@indigoai-us/hq-cli 5.345.159 → 5.345.161

package/CHANGELOG.md

@@ -2,6 +2,54 @@
 
 ## [Unreleased]
 
+## [5.345.161] — 2026-10-23
+- The bundled sync engine now uses hq-cloud 6.18.99, the current npm `latest`.
+  HQ Sync follows the server's telemetry decision for free-plan accounts,
+  failed company and personal sync legs report a short error summary with no
+  file names or paths, and the shell-script line-ending fix never rewrites a
+  file whose signature marks it as binary (hq-cloud #1039, #1043, #1044).
+- Fence session-journal counter owners with atomically published PID and owner-token records. Reclaim dead or aged PID-less publisher claims and aged orphan temp directories; holders that lose ownership retry before their callback or counter write.
+- `hq files cat` / `get` and the agent file tools now name the storage host when a signed vault download cannot connect (connection refused or reset, DNS failure, timeout, or a TLS failure from an HTTPS-inspecting proxy) and tell the operator to allow outbound HTTPS (TCP 443) to that host. Before this, the raw `fetch failed` error surfaced with no host.
+- New `hq feedback assign <id> --to <email|prs_uid>` reassigns a feedback ticket with your own login, including a ticket another person claimed. Agent and operator tokens still get `TICKET_CLAIMED_BY_HUMAN` for those tickets, and the command says to rerun it from your own login.
+- `hq integrations share`, `unshare`, `grant` and `ungrant` help now says the principal can be a vault group (`grp_…`), which the commands already accepted. Group membership is resolved when a tool is called, and `hq integrations access` shows the group's name once the server returns it.
+- Bot turns on the Claude runtime now bound each Bash tool call to 10 minutes (`BASH_DEFAULT_TIMEOUT_MS` / `BASH_MAX_TIMEOUT_MS`, kept when already set), and the runtime process is started with stdin closed, so a bot-authored command that waits on stdin (`cat > /dev/null`) can no longer hold a turn "working" indefinitely.
+- A bot no longer posts a short assistant aside (under 40 characters, no `hq-block`) that a tool call follows in the same assistant message ("Bind first, separately."); it is logged at debug level instead. Full-sentence progress notes still post.
+- `hq integrations reconnect` now accepts `--scopes <list>` like `connect` (space- or comma-separated). Use it when a provider such as Meta refuses a sign-in request that names no scopes.
+- Keep explicitly delivered conductor instructions replayable until the receiving
+  session acknowledges their stable receipt. Timing out or discarding hook output
+  no longer counts as instruction acceptance when the paired hook is installed.
+
+- Malformed rows now retain a private audit without preventing valid later
+  instructions from being accepted. Active Stop retries do not block repeatedly.
+- Keep temporary macOS Keychain read failures retryable instead of recording them as denied access, explain saved-sign-in fallback, and give explicit retries time to answer the prompt.
+- `hq lanes session-start` (the SessionStart auto-conduct hook) no longer reads the lanes registry flags over the network on every new session. It reads them from the local flag cache and person flag snapshot, fails open when none is known, and refreshes old or missing values in the background. It also skips loading the full command graph. On a warm cache it now returns in about 0.3 s instead of about 3 s, so the hook stays under its 2 s cap and the auto-conduct context is no longer dropped. Feedback 4db60cce.
+- `hq meetings list`, `get`, `transcript`, `search` and the other read subcommands now default to the bound company when the caller explicitly names its HQ session in the environment and omits `--company`. Before this they sent no company at all, so a bound session saw only the caller's personal recordings and missed the company's. Plain terminals and cron calls keep the server default; they never borrow the shared last-session pointer. `--company` still overrides, and `set-company` still requires an explicit target. Feedback 04771691-fcbc-4847-899a-6c966c561b52.
+- On Windows, remove npm's `hq.ps1` and `hq-auth-refresh.ps1` launchers after install, update and `hq install --global`, so PowerShell runs `hq.cmd` instead of failing with UnauthorizedAccess under the default Restricted execution policy. `hq doctor` reports a blocked launcher that is still present and `hq doctor --fix` removes it. The execution policy is only read, never changed.
