@indigoai-us/hq-cli 5.345.169 → 5.345.171

package/dist/commands/dm.js

@@ -5,7 +5,9 @@ import { resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
 import { redactAgentInboxItem as redactInboxCredentials } from "../lib/agent-kit/inbox-redact.js";
-import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN, defaultAudienceFor, recipientKindOf, } from "../lib/notify-recipient.js";
+import { classifyAgentInboxBody } from "../lib/agent-kit/inbox-state.js";
+import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN, PERSON_AGENT_AUDIENCE_MESSAGE, PERSON_CANNOT_SEND_AGENT_CODE, callerMayUseAudience, defaultAudienceFor, recipientKindOf, } from "../lib/notify-recipient.js";
+import { callerIsMachinePrincipal } from "../lib/caller-principal.js";
 export { defaultAudienceFor, recipientKindOf };
 import { dmForwardCliEnabled } from "./dm-forward-flag.js";
 import { attachmentScopeForChannel, formatUploadedAttachments, personalScopeForCaller, uploadDmAttachments, validateAttachmentPaths, } from "./dm-attach.js";
@@ -120,29 +122,45 @@ export function matchChannelsByName(channels, name) {
  * eba06f59). Returns null when nothing or more than one contact matches. Pure.
  */
 export function matchContactByName(contacts, name) {
-    const target = name.trim().toLowerCase();
-    const targetSlug = channelSlug(name);
+    const unique = matchContactsByName(contacts, name);
+    return unique.length === 1 ? unique[0] : null;
+}
+/**
+ * Every distinct contact (person or bot) whose display name matches `name`,
+ * using the same rule as matchContactByName. A leading '@' is the explicit
+ * person/bot selector and is ignored for matching. Pure.
+ */
+export function matchContactsByName(contacts, name) {
+    const bare = name.trim().replace(/^@/, "");
+    const target = bare.toLowerCase();
+    const targetSlug = channelSlug(bare);
     if (!target)
-        return null;
+        return [];
     const hits = contacts.filter((c) => {
         if (!c.personUid)
             return false;
         const dn = c.displayName?.trim().toLowerCase();
         return Boolean(dn && (dn === target || (targetSlug && channelSlug(dn) === targetSlug)));
     });
-    const unique = [...new Map(hits.map((c) => [c.personUid, c])).values()];
-    return unique.length === 1 ? unique[0] : null;
+    return [...new Map(hits.map((c) => [c.personUid, c])).values()];
+}
+/** One line per ambiguous contact match, for a refusal message. Pure. */
+export function formatContactMatches(matches) {
+    return matches
+        .map((c) => `  ${c.displayName || "(no name)"}${c.email ? ` <${c.email}>` : ""}  ${c.personUid}`)
+        .join("\n");
 }
+/** Contacts, or null when the lookup failed (so callers can say so). */
 async function fetchContacts(token) {
     try {
         const res = await vaultApiFetch({ token, path: "/v1/notify/contacts" });
         if (!res.ok)
-            return [];
+            return null;
         const data = (await res.json());
-        return Array.isArray(data.contacts) ? data.contacts : [];
+        return Array.isArray(data.contacts) ? data.contacts : null;
     }
     catch {
-        return [];
+        return null;
     }
 }
 /**
@@ -427,6 +445,8 @@ export async function resolveDmPeerUid(token, recipient) {
 function friendlyDmError(status, code, fallback) {
     if (status === 401)
         return "Not authenticated — run `hq login` and try again.";
+    if (code === PERSON_CANNOT_SEND_AGENT_CODE)
+        return fallback?.trim() || PERSON_AGENT_AUDIENCE_MESSAGE;
     if (status === 404 || code === "RECIPIENT_NOT_FOUND") {
         return "Recipient not found or not reachable — you can only DM someone you share an active company with.";
     }
@@ -818,29 +838,47 @@ function explicitAudience(opts) {
     }
     return explicit;
 }
+/** An explicit agent/both audience from a person login. */
+export class PersonAudienceError extends Error {
+    constructor() {
+        super(PERSON_AGENT_AUDIENCE_MESSAGE);
+        this.name = "PersonAudienceError";
+    }
+}
 /**
  * Resolve the audience for a send. The default comes from the recipient kind
- * (`defaultAudienceFor`); `--for-human` maps to `human`; an explicit
- * `--audience` wins over `--for-human` (with a warning) and is validated.
