@indigoai-us/hq-cli 5.345.170 → 5.345.172

package/CHANGELOG.md

@@ -2,6 +2,90 @@
 
 ## [Unreleased]
 
+## [5.345.172] — 2026-10-27
+- The daemon now moves vaults to the new sync engine by itself, following a per-company switch (`sync.rust-engine-rollout`) instead of a hand-written `syncCoreCanary` entry in `~/.hq/daemon/config.json`. A new `sync-core` service on desktop and self-hosted machines runs `hq daemon service sync-core-reconcile` every 10 minutes: it reads the switch for every company this machine belongs to, downloads the pinned hq-syncd release (v0.1.13) from the public mirror and checks it against the release's SHA256SUMS, installs it at `~/.hq/bin/hq-syncd`, writes one engine home per switched vault under `~/.hq/sync-core/engines/<vault>/`, and records the result in `~/.hq/sync-core/rollout.json`. Each vault's engine first runs read-only alongside the current sync until it has built its index and planned a pass; the reconcile records that plan's upload, download, delete, server-row and local-file counts per vault (`hq sync-core status` shows them). A vault is then promoted to full mode and turned off in the current sync (`menubar.json`) only when the plan would upload or delete at most 100 paths, and the daemon runs its `sync-core:<vault>` unit in full mode only after the current sync has stopped touching that vault. Company vaults stay read-only in this release: the engine's server snapshot is filtered by the caller's visibility while the current sync pulled the whole tree, so a full-mode company engine would upload the difference; promotion waits for an engine release that scopes the local tree the same way. The personal vault moves when at least one of the person's companies is switched on. When a switch turns off, the daemon stops that vault's engine, turns the current sync back on for it, and leaves the engine's index on disk. A switch that cannot be read keeps the vault where it was. `hq sync-core reconcile` and `hq sync-core status` run the same logic by hand (agent boxes run `reconcile --companies-only`). The old `syncCoreCanary` config key is ignored.
+
+- `hq files share 'clients/*/11_reports' --with <person>` now sends the path as typed instead of refusing it. The vault accepts one `*` standing for a whole folder name, so a single grant covers the `11_reports` folder under every client. A `*` inside a folder name (`acme*`), two wildcard folders, or a path made only of wildcards is still refused by the vault. Feedback 600e747f-e608-4266-8e1a-a9a9a4034828.
+- A bot created with `--hq-fleet-runtime` now starts with HQ knowledge: its standing HQ instructions (identity, owner, HQ folder, worker definition, persona and memory rules) become the runtime persona, the HQ folder's skills are available to it, and the runtime's own lifecycle and system notices no longer reach the conversation. The CLI checks those instructions with the runtime's own scanner before saving them and refreshes them from the worker folder on every start and restart. `hq bot list` and `hq bot status` read a runtime bot's process from its gateway, and the HQ background service no longer starts a second, legacy copy of a runtime bot. Pins hq-fleet-local v0.4.5.
+- Creating a bot with `--hq-fleet-runtime` no longer needs Python on the computer: the CLI installs a private,
+  pinned Python under the HQ fleet folder and builds the bot's runtime from it, on macOS, Linux and Windows.
+- `hq-hook` 0.3.1: the bridge runs a hook port only for a bash script version
+  the port was checked against. It hashes the `--script` it is given, and any
+  other version of `policy-enforcement-gate.sh` runs bash alone (logged as
+  `script-mismatch`), so an hq-core change to the gate is never answered by
+  an older engine.
+- The gate port now opens only the path column of the policy list, as bash
+  does, and never the excerpt text.
+- On Windows the gate port goes to bash for:
+  - UNC, device and MSYS-form policy paths, and for root forms Win32 and MSYS
+    read differently;
+  - a state folder it cannot create;
+  - Windows device names used as session ids.
+- The pass stamp records the bytes the decision read.
+- The nightly `hq-hook` workflow now runs the gate parity test on every target,
+  using Git Bash on Windows.
