@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/CHANGELOG.md

@@ -2,7 +2,262 @@
 
 ## [Unreleased]
 
+## [5.345.160] — 2026-10-22
+- The bundled sync engine now uses hq-cloud 6.18.98. When HQ pauses an account because of usage, `hq sync` now shows the server's usage-pause message and a Billing link instead of a generic failure (hq-cloud #1036).
+- `hq billing usage` now shows the amounts on HQ's usage statement, which is what the invoice bills. Before this it re-priced the meters itself, so it could show a different figure than the statement, for example charging the vault fee during the trial when the statement waived it.
+- When HQ pauses an account because of usage (spend limit reached, card needed, or trial cap hit), `hq` now shows the server's own message and a Billing link, with no plan-limit or Upgrade wording and no old plan names (Starter, Workforce, Individual). This covers sync, skills, agent enroll, meetings, members, secrets, integrations and remote databases. `hq billing upgrade` now opens the usage-pricing switch page instead of a Workforce checkout. `hq billing usage` now shows the company's usage view, and tells a member to use `--personal` for their own usage. Plan and trial reads use the server's shared plan status when it is available, and older servers keep working as before. (US-024)
+
+- `hq files acl` and `hq access` show a path whose most-specific ACL row has no grants and is not open as locked by that row (`lockedBy` in `--json`), instead of as inheriting a broader `*` grant. An open empty row is not a lock: broader grants still apply. An empty ancestor row, whose open flag the server does not report, reads as locked unless that row is open.
+- `hq billing upgrade` no longer dead-ends on the closed HQ Workforce checkout. When hq-pro answers that Workforce is closed to the company (`workforce_closed_to_new_signups`), the command explains that the company stays on Starter unless it switches to usage pricing, says to add a card first with `hq billing checkout`, and opens the console's usage-switch page for the company (`--no-browser` prints it; `--json` returns `{ url, legacyPlansClosed: true, message }`). The open-checkout line no longer quotes a plan price. The over-limit notice (`hq whoami`) and the plan-limit refusal printed by `hq secrets`, `hq members` and sync now read hq-pro's `legacyPlansClosed` field: while Workforce is closed they offer "Switch to usage pricing" with the switch link and never the free Workforce month or an "Upgrade to HQ Workforce" line. Older servers keep today's wording.
+- `hq-hook` gains the US-021 bridge used by master-hook.sh: `hq-hook bridge-plan`
+  lists the registry hooks whose `hook-engine-port-<id>` flag is `shadow` or
+  `on`, `hq-hook bridge <id>` runs one hook natively (shadow compares with bash
+  and returns the bash result; on returns the native result; a missing port or
+  a declined payload falls back to bash), and `hq-hook --self-check` reports the
+  engine version and bridge schema. The local kill switch `HQ_HOOK_ENGINE=off`
+  or the file `~/.hq/hook-engine.off` forces bash before any flag is read.
+  Shadow comparisons are appended to `~/.hq/logs/hook-engine.jsonl` with hook
+  ids, hashes, exit codes and timings only.
+- `hq-hook run derive-trigger-facts` and `hq-hook run eval-trigger` are native
+  ports of the two policy-trigger helpers (US-008, first slice), byte-identical
+  to the bundled shell on the parity corpus, with git facts read in-process.
+- `hq core hook-engine-path` now runs the engine's `--self-check` before
+  printing its path, and writes `~/.hq/bin/hq-hook/current` so hooks can find
+  the pinned engine without starting Node. A binary that fails its self-check
+  exits non-zero and removes that pointer, keeping bash hooks active.
+
+## [5.345.159] — 2026-10-22
+- `hq lanes link read` and `wait` now require the selected conductor session to own the requested link, preventing accidental cross-link report consumption while preserving explicit session resume/delegation and child inbox access.
+- `hq lanes resume` now uses the canonical lane ID after resolving a short ID. When low disk space queues a resume, it keeps the requested instruction for later admission and reports the lane as queued rather than started.
+- `hq sync status` now accepts `--company <slug>` and shows only that
+  company's sync journal. A company with no journal gets a message that names
+  it, and a blank value is rejected. Before this, the option was refused as
+  unknown. Feedback 7dee0a07-55a6-43f1-9b76-b4293bdd371b.
+
+- The bundled sync engine now uses hq-cloud 6.18.92. HQ Sync never uploads
+  or downloads company secret folders, even when an HQ root has an old or
+  missing `.hqignore`. The default ignore list now covers
+  `companies/<co>/secrets/`, `companies/<co>/settings/`, and any `.secrets`
+  folder or file at any depth. A folder named `secrets` inside company
+  knowledge still syncs. Files already on disk stay where they are.
+- The bundled sync engine now uses hq-cloud 6.18.95 (hq-cloud #1019 and
+  #1021). HQ Sync excludes credentials files from sync, and the credentials
+  match is now case-insensitive.
+- The bundled sync engine now uses hq-cloud 6.18.97, the current npm `latest`.
+  Sync now keeps local settings files intact when it repairs a sync record
+  (hq-cloud #1035). It also carries the 6.18.96 fixes: pull no longer deletes
+  or overwrites local files right after a sync record is recovered,
+  `hq sync --watch` waits to pull until a failed push is retried, sync stops
+  retrying when a sandbox blocks the network, the personal-vault sync record is
+  tied to the signed-in person, and pulls report every file they delete or skip.
+- `hq core checkpoint` no longer leaves the checkpoint sibling without a queue file. The launcher now creates an empty `workspace/checkpoints/sibling/pending.jsonl` before it starts the sibling, and the sibling prompt treats a missing or empty queue as empty instead of reporting an error (feedback_5ad007c4).
+- Stop `hq daemon` from restarting a failing service forever. A service that
+  fails for a cause a restart cannot fix (a missing or non-executable binary,
+  exit code 77/78/126/127, or an npm error code such as ETARGET or E404) is