+ * and the caller (`defaultAudienceFor`: always `human` for a person login);
+ * `--for-human` maps to `human`; an explicit `--audience` wins over
+ * `--for-human` (with a warning) and is validated. A person login passing
+ * `--audience agent|both` throws PersonAudienceError.
  */
-export function resolveSendAudience(opts, recipientKind, warn = (m) => console.error(chalk.yellow(m))) {
+export function resolveSendAudience(opts, recipientKind, warn = (m) => console.error(chalk.yellow(m)), machineCaller = callerIsMachinePrincipal()) {
     const explicit = explicitAudience(opts);
+    if (!callerMayUseAudience(explicit, machineCaller))
+        throw new PersonAudienceError();
     if (explicit !== undefined) {
         if (opts.forHuman) {
             warn("Both --audience " + explicit + " and --for-human were passed; using --audience " + explicit + ".");
         }
         return explicit;
     }
-    return opts.forHuman ? "human" : defaultAudienceFor(recipientKind);
+    return opts.forHuman ? "human" : defaultAudienceFor(recipientKind, machineCaller);
 }
 async function runDmSend(recipient, message, rawOpts) {
     // Validate an explicit --audience before any network call; the default is
     // applied once the recipient kind is known.
     explicitAudience(rawOpts);
+    // People never send agent-tagged messages: refuse before any network call.
+    const machineCaller = callerIsMachinePrincipal();
+    if (!callerMayUseAudience(rawOpts.audience, machineCaller)) {
+        console.error(chalk.red(PERSON_AGENT_AUDIENCE_MESSAGE));
+        process.exit(1);
+        return;
+    }
     const opts = { ...rawOpts };
     const withAudience = (kind) => ({
         ...rawOpts,
-        audience: resolveSendAudience(rawOpts, kind),
+        audience: resolveSendAudience(rawOpts, kind, undefined, machineCaller),
     });
     // --channel <name> is an explicit channel target; the positional carries the
     // message (recipient slot), e.g. `hq dm --channel vyg-dev "hello"`.
@@ -874,16 +912,46 @@ async function runDmSend(recipient, message, rawOpts) {
     // A bare name or #hash addresses a named DM channel.
     const channelName = parseChannelName(recipient);
     if (channelName !== null) {
-        // A bare word (no '#') may name a person as well as a channel. Prefer the
-        // exact person and say so; '#name' or --channel always means the channel.
-        const person = recipient.trim().startsWith("#")
-            ? null
-            : matchContactByName(await fetchContacts(await ensureCognitoToken()), channelName);
+        // A bare word may name a person or bot as well as a channel. Prefer the
+        // exact person/bot and say so; '#name' or --channel always means the
+        // channel, '@name' always means a person/bot. Several same-named
+        // contacts are ambiguous: refuse with the list rather than fall through
+        // to a channel of that name (feedback eba06f59).
+        const typed = recipient.trim();
+        const explicitPerson = typed.startsWith("@");
+        const bare = channelName.replace(/^@/, "");
+        let person = null;
+        if (!typed.startsWith("#")) {
+            const contacts = await fetchContacts(await ensureCognitoToken());
+            if (contacts === null) {
+                // Without contacts we cannot tell a person/bot from a channel, so a
+                // bare name must not guess the channel either.