+
+## [5.345.160] — 2026-10-22
+- The bundled sync engine now uses hq-cloud 6.18.98. When HQ pauses an account because of usage, `hq sync` now shows the server's usage-pause message and a Billing link instead of a generic failure (hq-cloud #1036).
+- `hq billing usage` now shows the amounts on HQ's usage statement, which is what the invoice bills. Before this it re-priced the meters itself, so it could show a different figure than the statement, for example charging the vault fee during the trial when the statement waived it.
+- When HQ pauses an account because of usage (spend limit reached, card needed, or trial cap hit), `hq` now shows the server's own message and a Billing link, with no plan-limit or Upgrade wording and no old plan names (Starter, Workforce, Individual). This covers sync, skills, agent enroll, meetings, members, secrets, integrations and remote databases. `hq billing upgrade` now opens the usage-pricing switch page instead of a Workforce checkout. `hq billing usage` now shows the company's usage view, and tells a member to use `--personal` for their own usage. Plan and trial reads use the server's shared plan status when it is available, and older servers keep working as before. (US-024)
+
+- `hq files acl` and `hq access` show a path whose most-specific ACL row has no grants and is not open as locked by that row (`lockedBy` in `--json`), instead of as inheriting a broader `*` grant. An open empty row is not a lock: broader grants still apply. An empty ancestor row, whose open flag the server does not report, reads as locked unless that row is open.
+- `hq billing upgrade` no longer dead-ends on the closed HQ Workforce checkout. When hq-pro answers that Workforce is closed to the company (`workforce_closed_to_new_signups`), the command explains that the company stays on Starter unless it switches to usage pricing, says to add a card first with `hq billing checkout`, and opens the console's usage-switch page for the company (`--no-browser` prints it; `--json` returns `{ url, legacyPlansClosed: true, message }`). The open-checkout line no longer quotes a plan price. The over-limit notice (`hq whoami`) and the plan-limit refusal printed by `hq secrets`, `hq members` and sync now read hq-pro's `legacyPlansClosed` field: while Workforce is closed they offer "Switch to usage pricing" with the switch link and never the free Workforce month or an "Upgrade to HQ Workforce" line. Older servers keep today's wording.
+- `hq-hook` gains the US-021 bridge used by master-hook.sh: `hq-hook bridge-plan`
+  lists the registry hooks whose `hook-engine-port-<id>` flag is `shadow` or
+  `on`, `hq-hook bridge <id>` runs one hook natively (shadow compares with bash
+  and returns the bash result; on returns the native result; a missing port or
+  a declined payload falls back to bash), and `hq-hook --self-check` reports the
+  engine version and bridge schema. The local kill switch `HQ_HOOK_ENGINE=off`
+  or the file `~/.hq/hook-engine.off` forces bash before any flag is read.
+  Shadow comparisons are appended to `~/.hq/logs/hook-engine.jsonl` with hook
+  ids, hashes, exit codes and timings only.
+- `hq-hook run derive-trigger-facts` and `hq-hook run eval-trigger` are native
+  ports of the two policy-trigger helpers (US-008, first slice), byte-identical
+  to the bundled shell on the parity corpus, with git facts read in-process.
+- `hq core hook-engine-path` now runs the engine's `--self-check` before
+  printing its path, and writes `~/.hq/bin/hq-hook/current` so hooks can find
+  the pinned engine without starting Node. A binary that fails its self-check
+  exits non-zero and removes that pointer, keeping bash hooks active.
+
 ## [5.345.159] — 2026-10-22
 - `hq lanes link read` and `wait` now require the selected conductor session to own the requested link, preventing accidental cross-link report consumption while preserving explicit session resume/delegation and child inbox access.
 - `hq lanes resume` now uses the canonical lane ID after resolving a short ID. When low disk space queues a resume, it keeps the requested instruction for later admission and reports the lane as queued rather than started.