+- In `on` mode, a hook port that declines a payload makes `hq-hook bridge`
+  exit 75 with no output. master-hook then runs the bash hook itself, so the
+  engine no longer starts bash for those calls. On Windows this removes about
+  200 to 330 ms from every gate call the port declines.
+- Agent sign-in no longer hangs on a stale network connection (hq-cloud 6.18.103).
+- When a company's sync stops because HQ could not finish listing the company's vault files (error code `REMOTE_LIST_NOT_CONVERGING` from hq-cloud), `hq sync now`, `hq sync push`, `hq sync pull` and their `--all` and `--personal` forms now print "HQ could not finish listing this company's files. Try hq sync now again in a minute; if it keeps happening, run hq feedback bug." with the original engine message on a following `Detail:` line, instead of only the raw engine message. `hq sync push --json` carries the same text in its `fatal` event. Menubar and background sync use the sync runner bundled from hq-cloud, which reports per-company errors as plain text without the code, so it still shows the engine message. Feedback e5eda195-9191-49b7-a73c-886f8139670b (DEV-5465).
+
+## [5.345.171] — 2026-10-26
+- The daemon's sync-core unit now accepts a `~/.hq/sync-core/config.toml` that sets `full_vault = true` instead of `canary_path`, so the Rust engine can keep the whole personal vault in sync under the same supervision (ownership check, legacy personal sync paused first, health restarts). A config that sets both keys, or neither, keeps the unit blocked with a reason that names the fix. `hq daemon status` describes the unit as the personal vault rather than a canary, and the unit's environment carries `HQ_SYNC_FULL_VAULT=1`. Company vaults and machines without the sync-core setting are unchanged. Requires an hq-sync-core release that understands `full_vault` (after 0.1.6).
+
+- The agent kit inbox service (`hq agent kit run inbox` or `run all`) no longer waits hours on a stale network connection. Before, one inbox check could hang until the operating system dropped the connection, so new DMs were mirrored and their wake fired up to about 2 hours late. Now the inbox check and each ack give up after 30 seconds, and the poll stops waiting for its token after 30 seconds. The check counts as a failed poll, and the next poll retries after the normal interval. Heartbeat posts, and the heartbeat's wait for its token, have the same limit. A token request that hangs inside the machine sign-in itself is not stopped yet and can still delay later polls; that is a known follow-up. Set `requestTimeoutMs` in the kit's `kit.json` to change it. The inbox log now has one line when a poll takes longer than 10 seconds or times out, giving the duration and outcome. Reported in feedback_66ce5718-d5d9-4d86-a25c-dd361a96226c.
+- `hq bot list --remote --json` now includes each bot's `ownerUid`, passed through unchanged from `GET /v1/agents/mine` (null when the server leaves it out). That route only returns the caller's own bots, so `ownerUid` always equals the viewer; the field is included for completeness. Telling a teammate's bot apart relies on the desktop app's local per-machine owner map, not this field. Human-readable output is unchanged. (feedback_ceda36fa-37c8-48ea-a066-e48c4d0fc438)
+- A local bot no longer fails every turn with EPERM when its TMPDIR is not writable, for example a TMPDIR on an external volume that was not ready when the bot started at login. The turn now uses `/tmp`, then `~/.hq/tmp`, logs one warning naming the folder, and hands the model CLI the working TMPDIR. When no folder works, the turn fails with one message naming the folder and saying to fix TMPDIR or run `hq bot restart`. Nothing changes when TMPDIR is writable. (feedback_f0131909)
+- The bundled sync engine now uses hq-cloud 6.18.102, the current npm `latest`.
+  It pulls in these hq-cloud fixes:
+  - Sync no longer lists the same vault page forever when the listing stops
+    early. It retries the page up to 3 times with backoff, then fails that
+    company's leg with `REMOTE_LIST_NOT_CONVERGING`. Before this,
+    `hq sync now --all --on-conflict keep` could hold a CPU core for hours.