+                console.error(chalk.red(`Could not load your contacts to resolve '${typed}'; nothing was sent. ` +
+                    `Use their email or prs_/agt_ uid for a person or bot, or '#${bare}' or --channel ${bare} to post to the channel.`));
+                process.exit(1);
+                return;
+            }
+            else {
+                const matches = matchContactsByName(contacts, bare);
+                if (matches.length > 1) {
+                    console.error(chalk.red(`'${bare}' matches ${matches.length} people or bots; nothing was sent. Use an email or uid:\n${formatContactMatches(matches)}\n` +
+                        `Use '#${bare}' or --channel ${bare} for a channel.`));
+                    process.exit(1);
+                    return;
+                }
+                person = matches[0] ?? null;
+            }
+            if (!person && explicitPerson) {
+                console.error(chalk.red(`No person or bot named '${bare}' in your contacts; nothing was sent. Use '#${bare}' for a channel.`));
+                process.exit(1);
+                return;
+            }
+        }
         if (!person?.personUid) {
             await runChannelSend(channelName, message, withAudience("channel"));
             return;
         }
-        console.log(chalk.dim(`Resolved '${channelName}' to person ${person.displayName || person.email || person.personUid} (${person.personUid}). Use '#${channelName}' or --channel ${channelName} to post to a channel instead.`));
+        console.log(chalk.dim(`Resolved '${bare}' to person ${person.displayName || person.email || person.personUid} (${person.personUid}). Use '#${bare}' or --channel ${bare} to post to a channel instead.`));
         recipient = person.personUid;
     }
     Object.assign(opts, withAudience(recipientKindOf(recipient)));
@@ -1492,23 +1560,46 @@ async function runAgentInbox(token, agentUid, opts) {
         console.error(chalk.red(`GET ${route} → ${res.status}`));
         process.exit(1);
     }
-    const data = (await res.json().catch(() => ({})));
-    let items = (Array.isArray(data.messages) ? data.messages : []).map(redactAgentInboxItem);
+    // Same guard as `hq agent inbox` (hq-cli #2155): a 200 alone does not
+    // certify the read. A decode failure stays undefined for the classifier;
+    // parser errors and response bytes are never echoed.
+    const classified = classifyAgentInboxBody(await res.json().catch(() => undefined));
+    if (classified.status === "invalid") {
+        console.error(chalk.red(`GET ${route} returned an invalid response; the inbox could not be read, and nothing was acknowledged.`));
+        process.exit(1);
+        return;
+    }
+    const partial = classified.status === "partial";
+    if (partial) {
+        console.error(chalk.yellow("The server inbox contained invalid messages; showing the valid ones only, which may be incomplete."));
+    }
+    let items = classified.items.map(redactAgentInboxItem);
     if (opts.limit && Number(opts.limit) > 0)
         items = items.slice(0, Number(opts.limit));
     if (opts.json) {
         console.log(JSON.stringify(items, null, 2));
     }
     else if (items.length === 0) {
-        console.log(chalk.dim("No pending inbox items."));
+        console.log(chalk.dim(partial
+            ? "No pending inbox items can be confirmed; the server inbox could not be read completely."
+            : "No pending inbox items."));
     }
     else {
         console.log(chalk.green(`${items.length} pending inbox item${items.length === 1 ? "" : "s"}:`));
         for (const item of items)
             console.log(`\n${formatAgentInboxItem(item)}`);
     }
-    if (opts.markRead) {
+    if (opts.markRead && partial) {
+        // An incomplete read cannot show what --mark-read would hide, so ack nothing.
