@indigoai-us/hq-cli 5.345.161 → 5.345.162

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.345.162] — 2026-10-23
+- `hq agent inbox` no longer reports malformed server responses as a verified empty inbox. Invalid JSON or a missing/non-array `messages` field keeps `source: "local-mirror"` and a privacy-safe warning. Mixed responses retain usable messages with `source: "server-partial"` and an incomplete-result warning; only `source: "server"` certifies completeness. Human output also says when an empty result is unverified. Reads still never send replies or acknowledgments.
+- The bundled sync engine now uses hq-cloud 6.18.100, the current npm `latest`.
+  After an account switch, HQ Sync no longer pushes files left behind by the
+  previous person (hq-cloud #1040).
+- Park a loop when its phase handoff remains malformed after repair, preserving
+  worker evidence and later queued work. The existing question flow can accept a
+  validated repaired handoff without rerunning the phase, explicitly retry with
+  an external-effects warning, or leave the phase held. Durable holds survive
+  controller restart, and explicit interruption and stop remain available.
+- New `hq sync held` and `hq sync release-held`. After someone else signs in on the same computer, HQ sync holds every upload and cloud delete for the personal vault and each company until the signed-in person releases them. `hq sync held` lists what is held, with a count and sample paths. `hq sync release-held` shows the signed-in person's held scopes, asks "Are these files yours to upload?" and releases them (`--company <slug>`, `--personal`, `--yes`, `--json`). It identifies the person from the current session token, so a session without an email works, and it releases nothing if the signed-in account changes during the command. Both commands need an HQ sync engine with this hold; on an older one they say to update HQ. Feedback 3bf773c5-320e-433d-b84b-0bab13147ff5.
+
 ## [5.345.161] — 2026-10-23
 - The bundled sync engine now uses hq-cloud 6.18.99, the current npm `latest`.
   HQ Sync follows the server's telemetry decision for free-plan accounts,

package/dist/command-catalog.generated.d.ts

@@ -1175,6 +1175,50 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly defaultValue: "<runtime-path>";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "held";
+        readonly description: "Show uploads held because someone else was signed in on this computer";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print the held scopes as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "release-held";
+        readonly description: "Confirm held files are yours and let sync upload them";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--company <slug>";
+            readonly description: "Release only this company";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "Release only the personal vault";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--yes";
+            readonly description: "Do not ask for confirmation";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the result as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }];
 }, {
     readonly name: "cloud";

package/dist/command-catalog.generated.js

@@ -1412,6 +1412,59 @@ export const COMMAND_CATALOG = [
                     }
                 ],
                 "subcommands": []
+            },
+            {
+                "name": "held",
+                "description": "Show uploads held because someone else was signed in on this computer",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print the held scopes as JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "release-held",
+                "description": "Confirm held files are yours and let sync upload them",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "Release only this company",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--personal",
+                        "description": "Release only the personal vault",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--yes",
+                        "description": "Do not ask for confirmation",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print the result as JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
             }
         ]
     },

package/dist/command-registration-plan.d.ts

@@ -135,6 +135,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "sync";
     readonly module: "./commands/sync-manifest.js";
     readonly exportName: "registerSyncManifestCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/sync-held.js";
+    readonly exportName: "registerSyncHeldCommands";
 }, {
     readonly type: "group";
     readonly root: "cloud";

package/dist/command-registration-plan.js

@@ -25,6 +25,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-mode.js", exportName: "registerSyncModeCommand" },
     { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-narrow.js", exportName: "registerSyncNarrowCommand" },
     { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-manifest.js", exportName: "registerSyncManifestCommand" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-held.js", exportName: "registerSyncHeldCommands" },
     { type: "group", root: "cloud", id: "cloud", name: "cloud", description: "Cloud commands — provision entities and manage cloud-backed companies" },
     { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-provision.js", exportName: "registerCloudProvisionCommands" },
     { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-retire.js", exportName: "registerCloudRetireCommands" },

