const creds = requireExternalCreds(paths);
-            ensureKitDirs(paths);
+            const runtime = buildKitRuntime("inbox");
+            const { paths, creds } = runtime;
             const config = readWakeConfig(paths);
             if (!config)
                 throw new Error("No wake configured. Run hq agent kit wake set-url --stdin (or set-command).");
             const log = createKitLogger(paths, "wake", { echo: false });
             const ids = pendingInbox(paths).map((e) => e.id);
-            const result = await fireWake(config, buildWakeNotice(creds.entityUid, "test", ids, new Date()), { paths, agentUid: creds.entityUid, log });
+            const result = await fireWake(config, buildWakeNotice(creds.entityUid, "test", ids, new Date()), { paths, agentUid: creds.entityUid, log, resolveHeaderSecrets: createWakeSecretResolver(creds.companySlug, runtime.getToken, creds.apiBaseUrl) });
             console.log(result.ok ? chalk.green(result.detail) : chalk.red(result.detail));
             if (!result.ok)
                 process.exit(1);

package/dist/commands/bot.js

@@ -44,7 +44,7 @@ import { DEFAULT_COGNITO, ensureCognitoToken, resolveDefaultHqRoot, } from "../u
 import { peekHqApiKey } from "../utils/resolve-vault-credential.js";
 import { getCompanyUid, resolveCallerPersonUid } from "../utils/vault-api.js";
 import { resolveHqBinary } from "../lib/mesh/live/daemon/install.js";
-import { askDaemonToStart, askDaemonToStop, daemonOwnsProcess, daemonSupervises, daemonWillSupervise, handOffInstallHere, } from "../lib/daemon/handoff.js";
+import { askDaemonToStart, askDaemonToStop, daemonOwnsProcess, daemonHoldReason, daemonSupervises, daemonWillSupervise, handOffInstallHere, } from "../lib/daemon/handoff.js";
 import { daemonPaths } from "../lib/daemon/paths.js";
 import { launchdLabel } from "../lib/bot/paths.js";
 import { isAncestorProcess } from "../lib/bot/self-process.js";
@@ -286,9 +286,11 @@ async function startBot(name, dir, config, output, extra = {}) {
     const d = botDaemonStatus(paths, daemonDeps());
     const hqDaemon = daemonPaths();
     let how;
+    let supervised = false;
     // A bot created since the daemon last read its plan is the daemon's too,
     // unless its own LaunchAgent runs it.
     if (daemonSupervises(hqDaemon, `bots:${name}`) || (!d.installed && daemonWillSupervise(hqDaemon, `bots:${name}`))) {
+        supervised = true;
         // `hq daemon` runs this bot; starting a copy here would run it twice.
         const before = readBotStatus(dir);
         if (before && isPidAlive(before.pid) && before.state === "running") {
@@ -322,18 +324,19 @@ async function startBot(name, dir, config, output, extra = {}) {
         return !!s && s.state === "running" && isPidAlive(s.pid);
     }, 15_000);
     const status = readBotStatus(dir);
+    const lastError = (!running && supervised ? daemonHoldReason(hqDaemon, `bots:${name}`) : null) ?? status?.lastError ?? null;
     if (output === "silent")
         return { running, how };
     if (output === "json") {
-        console.log(JSON.stringify({ ok: running, name, ...extra, running, how, state: status?.state ?? "unknown", pid: status?.pid ?? null, lastError: status?.lastError ?? null }, null, 2));
+        console.log(JSON.stringify({ ok: running, name, ...extra, running, how, state: status?.state ?? "unknown", pid: status?.pid ?? null, lastError }, null, 2));
         return { running, how };
     }
     if (running)
         console.log(chalk.green(`${name} is running`) + chalk.dim(` (${how})`));
     else {
         console.log(chalk.yellow(`${name} did not report running within 15s`) + chalk.dim(` (${how})`));
-        if (status?.lastError)
-            console.log(chalk.dim(`  last error: ${status.lastError}`));
+        if (lastError)
+            console.log(chalk.dim(`  last error: ${lastError}`));
         console.log(chalk.dim(`  logs: hq bot logs ${name}`));
     }
     return { running, how };