+        const n = items.length;
+        const ids = items.map((item) => item.id).join(", ");
+        console.error(chalk.yellow(`--mark-read skipped: the inbox read was incomplete, so ${n} ${n === 1 ? "item was" : "items were"} not acked` +
+            `${opts.limit ? " (count reflects --limit)" : ""}` +
+            `${n > 0 ? `: ${ids}. Ack individually with \`hq agent inbox done <id>\`.` : "."}`));
+    }
+    if (opts.markRead && !partial) {
         let acked = 0;
+        let failed = 0;
         for (const item of items) {
             const id = typeof item.messageId === "string" ? item.messageId : typeof item.id === "string" ? item.id : null;
             if (!id)
@@ -1516,9 +1607,13 @@ async function runAgentInbox(token, agentUid, opts) {
             const ack = await vaultApiFetch({ token, path: `${route}/${encodeURIComponent(id)}/ack`, method: "POST" });
             if (ack.ok)
                 acked += 1;
+            else
+                failed += 1;
         }
         if (!opts.json && acked > 0)
             console.log(chalk.dim(`\nAcked ${acked}.`));
+        if (failed > 0)
+            console.error(chalk.yellow(`${failed} item${failed === 1 ? "" : "s"} could not be acked.`));
     }
 }
 async function runDmInbox(opts) {
@@ -1729,7 +1824,7 @@ async function runDmChannel(target, opts) {
 export function registerDmCommand(program) {
     const dm = program
         .command("dm")
-        .description("Send and read direct messages, and manage connection requests. Messages to a person send to them; messages to an agent, a channel or a group are tagged for agents and folded away from people by default. Pass --for-human or --audience human|agent|both to override.");
+        .description("Send and read direct messages, and manage connection requests. Messages sent from a person login are always tagged for people. When an agent or bot sends, messages to an agent, a channel or a group are tagged for agents and folded away from people by default. Pass --for-human or --audience human to tag a message for people; --audience agent|both is for agents and bots only.");
     dm
         .command("send [recipient] [message]", { isDefault: true, hidden: true })
         .description('Send a direct message. RECIPIENT can be a person (email, personUid, or agentUid), a GROUP DM (comma-separated: "a@x.com,b@y.com"), or one of your DM CHANNELS by name — bare (hq dm vyg-dev "hi"), hash form (hq dm "#vyg-dev" "hi"), or via --channel (hq dm --channel vyg-dev "hi"). A person receives a DM as an HQ Sync notification; an agent receives it in its durable box inbox. If you aren\'t connected yet, it sends a connection request that holds your message. See your channels with `hq channels`.\n\nCHANNEL MENTIONS: HQ mentions are structured — the server never reads `@name` out of your text, so a channel message has to carry the participants alongside the body. When you write `@name` in a channel message, this command looks the name up in the channel roster (case-insensitive on display name and slug/handle; quote multi-word names as @"Jacob Posel") and sends it as a real mention, which notifies people and wakes agents. If a name is unknown or matches more than one member, the send FAILS with the candidates instead of posting something that mentions nobody. A bare "@" or an email address in your prose is never treated as a mention. Pass --no-mentions to post the text literally.\n\nCHANNEL THREADS: `hq dm <channel> --thread <eventId> "…"` replies under an existing root (the request carries rootEventId). `--thread last` replies to your most recent top-level message in that channel. Copy a root eventId from `hq dm channel <name>`, which prints each root\'s id and indents replies underneath.')
@@ -1742,7 +1837,7 @@ export function registerDmCommand(program) {
         .option("--details-file <path>", "Read the details from a file (1:1 DMs; channel sends also supported)")
         .option("--at <iso>", "Schedule delivery at an ISO8601 time (store-and-forward; delivered within ~60s of the time; 1:1 DMs only)")
         .option("--in <duration>", "Schedule delivery after a relative delay: 30s, 10m, 2h, 1d (1:1 DMs only)")
-        .option("--audience <human|agent|both>", "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both. Default: human for a person, agent for an agent, a channel or a group. Wins over --for-human.")
+        .option("--audience <human|agent|both>", "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both. agent and both are for agents and bots only; a person login always sends human. Default for agents and bots: human for a person, agent for an agent, a channel or a group. Wins over --for-human.")
         .option("--for-human", "Tag the message for people (alias for --audience human).")
         .option("--attach <path>", "Upload a local file and attach it to the message (repeatable, up to 5 files, 25 MB each). 1:1 DMs and named channels; the file lands in the conversation's vault scope and the recipient can open it. Not available for group DMs or scheduled sends.", (value, previous = []) => [...previous, value])
         .action(async (recipient, message, opts) => {

package/dist/commands/feedback-triage.d.ts

@@ -9,6 +9,18 @@ import { Command } from "commander";
  */
 export declare const TRIAGE_KINDS: readonly ["bug", "feature", "question"];
 export type TriageKind = (typeof TRIAGE_KINDS)[number];
+/**
+ * Internal feedback row statuses `hq feedback list --status` accepts.
+ * `stalled` is open work that started and then stopped: a row is in_progress
+ * only while it has a linked open PR or a live lane, and moves to stalled after
+ * 48h with no activity. It is listed apart from `new` (not started).