package/dist/commands/agent-inbox.js

@@ -33,7 +33,9 @@ export function registerAgentInboxCommand(agent) {
                 baseUrl: creds.apiBaseUrl,
                 path: `/v1/agents/${encodeURIComponent(creds.entityUid)}/inbox`,
             });
-            return { status: res.status, body: await res.json().catch(() => ({})) };
+            // Preserve a decode failure as an invalid body for mergeAgentInbox to
+            // classify. Parser errors can contain response bytes: do not echo them.
+            return { status: res.status, body: await res.json().catch(() => undefined) };
         });
         const rows = entries
             .filter((e) => opts.all || !done.has(e.id))
@@ -45,7 +47,9 @@ export function registerAgentInboxCommand(agent) {
         if (note)
             console.error(chalk.yellow(note));
         if (rows.length === 0) {
-            console.log(opts.all ? "Inbox is empty." : "No pending messages.");
+            console.log(note
+                ? "No matching messages can be confirmed; the server inbox could not be read completely."
+                : opts.all ? "Inbox is empty." : "No pending messages.");
             return;
         }
         for (const r of rows) {

package/dist/commands/lanes-loop.js

@@ -7,7 +7,7 @@ import { readLatestEnvelopeRecord } from "../lib/lanes/watcher.js";
 import { spawnLaneWorker } from "../lib/lanes/spawn.js";
 import { raiseLaneQuestion } from "../lib/lanes/questions.js";
 import { isTerminalLaneState } from "../lib/lanes/types.js";
-import { clearLoopControllerPid, loopAdmissionPath, runLoopLane, setLoopControllerPid } from "../lib/lanes/loop.js";
+import { HANDOFF_HOLD_CHOICES, clearLoopControllerPid, loopAdmissionPath, runLoopLane, setLoopControllerPid } from "../lib/lanes/loop.js";
 import { laneStories } from "../lib/lanes/stories.js";
 import { readLanesRegistryFlagFailOpen } from "../lib/lanes/registry-flag.js";
 import { LANE_LOOP_HANDOFF_REPAIR_FLAG } from "../lib/lanes/flag-keys.js";
@@ -255,7 +255,7 @@ export async function runLaneLoopController(ctx, laneId, deps) {
                     signal.removeEventListener("abort", abortPhase);
                 }
             },
-            raiseQuestion: ({ envelope, envelopeId, attempt, error, questionId }) => {
+            raiseQuestion: ({ envelope, envelopeId, attempt, error, questionId, reason }) => {
                 const current = readLane(hqRoot, laneId);
                 const data = envelope;
                 raiseLaneQuestion({
@@ -265,11 +265,11 @@ export async function runLaneLoopController(ctx, laneId, deps) {
                     raisedVia: "cli",
                     at: ctx.now().toISOString(),
                     body: {
-                        question: `Loop phase ${String(data.phase ?? envelopeId)} stalled twice. How should it proceed?`,
-                        context: `${error}\nThe phase is parked; later envelopes remain queued. Stall attempt: ${attempt}.`,
-                        options: ["Retry with a longer deadline", "Reroute to another worker", "Drop this phase and block the story"],
-                        recommended: "Retry with a longer deadline",
-                        loop_stall: { lane_id: laneId, envelope_id: envelopeId, attempt },
+                        question: reason === "handoff_needs_repair" ? `Loop phase ${String(data.phase ?? envelopeId)} has an invalid handoff. How should it proceed?` : `Loop phase ${String(data.phase ?? envelopeId)} stalled twice. How should it proceed?`,
+                        context: reason === "handoff_needs_repair" ? `${error}\nThe worker file is preserved and the phase is parked; later envelopes remain queued. Repair the handoff file before accepting it. Retrying can repeat external effects.` : `${error}\nThe phase is parked; later envelopes remain queued. Stall attempt: ${attempt}.`,
+                        options: reason === "handoff_needs_repair" ? [...HANDOFF_HOLD_CHOICES] : ["Retry with a longer deadline", "Reroute to another worker", "Drop this phase and block the story"],
+                        recommended: reason === "handoff_needs_repair" ? HANDOFF_HOLD_CHOICES[0] : "Retry with a longer deadline",
+                        loop_stall: { lane_id: laneId, envelope_id: envelopeId, attempt, ...(reason ? { reason } : {}) },
                     },
                 });
             },

