@indigoai-us/hq-cli 5.345.169 → 5.345.171

package/CHANGELOG.md

@@ -2,6 +2,75 @@
 
 ## [Unreleased]
 
+## [5.345.171] — 2026-10-26
+- The daemon's sync-core unit now accepts a `~/.hq/sync-core/config.toml` that sets `full_vault = true` instead of `canary_path`, so the Rust engine can keep the whole personal vault in sync under the same supervision (ownership check, legacy personal sync paused first, health restarts). A config that sets both keys, or neither, keeps the unit blocked with a reason that names the fix. `hq daemon status` describes the unit as the personal vault rather than a canary, and the unit's environment carries `HQ_SYNC_FULL_VAULT=1`. Company vaults and machines without the sync-core setting are unchanged. Requires an hq-sync-core release that understands `full_vault` (after 0.1.6).
+
+- The agent kit inbox service (`hq agent kit run inbox` or `run all`) no longer waits hours on a stale network connection. Before, one inbox check could hang until the operating system dropped the connection, so new DMs were mirrored and their wake fired up to about 2 hours late. Now the inbox check and each ack give up after 30 seconds, and the poll stops waiting for its token after 30 seconds. The check counts as a failed poll, and the next poll retries after the normal interval. Heartbeat posts, and the heartbeat's wait for its token, have the same limit. A token request that hangs inside the machine sign-in itself is not stopped yet and can still delay later polls; that is a known follow-up. Set `requestTimeoutMs` in the kit's `kit.json` to change it. The inbox log now has one line when a poll takes longer than 10 seconds or times out, giving the duration and outcome. Reported in feedback_66ce5718-d5d9-4d86-a25c-dd361a96226c.
+- `hq bot list --remote --json` now includes each bot's `ownerUid`, passed through unchanged from `GET /v1/agents/mine` (null when the server leaves it out). That route only returns the caller's own bots, so `ownerUid` always equals the viewer; the field is included for completeness. Telling a teammate's bot apart relies on the desktop app's local per-machine owner map, not this field. Human-readable output is unchanged. (feedback_ceda36fa-37c8-48ea-a066-e48c4d0fc438)
+- A local bot no longer fails every turn with EPERM when its TMPDIR is not writable, for example a TMPDIR on an external volume that was not ready when the bot started at login. The turn now uses `/tmp`, then `~/.hq/tmp`, logs one warning naming the folder, and hands the model CLI the working TMPDIR. When no folder works, the turn fails with one message naming the folder and saying to fix TMPDIR or run `hq bot restart`. Nothing changes when TMPDIR is writable. (feedback_f0131909)
+- The bundled sync engine now uses hq-cloud 6.18.102, the current npm `latest`.
+  It pulls in these hq-cloud fixes:
+  - Sync no longer lists the same vault page forever when the listing stops
+    early. It retries the page up to 3 times with backoff, then fails that
+    company's leg with `REMOTE_LIST_NOT_CONVERGING`. Before this,
+    `hq sync now --all --on-conflict keep` could hold a CPU core for hours.
+  - Sync pull no longer replaces your session handoff pointer
+    (`workspace/threads/handoff.json`) with an older vault copy. The copy with
+    the newer `created_at` is kept, and a kept local pointer is always queued
+    for push, so the vault catches up.
+  - When the vault refuses some of your files during a push
+    (FILES_PRESIGN_FORBIDDEN), the pull that follows no longer deletes or
+    overwrites your local copies of those files (hq-cloud #1048).
+  - Sync pull no longer writes or deletes a file through a folder link inside
+    the synced tree, such as `.agents` linking to `.claude` (hq-cloud #1041).
+  - Sync push no longer uploads a second cloud copy of a file under an in-tree
+    folder link's name; it skips the path and names the real path to push
+    instead. Files reached only through a link into an excluded folder are no
+    longer backed up under the link's name (hq-cloud #1047, #1053).
+  - `readManifestUploadStatus` also returns the last failed manifest upload's
+    time, failure count, reason and HTTP status (hq-cloud #1050).
+  - New `hq outposts pull <outpost> <remote-path> [local-path]` downloads one
+    file from an Outpost when it is too large for `hq outposts exec`. It needs
+    the matching hq-pro endpoint to be deployed (hq-cloud #996).