+  held at once. Any other failure keeps the usual backoff until the sixth
+  failure without 30 minutes of healthy running, then the service is held.
+  A held service shows as `held` with its reason in `hq daemon status`, stays
+  held across daemon restarts (recorded in `~/.hq/daemon/holds.json`), and
+  starts again on `hq daemon restart <unit>`, a command change, or a CLI
+  update.
+
+  Held bots remain daemon-owned when started or stopped through `hq bot`; an explicit start asks the supervisor to retry instead of launching a separate process. A failed start reports the current hold reason and recovery command.
+
+- Exhausted transient sync/mesh holds now wait the existing 30-minute healthy
+  episode window, then claim one supervised retry durably before starting it.
+  Failure re-holds for another window; only a continuously running probe earns
+  the healthy reset. Daemon restarts keep the deadline and claim. Missing or
+  invalid legacy deadlines get one full window instead of an immediate burst.
+  A durable-claim write failure keeps the service held. Permanent holds and
+  other services remain manual. An explicit stop of a recovering sync/mesh unit
+  persists across daemon restarts and command/version changes until an explicit
+  start/restart; a paused plan never launches a probe while blocked. This does
+  not change stop semantics for healthy units. The held reason includes the
+  next supervised retry time.
+- `hq deploy access <app> --mode public` now asks for approval when the app is not already public, and any change that removes an app's password protection prints a warning and asks for approval. The prompt names the app and the old and new mode. Pass `--yes` to approve without a prompt. Without a terminal and without `--yes`, the command refuses, changes nothing, and exits 1. Changing the mode now keeps the saved member lists and company id, so switching back to selected restores the previous members. Unexpected failures now include the error type and message, and unexpected hq-deploy responses include the HTTP status, error code and server message.
+- `hq deploy access app_<id> --mode ...` now reads the app's own record before changing access by direct app id, so it no longer clears a real password without approval when the saved access policy does not show the password. Removing a password still needs approval or `--yes`. If the app record cannot be read (403 or 404), belongs to a different id, or does not state whether the app has a password, the command refuses and changes nothing, even with `--yes`.
+- When `hq dm channel`, `hq dm <channel>`, `hq channels members` or `hq files share --channel` cannot find a channel by name, the error now lists up to three of your channels with the closest names. Comparison ignores the `project-` prefix and the trailing 8-character id, so `desktop-agent-coordination` suggests `project-desktop-agent-creation-1331ed7f`. With `--json`, `hq dm channel` and `hq channels members` print the error with a `suggestions` array of `{id, name}`. The exit code is still 1.
+- `hq sync status` now lists local files under a company's server-owned folders (`sources/`, `signals/`, and `ontology/` outside `entities/`) that are not in the sync journal. The cloud pipeline writes those folders and push skips them without counting them as pending, so meeting notes or signals filed there by a local skill never reached the vault while status reported a clean tree. The warning names up to 20 paths per company and says to keep self-written notes under `knowledge/` or add sources through an ingestion flow.
+- `hq lanes resume` and `hq lanes message` now print a line to stderr before
+  the resume-time `/compact` starts, saying it can take up to 10 minutes and
+  that `--no-compact` skips it. Before this the command printed nothing while
+  compaction ran and looked hung.
+- `hq files acl <prefix>` now lists the more specific rules under the prefix (for example a bare `knowledge` row or a `knowledge/agents/` folder row), including rules that carry no grants. Each of those rules replaces the prefix's grants for its own paths, so a grant on `knowledge/*` did not reach them, and the old view hid them because it only showed grants. `--json` carries them as `masking`.
+- `hq files share <prefix> --with <principal>` warns when the new grant is shadowed by more specific rules that do not include that principal, names the paths, and shows the share command for them. Both need hq-pro with the `masking` / `maskedBy` fields; older servers print the old output. (feedback_466fe8b8)
+- `hq secrets share` and `hq secrets unshare` now explain a permission refusal plainly: changing who can see a secret needs admin permission on it, and read access is not affected. The old "Not authorized to share this secret" text made people and agents think the secret itself was locked to them.
+- `hq secrets share` now prints the server's explanation when a secret takes its access from a broader ACL (for example `SLACK/*`) and names the path to share instead. It used to print "Concurrent modification — please retry", which retrying would never fix.
+- New `hq mesh project archive|complete|activate <projectId> --company <slug>`
+  moves a Board between active, completed and archived through the server's
+  lifecycle route, and `hq mesh project lifecycle [projectId] --company <slug>`
+  lists or shows that state. Use `archive` to put away a duplicate Board (for
+  example one registered under a board id next to the live one registered
+  under the folder slug). Nothing is deleted: stories, the project folder,
+  channel, memberships and history stay; the project only leaves the active
+  Board list and the organize candidates, and `activate` brings it back. When
+  the Board still has stories, `archive` stops and asks for
+  `--confirm-nonempty`. A project already in the requested state is reported
+  and left alone. Feedback 5d596dd0-6748-4aba-b437-f57ee914e311.
+- `hq dm send` gains `--attach <path>` (repeatable, up to 5 files, 25 MB
+  each). Before this, sending an image to a teammate or agent meant copying it
+  into the company vault, running a sync push, and pasting the path into the DM
+  text. Now the CLI presign-uploads each file into the conversation's own vault
+  scope (`chat/attachments/dm/<uidA--uidB>/…` in the sender's personal vault