+ */
+/**
+ * Statuses shown in `list --status` help. Help text only: the CLI does not
+ * validate against this list, because hq-pro owns the set and returns a 400
+ * for an unknown value.
+ */
+export declare const FEEDBACK_LIST_STATUSES: readonly ["new", "triaging", "accepted", "wont_fix", "in_progress", "resolved", "waiting_on_customer", "reopened", "stalled", "needs_info"];
 export declare const MAX_TRIAGE_SUMMARY = 2000;
 export declare const DEFAULT_LIST_LIMIT = 50;
 export interface FeedbackListRow {
@@ -24,6 +36,14 @@ export type FeedbackListSelector = {
 } | {
     kind: "assignee";
     assignee: string;
+}
+/** Every visible row, untriaged or not. Used for `--status` with no other selector. */
+ | {
+    kind: "any";
+}
+/** Every row not in a terminal status, untriaged or not (`--open`). */
+ | {
+    kind: "open";
 };
 /** Email claim of the caller's staff token, used by `list --mine`. */
 export declare function emailFromToken(token: string): string | null;
@@ -36,14 +56,36 @@ export declare function formatFeedbackAge(iso: string | undefined, now?: number)
  * back as `?cursor=`.
  */
 export declare function cursorFrom(data: unknown): string | null;
+/**
+ * Lifecycle states hq-pro treats as closed (`TERMINAL_STATUSES` in
+ * feedback-status.ts). `--open` lists every row outside this set; a row with
+ * no status counts as open.
+ */
+export declare const TERMINAL_FEEDBACK_STATUSES: readonly string[];
+/** Why a list stopped before the server ran out of rows, if it did. */
+export type FeedbackListTruncation = "limit" | "page-cap" | "server";
+export interface FeedbackListResult {
+    items: FeedbackListRow[];
+    /** Set when matching rows may exist beyond `items`. */
+    truncated?: FeedbackListTruncation;
+}
 /** Page through `GET /v1/feedback` until `limit` rows (or every row with `limit: null`). */
 export declare function listFeedback(opts: {
     token: string;
     selector: FeedbackListSelector;
     status?: string;
     limit: number | null;
-}): Promise<FeedbackListRow[]>;
+}): Promise<FeedbackListResult>;
+/** One-line stderr notice for a list that stopped before the end. */
+export declare function feedbackTruncationNotice(reason: FeedbackListTruncation, shown: number): string;
 export declare function formatFeedbackTable(rows: FeedbackListRow[], now?: number): string;
+/** Status cell for the list table. A stalled row is flagged so it does not read as not started. */
+export declare function formatFeedbackStatus(status: unknown): string;
+/**
+ * Normalize `list --status`; accepts `in-progress` as an alias of `in_progress`.
+ * Any non-empty value goes to the server, which validates it.
+ */
+export declare function parseListStatus(raw: string): string;
 export declare function parseListLimit(raw: string): number;
 export declare function buildTriagePatch(opts: {
     id: string;

package/dist/commands/feedback-triage.js

@@ -11,6 +11,29 @@ import { assertFeedbackId, normalizeFeedbackAssignee, readFeedbackError, resolve
  * send them.
  */
 export const TRIAGE_KINDS = ["bug", "feature", "question"];
+/**
+ * Internal feedback row statuses `hq feedback list --status` accepts.
+ * `stalled` is open work that started and then stopped: a row is in_progress
+ * only while it has a linked open PR or a live lane, and moves to stalled after
+ * 48h with no activity. It is listed apart from `new` (not started).
+ */
+/**
+ * Statuses shown in `list --status` help. Help text only: the CLI does not
+ * validate against this list, because hq-pro owns the set and returns a 400
+ * for an unknown value.