+- People now send only human messages. From a person login, `hq dm` tags every message `audience: "human"`, including 1:1 DMs to an agent, group DMs, channel posts and scheduled sends, and `--audience agent` or `--audience both` fails before any request with "People can only send human messages. Agent messages are sent by agents and bots." and exit 1. `--audience human` and `--for-human` work as before. Local bots, agent-kit agents and other machine identities keep the recipient-based default (agent for an agent, a channel or a group) and may still pass `--audience agent|both`. The caller type comes from the credentials the send uses (machine creds or a person session), not from a flag. The same rule applies to `hq agents message`, the `hq access` grant request, the `hq core delegate send` pickup DM (`both` only from a machine identity), `hq dm-bind post` and the agent MCP `hq_dm_send` tool when its token is a person's. A 403 `person_cannot_send_agent_message` from the server is printed as a plain message with exit 1. A personal bot's model turn runs without machine credentials, so `hq dm --audience agent` typed inside such a turn is now refused and its channel and group posts default to human; the bot's own progress messages still go out under its machine identity.
+- `hq dm send <name>` no longer falls through to a same-named channel when the name matches more than one person or bot. It refuses, sends nothing, and lists each match with its uid. `@name` now always means a person or bot: it never posts to a channel and refuses when no contact matches. `#name` and `--channel` still always mean the channel. When the contacts lookup fails, a bare name now exits 1 and sends nothing instead of guessing the channel; use `#name` or `--channel` to post to the channel.
+- `hq dm inbox` for an agent identity no longer reports a malformed server response as an empty inbox. Invalid JSON or a missing/non-array `messages` field exits 1 with a privacy-safe error and acknowledges nothing. A mixed response keeps the valid messages and warns that the read may be incomplete; `--mark-read` then acks nothing and says how many items were not acked. Acks that fail are now reported. This reuses the `hq agent inbox` classifier from #2155, now exported as `classifyAgentInboxBody`.
+- `hq doctor --fix` and `hq rescue` now repair HQ-managed release links (`.agents/skills`, `.codex/claude` and the other links hq-core ships) whose target is missing, such as links an earlier rescue left pointing into its deleted temp folder. On macOS and Linux the link gets back the relative text hq-core ships (for example `../.claude/skills`), so the git-tracked link is unchanged; on Windows a directory link is an absolute junction. A link is removed instead when its shipped target is missing too. Only a dangling link whose current target is under the HQ root, the system temp folder, or the rescue staging folder beside the backup root (`~/.hq/tmp`, or next to `$HQ_BACKUP_DIR`), or whose path has an `hq-replace-rescue-` folder, is repaired; a dangling link that points anywhere else (for example an unmounted `/Volumes/X`) is treated as your own, left alone, and reported. A real file or folder, or a link that resolves anywhere, is never touched, the link entry is removed without following it (re-checked right before removal), and one link that fails to repair does not stop the others.
+- `hq capacity` Grok collector now passes its clock to the capacity ledger, so ledger retention and `now.json` use the same instant as the readings it just wrote. Before this, retention ran on the wall clock, and a collector given an earlier time deleted its own readings.
+- `hq integrations connect` (and `add`) takes `--personal` or `--company-owned` to choose who owns the new connection; `reconnect --connect` takes them too when it adds a revoked app again. They cannot be combined, and `--company-owned` is separate from `--company <slug>`, which still picks the company. The CLI sends `scope` to the install and sign-in start requests only when one of the flags is given, including on the link-only and access-key retry paths. If the company does not have personal and company integrations turned on yet, the command says so and tells you to run it again without the flag.
+- The "already connected" check now looks at ownership when the server offers personal connections. A personal connect only stops at your own personal connection of the same app, and a company connect only at a company or older shared one, so connecting your own Gmail no longer needs `--force` when the company already has one. `--force` still adds a second account.
+- `hq integrations list` and `show` show each connection's owner (Personal, Company, or Shared (legacy)) and its account label when the server reports owners, and `--json` keeps both fields. Rows without an owner print as before.
+- `hq integrations call` and `tools` take `--account <connection id or account label>` to pick one of several accounts of the same app. With owners reported, `call` passes it to the gateway as the account selector. When more than one account matches, or none does, the command lists the accounts (id, owner, label) and asks you to rerun with `--account`.
+- A loop lane (`hq lanes loop`) no longer shows `running` with no engine after its next envelope is activated and admission is refused. If admission cannot run when the next phase starts, the lane goes to `queued` with reason `admit_failed` and the error, which `hq lanes show` displays. This covers a store lock timeout (`store_lock_timeout`) and the lane changing while admission was checked (`lane_admission_conflict`, `version_conflict`). Any other resume error still fails the envelope with its message. The phase is kept as a pending resume, so reconcile retries it and the envelope is not marked failed. When a throttled loop phase is later admitted, HQ starts that phase's engine (claude, codex or grok) through the normal spawn path. Before this fix it started a second loop controller, which exited at once and left the lane running with no engine pid. Feedback feedback_865fe8a0-49aa-49bd-8719-8a57355bc037.