+  for a 1:1 DM, `chat/attachments/chan/<channelId>/…` in the channel's company
+  vault for a named channel, including `--thread` replies), sends it as
+  `attachments[]` on the message, and prints each file's vault path. The
+  message body may be empty when a file is attached. Missing, oversized, or
+  too many files are refused by name before anything is uploaded; group DMs,
+  scheduled sends (`--at`/`--in`), and agent senders on 1:1 DMs are refused
+  with a plain message.
+- `hq secrets share` and `hq secrets unshare` now accept a fleet agent uid (`agt_` plus a 26-character upper-case Crockford ULID) as the principal, so `/delegate` to a fleet agent no longer stops at "Invalid principal 'agt_…'". The CLI sends the agent's machine email (`agt-<ulid>@agents.getindigo.ai`) and hq-pro stores the grant under the agent's `agt_…` principal (granteeType `person`), which is the row `hq secrets acl` then lists. `share` first checks the company agent roster and refuses, writing nothing, when the agent is not an active agent of this company; a malformed uid or machine email is rejected locally. The success line names both the uid and the email.
+- `hq signals list` and `hq signals get` now accept `--company <slug>`, the
+  same flag `hq meetings` and `hq integrations` take. It means the same thing
+  as `--entity`. Before this, `hq signals list --company <slug>` failed with
+  `unknown option '--company'`. Passing `--entity` and `--company` with
+  different values is an error.
+- `hq secrets script approve` no longer replaces an existing approval by accident. Approving an `--id` that is already approved for a different path or hash now fails, keeps the stored approval, and says what to do: pass `--replace` to replace it on purpose, use a new `--id`, or approve one HQ-relative `--remote-path` so a single approval matches on every machine. Re-sending the identical approval still succeeds. Needs hq-pro with the matching `script_id_exists` refusal; older servers keep replacing. (feedback_8224c4d5)
+- When the minimum-version gate refuses an older local or user-level copy of `hq` (for example a pnpm user-global install in `~/.local` that shadows `/usr/bin/hq`), it now runs the command with a newer global `hq` from `/usr/bin`, `/usr/local/bin` or `/opt/homebrew/bin` instead of exiting 75. The old copy still never runs the command, and the gate still exits 75 when no qualifying global install exists.
+- New `hq repo add <path> --company <slug>` registers a git checkout with HQ.
+  It links the checkout into `repos/private/<name>` (or `repos/public/` with
+  `--public`) and adds it to `companies.<slug>.repos` in
+  `companies/manifest.yaml`. Before this, you had to make the symlink and edit
+  the manifest by hand. A checkout that already sits directly under `repos/` is
+  registered where it is. Running it again changes nothing. `--dry-run` shows
+  the plan without changing anything. Comments and layout in the rest of the
+  manifest stay as they were.
+- `hq lanes stop` (and every other lane write) no longer fails with
+  `store_lock_timeout` because of a lane record lock left behind by a process
+  that died. A lock is now reclaimed when the process that wrote it no longer
+  exists, or, when the lock file is empty or unreadable (a process killed
+  between creating and writing it), once the file is older than 30 seconds.
+  The lock now records its hostname, and the dead-process rule applies only
+  to locks written on this machine; a lock from another host or with no host
+  falls back to the 30-second age rule.
+  Before this, an empty or partial lock file was never reclaimed. A lock held
+  by a live process is still respected.
+  Reclaiming a stale lock is now atomic, so two waiters cannot both take it,
+  and a holder releases the lock only if it is still its own. A lock whose
+  timestamp is in the future ages out by file time. The 30-second window can
+  be changed with `HQ_LANES_LOCK_STALE_MS`.
+- New `hq feedback show <id>` for HQ operators. It prints one feedback row
+  (title, status, company, reporter, body) and lists its screenshots, email
+  attachments and log bundle. `--download <dir>` saves the attachments to that
+  directory, and `--logs` adds the log bundle. `--json` prints the row with
+  download links removed. The server only allows operators, so anyone else
+  gets an "operators only" error, and the command never prints a download
+  link or token. Needs hq-pro#5143 for screenshot links. Feedback
+  b1d14d0a-caff-4bae-bee4-977fc6b1d6e6.
+- New `hq deploy access` command manages who can open a deploy app.
+  `hq deploy access get <app>` shows the current mode and selected members.
+  `hq deploy access <app> --mode company|selected|public` changes the mode, and
+  `--add-user`, `--remove-user`, `--add-group`, `--remove-group` edit the
+  selected-members list. `<app>` is an app id, subdomain, or exact name. It
+  calls hq-deploy's existing `/api/apps/:id/access-policy` API with your HQ
+  sign-in, so only the app owner or a company admin can change access. Any
+  other mode is refused before a request is sent.
+  For an app with no saved policy, the company id comes from the app record
+  or from `--company` (or the active company), never the hq-deploy org id; if
+  it cannot be found the command stops with an error and changes nothing.
+- `hq dm <name>` now sends to a person in your contacts whose name matches exactly, instead of a channel that shares that slug, and prints which person it chose. Use `#name` or `--channel name` to post to the channel.
+- `hq dm <name> "..."` now says which channel the name resolved to when it
+  differs from the channel's display name. Before this, `hq dm setup "hi"`
+  printed only `Message posted to #welcome.`, with nothing linking `setup` to
+  `#welcome`. The line now reads
+  `Message posted to #welcome (resolved 'setup' to personal channel chn_...).`
+- `hq lanes watch` keeps monitoring loop lanes between phase envelopes, even
+  when the last phase briefly records `done`. It continues account checks and
+  waits for the live loop controller to stop, fail, or exit before treating that phase as
+  terminal. Ordinary lanes and failed launches without loop metadata still exit.