package/dist/commands/lanes-questions.js

@@ -1,4 +1,5 @@
 import * as path from "node:path";
+import { readSessionCompanyLock } from "../lib/session-company-lock.js";
 import { isQuestionImported } from "../lib/lanes/imported-question.js";
 import { buildOutpostQuestionAnswerCommand, buildOutpostQuestionCancelCommand, buildOutpostQuestionShowCommand, dispatchErrorMessage } from "../lib/lanes/outpost-dispatch.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
@@ -6,7 +7,7 @@ import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { appendCappedHistory, createQuestion, expandLocalLaneIdPrefix, isLanesError, listSessionLiveness, parseLivenessState, parseQuestionRecord, parseQuestionStatus, readDaemonPresenceConnected, readLane, readQuestion, wakeAnsweredLaneNow, sessionLiveness, appendDropboxMessage, answerDropboxMessage, laneAcceptsDropboxDelivery, laneIdForAnswerDelivery, writeQuestionBody } from "../lib/lanes/index.js";
 import { resolveQuestionCompanyWithFallback } from "../lib/lanes/questions.js";
 import { LanesError } from "../lib/lanes/errors.js";
-import { applyLoopStallAnswer, findLoopStallResult } from "../lib/lanes/loop.js";
+import { HANDOFF_HOLD_CHOICES, applyLoopStallAnswer, findLoopStallResult, loopHandoffHoldIdentity } from "../lib/lanes/loop.js";
 export function resolveAnswerChoice(choice, options, freeform) {
     const trimmed = choice.trim();
     if (/^[0-9]+$/.test(trimmed)) {
@@ -847,11 +848,48 @@ export function createLaneQuestionsHandlers(deps) {
         const retryingSameLoopAnswer = isLoopStallQuestion && question.status === "answered" && question.answer?.choice === choice &&
             question.answer.answer_kind === incomingAnswerKind && incomingNotesMatch &&
             deps.sameQuestionAnswer(question.answer, { ...question.answer });
-        if (question.status !== "pending" && !retryingSameLoopAnswer)
-            throwIfQuestionNotPending(question);
         const loopStallResult = isLoopStallQuestion
             ? findLoopStallResult(path.join(hqRoot, "workspace", "lanes-runs", askingLane.lane_id), questionId)
             : undefined;
+        if (loopStallResult?.hold_reason === "handoff_needs_repair" && !HANDOFF_HOLD_CHOICES.includes(choice)) {
+            throw new LanesError("invalid_handoff_disposition", "Choose an explicit handoff repair disposition", { question_id: questionId });
+        }
+        const handoffIdentity = askingLane.loop_mode ? loopHandoffHoldIdentity(path.join(hqRoot, "workspace", "lanes-runs", askingLane.lane_id)) : undefined;
+        const changingHeldAnswer = body.loop_stall?.reason === "handoff_needs_repair" && isLoopStallQuestion &&
+            question.status === "answered" && question.answer?.choice === HANDOFF_HOLD_CHOICES[2] &&
+            choice !== HANDOFF_HOLD_CHOICES[2] && handoffIdentity?.unresolved === true &&
+            handoffIdentity.question_id === questionId && handoffIdentity.envelope_id === body.loop_stall.envelope_id &&
+            loopStallResult?.hold_reason === "handoff_needs_repair";
+        if (question.status !== "pending" && !retryingSameLoopAnswer && !changingHeldAnswer)
+            throwIfQuestionNotPending(question);
+        const isHandoffQuestion = body.loop_stall?.reason === "handoff_needs_repair" || loopStallResult?.hold_reason === "handoff_needs_repair" || handoffIdentity !== undefined;
+        if (isHandoffQuestion) {
+            assertQuestionAnswerAuthorized(ctx, askingLane);
+            assertLaneRunsHereForOperatorMutation(ctx, askingLane, "resolve a handoff repair hold on");
+            const targetCompany = questionCompanyForLane(question, askingLane, hqRoot);
+            const lock = readSessionCompanyLock({ ...ctx.env, HQ_ROOT: hqRoot });
+            const actorLaneId = ctx.env.HQ_LANE_ID?.trim();
+            if (actorLaneId) {
+                const actorLane = readLane(hqRoot, actorLaneId);
+                const actorCompany = actorLane.company ?? actorLane.mesh_company;
+                if (!targetCompany || !actorCompany || !sameQuestionCompany(actorCompany, targetCompany))