+- Lanes store locks: a lock held by a live process on this host is no longer reclaimed after the 30-second stale window; it is kept until a 10-minute ceiling (`HQ_LANES_LOCK_LIVE_OWNER_MAX_MS`) that covers pid reuse and hung holders. The reconcile and admission locks now use the same reclaim rules as lane record locks: a lock whose owner pid is dead on this host is reclaimed at once, and an empty lock left by a killed holder ages out by file time instead of blocking forever with `store_lock_timeout`. The reconcile lock holder now removes only its own lock. A legacy lock without a host line whose pid is alive here gets the same ceiling. Older CLIs on the same machine still reclaim by the 30-second window until they are upgraded. Feedback a4226dc9.
+- Personal bots can now run on this computer on the HQ Fleet Runtime: `hq bot create <name> --hq-fleet-runtime`
+  installs a signed, isolated runtime, `hq bot auth <name> --provider chatgpt|grok|claude` signs it in with your own
+  login or API key, and `hq bot start|stop|restart|status|rm` manage its background service. Credentials live in the
+  operating system's secure store, removal wipes them, and `hq bot promote` moves such a bot to the cloud too.
+- Loop lanes: the loop controller (`hq lanes _loop-worker`) is now started with the live Node binary, re-resolved from the Homebrew prefix or PATH when `process.execPath` no longer exists, so a Node upgrade that removes the launch-time binary no longer stops a loop lane from starting its controller. Phase workers and watchers already did this (#2064). Feedback 6cf19c9d.
+- `hq sync push` of a path that is not listed in `.hqinclude` now says so and prints the `.hqinclude` line to add (for example `companies/<slug>/workers/<name>/`). Before, the error ended with advice about symlinks, which sent people looking for a symlink problem. The symlink advice now appears only when a path resolves outside the company folder or its link target cannot be read. The push error text changes for anyone pushing a path missing from `.hqinclude` (feedback_6afa6ce4).
+- When every file under the paths you name in `hq sync push` falls outside your write access, the push now names each requested path as the blocker and points at `hq access <path>`. It still exits 1 (feedback_5baccb9e).
+- `hq access` on a file that is on this computer but not in the vault now checks write access. When an ACL blocks writes, it reports the new outcome `no-write-access` (exit 3) and names the blocking ACL row (`writeBlockedBy` in `--json`), instead of `never-existed` (feedback_5baccb9e).
+- `hq core rebuild-index` (projects, company-knowledge, companies, all) now stays inside the session's bound company set, read exactly as `core/scripts/hq-session.sh get company_slugs` reports it. In a bound session a run with no company rebuilds only the bound companies, and a company outside the set or `--all-companies` is refused before anything is written. Session state that cannot be read (unreadable metadata, a garbled or unreadable `workspace/sessions/.current`, a bound company that is no longer a real directory) refuses the rebuild. An unbound session keeps the every-company rebuild with a warning, so automation is unaffected, and a personal-only session's `all` rebuilds the non-company indexes. `cli.rebuild-index-company-scope` is now a default-on kill switch; turned off, the company root indexes go back to the every-company rebuild with a warning. (feedback_f4468815)
+- `hq scan secrets --range <base>[..<head>]` scans only the lines a branch added: every commit of the range, the lines each merge commit introduced itself, and the net diff from the merge base. A secret added in any commit, including a merge resolution, is caught even if a later commit deletes it. Lines already on the base and older versions of untouched lines are no longer flagged. Added binary files are scanned as text up to 10 MB (larger ones are warned about). It applies the exact-value allowlists committed in the base's `.gitleaks.toml` and adds the base's `[[rules]]` to the built-in rules; rules a branch adds are not run, and a repo rule cannot replace or switch off a built-in one. A reversed range or a git failure exits 2; an empty range warns. `commit-secret-scan.sh pr-check` can use it in place of its whole-file history scan. (feedback_b0af3152)
+- `hq secrets generate-link` prints the link as a clickable OSC-8 hyperlink when stdout is a terminal that supports it (iTerm2, WezTerm, VS Code, Ghostty, kitty, Windows Terminal, VTE; on a TTY only, the `FORCE_HYPERLINK` env var set to `1` or `0` overrides detection), and as the plain URL otherwise. Output to a pipe or file is unchanged and never gets escape sequences, whatever `FORCE_HYPERLINK` says. Control characters (C0, DEL, C1) are stripped from the URL, secret name and expiry before printing, and `[`/`]` are escaped in the Markdown label. New `--format markdown` prints one Markdown link line on stdout, with the expiry and one-time-use note on stderr, so `$(...)` and pipes capture only the link; the link label never contains the token. New `--json` (or `--format json`) prints `{ url, expiresAt, secretName }`.