+- `hq feedback bug|feature` now prints a `Track:` link to the ticket's public page on status.hqforwork.com. New `hq feedback link <id>` prints that link for an existing ticket, and `hq feedback update <id> --state <state> --note "<text>"` posts a customer-visible status update that also lands in the ticket's #hq-feedback thread.
+- Single-company local bots bind before DM, room, and scheduled-job turns. Company-setting changes pause new turns until restart; prior company conversations are archived before starting fresh. Binding failures retain pending work without invoking the model. Existing company bots archive unproven conversations once after upgrade while preserving pending reply and job recovery. Archives are retained for manual recovery.
+- Agent kit URL wakes accept repeatable `--header-secret Header-Name=VAULT_SECRET_NAME` references, resolving values with the agent identity at each wake without storing or logging them.
+- The bundled shell scripts `rebuild-company-knowledge-index.sh` and `rebuild-projects-index.sh` now follow the same argument rules as `hq core rebuild-index company-knowledge|projects`. `--help` or `-h` prints usage, exits 0, and writes nothing, even when `--accept` is also given. A company slug (positional, `--company <slug>` or `--company=<slug>`) limits writes to that company's INDEX.md; `projects` no longer rewrites other companies or `personal/projects/INDEX.md` in that case. `--accept` overwrites a hand-edited INDEX.md in the selected scope. Without it, `rebuild-company-knowledge-index.sh` now keeps a hand-edited INDEX.md the way `rebuild-projects-index.sh` already did. Unknown options, a second slug, an invalid slug or a missing company exit 1 before any write. A symlinked INDEX.md is refused with exit 1 and its target is not read or written. Each INDEX.md is now installed by renaming a temp file from the same directory over it, as the native renderer does, so another file hard-linked to the old INDEX.md keeps its bytes. An existing INDEX.md keeps its permission bits. Before, the bundled scripts ignored all arguments and rebuilt every index.
+- Restrict lane moves and account recovery to accounts explicitly assigned to the lane company. Configure account ownership with `company` in `personal/lanes/config.json`; unavailable same-company recovery capacity leaves pending work queued. Preserve existing untagged account assignments while enforcing company ownership for creation, queued admission, first assignment, profile refresh, and account moves.
+- Make account company enforcement opt-in per provider: while no account for a provider has a `company` tag, company lanes keep creating and assigning on untagged accounts, consistently at creation, first assignment, and queued admission. Once a provider has a tagged account and every enabled candidate is excluded only by company, creation and first assignment report `account_company_mismatch` with the lane company, the excluded accounts, and the `company` key in `personal/lanes/config.json`. Recorded Claude-account recovery, balance move suggestions, and the company account-retry hold now use the resolved lane company (lane, mesh company, then project owner).
+- The pipeline driver no longer exits 22 (deadline) or 28 (stall) for a phase
+  that is still waiting in its loop lane's queue, for example while the lane is
+  queued behind the host throttle or busy on another envelope. Once the lane
+  picks the phase up it gets its full deadline budget. This ports
+  hq-core-staging #1357 to the native driver and also covers the stall check.
+  Queue time is bounded by `PC_QUEUE_MAX_MIN` (default 240): a phase still
+  waiting after that long ends the run with exit 22 and a QUEUED_TOO_LONG
+  message naming the lane. An admitted lane with an empty queue that is not
+  working on the phase no longer counts as holding it, so the deadline applies.
+  While the lane is busy on an envelope from another run, the phase waits on
+  that envelope's own watchdog, up to the queue ceiling.
+- Loop lane workers, watchers and the drain hook registration that outlive a
+  Node upgrade now use a live Node binary when the one they were launched with
+  has been removed: the Homebrew prefix `bin/node` link for a Cellar path,
+  else `node` on PATH. This covers watcher queued-message recovery, terminal
+  keep-alive scheduling and senior message delivery.
+- `hq sync push`, `hq sync push --all` and `hq sync now` no longer report
+  success when files failed to upload. When hq-cloud reports failed uploads
+  (for example a refused presign), the CLI prints how many files were not
+  uploaded and lists them, adds `filesUploadFailed` and `uploadFailedPaths`
+  to the `--json` complete event, and exits 1. A path you type on
+  `hq sync push` that an ignore rule drops (a `.hq-*` file or a generated
+  INDEX.md) now fails with the rule that dropped it instead of printing a
+  0-file success. Both need the hq-cloud release that reports these cases.
+  Feedback 943456f4-56bf-43bc-94fa-bdbc7384ec41,
+  63bfc302-ae00-4d32-9d94-0a5eaf8e1314,
+  8c294805-8761-44c4-abf2-5ab14c263d84.
+- `hq core rebuild-index --help`, `-h`, and `hq core rebuild-index <target> --help` now print usage and exit without rewriting any INDEX.md. Before, `rebuild-index all --help` (and other targets without their own help) rebuilt every index.
+- `hq core worktree --base origin/<branch>` (and the scaffold `worktree.sh`)
+  now accepts the `origin/` prefix instead of building `origin/origin/<branch>`.
+- The `hq monitor` expiry message now names `--timeout <duration>` and
+  `--persistent` for re-arming a longer watch. The 5-minute default is unchanged.
+- The CLI no longer waits about 4 minutes on a leftover `update.pending.json`
+  after a reboot. A request written before the current boot, or whose pid is
+  gone or belongs to another user (EPERM), is treated as stale and removed.
+- Fixed `hq integrations connect --link-only` ignoring a supplied OAuth client ID and stdin client secret. Link-only sign-in now uses the caller's registered app while keeping the console callback and returning the sign-in URL without opening a browser.