+                    throw new LanesError("handoff_answer_company_mismatch", "Caller lane does not own this handoff company", { question_id: questionId });
+            }
+            // Lane-only callers may use their owned lane identity; a present session lock
+            // always constrains that identity and may never be widened by HQ_LANE_ID.
+            if ((lock || !actorLaneId) && (!lock || !targetCompany || !lock.companies.includes(targetCompany.slug))) {
+                throw new LanesError("handoff_answer_company_mismatch", "The current session is not bound to this handoff company", { question_id: questionId });
+            }
+            if (!isLoopStallQuestion || body.loop_stall?.reason !== "handoff_needs_repair" ||
+                (handoffIdentity && (handoffIdentity.question_id !== questionId || handoffIdentity.envelope_id !== body.loop_stall.envelope_id)) ||
+                (loopStallResult && loopStallResult.envelope_id !== body.loop_stall.envelope_id)) {
+                throw new LanesError("handoff_question_identity_mismatch", "The persisted handoff question and hold identities do not match", { question_id: questionId });
+            }
+            if (!HANDOFF_HOLD_CHOICES.includes(choice))
+                throw new LanesError("invalid_handoff_disposition", "Choose an explicit handoff repair disposition", { question_id: questionId });
+            if (!loopStallResult && question.status === "pending")
+                throw new LanesError("handoff_result_missing", "The handoff hold result is missing; no disposition was applied", { question_id: questionId });
+        }
         const at = ctx.now().toISOString();
         const answeredBy = sessionIdFromEnv(ctx.env)
             ? `session:${sessionIdFromEnv(ctx.env)}`
@@ -860,7 +898,14 @@ export function createLaneQuestionsHandlers(deps) {
             if (retryingSameLoopAnswer && current.status === "answered" && current.answer?.choice === choice &&
                 deps.sameQuestionAnswer(current.answer, question.answer))
                 return current;
-            throwIfQuestionNotPending(current);
+            const currentHold = changingHeldAnswer ? loopHandoffHoldIdentity(path.join(hqRoot, "workspace", "lanes-runs", askingLane.lane_id)) : undefined;
+            const stillHeld = changingHeldAnswer && current.status === "answered" &&
+                current.answer?.choice === HANDOFF_HOLD_CHOICES[2] &&
+                deps.sameQuestionAnswer(current.answer, question.answer) &&
+                currentHold?.unresolved === true && currentHold.question_id === questionId &&
+                currentHold.envelope_id === body.loop_stall?.envelope_id;
+            if (!stillHeld)
+                throwIfQuestionNotPending(current);
             assertQuestionCompanyAccess(current, askingLane, requestedCompany, hqRoot);
             const recordedCompany = current.company ?? questionCompany;
             const currentForBody = current.company === null
@@ -882,6 +927,7 @@ export function createLaneQuestionsHandlers(deps) {
                 body: nextBody,
                 status: "answered",
                 delivered_at: null,
+                ...(stillHeld && current.answer ? { answer_history: [...(current.answer_history ?? []), current.answer] } : {}),
                 answer: {
                     choice,
                     answer_kind: freeform ? "freeform" : "option",
@@ -911,6 +957,10 @@ export function createLaneQuestionsHandlers(deps) {
                 printJson({ ok: true, action: "questions.answer", lane_id: askingLane.lane_id, question: updated, loop_action: resolved.action });
                 return;
             }
+            if (isHandoffQuestion && resolved.action === "parked") {
+                printJson({ ok: true, action: "questions.answer", lane_id: askingLane.lane_id, question: updated, loop_action: "parked" });
+                return;
+            }
             const controllerPid = await deps.restartLoopController(ctx, askingLane.lane_id);
             printJson({ ok: true, action: "questions.answer", lane_id: askingLane.lane_id, question: updated, loop_action: resolved.action, controller_pid: controllerPid });
             return;