+- Security: `hq secrets exec --script` and `hq run --script` now release script-locked secrets only to the approved script itself. When any requested secret is script-locked (or the vault does not report its lock state), the command after `--` must be the script (for example `-- ./script.sh args`) or an allowlisted system interpreter followed directly by it (for example `-- bash script.sh args`). Any other command, a shell `-c` string, or a wrapper such as `env` or `xargs` is refused with exit 1 and nothing is injected. The script's `#!` interpreter goes through the same allowlist, and `#!/usr/bin/env X` is resolved on a fixed system PATH. Allowlisted interpreters are sh, dash, ksh, bash (with `--noprofile --norc`), zsh (with `-f`), python3 (with `-I -S`) and node; each must be root-owned and not writable by other users, so Homebrew installs are refused. The script is read once, hash-checked, copied to a private 0700 directory and that copy is run; `HQ_APPROVED_SCRIPT` and `HQ_APPROVED_SCRIPT_DIR` name the original path and its directory (use them to load neighbour files, since `$0` names the copy). The copy is removed on exit, SIGINT, SIGTERM and SIGHUP. `hq run --script` no longer loads the schema through varlock: it reads the schema and local env files in a strict mode that accepts only `KEY=hq(...)`, plain literals and the decorators `@hqCompany`, `@required`, `@optional`, `@sensitive`, `@public`, `@defaultRequired` and `@defaultSensitive`. Any other resolver (such as `exec()`) or decorator (such as `@plugin` or `@import`) is refused before a secret is fetched. The bound child's environment is built from an allowlist: HOME, USER, LOGNAME, LANG, LC_*, TERM, TZ and TMPDIR from the caller, plus the injected values. Injected secrets and schema literals may not use proxy, CA/TLS, pager/editor, HOME/XDG, locale/terminfo, interpreter or inherited names (for example `HTTPS_PROXY`, `SSL_CERT_FILE`, `NODE_TLS_REJECT_UNAUTHORIZED`, `HOME`, `PAGER`, `LESSOPEN`, `EDITOR`, `NLSPATH`, `TMPDIR`); Tool-config names (`AWS_ENDPOINT_URL*`, `AWS_CA_BUNDLE`, `AWS_CONFIG_FILE`, `AWS_SHARED_CREDENTIALS_FILE`, `AWS_PROFILE`, `KUBECONFIG`, `DOCKER_*`, `PIP_*`, `NPM_CONFIG_*`, `BROWSER`, `GNUPGHOME`, `TF_CLI_CONFIG_FILE`, `GOPROXY`, `GOFLAGS`, `CARGO_*`, `SUDO_ASKPASS`) are refused too. With `hq run --script`, schema and local env literals are accepted only for `NODE_ENV`, `APP_ENV`, `ENVIRONMENT`, `LOG_LEVEL`, `LOG_FORMAT`, `CI`, `NO_COLOR` and `FORCE_COLOR`; any other literal is refused before any fetch, and other values must come from the vault through `hq()`. Other caller variables such as `AWS_*` no longer reach a bound script. The private copy is written under `/tmp`, not the caller's `TMPDIR`. The binding controls which entrypoint receives the secret, not what that entrypoint runs. A same-user caller can still influence tools the script calls through dotfiles in HOME (`~/.gitconfig`, `~/.curlrc`, `~/.ssh/config`), so use `hq secrets sandbox` when real isolation matters. The child gets PATH `/usr/bin:/bin:/usr/sbin:/sbin` and loses interpreter and loader injection variables (`BASH_ENV`, `FPATH`, `PYTHON*`, `NODE_OPTIONS`, `NODE_PATH`, `RUBY*`, `GEM_*`, `BUNDLE_*`, `PERL*`, `LD_*`, `DYLD_*`, `OPENSSL_*`, `GIO_*`, `GCONV_PATH`, `LOCPATH`, `GLIBC_TUNABLES`, `DEVELOPER_DIR`, exported bash functions). A bound launch is refused when a secret, or an `hq run` schema or local env value, uses one of those names or `PATH`. The API-key fetch path now reads the secret's lock state too, so API-key callers with unlocked secrets keep working. For `hq secrets exec --script`, secrets the vault marks as not script-locked still go to the command as given. Breaking: every `hq run --script` run uses the strict schema reader and the literal allowlist, including runs whose secrets are not script-locked, so an ordinary literal such as `API_BASE_URL=https://...` now fails.
+- `hq sync now` has two opt-in limits for scheduled or unattended jobs: `--max-idle <seconds>` (or `HQ_SYNC_MAX_IDLE`) and `--max-runtime <seconds>` (or `HQ_SYNC_MAX_RUNTIME`). Both are off by default, so a sync you start yourself is never stopped. With a limit set, a run that has no file planned, transferred, or skipped for the idle time, or that runs past the total time, prints a message saying the sync watchdog stopped it, records a failed sync, and exits with code 124. Time spent with a Mac or Linux laptop asleep does not count. The remote listing and planning step of each company does not register as progress, so set `--max-idle` longer than your slowest planning step. A check in a worker thread also ends the process if it is stuck in a loop that never yields, or if it hangs after the watchdog stops it. That forced stop exits with 137 on macOS and Linux (SIGKILL), not 124. The hang that prompted this, where `hq sync now --all --on-conflict keep` held a CPU core for hours, is fixed in the sync engine and the vault service. Feedback b7c00a62-fa46-417d-93a5-67119263d13f.