+- `hq lanes loop` no longer stalls when a phase's watcher is still finishing a slow mesh call as the next phase starts. The finishing watcher now releases its single-owner claim right after the terminal write, before mesh and follow-up awaits. A new watcher that finds a live claimant from an older run retries the claim for up to 60 s instead of exiting, and a lost claim is logged as `watcher_claim_lost`. A live claimant on the same run still makes the new watcher exit at once.
+- After it releases the claim, a finishing watcher's follow-up lane writes (status gate, blocker and KR freshness, repair continue) and queued-message recovery are skipped once the lane has moved to a newer run, so they cannot overwrite or re-queue the next phase.
+- `hq lanes accounts list` no longer reports an expired Claude sign-in as logged in. For each Claude account it reads the access-token expiry of the credential the lane worker uses (the Keychain item for that account's `CLAUDE_CONFIG_DIR` on macOS, or `.credentials.json`). An access token past its expiry still counts as signed in when it has a refresh token that `hq capacity` has not recorded as revoked, since Claude Code renews it at startup. A sign-in that cannot be renewed shows `logged_in: false`, `sign_in_state: "expired"`, `sign_in_expires_at`, `error: "sign_in_expired"` and a `fix_command`. Lane auto-select skips that account, and a lane started on it fails before the worker starts with a message to open Claude Code on the account and run `/login`, instead of exiting 10 to 20 seconds in with an OAuth error.
+- `hq capacity login` and the Remote Control lane check the same Claude sign-in expiry, and the quota-held explicit account pick passes the expiry check through to its status read.
+- Loop lanes created with `--no-story` now run every phase. Before, each phase after the first failed with `--story must be non-empty` because the loop passed an empty story to the resume step. The loop now leaves the story unset for these lanes, and a phase envelope that names a `story_id` on a no-story lane is ignored with a warning instead of writing a lane record that could no longer be loaded or cancelled. Feedback: "Loop lanes created without a story fail every phase after the first".
+- `hq lanes set --model/--effort` now works for a lane that runs on an Outpost.
+  The change is forwarded to the Outpost that owns the lane, which re-checks
+  that the caller is the lane or its senior before applying it. Before this, the
+  command refused any Outpost lane. An Outpost that has not been upgraded yet
+  returns `outpost_cli_upgrade_required` instead of an unknown-command error.
+- The phase worker brief now tells the worker to copy each acceptance criterion
+  verbatim into its handoff `ac_evidence[].criterion`, keep its 0-based index,
+  and not shorten or paraphrase the text, so the criteria recheck matches them
+  (feedback fa21c737).
+- The native pipeline driver no longer exits 23 when a worker writes a handoff
+  that fails validation. It moves the worker's file to
+  `handoffs/<story>-<phase>.invalid.<n>.json`, records the phase as failed with
+  the validation error, and keeps driving; the fail cap still bounds retries.
+  The loop lane runner no longer overwrites a handoff the worker already wrote
+  to `result_path`; its own failed handoff goes beside it as
+  `<name>.lane-failure.json`. The phase brief now says that `summary`,
+  `context_for_next` and each `ac_evidence` `evidence` are single strings.
+- Company project and knowledge index rebuilds preserve manually curated legacy files even when they still carry an auto-generated header. Unstamped files are refreshed only when their body matches the current render; `--accept` remains the explicit overwrite path. Native rendering and bundled compatibility scripts apply the same protection (feedback f4468815).
+- `scripts/scaffold-freshness.json` now records the current sha256 of the bundled `rebuild-company-knowledge-index.sh`, `rebuild-projects-index.sh` and `worktree.sh`, which #2115 and #2121 changed without updating the manifest. The tag-only scaffold bundle freshness check failed on v5.345.157 because of this.
+- `hq scan secrets --staged` now reads `[[allowlists]]` (and the legacy
+  `[allowlist]`) from the repo's own `.gitleaks.toml`, with gitleaks semantics
+  for `paths`, `regexes`, `regexTarget`, `stopwords`, `commits`, `targetRules`
+  and `condition = "AND" | "OR"`, on top of the built-in rules, for that repo
+  only. The file is read from git, not the working tree: it applies only once
+  committed, so a commit that changes it is scanned with the previous version.
+  Every allowlist needs `paths` that start with `^` and a literal name
+  (such as `^fixtures/`); `regexes` and `stopwords` need `condition = "AND"`.
+  A file that breaks these rules, cannot be parsed, is a symlink, or has an
+  unknown key or an unsafe regex stops the scan with exit 2 and names the
+  problem.
+- HQ staff can review marketplace listings from the CLI. `hq staff listings queue` lists pending listings, oldest first. `hq staff listings approve <lst_id> [--note <text>]` approves one and prints any older versions it replaced, and `hq staff listings reject <lst_id> --note <reason>` rejects one with a required reason. A `@vyg.ai` staff session is no longer refused locally by `hq staff` commands, matching the server.
+- `hq company settings set --work-mesh-live-enabled` help now says live work tracking is on by default, matching the server change that turns Work Mesh Live on for every company unless it sets the value to false.
+- Add `hq crm entity list` and `hq crm entity get` to read CRM entities, and enforce the session company lock for CRM reads and upserts.
+
 ## [5.345.156] — 2026-10-21
+- Automatic Stop-gate checkpoints now start at most one background checkpoint
+  agent per session every 30 minutes. Each of those runs costs a fresh agent
+  session's worth of tokens, and most of them found nothing new. A skipped run
+  still writes the checkpoint thread, so the Stop gate behaves the same.
+  `/checkpoint` and runs without a session id are unchanged, and
+  `HQ_CHECKPOINT_AGENT=0` still turns the agent off. Feedback
+  90c33997-5a41-4a23-a23e-f7172bfead88.
+
 - `hq doctor --fix` stops pulling a company the sync service could not find
   for your HQ account. When a pull fails because the company does not exist
   for you or access is refused, the next check shows that company's stale