package/dist/commands/lanes.js

@@ -717,7 +717,8 @@ export function parseQuestionBody(raw) {
         typeof obj.loop_stall.envelope_id !== "string" ||
         typeof obj.loop_stall.attempt !== "number" ||
         !Number.isSafeInteger(obj.loop_stall.attempt) ||
-        obj.loop_stall.attempt < 1))
+        obj.loop_stall.attempt < 1 ||
+        (obj.loop_stall.reason !== undefined && obj.loop_stall.reason !== "handoff_needs_repair")))
         return null;
     const options = obj.options.filter((item) => typeof item === "string");
     const body = {

package/dist/commands/sync-held.d.ts

@@ -0,0 +1,87 @@
+/**
+ * `hq sync held` and `hq sync release-held` (feedback_3bf773c5).
+ *
+ * After a different person signs in on the same computer, hq-cloud holds every
+ * upload and cloud delete for each sync scope (the personal vault and each
+ * company) until the signed-in person reviews what is held and releases it.
+ * These commands are the person's way to see the hold and make that decision.
+ *
+ * The hq-cloud exports (`listPushIdentityFences`, `releasePushIdentityFences`)
+ * ship after the hq-cloud version this CLI pins, so they are feature-detected
+ * on the module namespace, the same way `lib/hq-cloud-manifest.ts` does it. A
+ * static named import of a missing ESM export would stop every command that
+ * loads this file.
+ */
+import { Command } from "commander";
+export interface HeldScope {
+    slug: string;
+    uid: string;
+    sinceMs: number;
+    held?: {
+        count: number;
+        samplePaths: string[];
+        at: string;
+    };
+}
+interface FenceExports {
+    listPushIdentityFences: (stateDir: string) => HeldScope[];
+    releasePushIdentityFences: (stateDir: string, identities: readonly string[], slugs?: readonly string[]) => string[];
+}
+export declare const HELD_UNAVAILABLE_MESSAGE = "this HQ build cannot list or release held uploads yet; update HQ and try again";
+export declare function fenceExports(mod?: Record<string, unknown>): FenceExports | undefined;
+/**
+ * One authenticated snapshot of who is signed in: the Cognito sub of the
+ * session token and, when asked for, the personal vault uid resolved with that
+ * same token. The sub never comes from the upload-author label, which needs an
+ * email; hq-cloud#1040 identifies email-less sessions by sub alone.
+ */
+export interface HeldIdentity {
+    sub: string;
+    personalUid?: string;
+}
+export interface SyncHeldDeps {
+    exports: FenceExports | undefined;
+    stateDir: string;
+    /**
+     * Resolve the signed-in identity from one token. `interactive` allows a
+     * sign-in or refresh; the result is taken after it, never mixed with an
+     * identity read before it.
+     */
+    identity: (options: {
+        needPersonal: boolean;
+        interactive: boolean;
+    }) => Promise<HeldIdentity>;
+    confirm: (question: string) => Promise<boolean>;
+    log: (line: string) => void;
+}
+export declare function scopeLabel(slug: string): string;
+export declare function runSyncHeld(deps: SyncHeldDeps, json?: boolean): Promise<number>;
+export interface ReleaseHeldOptions {
+    company?: string;
+    personal?: boolean;
+    yes?: boolean;
+    json?: boolean;
+}
+export declare function runReleaseHeld(deps: SyncHeldDeps, options: ReleaseHeldOptions): Promise<number>;
+/**
+ * The signed-in identity from the session token `ensureCognitoToken` selects
+ * (person or machine, the same choice every vault call makes). The personal
+ * vault uid is resolved with that same token: an agent principal uses its own
+ * entity uid, as the sync runner does; a person uses the canonical person
+ * entity.
+ */
+export declare function resolveHeldIdentity(options: {
+    needPersonal: boolean;
+    interactive: boolean;
+}, io: {
+    ensureToken: (interactive: boolean) => Promise<string>;
+    listPersons: (token: string) => Promise<Array<{
+        uid: string;
+        type: string;
+        createdAt: string;
+    }>>;
+}): Promise<HeldIdentity>;
+export declare function createDefaultSyncHeldDeps(): SyncHeldDeps;
+export declare function registerSyncHeldCommands(syncCmd: Command): void;
+export {};
+//# sourceMappingURL=sync-held.d.ts.map