package/assets/scaffold/core/scripts/session-journal.sh

@@ -3,7 +3,7 @@
 # Spec: core/knowledge/public/hq-core/session-journal-spec.md
 #
 # Usage:
-#   session-journal.sh write "<title>" [--files f1,f2,...] [--body-file PATH] [--session KEY]
+#   session-journal.sh write "<title>" [--files f1,f2,...] [--body-file PATH] [--session KEY] [--company SLUG]
 #   session-journal.sh list [--date YYYY-MM-DD]
 #   session-journal.sh read <NNN> [--date YYYY-MM-DD]
 #   session-journal.sh index-path [--date YYYY-MM-DD]   # prints the INDEX.md path
@@ -18,6 +18,7 @@
 # "unscoped". A date-global counter let concurrent Claude and Codex tasks
 # trigger and reset each other's journal reminders.
 #
+# HQ_JOURNAL_COUNTER_NOW overrides epoch seconds only in the counter-lock age check, for deterministic tests.
 # All commands fail-soft: warn to stderr, exit 0 — never block the caller.
 
 set -uo pipefail
@@ -131,7 +132,8 @@ resolve_session_key() {
 counter_lock_is_aged() {
   local lockdir="$1" lock_mtime now
   lock_mtime="$(stat -c %Y "$lockdir" 2>/dev/null)" || lock_mtime="$(stat -f %m "$lockdir" 2>/dev/null)" || return 1
-  now="$(date -u +%s 2>/dev/null)" || return 1
+  now="${HQ_JOURNAL_COUNTER_NOW:-$(date -u +%s 2>/dev/null)}"
+  [ -n "$now" ] || return 1
   case "$lock_mtime:$now" in *[!0-9:]*|:*|*:) return 1 ;; esac
   [ "$now" -ge "$lock_mtime" ] && [ "$((now - lock_mtime))" -ge 60 ]
 }
@@ -158,8 +160,9 @@ counter_lock_owner_is_alive() {
 }
 
 reclaim_stale_counter_lock() {
-  local lockdir="$1" owner_pid current_owner current_windows_pid windows_pid claim stale_dir suffix=0 pidless=0
+  local lockdir="$1" owner_pid current_owner current_windows_pid windows_pid owner_token current_token claim stale_dir suffix=0 pidless=0
   owner_pid="$(cat "$lockdir/pid" 2>/dev/null || true)"
+  owner_token="$(cat "$lockdir/owner-token" 2>/dev/null || true)"
   case "$owner_pid" in
     '')
       windows_pid="$(cat "$lockdir/winpid" 2>/dev/null || true)"
@@ -189,6 +192,7 @@ reclaim_stale_counter_lock() {
 
   current_owner="$(cat "$lockdir/pid" 2>/dev/null || true)"
   current_windows_pid="$(cat "$lockdir/winpid" 2>/dev/null || true)"
+  current_token="$(cat "$lockdir/owner-token" 2>/dev/null || true)"
   if [ "$pidless" -eq 1 ]; then
     # Recheck both identity and age after winning the claim, before renaming.
     if [ -z "$current_owner" ] && [ "$current_windows_pid" = "$windows_pid" ] \
@@ -200,6 +204,7 @@ reclaim_stale_counter_lock() {
     fi
   fi
   if [ "$current_owner" = "$owner_pid" ] && [ "$current_windows_pid" = "${windows_pid:-$(cat "$lockdir/winpid" 2>/dev/null || true)}" ] \
+    && [ "$current_token" = "$owner_token" ] \
     && { [ "$pidless" -eq 1 ] || ! counter_lock_owner_is_alive "$lockdir" "$owner_pid"; }; then
     stale_dir="${lockdir}.stale.$$.$RANDOM"
     while [ -e "$stale_dir" ]; do
@@ -217,38 +222,111 @@ reclaim_stale_counter_lock() {
   return 1
 }
 