package/assets/scaffold/core/scripts/rebuild-company-knowledge-index.sh

@@ -16,9 +16,46 @@
 
 set -euo pipefail
 
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index company-knowledge [<company> | --company <company>] [--accept]' \
+      '' \
+      'With a company, rebuild only that company'\''s index. Without a company, retain the all-company rebuild. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 
+# Company scope, mirroring the native companyScope() contract: one slug as a
+# positional, --company <slug>, or --company=<slug>. --accept overwrites a
+# hand-edited INDEX.md in the selected scope. Anything else is refused before
+# any write.
+SCOPE=""
+ACCEPT=0
+scope_error() { printf 'hq: rebuild-index company-knowledge: %s\n' "$1" >&2; exit 1; }
+while [[ $# -gt 0 ]]; do
+  value="$1"
+  if [[ "$value" == "--accept" ]]; then ACCEPT=1; shift; continue; fi
+  if [[ "$value" == "--company" ]]; then shift; value="${1:-}";
+  elif [[ "$value" == --company=* ]]; then value="${value#--company=}"; fi
+  [[ -n "$value" && "$value" != -* ]] || scope_error "expected a company slug; unknown or incomplete option"
+  [[ -z "$SCOPE" ]] || scope_error "supply only one company slug"
+  [[ "$value" =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]] || scope_error "invalid company slug"
+  SCOPE="$value"
+  shift
+done
+if [[ -n "$SCOPE" ]]; then
+  [[ -e "companies/$SCOPE" || -L "companies/$SCOPE" ]] || scope_error "no company directory named \"$SCOPE\""
+  [[ -d "companies/$SCOPE" && ! -L "companies/$SCOPE" ]] || scope_error "company must be a real directory"
+  scope_content="companies/$SCOPE/knowledge"
+  if [[ -e "$scope_content" || -L "$scope_content" ]]; then
+    [[ -d "$scope_content" && ! -L "$scope_content" ]] || scope_error "content must be a real directory"
+  fi
+fi
+
 DATE=$(date -u +%Y-%m-%d)
 
 titleize() {
@@ -86,6 +123,33 @@ sha256_file() {
   fi
 }
 
+# replace_entry <content-file> <target>: install content as <target> by
+# renaming a same-directory temp file over the directory entry, like native
+# atomicWrite(). The old inode is never written, so a hardlinked alias keeps
+# its bytes. Symlinks and directories at <target> are refused before the
+# rename, so mv never follows or descends into them. An existing target's
+# permission bits are kept; a new file gets 0666 minus the umask.
+replace_entry() {
+  local content="$1" target="$2" dir tmp mode
+  if [[ -L "$target" || -d "$target" ]]; then
+    echo "rebuild-company-knowledge-index: refused ${target} (INDEX.md is a symlink or directory)" >&2
+    rm -f "$content"
+    exit 1
+  fi
+  dir=$(dirname "$target")
+  tmp=$(mktemp "${dir}/.INDEX.md.XXXXXX") || { rm -f "$content"; exit 1; }
+  if [[ -e "$target" ]]; then
+    mode=$(stat -c %a "$target" 2>/dev/null || stat -f %Lp "$target")
+  else
+    mode=$(printf '%o' $(( 0666 & ~$(umask) )))
+  fi
+  if ! { cat "$content" > "$tmp" && chmod "$mode" "$tmp" && mv -f "$tmp" "$target"; }; then
+    rm -f "$tmp" "$content"
+    exit 1
+  fi
+  rm -f "$content"
+}
+
 stamp_generated() {
   local tmp="$1"
   local out="$2"
@@ -95,7 +159,10 @@ stamp_generated() {
   local hash
   hash=$(sha256_file "$norm")
   rm -f "$norm"
-  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$tmp" > "$out"
+  local stamped
+  stamped=$(mktemp)
+  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$tmp" > "$stamped"
+  replace_entry "$stamped" "$out"
 }
 
 write_knowledge_index() {
@@ -103,6 +170,12 @@ write_knowledge_index() {
   local kdir="companies/${co}/knowledge"
   [[ -d "$kdir" ]] || return 0
   local out="${kdir}/INDEX.md"
+  # Never read or write through a symlinked INDEX.md: it could point at
+  # another company's file.
+  if [[ -L "$out" ]]; then
+    echo "rebuild-company-knowledge-index: refused ${out} (INDEX.md is a symlink)" >&2
+    exit 1
+  fi
   local title
   title="$(titleize "$co") Knowledge"
   local tmp
@@ -140,6 +213,41 @@ write_knowledge_index() {
     )
   } > "$tmp"
 