+
+## [5.345.170] — 2026-10-25
+- `hq access --fix` now labels its suggested recipient as an access contact and explicitly distinguishes an ACL creator from a fallback company owner or admin. The label no longer implies that the contact wrote the file; access checks and sharing permissions are unchanged.
+
+- `hq doctor --fix` no longer counts a manifest upload as done when `hq sync manifest` exits 0 without uploading. It now runs `hq sync manifest --json` and reports `soft_skipped`, `throttled`, `disabled`, `locked` and `resend_full_scheduled` as not uploaded, with the reason in the unresolved-check next step. When the server asks for a full resend, `--fix` retries once with `--full`, so that scope can clear in the same run; if the server asks again, the reason says a full resend is queued. An `hq` on PATH that predates `--json` falls back to exit-code handling. `hq sync manifest --json` prints the pass outcome as one JSON line (status, mode, error kind and HTTP status; no paths or error text). On hq-cloud releases that store the last failed pass, a stale `sync.manifest.*` row names that failure instead of saying the daily pass is not running, and a failure `--fix` cannot clear (404 route, 403, rejected identity; a 401 keeps its `--fix` target) is reported as `manifest-upload-rejected` with no `--fix` target (feedback_84d7a862).
+- `hq feedback` adds a `stalled` status for work that started and then stopped. A feedback row is in progress only while it has a linked open PR or a live lane; after 48 hours with no activity it moves to `stalled` (the hq-pro sweep, guard and `prUrl`/`laneId` fields ship separately), which is listed apart from `new` (not started). `hq feedback list --status stalled` filters on it, the list table now has a STATUS column that marks stalled rows `stalled!`, and `--status` accepts `in-progress` for `in_progress`; the server validates the value. `hq feedback update --state` accepts `stalled`.
+- `hq feedback update --state in-progress` (or `in_progress`) now requires `--pr <url>` or `--lane <id>`. The CLI first stores the link as `prUrl`/`laneId` and reads the ticket back to check that the server saved it, then posts the state. If the server rejects or ignores the link fields (a server without the new fields), the command exits 1 without posting the state, and the message gives the ticket's current state as read back from the server. The new `hq feedback claim <id>` assigns a ticket to you, and it and `hq feedback assign` send only the assignee and never set a status.
+- `hq files share <name> --with <member>` now looks an extension-less name such as `knowledge` up in the vault before granting it. If `knowledge/` has files and no object `knowledge` exists, the grant covers the folder glob `knowledge/*` and a note says so. Before, it granted an exact object named `knowledge`, which covered nothing under the folder. If only the object exists, the exact key is granted as before. If both exist, neither exists, or the lookup fails, the command refuses with exit 1 and points to `--exact` or `'knowledge/*'`. The share-session path (no `--with`) resolves the name the same way. `hq files unshare <name> --with <member>` first removes the exact `<name>` grant (including rows left by older versions), and when none matches it tries `<name>/*` unless the vault shows `<name>` is only a file; it says which row it removed, lists both rows when nothing matched, and is never blocked by the vault lookup. `unshare` without `--with` still uses the prefix exactly as typed. `--exact` keeps the literal key, and now errors without `--with`. Prefixes with a `*` inside a segment (`**`, `know*`) or an empty segment (`/knowledge`) are refused. The access-request prompt sent to an owner now passes `--exact`, so it grants only the requested object.
+- Fix `hq feedback list` hiding most items: `--status <s>` alone now lists every item in that status instead of only untriaged ones, the new `--open` lists every item that is not resolved, wont-fix or accepted, and a list cut short by `--limit`, the page cap or the server prints a notice on stderr and adds `truncated: true` to `--json` output.
+- `hq mesh context organize` now lists project candidates for a session that attached a project existing only on this machine. Before this fix, such a session could be saved with its company slug but no company id (when the membership check was offline or failed during reconcile), and organize answered `candidates_unavailable` even when signed in. Organize now looks the slug up in your active memberships (5-second limit), saves the company id and fetches candidates. Offline sessions and slugs you are not an active member of keep the old answer. Follow-up to hq-pro #5114.