package/dist/commands/channel-suggest.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Near-match suggestions for a channel name that resolved to nothing.
+ *
+ * `hq dm channel <name>`, `hq dm <channel> "msg"`, `hq channels members` and
+ * `hq files share --channel` all resolve a channel by exact slug or display
+ * name. When that misses, the user usually typed something close to a real
+ * channel (for example "desktop-agent-coordination" for the project channel
+ * "project-desktop-agent-creation-1331ed7f"). This module ranks the caller's
+ * channels against the typed name so the error can list the closest few.
+ *
+ * Pure: no I/O, so it is unit-testable.
+ */
+/** The fields the ranker reads. Structurally compatible with ChannelSummary. */
+export interface SuggestableChannel {
+    channelId: string;
+    name?: string;
+    slug?: string;
+    scope?: string;
+}
+export interface ChannelSuggestion {
+    id: string;
+    name: string;
+}
+/** Most suggestions an error ever lists. */
+export declare const MAX_CHANNEL_SUGGESTIONS = 3;
+/**
+ * Tokens used for comparison. Drops a leading "project" token and a trailing
+ * 8-hex id, which every project channel carries and which would otherwise
+ * dominate the comparison. Falls back to the raw tokens when stripping would
+ * leave nothing (a channel literally named "project").
+ */
+export declare function comparableTokens(value: string): string[];
+/** Levenshtein distance over code points (so astral characters count once). */
+export declare function editDistance(a: string, b: string): number;
+/**
+ * Rank the caller's channels against a name that matched nothing and return
+ * up to `max` close ones, best first. Group DMs are unnamed and cannot be
+ * addressed by name, so they are never suggested. Each channel is compared by
+ * both its slug and its display name; the better score wins.
+ */
+export declare function suggestChannels(channels: readonly SuggestableChannel[], query: string, max?: number): ChannelSuggestion[];
+/**
+ * Append a "Did you mean" block to a not-found message. Returns the message
+ * unchanged when there are no suggestions.
+ */
+export declare function withChannelSuggestions(message: string, suggestions: readonly ChannelSuggestion[]): string;
+/**
+ * Thrown by channel resolvers when a name or id matches nothing. Carries the
+ * near-match suggestions so a --json caller can emit them structurally.
+ */
+export declare class ChannelNotFoundError extends Error {
+    readonly baseMessage: string;
+    readonly suggestions: ChannelSuggestion[];
+    constructor(baseMessage: string, suggestions: ChannelSuggestion[]);
+}
+//# sourceMappingURL=channel-suggest.d.ts.map