+  if [[ -e "$out" && "$ACCEPT" != 1 ]]; then
+    if grep -q '<!-- hq:keep -->' "$out" || ! grep -q '^> Auto-generated. Updated: ' "$out"; then
+      echo "rebuild-company-knowledge-index: refused to overwrite ${out} (hand-written or kept)" >&2
+      rm -f "$tmp"
+      return 0
+    fi
+    local stored actual normalized
+    stored=$(sed -n 's/^<!-- hq-generated-sha256: \([a-f0-9]*\) -->$/\1/p' "$out" | head -n 1)
+    if [[ -n "$stored" ]]; then
+      normalized=$(mktemp)
+      sed -e '/^<!-- hq-generated-sha256: [a-f0-9]* -->$/d' -e 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$out" > "$normalized"
+      actual=$(sha256_file "$normalized")
+      rm -f "$normalized"
+      if [[ "$stored" != "$actual" ]]; then
+        echo "rebuild-company-knowledge-index: refused to overwrite ${out} (generated content was edited)" >&2
+        rm -f "$tmp"
+        return 0
+      fi
+    else
+      # A legacy header is not proof that the generated body is untouched.
+      # Only upgrade an unstamped file when its complete body matches this render.
+      normalized=$(mktemp)
+      local candidate_normalized
+      candidate_normalized=$(mktemp)
+      sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$out" > "$normalized"
+      sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$tmp" > "$candidate_normalized"
+      if ! cmp -s "$normalized" "$candidate_normalized"; then
+        rm -f "$normalized" "$candidate_normalized" "$tmp"
+        echo "rebuild-company-knowledge-index: refused to overwrite ${out} (unstamped content differs; use --accept to overwrite)" >&2
+        return 0
+      fi
+      rm -f "$normalized" "$candidate_normalized"
+    fi
+  fi
+
   stamp_generated "$tmp" "$out"
   rm -f "$tmp"
 
@@ -155,6 +263,6 @@ while IFS= read -r dir; do
     write_knowledge_index "$co"
     COUNT=$((COUNT+1))
   fi
-done < <(find companies -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+done < <(if [[ -n "$SCOPE" ]]; then printf 'companies/%s\n' "$SCOPE"; else find companies -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort; fi)
 
 echo "rebuild-company-knowledge-index: regenerated ${COUNT} knowledge INDEX.md file(s)" >&2

package/assets/scaffold/core/scripts/rebuild-projects-index.sh

@@ -8,9 +8,46 @@
 
 set -euo pipefail
 
+for arg in "$@"; do
+  if [[ "$arg" == "--help" || "$arg" == "-h" ]]; then
+    printf '%s\n' \
+      'Usage: hq core rebuild-index projects [<company> | --company <company>] [--accept]' \
+      '' \
+      'With a company, rebuild only that company'\''s index. Without a company, retain the all-company rebuild. Help performs no writes.'
+    exit 0
+  fi
+done
+
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 
+# Company scope, mirroring the native companyScope() contract: one slug as a
+# positional, --company <slug>, or --company=<slug>. --accept overwrites a
+# hand-edited INDEX.md in the selected scope. Anything else is refused before
+# any write.
+SCOPE=""
+ACCEPT=0
+scope_error() { printf 'hq: rebuild-index projects: %s\n' "$1" >&2; exit 1; }
+while [[ $# -gt 0 ]]; do
+  value="$1"
+  if [[ "$value" == "--accept" ]]; then ACCEPT=1; shift; continue; fi
+  if [[ "$value" == "--company" ]]; then shift; value="${1:-}";
+  elif [[ "$value" == --company=* ]]; then value="${value#--company=}"; fi
+  [[ -n "$value" && "$value" != -* ]] || scope_error "expected a company slug; unknown or incomplete option"
+  [[ -z "$SCOPE" ]] || scope_error "supply only one company slug"
+  [[ "$value" =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]] || scope_error "invalid company slug"
+  SCOPE="$value"
+  shift
+done
+if [[ -n "$SCOPE" ]]; then
+  [[ -e "companies/$SCOPE" || -L "companies/$SCOPE" ]] || scope_error "no company directory named \"$SCOPE\""
+  [[ -d "companies/$SCOPE" && ! -L "companies/$SCOPE" ]] || scope_error "company must be a real directory"
+  scope_content="companies/$SCOPE/projects"
+  if [[ -e "$scope_content" || -L "$scope_content" ]]; then
+    [[ -d "$scope_content" && ! -L "$scope_content" ]] || scope_error "content must be a real directory"
+  fi
+fi
+
 COMPANIES_DIR="companies"
 PROJECTS_DIR="personal/projects"
 OUT="${PROJECTS_DIR}/INDEX.md"
@@ -66,13 +103,42 @@ sha256_file() {
   fi
 }
 