+ */
+export const FEEDBACK_LIST_STATUSES = [
+    "new",
+    "triaging",
+    "accepted",
+    "wont_fix",
+    "in_progress",
+    "resolved",
+    "waiting_on_customer",
+    "reopened",
+    "stalled",
+    "needs_info",
+];
 export const MAX_TRIAGE_SUMMARY = 2000;
 export const DEFAULT_LIST_LIMIT = 50;
 /** Safety stop for --all so a server that never ends its cursor can't loop forever. */
@@ -64,49 +87,114 @@ export function cursorFrom(data) {
     }
     return null;
 }
+function isTruncated(data) {
+    return (!!data &&
+        typeof data === "object" &&
+        !Array.isArray(data) &&
+        data.truncated === true);
+}
 /** Server page cap (FEEDBACK_LIST_PAGE_MAX). The plain list path rejects a cursor without a limit. */
 const LIST_PAGE_SIZE = 200;
+/**
+ * Lifecycle states hq-pro treats as closed (`TERMINAL_STATUSES` in
+ * feedback-status.ts). `--open` lists every row outside this set; a row with
+ * no status counts as open.
+ */
+export const TERMINAL_FEEDBACK_STATUSES = ["resolved", "wont_fix", "accepted"];
+function isOpenRow(row) {
+    const status = row.status;
+    return typeof status !== "string" || !TERMINAL_FEEDBACK_STATUSES.includes(status);
+}
 /** Page through `GET /v1/feedback` until `limit` rows (or every row with `limit: null`). */
 export async function listFeedback(opts) {
     const base = opts.selector.kind === "untriaged"
         ? { triage: "untriaged" }
-        : { assignee: opts.selector.assignee };
+        : opts.selector.kind === "assignee"
+            ? { assignee: opts.selector.assignee }
+            : {};
     if (opts.status)
         base.status = opts.status;
+    const keep = opts.selector.kind === "open" ? isOpenRow : () => true;
     const rows = [];
     let cursor = null;
+    let serverTruncated = false;
     for (let page = 0; page < MAX_LIST_PAGES; page++) {
-        const pageSize = opts.limit === null ? LIST_PAGE_SIZE : Math.min(LIST_PAGE_SIZE, opts.limit - rows.length);
+        // The untriaged queue applies `limit` after filtering, so ask for exactly
+        // what is still needed. The plain list path applies `limit` to the
+        // DynamoDB read BEFORE its filters, so a small page returns few or no
+        // matches per request and burns the page budget: always ask for a full
+        // page there and trim to the limit here.
+        const pageSize = opts.limit === null || opts.selector.kind !== "untriaged"
+            ? LIST_PAGE_SIZE
+            : Math.min(LIST_PAGE_SIZE, opts.limit - rows.length);
         const query = { ...base, limit: String(pageSize) };
         if (cursor)
             query.cursor = cursor;
         const res = await vaultApiFetch({ token: opts.token, path: "/v1/feedback", query });
         if (!res.ok) {
-            throw new Error(`Failed to list feedback: ${await readFeedbackError(res)}`);
+            throw new Error("Failed to list feedback: " + (await readFeedbackError(res)));
         }
         const data = (await res.json());
-        rows.push(...rowsFrom(data));
-        if (opts.limit !== null && rows.length >= opts.limit)
-            return rows.slice(0, opts.limit);
+        rows.push(...rowsFrom(data).filter(keep));
+        if (isTruncated(data))
+            serverTruncated = true;
         cursor = cursorFrom(data);
-        if (!cursor)
-            return rows;
+        if (opts.limit !== null && rows.length >= opts.limit) {
+            // More rows exist when this page overflowed the limit or the server
+            // has another page.