package/dist/commands/channel-suggest.js

@@ -0,0 +1,170 @@
+/**
+ * Near-match suggestions for a channel name that resolved to nothing.
+ *
+ * `hq dm channel <name>`, `hq dm <channel> "msg"`, `hq channels members` and
+ * `hq files share --channel` all resolve a channel by exact slug or display
+ * name. When that misses, the user usually typed something close to a real
+ * channel (for example "desktop-agent-coordination" for the project channel
+ * "project-desktop-agent-creation-1331ed7f"). This module ranks the caller's
+ * channels against the typed name so the error can list the closest few.
+ *
+ * Pure: no I/O, so it is unit-testable.
+ */
+/** Most suggestions an error ever lists. */
+export const MAX_CHANNEL_SUGGESTIONS = 3;
+/**
+ * Comparison strings are capped so a very long name cannot make the edit
+ * distance (quadratic) expensive across a large channel list.
+ */
+const MAX_COMPARE_LENGTH = 64;
+/** Lowercase, Unicode-normalised tokens split on '-', '_' and whitespace. */
+function rawTokens(value) {
+    return value
+        .normalize("NFKC")
+        .toLowerCase()
+        .trim()
+        .replace(/^#/, "")
+        .split(/[\s_-]+/u)
+        .filter((token) => token.length > 0);
+}
+/**
+ * Tokens used for comparison. Drops a leading "project" token and a trailing
+ * 8-hex id, which every project channel carries and which would otherwise
+ * dominate the comparison. Falls back to the raw tokens when stripping would
+ * leave nothing (a channel literally named "project").
+ */
+export function comparableTokens(value) {
+    const tokens = rawTokens(value);
+    let stripped = tokens;
+    if (stripped[0] === "project")
+        stripped = stripped.slice(1);
+    const last = stripped[stripped.length - 1];
+    if (last !== undefined && /^[0-9a-f]{8}$/.test(last)) {
+        stripped = stripped.slice(0, -1);
+    }
+    return stripped.length > 0 ? stripped : tokens;
+}
+function sharedPrefixLength(a, b) {
+    const max = Math.min(a.length, b.length);
+    let i = 0;
+    while (i < max && a[i] === b[i])
+        i += 1;
+    return i;
+}
+/** Levenshtein distance over code points (so astral characters count once). */
+export function editDistance(a, b) {
+    const left = Array.from(a);
+    const right = Array.from(b);
+    if (left.length === 0)
+        return right.length;
+    if (right.length === 0)
+        return left.length;
+    let previous = Array.from({ length: right.length + 1 }, (_, j) => j);
+    for (let i = 1; i <= left.length; i += 1) {
+        const current = [i];
+        for (let j = 1; j <= right.length; j += 1) {
+            const cost = left[i - 1] === right[j - 1] ? 0 : 1;
+            current[j] = Math.min(previous[j] + 1, current[j - 1] + 1, previous[j - 1] + cost);
+        }
+        previous = current;
+    }
+    return previous[right.length];
+}
+function toComparable(value) {
+    const tokens = comparableTokens(value);
+    return {
+        tokens: new Set(tokens),
+        joined: Array.from(tokens.join("-")).slice(0, MAX_COMPARE_LENGTH).join(""),
+    };
+}
+/**
+ * Similarity in [0, 1], or 0 when the two are not close enough to suggest.
+ * A candidate qualifies when it shares a token, shares a prefix of at least
+ * three characters, or is within 40% edit distance of the query.
+ */
+function similarity(query, candidate) {
+    if (!query.joined || !candidate.joined)
+        return 0;
+    let shared = 0;
+    for (const token of query.tokens)
+        if (candidate.tokens.has(token))
+            shared += 1;
+    const union = query.tokens.size + candidate.tokens.size - shared;
+    const tokenScore = union > 0 ? shared / union : 0;
+    const prefix = sharedPrefixLength(query.joined, candidate.joined);
+    const longest = Math.max(Array.from(query.joined).length, Array.from(candidate.joined).length);
+    const prefixScore = longest > 0 ? prefix / longest : 0;
+    const editScore = longest > 0
+        ? 1 - editDistance(query.joined, candidate.joined) / longest
+        : 0;
+    const close = shared > 0 || prefix >= 3 || editScore >= 0.6;
+    if (!close)
+        return 0;
+    return 0.5 * tokenScore + 0.2 * prefixScore + 0.3 * editScore;
+}
+/**
+ * Rank the caller's channels against a name that matched nothing and return
+ * up to `max` close ones, best first. Group DMs are unnamed and cannot be
+ * addressed by name, so they are never suggested. Each channel is compared by
+ * both its slug and its display name; the better score wins.
+ */
+export function suggestChannels(channels, query, max = MAX_CHANNEL_SUGGESTIONS) {
+    if (max <= 0)
+        return [];
+    const target = toComparable(query);
+    if (!target.joined)
+        return [];
+    const scored = [];
+    for (const channel of channels) {
+        if (channel.scope === "group")
+            continue;
+        const slug = channel.slug?.trim() ?? "";
+        const name = channel.name?.trim() ?? "";
+        if (!slug && !name)
+            continue;
+        const score = Math.max(slug ? similarity(target, toComparable(slug)) : 0, name ? similarity(target, toComparable(name)) : 0);
+        if (score <= 0)
+            continue;
+        scored.push({
+            suggestion: { id: channel.channelId, name: slug || name },
+            score,
+        });
+    }
+    scored.sort((a, b) => b.score - a.score ||
+        a.suggestion.name.localeCompare(b.suggestion.name) ||
+        a.suggestion.id.localeCompare(b.suggestion.id));
+    return scored.slice(0, max).map((entry) => entry.suggestion);
+}
+/**
+ * Strip control and bidi-override characters so a server-supplied name cannot
+ * drive the terminal or visually reorder the line.
+ */
+function printable(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+/**
+ * Append a "Did you mean" block to a not-found message. Returns the message
+ * unchanged when there are no suggestions.
+ */
+export function withChannelSuggestions(message, suggestions) {
+    if (suggestions.length === 0)
+        return message;
+    const lines = suggestions.map((s) => `  ${printable(s.name)} (${printable(s.id)})`);
+    return `${message}\nDid you mean:\n${lines.join("\n")}`;
+}
+/**
+ * Thrown by channel resolvers when a name or id matches nothing. Carries the
+ * near-match suggestions so a --json caller can emit them structurally.
+ */
+export class ChannelNotFoundError extends Error {
+    baseMessage;
+    suggestions;
+    constructor(baseMessage, suggestions) {
+        super(withChannelSuggestions(baseMessage, suggestions));
+        this.name = "ChannelNotFoundError";
+        this.baseMessage = baseMessage;
+        this.suggestions = suggestions;
+    }
+}
+//# sourceMappingURL=channel-suggest.js.map