package/dist/commands/sync-held.js

@@ -0,0 +1,191 @@
+/**
+ * `hq sync held` and `hq sync release-held` (feedback_3bf773c5).
+ *
+ * After a different person signs in on the same computer, hq-cloud holds every
+ * upload and cloud delete for each sync scope (the personal vault and each
+ * company) until the signed-in person reviews what is held and releases it.
+ * These commands are the person's way to see the hold and make that decision.
+ *
+ * The hq-cloud exports (`listPushIdentityFences`, `releasePushIdentityFences`)
+ * ship after the hq-cloud version this CLI pins, so they are feature-detected
+ * on the module namespace, the same way `lib/hq-cloud-manifest.ts` does it. A
+ * static named import of a missing ESM export would stop every command that
+ * loads this file.
+ */
+import * as hqCloud from "@indigoai-us/hq-cloud";
+import chalk from "chalk";
+import * as readline from "node:readline/promises";
+import { VaultClient, PERSONAL_VAULT_JOURNAL_SLUG, getStateDir } from "@indigoai-us/hq-cloud";
+import { buildVaultConfig, cognitoSubjectFromToken, ensureCognitoToken } from "../utils/cognito-session.js";
+import { decodeJwtPayload } from "../utils/person-token-cache.js";
+import { resolveCanonicalPersonUid } from "./cloud.js";
+export const HELD_UNAVAILABLE_MESSAGE = "this HQ build cannot list or release held uploads yet; update HQ and try again";
+export function fenceExports(mod = hqCloud) {
+    const list = mod.listPushIdentityFences;
+    const release = mod.releasePushIdentityFences;
+    if (typeof list !== "function" || typeof release !== "function")
+        return undefined;
+    return {
+        listPushIdentityFences: list,
+        releasePushIdentityFences: release,
+    };
+}
+export function scopeLabel(slug) {
+    return slug === PERSONAL_VAULT_JOURNAL_SLUG || slug === "personal" ? "personal vault" : `company ${slug}`;
+}
+function describe(scope) {
+    const since = new Date(scope.sinceMs).toISOString();
+    const lines = [`  ${scopeLabel(scope.slug)}: held since ${since}`];
+    if (scope.held) {
+        lines.push(`    ${scope.held.count} file${scope.held.count === 1 ? "" : "s"} waiting to upload (last checked ${scope.held.at})`);
+        for (const sample of scope.held.samplePaths.slice(0, 20))
+            lines.push(`      ${sample}`);
+        if (scope.held.count > Math.min(20, scope.held.samplePaths.length))
+            lines.push("      ...");
+    }
+    return lines;
+}
+export async function runSyncHeld(deps, json = false) {
+    if (!deps.exports) {
+        deps.log(`${chalk.red("✗")} ${HELD_UNAVAILABLE_MESSAGE}`);
+        return 1;
+    }
+    const scopes = deps.exports.listPushIdentityFences(deps.stateDir);
+    if (json) {
+        deps.log(JSON.stringify({ scopes }));
+        return 0;
+    }
+    if (scopes.length === 0) {
+        deps.log("No uploads are held on this computer.");
+        return 0;
+    }
+    deps.log("Someone else was signed in on this computer, so these uploads are held:");
+    for (const scope of scopes)
+        for (const line of describe(scope))
+            deps.log(line);
+    deps.log("");
+    deps.log("Nothing has been uploaded or deleted in the cloud. If these files are yours, run `hq sync release-held`.");
+    return 0;
+}
+export async function runReleaseHeld(deps, options) {
+    if (!deps.exports) {
+        deps.log(`${chalk.red("✗")} ${HELD_UNAVAILABLE_MESSAGE}`);
+        return 1;
+    }
+    let scopes = deps.exports.listPushIdentityFences(deps.stateDir);
+    if (options.personal)
+        scopes = scopes.filter((scope) => scope.slug === PERSONAL_VAULT_JOURNAL_SLUG || scope.slug === "personal");
+    if (options.company)
+        scopes = scopes.filter((scope) => scope.slug === options.company);
+    if (scopes.length === 0) {
+        deps.log(options.json ? JSON.stringify({ released: [] }) : "No held uploads match.");
+        return 0;
+    }
+    const needPersonal = scopes.some((scope) => scope.slug === PERSONAL_VAULT_JOURNAL_SLUG || scope.slug === "personal");
+    const snapshot = await deps.identity({ needPersonal, interactive: true });
+    const identities = [snapshot.sub, ...(snapshot.personalUid ? [snapshot.personalUid] : [])];
+    const mine = scopes.filter((scope) => identities.includes(scope.uid));
+    if (mine.length === 0) {
+        deps.log(options.json
+            ? JSON.stringify({ released: [], reason: "not-yours" })
+            : "These held uploads belong to a different signed-in person. Sign in as that person to release them.");