+# replace_entry <content-file> <target>: install content as <target> by
+# renaming a same-directory temp file over the directory entry, like native
+# atomicWrite(). The old inode is never written, so a hardlinked alias keeps
+# its bytes. Symlinks and directories at <target> are refused before the
+# rename, so mv never follows or descends into them. An existing target's
+# permission bits are kept; a new file gets 0666 minus the umask.
+replace_entry() {
+  local content="$1" target="$2" dir tmp mode
+  if [[ -L "$target" || -d "$target" ]]; then
+    echo "rebuild-projects-index: refused ${target} (INDEX.md is a symlink or directory)" >&2
+    rm -f "$content"
+    exit 1
+  fi
+  dir=$(dirname "$target")
+  tmp=$(mktemp "${dir}/.INDEX.md.XXXXXX") || { rm -f "$content"; exit 1; }
+  if [[ -e "$target" ]]; then
+    mode=$(stat -c %a "$target" 2>/dev/null || stat -f %Lp "$target")
+  else
+    mode=$(printf '%o' $(( 0666 & ~$(umask) )))
+  fi
+  if ! { cat "$content" > "$tmp" && chmod "$mode" "$tmp" && mv -f "$tmp" "$target"; }; then
+    rm -f "$tmp" "$content"
+    exit 1
+  fi
+  rm -f "$content"
+}
+
 stamp_generated() {
-  local input="$1" output="$2" normalized hash
+  local input="$1" output="$2" normalized hash stamped
   normalized=$(mktemp)
   sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$input" > "$normalized"
   hash=$(sha256_file "$normalized")
   rm -f "$normalized"
-  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$input" > "$output"
+  stamped=$(mktemp)
+  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$input" > "$stamped"
+  replace_entry "$stamped" "$output"
 }
 
 company_title() {
@@ -84,6 +150,12 @@ write_company_projects_index() {
   company_root="${COMPANIES_DIR}/${company}"
   project_dir="${company_root}/projects"
   output="${project_dir}/INDEX.md"
+  # Never read or write through a symlinked INDEX.md: it could point at
+  # another company's file.
+  if [[ -L "$output" ]]; then
+    echo "rebuild-projects-index: refused ${output} (INDEX.md is a symlink)" >&2
+    exit 1
+  fi
   tmp=$(mktemp)
   {
     printf '# %s Projects\n\n' "$(company_title "$company")"
@@ -106,7 +178,7 @@ write_company_projects_index() {
   } > "$tmp"
   local existing=0 stored actual normalized
   [[ -e "$output" ]] && existing=1
-  if [[ "$existing" == 1 ]]; then
+  if [[ "$existing" == 1 && "$ACCEPT" != 1 ]]; then
     if grep -q '<!-- hq:keep -->' "$output" || ! grep -q '^> Auto-generated. Updated: ' "$output"; then
       echo "rebuild-projects-index: refused to overwrite ${output} (hand-written or kept)" >&2
       rm -f "$tmp"
@@ -123,6 +195,20 @@ write_company_projects_index() {
         rm -f "$tmp"
         return 0
       fi
+    else
+      # A legacy header is not proof that the generated body is untouched.
+      # Only upgrade an unstamped file when its complete body matches this render.
+      normalized=$(mktemp)
+      local candidate_normalized
+      candidate_normalized=$(mktemp)
+      sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$output" > "$normalized"
+      sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$tmp" > "$candidate_normalized"
+      if ! cmp -s "$normalized" "$candidate_normalized"; then
+        rm -f "$normalized" "$candidate_normalized" "$tmp"
+        echo "rebuild-projects-index: refused to overwrite ${output} (unstamped content differs; use --accept to overwrite)" >&2
+        return 0
+      fi
+      rm -f "$normalized" "$candidate_normalized"
     fi
   fi
   stamp_generated "$tmp" "$output"
@@ -136,10 +222,19 @@ while IFS= read -r dir; do
   [[ "$co" == .* ]] && continue
   project_dir="${COMPANIES_DIR}/${co}/projects"
   [[ -d "$project_dir" ]] && write_company_projects_index "$co"
-done < <(find "$COMPANIES_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+done < <(if [[ -n "$SCOPE" ]]; then printf 'companies/%s\n' "$SCOPE"; else find "$COMPANIES_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort; fi)
+
+# A company-scoped run writes only that company's index.
+[[ -z "$SCOPE" ]] || exit 0
 
 [[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
 
+if [[ -L "$OUT" ]]; then
+  echo "rebuild-projects-index: refused ${OUT} (INDEX.md is a symlink)" >&2
+  exit 1
+fi
+
+personal_tmp=$(mktemp)
 {
   echo "# Projects"
   echo ""
@@ -186,7 +281,8 @@ done < <(find "$COMPANIES_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sor
     [[ -z "$desc" ]] && desc="—"
     printf '| `%s/` | %s | %s | %s |\n' "$name" "$stories" "$status" "$desc"
   done < <(find "$PROJECTS_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
-} > "$OUT"
+} > "$personal_tmp"
+replace_entry "$personal_tmp" "$OUT"
 
 count=$(find "$PROJECTS_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l | tr -d ' ')
 echo "rebuild-projects-index: wrote ${OUT} (${count} HQ project(s))" >&2

package/assets/scaffold/core/scripts/worktree.sh

@@ -30,6 +30,10 @@ while [ $# -gt 0 ]; do
   esac
 done
 
+# Accept "--base origin/<branch>" as well as "--base <branch>"; the fetch and
+# ref lookups below add the origin/ prefix themselves.
+BASE="${BASE#origin/}"
+
 [ -n "$NAME" ] || die "--name is required (kebab-case slug, e.g. 'fix-login-bug')"
 
 # Validate name: kebab-case-ish, no slashes, no spaces