+  - Sync pull no longer replaces your session handoff pointer
+    (`workspace/threads/handoff.json`) with an older vault copy. The copy with
+    the newer `created_at` is kept, and a kept local pointer is always queued
+    for push, so the vault catches up.
+  - When the vault refuses some of your files during a push
+    (FILES_PRESIGN_FORBIDDEN), the pull that follows no longer deletes or
+    overwrites your local copies of those files (hq-cloud #1048).
+  - Sync pull no longer writes or deletes a file through a folder link inside
+    the synced tree, such as `.agents` linking to `.claude` (hq-cloud #1041).
+  - Sync push no longer uploads a second cloud copy of a file under an in-tree
+    folder link's name; it skips the path and names the real path to push
+    instead. Files reached only through a link into an excluded folder are no
+    longer backed up under the link's name (hq-cloud #1047, #1053).
+  - `readManifestUploadStatus` also returns the last failed manifest upload's
+    time, failure count, reason and HTTP status (hq-cloud #1050).
+  - New `hq outposts pull <outpost> <remote-path> [local-path]` downloads one
+    file from an Outpost when it is too large for `hq outposts exec`. It needs
+    the matching hq-pro endpoint to be deployed (hq-cloud #996).
+- People now send only human messages. From a person login, `hq dm` tags every message `audience: "human"`, including 1:1 DMs to an agent, group DMs, channel posts and scheduled sends, and `--audience agent` or `--audience both` fails before any request with "People can only send human messages. Agent messages are sent by agents and bots." and exit 1. `--audience human` and `--for-human` work as before. Local bots, agent-kit agents and other machine identities keep the recipient-based default (agent for an agent, a channel or a group) and may still pass `--audience agent|both`. The caller type comes from the credentials the send uses (machine creds or a person session), not from a flag. The same rule applies to `hq agents message`, the `hq access` grant request, the `hq core delegate send` pickup DM (`both` only from a machine identity), `hq dm-bind post` and the agent MCP `hq_dm_send` tool when its token is a person's. A 403 `person_cannot_send_agent_message` from the server is printed as a plain message with exit 1. A personal bot's model turn runs without machine credentials, so `hq dm --audience agent` typed inside such a turn is now refused and its channel and group posts default to human; the bot's own progress messages still go out under its machine identity.
+- `hq dm send <name>` no longer falls through to a same-named channel when the name matches more than one person or bot. It refuses, sends nothing, and lists each match with its uid. `@name` now always means a person or bot: it never posts to a channel and refuses when no contact matches. `#name` and `--channel` still always mean the channel. When the contacts lookup fails, a bare name now exits 1 and sends nothing instead of guessing the channel; use `#name` or `--channel` to post to the channel.
+- `hq dm inbox` for an agent identity no longer reports a malformed server response as an empty inbox. Invalid JSON or a missing/non-array `messages` field exits 1 with a privacy-safe error and acknowledges nothing. A mixed response keeps the valid messages and warns that the read may be incomplete; `--mark-read` then acks nothing and says how many items were not acked. Acks that fail are now reported. This reuses the `hq agent inbox` classifier from #2155, now exported as `classifyAgentInboxBody`.
+- `hq doctor --fix` and `hq rescue` now repair HQ-managed release links (`.agents/skills`, `.codex/claude` and the other links hq-core ships) whose target is missing, such as links an earlier rescue left pointing into its deleted temp folder. On macOS and Linux the link gets back the relative text hq-core ships (for example `../.claude/skills`), so the git-tracked link is unchanged; on Windows a directory link is an absolute junction. A link is removed instead when its shipped target is missing too. Only a dangling link whose current target is under the HQ root, the system temp folder, or the rescue staging folder beside the backup root (`~/.hq/tmp`, or next to `$HQ_BACKUP_DIR`), or whose path has an `hq-replace-rescue-` folder, is repaired; a dangling link that points anywhere else (for example an unmounted `/Volumes/X`) is treated as your own, left alone, and reported. A real file or folder, or a link that resolves anywhere, is never touched, the link entry is removed without following it (re-checked right before removal), and one link that fails to repair does not stop the others.