+            const more = rows.length > opts.limit || cursor !== null || serverTruncated;
+            return {
+                items: rows.slice(0, opts.limit),
+                ...(more ? { truncated: serverTruncated ? "server" : "limit" } : {}),
+            };
+        }
+        if (!cursor) {
+            return { items: rows, ...(serverTruncated ? { truncated: "server" } : {}) };
+        }
     }
-    return rows;
+    return { items: rows, truncated: "page-cap" };
+}
+/** One-line stderr notice for a list that stopped before the end. */
+export function feedbackTruncationNotice(reason, shown) {
+    if (reason === "limit") {
+        return "Showing the first " + String(shown) + " items; more may match. Use --all or a larger --limit.";
+    }
+    if (reason === "page-cap") {
+        return ("Stopped after " + String(MAX_LIST_PAGES) + " pages (" + String(shown) +
+            " items); more may match. Narrow the query, for example with --status or --assignee instead of --open.");
+    }
+    return "The server cut this read short; some matching items may be missing.";
 }
 export function formatFeedbackTable(rows, now = Date.now()) {
-    const header = ["ID", "AGE", "PLAN", "TITLE"];
+    const header = ["ID", "AGE", "STATUS", "PLAN", "TITLE"];
     const body = rows.map((row) => [
         row.id,
         formatFeedbackAge(row.submittedAt ?? row.createdAt, now),
+        formatFeedbackStatus(row.status),
         typeof row.plan === "string" && row.plan.length > 0 ? row.plan : "-",
         typeof row.title === "string" ? row.title : "",
     ]);
-    const widths = [0, 1, 2].map((col) => Math.max(header[col].length, ...body.map((cells) => cells[col].length)));
+    const widths = [0, 1, 2, 3].map((col) => Math.max(header[col].length, ...body.map((cells) => cells[col].length)));
     return [header, ...body]
-        .map((cells) => cells.map((cell, col) => (col < 3 ? cell.padEnd(widths[col]) : cell)).join("  ").trimEnd())
+        .map((cells) => cells.map((cell, col) => (col < 4 ? cell.padEnd(widths[col]) : cell)).join("  ").trimEnd())
         .join("\n");
 }
+/** Status cell for the list table. A stalled row is flagged so it does not read as not started. */
+export function formatFeedbackStatus(status) {
+    if (typeof status !== "string" || status.length === 0)
+        return "-";
+    return status === "stalled" ? "stalled!" : status;
+}
+/**
+ * Normalize `list --status`; accepts `in-progress` as an alias of `in_progress`.
+ * Any non-empty value goes to the server, which validates it.
+ */
+export function parseListStatus(raw) {
+    const value = raw.trim().toLowerCase().replace(/-/g, "_");
+    if (!value)
+        throw new Error("--status must not be empty.");
+    return value;
+}
 export function parseListLimit(raw) {
     const n = Number(raw);
     if (!Number.isInteger(n) || n < 1) {
@@ -167,31 +255,40 @@ function registerListSubcommand(feedbackCmd) {
         .command("list")
         .description("List feedback: untriaged (default), yours, or one person's")
         .option("--untriaged", "Items nobody has triaged yet (the default)")
+        .option("--open", "Every item not resolved, won't-fix or accepted, triaged or not")
         .option("--mine", "Items assigned to you")
         .option("--assignee <person>", "Items assigned to this email address or prs_ uid")
-        .option("--status <status>", "Only items with this status")
+        .option("--status <status>", `Only items with this status (${FEEDBACK_LIST_STATUSES.join(", ")}). Without --untriaged, --mine or --assignee it lists every item in that status`)
         .option("--limit <n>", `Stop after this many items (default ${DEFAULT_LIST_LIMIT})`)
         .option("--all", "Fetch every page")
-        .option("--json", "Print { items, count } as JSON")
+        .option("--json", "Print { items, count } as JSON, plus truncated: true when more items match")
         .action(async (opts) => {
         try {
-            const picked = [opts.untriaged, opts.mine, opts.assignee !== undefined].filter(Boolean);
+            const picked = [opts.untriaged, opts.open, opts.mine, opts.assignee !== undefined].filter(Boolean);
             if (picked.length > 1) {
-                throw new Error("Use only one of --untriaged, --mine and --assignee.");
+                throw new Error("Use only one of --untriaged, --open, --mine and --assignee.");
+            }
+            if (opts.open && opts.status !== undefined) {
+                throw new Error("--open already selects every open status; use --status on its own instead.");
             }
             if (opts.all && opts.limit !== undefined) {
                 throw new Error("Use --limit or --all, not both.");
             }
-            if (opts.status !== undefined && !opts.status.trim()) {
-                throw new Error("--status must not be empty.");
-            }
+            const status = opts.status === undefined ? undefined : parseListStatus(opts.status);
             const limit = opts.all
                 ? null
                 : opts.limit === undefined
                     ? DEFAULT_LIST_LIMIT
                     : parseListLimit(opts.limit);
             const token = await resolveStaffToken();
-            let selector = { kind: "untriaged" };
+            // No selector means the untriaged queue, except with --status: a
+            // status filter alone lists every row in that status. The queue only
+            // holds untriaged rows, so `--status accepted` there was nearly empty.