package/dist/commands/channels.js

@@ -1,6 +1,7 @@
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
+import { suggestChannels, withChannelSuggestions } from "./channel-suggest.js";
 import { callerFromToken, channelSlug, fetchChannelMembers, fetchChannels, matchChannelsByName, } from "./dm.js";
 /**
  * Human label for a channel row. Named channels (personal/company) show their
@@ -189,7 +190,12 @@ async function runChannelsMembers(channelName, opts) {
         const channels = await fetchChannels(token);
         const matches = matchChannelsByName(channels, channelName);
         if (matches.length === 0) {
-            console.error(chalk.red(`No channel named '${channelName}' — run \`hq channels\` to see your channels.`));
+            const message = `No channel named '${channelName}' — run \`hq channels\` to see your channels.`;
+            const suggestions = suggestChannels(channels, channelName);
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, error: message, suggestions }, null, 2));
+            }
+            console.error(chalk.red(withChannelSuggestions(message, suggestions)));
             process.exit(1);
         }
         if (matches.length > 1) {

package/dist/commands/cloud.d.ts

@@ -69,6 +69,32 @@ export declare function scopeExcludedExitCode(count: number): 0 | 1;
 export declare function scopeExcludedWarning(count: number): string | null;
 /** Actionable recovery for files refused because the vault baseline is stale. */
 export declare function staleUploadRefusalLines(count: number, paths?: readonly string[]): string[];
+/**
+ * Upload-failure fields newer hq-cloud ShareResult carries. Read through
+ * readUploadFailures so this CLI also builds against a release without them.
+ */
+export interface UploadFailureCounts {
+    filesUploadFailed?: number;
+    uploadFailedPaths?: string[];
+}
+export declare function readUploadFailures(result: object): {
+    count: number;
+    paths: string[];
+};
+/**
+ * Files the vault accepted in the plan but refused or failed at upload
+ * (feedback_943456f4). Without these lines a push that uploaded nothing
+ * printed "✓ Pushed 0" and exited 0.
+ */
+export declare function uploadFailedLines(count: number, paths?: readonly string[]): string[];
+/**
+ * share() option that turns a user-named path an ignore rule drops into an
+ * "unreachable path" error instead of a silent 0-file success
+ * (feedback_63bfc302, feedback_8c294805). Spread as a plain record so this
+ * builds against an hq-cloud release whose ShareOptions predates the field;
+ * older releases ignore it.
+ */
+export declare function namedPathShareOptions(userNamedPaths: boolean): Record<string, boolean>;
 /**
  * Optional detail line listing the effective write prefixes when a push
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
@@ -241,6 +267,8 @@ export interface ShareCallResult {
     filesExcludedByScope: number;
     filesRefusedStale?: number;
     filesRefusedStalePaths?: string[];
+    filesUploadFailed?: number;
+    uploadFailedPaths?: string[];
     conflictPaths: string[];
     aborted: boolean;
     /** Files this leg's plan limit refused; absent or null when none were. */
@@ -286,6 +314,8 @@ export interface PushAllResult {
     filesExcludedByScope: number;
     filesRefusedStale?: number;
     filesRefusedStalePaths?: string[];
+    filesUploadFailed?: number;
+    uploadFailedPaths?: string[];
     errors: Array<{
         company: string;
         message: string;
@@ -418,4 +448,19 @@ export declare function printReadOnlyLocalOnly(hqRoot: string, journals: Readonl
         files?: Record<string, unknown>;
     };
 }>, log?: (line: string) => void): number;
+/**
+ * `hq sync status`: list local files under server-owned folders (sources/,
+ * signals/, ontology/ outside entities/) that are not in the sync journal.
+ * The server pipeline writes these folders; a client push refuses them and
+ * the recurring runner skips them quietly, so a file written locally there
+ * never reaches the vault and `pendingFiles: 0` still reports a clean tree
+ * (feedback_0414d71c). Uses only the journals already loaded, with no
+ * network calls. Prints nothing when nothing applies.
+ */
+export declare function printServerOwnedLocalOnly(hqRoot: string, journals: ReadonlyArray<{
+    slug: string;
+    journal: {
+        files?: Record<string, unknown>;
+    };
+}>, log?: (line: string) => void): number;
 //# sourceMappingURL=cloud.d.ts.map