+reclaim_stale_counter_tempdirs() {
+  local lockdir="$1" candidate owner_pid windows_pid owner_token current_pid current_windows current_token stale_dir suffix=0
+  # Publishers create <lock>.tmp.XXXXXX. Older native hq-cli builds used
+  # <lock>.tmp-XXXXXX, so reclaim aged orphans with either prefix.
+  for candidate in "${lockdir}.tmp."* "${lockdir}.tmp-"*; do
+    [ -d "$candidate" ] || continue
+    counter_lock_is_aged "$candidate" || continue
+    owner_pid="$(cat "$candidate/pid" 2>/dev/null || true)"
+    windows_pid="$(cat "$candidate/winpid" 2>/dev/null || true)"
+    owner_token="$(cat "$candidate/owner-token" 2>/dev/null || true)"
+    case "$owner_pid" in
+      '')
+        if [ -n "$windows_pid" ] && counter_windows_pid_is_alive "$windows_pid"; then continue; fi
+        ;;
+      *[!0-9]*) continue ;;
+      *)
+        [ "$owner_pid" -gt 1 ] 2>/dev/null || continue
+        counter_lock_owner_is_alive "$candidate" "$owner_pid" && continue
+        ;;
+    esac
+    current_pid="$(cat "$candidate/pid" 2>/dev/null || true)"
+    current_windows="$(cat "$candidate/winpid" 2>/dev/null || true)"
+    current_token="$(cat "$candidate/owner-token" 2>/dev/null || true)"
+    [ "$current_pid" = "$owner_pid" ] && [ "$current_windows" = "$windows_pid" ] \
+      && [ "$current_token" = "$owner_token" ] && counter_lock_is_aged "$candidate" || continue
+    [ -z "$current_pid" ] || ! counter_lock_owner_is_alive "$candidate" "$current_pid" || continue
+    [ -z "$current_windows" ] || ! counter_windows_pid_is_alive "$current_windows" || continue
+    stale_dir="${candidate}.stale.$$.$RANDOM"
+    while [ -e "$stale_dir" ]; do suffix=$((suffix + 1)); stale_dir="${candidate}.stale.$$.$RANDOM.$suffix"; done
+    if mv "$candidate" "$stale_dir" 2>/dev/null; then rm -rf "$stale_dir" 2>/dev/null || true; fi
+  done
+}
+
 with_counter_lock() {
   local lockdir="$1"; shift
-  local i=0 acquired=0 rc=0 tries="${HQ_JOURNAL_COUNTER_LOCK_TRIES:-250}"
+  local i=0 acquired=0 rc=0 tries="${HQ_JOURNAL_COUNTER_LOCK_TRIES:-250}" owner_token tempdir windows_pid token_file publish_claim
   case "$tries" in ''|*[!0-9]*) tries=250 ;; esac
   while [ "$i" -lt "$tries" ]; do
-    if mkdir "$lockdir" 2>/dev/null; then
-      acquired=1
+    reclaim_stale_counter_tempdirs "$lockdir"
+    # Publish a complete owner record in one rename. Legacy clients may still
+    # leave PID-less lock directories, which the age-based reclaim handles.
+    tempdir="$(mktemp -d "${lockdir}.tmp.XXXXXX" 2>/dev/null)" || tempdir=""
+    if [ -n "$tempdir" ]; then
+      owner_token="$$.$RANDOM.$RANDOM.$(date -u +%s 2>/dev/null)"
       if [[ "${OSTYPE:-}" == msys* ]] || [[ "${OSTYPE:-}" == cygwin* ]]; then
-        local windows_pid
         windows_pid="$(cat "/proc/$$/winpid" 2>/dev/null || true)"
-        case "$windows_pid" in ''|*[!0-9]*) ;; *) printf '%s\n' "$windows_pid" > "$lockdir/winpid" || { rm -rf "$lockdir" 2>/dev/null || true; return 0; } ;; esac
+        case "$windows_pid" in ''|*[!0-9]*) windows_pid="" ;; esac
+        if [ -n "$windows_pid" ] && ! printf '%s\n' "$windows_pid" > "$tempdir/winpid"; then rm -rf "$tempdir"; tempdir=""; fi
       fi
-      if ! printf '%s\n' "$$" > "$lockdir/pid" 2>/dev/null; then
-        rm -rf "$lockdir" 2>/dev/null || true
-        return 0
+      if [ -n "$tempdir" ] && printf '%s\n' "$$" > "$tempdir/pid" \
+        && printf '%s\n' "$owner_token" > "$tempdir/owner-token"; then
+        # Serialize publishers so mv cannot interpret a concurrently-created
+        # lock directory as a destination directory and nest the temp folder.
+        publish_claim="${lockdir}.publish"
+        if mkdir "$publish_claim" 2>/dev/null; then
+          # Exclusive token creation fences a publisher resumed after a stale
+          # PID-less claim was reclaimed and reused by another process.
+          if (set -C; printf '%s\n' "$owner_token" > "$publish_claim/owner-token") 2>/dev/null \
+            && [ "$(cat "$publish_claim/owner-token" 2>/dev/null || true)" = "$owner_token" ] \
+            && (set -C; printf '%s\n' "$$" > "$publish_claim/pid") 2>/dev/null \
+            && [ "$(cat "$publish_claim/owner-token" 2>/dev/null || true)" = "$owner_token" ] \
+            && [ ! -e "$lockdir" ] && mv "$tempdir" "$lockdir" 2>/dev/null; then :; fi
+          if [ "$(cat "$publish_claim/owner-token" 2>/dev/null || true)" = "$owner_token" ]; then
+            rm -rf "$publish_claim" 2>/dev/null || true
+          fi
+        else
+          rm -rf "$tempdir" 2>/dev/null || true
+          reclaim_stale_counter_lock "$publish_claim" && continue
+        fi
+        if [ ! -e "$tempdir" ] && [ "$(cat "$lockdir/owner-token" 2>/dev/null || true)" = "$owner_token" ]; then
+          acquired=1
+          rmdir "$tempdir" 2>/dev/null || true
+          token_file="$lockdir/owner-token"
+          if [ "$(cat "$token_file" 2>/dev/null || true)" = "$owner_token" ]; then
+            "$@" "$owner_token"
+            rc=$?
+            if [ "$rc" -eq 75 ]; then
+              acquired=0
+              i=$((i + 1))
+              continue
+            fi
+            if [ "$(cat "$token_file" 2>/dev/null || true)" = "$owner_token" ]; then
+              rm -rf "$lockdir" 2>/dev/null || true
+            fi
+            return "$rc"
+          fi
+          acquired=0
+          i=$((i + 1))
+          continue
+        fi
+        if [ ! -e "$tempdir" ]; then rm -rf "$lockdir/$(basename "$tempdir")" 2>/dev/null || true; fi
       fi
-      break
+      if [ -n "$tempdir" ]; then rm -rf "$tempdir" 2>/dev/null || true; fi
     fi
     reclaim_stale_counter_lock "$lockdir" && continue
     i=$((i + 1))
     [ "$i" -ge "$tries" ] || sleep 0.02 2>/dev/null || sleep 1
   done
-  if [ "$acquired" -ne 1 ]; then
-    warn "tool-counter: lock remained busy; skipped update"
-    return 0
-  fi
+  warn "tool-counter: lock remained busy; skipped update"
+  return 0
+}
 