+            let selector = opts.open
+                ? { kind: "open" }
+                : opts.status !== undefined && !opts.untriaged
+                    ? { kind: "any" }
+                    : { kind: "untriaged" };
             if (opts.mine) {
                 const email = emailFromToken(token);
                 if (!email) {
@@ -206,14 +303,17 @@ function registerListSubcommand(feedbackCmd) {
                 };
             }
             assertVaultApiRequestSupported({ token, path: "/v1/feedback" });
-            const items = await listFeedback({
+            const { items, truncated } = await listFeedback({
                 token,
                 selector,
-                status: opts.status?.trim(),
+                status,
                 limit,
             });
+            if (truncated) {
+                console.error(chalk.yellow("Note:"), feedbackTruncationNotice(truncated, items.length));
+            }
             if (opts.json) {
-                console.log(JSON.stringify({ items, count: items.length }));
+                console.log(JSON.stringify({ items, count: items.length, ...(truncated ? { truncated: true } : {}) }));
             }
             else if (items.length === 0) {
                 console.log("No feedback items match.");

package/dist/commands/feedback.d.ts

@@ -73,7 +73,7 @@ export declare function attachDebugLogs(requestBody: Record<string, unknown>, di
 }): void;
 export declare function submitFeedback(opts: FeedbackSubmitOptions): Promise<FeedbackResult>;
 /** Customer-visible states accepted by `hq feedback update --state`. */
-export declare const PUBLIC_TICKET_STATES: readonly ["triaged", "in-progress", "shipped", "verified", "resolved"];
+export declare const PUBLIC_TICKET_STATES: readonly ["triaged", "in-progress", "stalled", "shipped", "verified", "resolved"];
 export type PublicTicketState = (typeof PUBLIC_TICKET_STATES)[number];
 export declare function assertFeedbackId(id: string): void;
 /**
@@ -88,6 +88,45 @@ export declare function fetchFeedbackLink(opts: {
     id: string;
     token: string;
 }): Promise<string>;
+/**
+ * Work links for an in-progress update. A feedback row is in_progress only
+ * while it has a linked open PR or a live lane, so `--state in-progress`
+ * requires one of them. Field names match the hq-pro PATCH body.
+ */
+export interface FeedbackWorkLink {
+    prUrl?: string;
+    laneId?: string;
+}
+/** Accept `in_progress` as an alias of the public `in-progress` state. */
+export declare function normalizePublicState(raw: string): string;
+/** Validate --pr/--lane for a state; in-progress needs at least one, other states take none. */
+export declare function buildWorkLink(state: string, opts: {
+    pr?: string;
+    lane?: string;
+}): FeedbackWorkLink | null;
+/** Read a feedback row with the staff GET. Returns null when it cannot be read. */
+export declare function fetchFeedbackRow(opts: {
+    id: string;
+    token: string;
+}): Promise<Record<string, unknown> | null>;
+/** Delays between read-back attempts: 3 reads over about 1s. */
+export declare const LINK_READBACK_DELAYS_MS: readonly number[];
+/** Overridable in tests so retries do not wait on real timers. */
+export declare const linkReadbackTimer: {
+    sleep: (ms: number) => Promise<void>;
+};
+/**
+ * Store the PR or lane link before any state change, then confirm it was
+ * saved by reading the row back. The PATCH response does not echo prUrl or
+ * laneId, and an older server ignores unknown fields, so only the GET shows
+ * the link is stored. A link-only PATCH can itself change the row (hq-pro
+ * resumes a stalled row), so errors report the row's actual state.
+ */
+export declare function storeFeedbackWorkLink(opts: {
+    id: string;
+    token: string;
+    link: FeedbackWorkLink;
+}): Promise<void>;
 /** Post a customer-visible update; the server also mirrors it into #hq-feedback. */
 export declare function postFeedbackUpdate(opts: {
     id: string;