+        return 1;
+    }
+    if (!options.json) {
+        deps.log("Releasing these uploads sends the files below to the cloud as yours:");
+        for (const scope of mine)
+            for (const line of describe(scope))
+                deps.log(line);
+    }
+    if (!options.yes) {
+        const ok = await deps.confirm("Are these files yours to upload? [y/N] ");
+        if (!ok) {
+            deps.log(options.json ? JSON.stringify({ released: [] }) : "Nothing released.");
+            return 1;
+        }
+    }
+    // Re-read the signed-in identity right before releasing, without a sign-in.
+    // If the account changed since the snapshot (including during the prompt),
+    // release nothing: the scopes were judged against the earlier account.
+    const current = await deps.identity({ needPersonal, interactive: false });
+    if (current.sub !== snapshot.sub || current.personalUid !== snapshot.personalUid) {
+        deps.log(options.json
+            ? JSON.stringify({ released: [], reason: "identity-changed" })
+            : "The signed-in account changed while releasing. Nothing was released; run the command again.");
+        return 1;
+    }
+    const released = deps.exports.releasePushIdentityFences(deps.stateDir, identities, mine.map((scope) => scope.slug));
+    deps.log(options.json
+        ? JSON.stringify({ released })
+        : `Released ${released.map(scopeLabel).join(", ")}. The next sync uploads these files.`);
+    return 0;
+}
+async function confirmOnTty(question) {
+    if (process.stdin.isTTY !== true || process.stdout.isTTY !== true)
+        return false;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await rl.question(question);
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * The signed-in identity from the session token `ensureCognitoToken` selects
+ * (person or machine, the same choice every vault call makes). The personal
+ * vault uid is resolved with that same token: an agent principal uses its own
+ * entity uid, as the sync runner does; a person uses the canonical person
+ * entity.
+ */
+export async function resolveHeldIdentity(options, io) {
+    const token = await io.ensureToken(options.interactive);
+    const { sub, entityUid } = cognitoSubjectFromToken(token);
+    if (!sub)
+        throw new Error("could not read the signed-in account from the session; run `hq login` and try again");
+    if (!options.needPersonal)
+        return { sub };
+    const entityType = decodeJwtPayload(token)?.["custom:entityType"];
+    if (entityType === "agent" && entityUid)
+        return { sub, personalUid: entityUid };
+    const personalUid = await resolveCanonicalPersonUid({
+        listMyMemberships: async () => [],
+        listPersonEntities: () => io.listPersons(token),
+        getEntity: async () => null,
+    });
+    return { sub, personalUid };
+}
+export function createDefaultSyncHeldDeps() {
+    const tty = process.stdin.isTTY === true && process.stdout.isTTY === true;
+    return {
+        exports: fenceExports(),
+        stateDir: getStateDir(),
+        identity: (options) => resolveHeldIdentity({ needPersonal: options.needPersonal, interactive: options.interactive && tty }, {
+            ensureToken: (interactive) => ensureCognitoToken({ interactive }),
+            listPersons: async (token) => (await new VaultClient(buildVaultConfig(token)).entity.listByType("person")),
+        }),
+        confirm: confirmOnTty,
+        log: (line) => console.log(line),
+    };
+}
+export function registerSyncHeldCommands(syncCmd) {
+    syncCmd
+        .command("held")
+        .description("Show uploads held because someone else was signed in on this computer")
+        .option("--json", "Print the held scopes as JSON")
+        .action(async (options) => {
+        process.exitCode = await runSyncHeld(createDefaultSyncHeldDeps(), options.json === true);
+    });
+    syncCmd
+        .command("release-held")
+        .description("Confirm held files are yours and let sync upload them")
+        .option("--company <slug>", "Release only this company")
+        .option("--personal", "Release only the personal vault")
+        .option("--yes", "Do not ask for confirmation")
+        .option("--json", "Print the result as JSON")
+        .action(async (options) => {
+        process.exitCode = await runReleaseHeld(createDefaultSyncHeldDeps(), options);
+    });
+}
+//# sourceMappingURL=sync-held.js.map