+- `hq sync push` no longer prints a success line when uploads are held after an account sign-in change on this computer. Before, the push skipped every named file without counting it and reported "Pushed 0 file(s) (0 B, 0 skipped)" with exit 0, while the vault kept the old copy. It now prints how many files were not uploaded, names `hq sync held` and `hq sync release-held`, adds `filesHeldByIdentityFence` to the `--json` complete event, and exits 1. Feedback a69e12ba-c8c6-40a9-ba00-01e60d302e18.
+- HQ's existing daemon can now supervise one explicitly configured personal-vault sync-core canary on macOS or Linux. Activation fails closed unless the binary, vault ownership and full-mode configuration match, hands ownership over without overlapping the existing sync runner, and restarts a core process that stops reporting health. The existing realtime connection accepts only the versioned, content-free sync wake envelope. Company vaults and machines without the canary setting keep the existing sync path unchanged.
+- The personal local bot records a decision pick from the owner's HQ DM. When a decision is in conversation in that DM (`hq decide talk`) and the owner's whole reply names one option (`Release`, `ship`, `go with Release`), the bot records it through the decisions API with source `thread` and replies `Recorded: <option>.` Any other reply goes to the model with the decision loaded, and nothing is recorded. Only the owner's messages count, only decisions addressed to the owner in the owner's own companies are used, and the call uses the bot's own sign-in. After 24 hours with no pick the bot restates the full decision once. If the decisions API is not deployed (404), a pick gets a plain reply saying it was not recorded.
+
+
 ## [5.345.169] — 2026-10-24
 - Sentry error reports now redact CloudFront signed-URL params (`Policy`, `Key-Pair-Id`) and the `AWSAccessKeyId` and `GoogleAccessId` ids when they appear as structured keys in event data, for example a parsed query under `extra`. The feedback diagnostics scrubber already redacted them (#2177); the Sentry scrubber caught them only inside strings. The shared structured-key cases now run against the Sentry scrubber too.
 - A debounced automatic checkpoint is now queued for the next checkpoint sibling. Before this, `hq core checkpoint` wrote the `-auto-` thread when the per-session debounce skipped the sibling, but it never queued the payload, so no sibling ever filled the thread in. The payload is now added to the pending queue once, and the next sibling run picks it up. The debounce still limits how many siblings start. When the pending queue goes over its cap of 50, a message on stderr now gives the number of oldest payloads dropped. Feedback a2a5c2c3-5ea0-4e1f-8155-1f39ce6ac750.

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -283,7 +283,7 @@ if ! jq '.status = "sending"' "$MANIFEST" > "$TMP_MANIFEST" || ! mv "$TMP_MANIFE
   rm -f "$TMP_MANIFEST"
   die "could not persist sending state; no DM attempted"
 fi
-DM_OUT="$(hq dm "$PRINCIPAL" "$HEADLINE" --audience both --prompt-file "$PROMPT" --details-file "$BRIEF")" \
+DM_OUT="$(hq dm "$PRINCIPAL" "$HEADLINE" --audience human --prompt-file "$PROMPT" --details-file "$BRIEF")" \
   || die "hq dm delivery outcome is uncertain; status is sending, inspect DM history before retrying"
 
 EVENT_ID="$(printf '%s' "$DM_OUT" | grep -oE 'eventId[: ]+[A-Za-z0-9_-]+' | head -1 | sed -E 's/eventId[: ]+//' || true)"

package/dist/command-catalog.generated.d.ts

@@ -1044,6 +1044,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--force-scope-shrink";
             readonly description: "When a scope shrink would un-track locally-modified files, proceed anyway. Dirty files are KEPT on disk (only un-tracked); clean out-of-scope files are quarantined under .hq/scope-quarantine/.";
             readonly hidden: false;
+        }, {
+            readonly flags: "--max-idle <seconds>";
+            readonly description: "For scheduled or unattended runs: stop with exit code 124 after this many seconds with no file planned, transferred or skipped. The remote listing and planning phase of a leg reports no progress, so set this longer than your slowest planning phase. Laptop sleep does not count. (default: HQ_SYNC_MAX_IDLE, else off)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--max-runtime <seconds>";
+            readonly description: "For scheduled or unattended runs: stop with exit code 124 if the run has not finished after this many seconds, even while it is making progress. Laptop sleep does not count. (default: HQ_SYNC_MAX_RUNTIME, else off)";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -1164,6 +1172,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--print";
             readonly description: "Build and print the chunks as JSON; upload nothing";
             readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the pass outcome as one JSON line instead of a summary";
+            readonly hidden: false;
         }, {
             readonly flags: "--respect-throttle";
             readonly description: "Honour the 24h per-scope upload throttle instead of forcing a pass (for scheduled callers)";
@@ -2283,6 +2295,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Token expiry duration (e.g. 24h, 2d, 30m)";
             readonly hidden: false;
             readonly defaultValue: "24h";
+        }, {
+            readonly flags: "--format <format>";
+            readonly description: "Output format: text (default; OSC-8 hyperlink on a supporting TTY, plain URL otherwise; FORCE_HYPERLINK=1/0 overrides detection on a TTY only), markdown (one Markdown link line on stdout, details on stderr), json";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print { url, expiresAt, secretName } as JSON (same as --format json)";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -3067,6 +3087,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--permission <level>";
             readonly description: "Permission level (only with --with): read | write";
             readonly hidden: false;
+        }, {
+            readonly flags: "--exact";
+            readonly description: "With --with: grant exactly the object named by <prefix>, even when it looks like a folder (by default a bare folder name such as 'knowledge' is granted as the folder glob 'knowledge/*').";
+            readonly hidden: false;
         }, {
             readonly flags: "--full";
             readonly description: "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.";
@@ -3092,7 +3116,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "unshare";