-  "$@" || rc=$?
-  if [ "$(cat "$lockdir/pid" 2>/dev/null || true)" = "$$" ]; then
-    rm -rf "$lockdir" 2>/dev/null || true
-  fi
-  return "$rc"
+counter_lock_token_is_current() {
+  local lockdir="$1" owner_token="$2"
+  [ -n "$owner_token" ] && [ "$(cat "$lockdir/owner-token" 2>/dev/null || true)" = "$owner_token" ]
 }
 
 counter_read_raw() {
@@ -303,8 +381,10 @@ case "$cmd" in
     files_csv=""
     body_file=""
     session_arg=""
+    company_arg="${HQ_ACTIVE_COMPANY:-}"
     while [ $# -gt 0 ]; do
       case "$1" in
+        --company)   company_arg="${2:-}"; shift 2 || break ;;
         --files)     files_csv="${2:-}"; shift 2 || break ;;
         --body-file) body_file="${2:-}"; shift 2 || break ;;
         --session)   session_arg="${2:-}"; shift 2 || break ;;
@@ -313,6 +393,9 @@ case "$cmd" in
     done
 
     [ -z "$title" ] && { warn "write: title required"; exit 0; }
+    # The bound company tags the entry so the SessionStart index loader can
+    # surface only that company's entries. Anything not slug-shaped is dropped.
+    [[ "$company_arg" =~ ^[A-Za-z0-9_-]+$ ]] || company_arg=""
 
     d="$(today)"
     dir="$(journal_dir_for "$d")"
@@ -346,6 +429,7 @@ case "$cmd" in
           printf 'ts: %s\n' "$(now_iso_z)"
           printf 'title: %s\n' "$yaml_title"
           printf 'slug: %s\n' "$yaml_slug"
+          [ -z "$company_arg" ] || printf 'company: %s\n' "$company_arg"
           if [ -n "$files_csv" ]; then
             printf 'files:\n'
             old_ifs="$IFS"
@@ -384,7 +468,9 @@ case "$cmd" in
     if [ ! -f "$idx" ]; then
       printf '# Session journal — %s\n\n' "$d" > "$idx"
     fi
-    printf -- '- `%s` %s — %s\n' "$seq" "$(now_hhmm_z)" "$title" >> "$idx" \
+    company_tag=""
+    [ -z "$company_arg" ] || company_tag=" [company: $company_arg]"
+    printf -- '- `%s` %s — %s%s\n' "$seq" "$(now_hhmm_z)" "$title" "$company_tag" >> "$idx" \
       || warn "write: INDEX update failed"
 
     # Reset the tool counter for THIS session only — journaling one task's
@@ -452,8 +538,10 @@ case "$cmd" in
     case "$sub" in
       increment)
         do_increment() {
-          local n
+          local owner_token="${1:-}" n
+          counter_lock_token_is_current "$lockdir" "$owner_token" || return 75
           n=$(counter_read_raw "$counter")
+          counter_lock_token_is_current "$lockdir" "$owner_token" || return 75
           echo $((n + 1)) > "$counter" 2>/dev/null || true
         }
         with_counter_lock "$lockdir" do_increment
@@ -462,7 +550,11 @@ case "$cmd" in
         printf '%d\n' "$(counter_read_raw "$counter")"
         ;;
       reset)
-        do_reset() { echo 0 > "$counter" 2>/dev/null || true; }
+        do_reset() {
+          local owner_token="${1:-}"
+          counter_lock_token_is_current "$lockdir" "$owner_token" || return 75
+          echo 0 > "$counter" 2>/dev/null || true
+        }
         with_counter_lock "$lockdir" do_reset
         ;;
       *) warn "tool-counter: subcommand required (increment|read|reset)" ;;