-        readonly description: "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.";
+        readonly description: "Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with. With --with, a bare name such as 'knowledge' first removes the exact 'knowledge' grant (rows from older `hq files share` versions) and, when none matches, the folder-glob 'knowledge/*' grant. Without --with, the prefix is used exactly as typed: pass 'knowledge/*' (quoted) to clean up the folder-glob row.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -3109,6 +3133,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--with <principal>";
             readonly description: "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant";
             readonly hidden: false;
+        }, {
+            readonly flags: "--exact";
+            readonly description: "With --with: remove the grant on exactly the object named by <prefix>. By default a bare folder name such as 'knowledge' resolves to the folder glob 'knowledge/*', the same way `hq files share` resolves it.";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -3381,7 +3409,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly usage: "[options] [vault-path...]";
     readonly helpText: readonly [{
         readonly position: "after";
-        readonly text: "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it)\n  4  ambiguous (several keys matched; pick one)\n\nWith several paths, each gets its own result block and the exit code is the\nhighest one across the paths.\n";
+        readonly text: "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it), or\n     no-write-access (the file is on disk, not in the vault, and you cannot\n     write to it, so a push cannot upload it)\n  4  ambiguous (several keys matched; pick one)\n\nWith several paths, each gets its own result block and the exit code is the\nhighest one across the paths.\n";
     }];
     readonly arguments: readonly [{
         readonly name: "vault-path";
@@ -3987,7 +4015,7 @@ export declare const COMMAND_CATALOG: readonly [{
     }];
 }, {
     readonly name: "dm";
-    readonly description: "Send and read direct messages, and manage connection requests. Messages to a person send to them; messages to an agent, a channel or a group are tagged for agents and folded away from people by default. Pass --for-human or --audience human|agent|both to override.";
+    readonly description: "Send and read direct messages, and manage connection requests. Messages sent from a person login are always tagged for people. When an agent or bot sends, messages to an agent, a channel or a group are tagged for agents and folded away from people by default. Pass --for-human or --audience human to tag a message for people; --audience agent|both is for agents and bots only.";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly helpOption: true;
@@ -4054,7 +4082,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--audience <human|agent|both>";
-            readonly description: "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both. Default: human for a person, agent for an agent, a channel or a group. Wins over --for-human.";
+            readonly description: "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both. agent and both are for agents and bots only; a person login always sends human. Default for agents and bots: human for a person, agent for an agent, a channel or a group. Wins over --for-human.";
             readonly hidden: false;
         }, {
             readonly flags: "--for-human";
@@ -4565,12 +4593,20 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--state <state>";
-            readonly description: "One of: triaged, in-progress, shipped, verified, resolved";
+            readonly description: "One of: triaged, in-progress, stalled, shipped, verified, resolved";
             readonly hidden: false;
         }, {
             readonly flags: "--note <text>";
             readonly description: "What the customer should read (plain text, up to 2000 characters)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--pr <url>";
+            readonly description: "Open pull request for this ticket (required with --state in-progress unless --lane is given)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--lane <id>";
+            readonly description: "Live lane working this ticket (required with --state in-progress unless --pr is given)";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -4632,6 +4668,27 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "claim";
+        readonly description: "Assign a ticket to yourself (sets the assignee only, never the status)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <id>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "id";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "Feedback id (feedback_<uuid>)";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print { id, assignee } as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "list";
         readonly description: "List feedback: untriaged (default), yours, or one person's";
@@ -4646,6 +4703,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--untriaged";
             readonly description: "Items nobody has triaged yet (the default)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--open";
+            readonly description: "Every item not resolved, won't-fix or accepted, triaged or not";
+            readonly hidden: false;
         }, {
             readonly flags: "--mine";
             readonly description: "Items assigned to you";
@@ -4656,7 +4717,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--status <status>";
-            readonly description: "Only items with this status";
+            readonly description: "Only items with this status (new, triaging, accepted, wont_fix, in_progress, resolved, waiting_on_customer, reopened, stalled, needs_info). Without --untriaged, --mine or --assignee it lists every item in that status";
             readonly hidden: false;
         }, {
             readonly flags: "--limit <n>";
@@ -4668,7 +4729,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--json";
-            readonly description: "Print { items, count } as JSON";
+            readonly description: "Print { items, count } as JSON, plus truncated: true when more items match";
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
@@ -5301,6 +5362,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--company <slug>";
             readonly description: "Company slug, e.g. indigo";
             readonly hidden: false;
+        }, {
+            readonly flags: "--account <id-or-label>";
+            readonly description: "Which account of the app: its connection id or account label";
+            readonly hidden: false;
         }, {
             readonly flags: "--describe <tool>";
             readonly description: "Print the full input schema for one tool";
@@ -5334,6 +5399,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--connection <id>";
             readonly description: "Connection id (acct_…)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--account <id-or-label>";
+            readonly description: "Which account of the app: its connection id or account label";
+            readonly hidden: false;
         }, {
             readonly flags: "--company <slug>";
             readonly description: "Company slug, e.g. indigo";
@@ -5589,6 +5658,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--force";
             readonly description: "Connect again even if this app is already connected";
             readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "Connect it as your own personal connection (not --company <slug>, which picks the company)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--company-owned";
+            readonly description: "Connect it as a connection the whole company owns (needs permission to add company apps)";
+            readonly hidden: false;
         }, {
             readonly flags: "--json";
             readonly description: "Machine-readable output";
@@ -5658,6 +5735,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--connect";
             readonly description: "For a revoked row, run `connect <domain>` to re-add and revive it";
             readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "With --connect: re-add it as your own personal connection";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--company-owned";
+            readonly description: "With --connect: re-add it as a connection the whole company owns";
+            readonly hidden: false;
         }, {
             readonly flags: "--json";
             readonly description: "Machine-readable output";
@@ -6283,7 +6368,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--repo <dir>";
-            readonly description: "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths";
+            readonly description: "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths. With --range: the repo to scan (default: the current directory)";
             readonly hidden: false;
         }, {
             readonly flags: "--snapshot-root <dir>";
@@ -6293,6 +6378,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--allowlist-rev <rev>";
             readonly description: "With --repo: read .gitleaks.toml from this commit instead of HEAD";
             readonly hidden: false;
+        }, {
+            readonly flags: "--range <range>";
+            readonly description: "Scan the lines added in <base>..<head> (head defaults to HEAD), every commit included, with the base's .gitleaks.toml allowlists and the repo's [[rules]]";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }];
@@ -8455,6 +8544,41 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "pull";
+        readonly description: "Download one file from an Outpost through a short-lived download link (for files too large for exec output). <outpost> is the Outpost id (`primary` for your first box). The remote path must be inside the Outpost user's home or HQ dir; relative and ~ paths start at the home dir. The file is saved to [local-path], or to the remote file name in the current directory.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <outpost> <remote-path> [local-path]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "outpost";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }, {
+            readonly name: "remote-path";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }, {
+            readonly name: "local-path";
+            readonly required: false;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--force";
+            readonly description: "Replace the local file if it already exists";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Emit raw JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "terminal";
         readonly description: "Open an interactive terminal on an Outpost — a real TTY over SSM Session Manager (no SSH, no local AWS credentials). Requires the AWS session-manager-plugin installed locally. With --forward, tunnels a port on the box to your machine instead of opening a shell.";
@@ -18501,7 +18625,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--runtime <runtime>";
             readonly description: "Model CLI to run the bot with: claude|codex|grok";
             readonly hidden: false;
-            readonly defaultValue: "claude";
+        }, {
+            readonly flags: "--hq-fleet-runtime";
+            readonly description: "Create this personal bot with the local HQ Fleet Runtime";
+            readonly hidden: false;
         }, {
             readonly flags: "--model <model>";
             readonly description: "Model override passed to the runtime CLI";
@@ -18773,6 +18900,51 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "auth";
+        readonly description: "Sign a runtime-backed personal bot in to ChatGPT, Grok, Claude, or another supported provider";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <name>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "name";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--provider <provider>";
+            readonly description: "Provider: chatgpt, grok, claude, or a runtime provider id";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--model <model>";
+            readonly description: "Model id; required for providers without a built-in personal-bot default";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--api-key";
+            readonly description: "Read an API key from stdin instead of starting device authorization";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--base-url <url>";
+            readonly description: "Provider API base URL; required for custom runtime providers";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--transport <transport>";
+            readonly description: "Provider transport: chat_completions, anthropic_messages, or codex_responses";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--no-browser";
+            readonly description: "Do not open a browser during device authorization";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "logs";
         readonly description: "Show the bot's log";