+- `hq capacity` Grok collector now passes its clock to the capacity ledger, so ledger retention and `now.json` use the same instant as the readings it just wrote. Before this, retention ran on the wall clock, and a collector given an earlier time deleted its own readings.
+- `hq integrations connect` (and `add`) takes `--personal` or `--company-owned` to choose who owns the new connection; `reconnect --connect` takes them too when it adds a revoked app again. They cannot be combined, and `--company-owned` is separate from `--company <slug>`, which still picks the company. The CLI sends `scope` to the install and sign-in start requests only when one of the flags is given, including on the link-only and access-key retry paths. If the company does not have personal and company integrations turned on yet, the command says so and tells you to run it again without the flag.
+- The "already connected" check now looks at ownership when the server offers personal connections. A personal connect only stops at your own personal connection of the same app, and a company connect only at a company or older shared one, so connecting your own Gmail no longer needs `--force` when the company already has one. `--force` still adds a second account.
+- `hq integrations list` and `show` show each connection's owner (Personal, Company, or Shared (legacy)) and its account label when the server reports owners, and `--json` keeps both fields. Rows without an owner print as before.
+- `hq integrations call` and `tools` take `--account <connection id or account label>` to pick one of several accounts of the same app. With owners reported, `call` passes it to the gateway as the account selector. When more than one account matches, or none does, the command lists the accounts (id, owner, label) and asks you to rerun with `--account`.
+- A loop lane (`hq lanes loop`) no longer shows `running` with no engine after its next envelope is activated and admission is refused. If admission cannot run when the next phase starts, the lane goes to `queued` with reason `admit_failed` and the error, which `hq lanes show` displays. This covers a store lock timeout (`store_lock_timeout`) and the lane changing while admission was checked (`lane_admission_conflict`, `version_conflict`). Any other resume error still fails the envelope with its message. The phase is kept as a pending resume, so reconcile retries it and the envelope is not marked failed. When a throttled loop phase is later admitted, HQ starts that phase's engine (claude, codex or grok) through the normal spawn path. Before this fix it started a second loop controller, which exited at once and left the lane running with no engine pid. Feedback feedback_865fe8a0-49aa-49bd-8719-8a57355bc037.
+- Lanes store locks: a lock held by a live process on this host is no longer reclaimed after the 30-second stale window; it is kept until a 10-minute ceiling (`HQ_LANES_LOCK_LIVE_OWNER_MAX_MS`) that covers pid reuse and hung holders. The reconcile and admission locks now use the same reclaim rules as lane record locks: a lock whose owner pid is dead on this host is reclaimed at once, and an empty lock left by a killed holder ages out by file time instead of blocking forever with `store_lock_timeout`. The reconcile lock holder now removes only its own lock. A legacy lock without a host line whose pid is alive here gets the same ceiling. Older CLIs on the same machine still reclaim by the 30-second window until they are upgraded. Feedback a4226dc9.
+- Personal bots can now run on this computer on the HQ Fleet Runtime: `hq bot create <name> --hq-fleet-runtime`
+  installs a signed, isolated runtime, `hq bot auth <name> --provider chatgpt|grok|claude` signs it in with your own
+  login or API key, and `hq bot start|stop|restart|status|rm` manage its background service. Credentials live in the
+  operating system's secure store, removal wipes them, and `hq bot promote` moves such a bot to the cloud too.
+- Loop lanes: the loop controller (`hq lanes _loop-worker`) is now started with the live Node binary, re-resolved from the Homebrew prefix or PATH when `process.execPath` no longer exists, so a Node upgrade that removes the launch-time binary no longer stops a loop lane from starting its controller. Phase workers and watchers already did this (#2064). Feedback 6cf19c9d.
+- `hq sync push` of a path that is not listed in `.hqinclude` now says so and prints the `.hqinclude` line to add (for example `companies/<slug>/workers/<name>/`). Before, the error ended with advice about symlinks, which sent people looking for a symlink problem. The symlink advice now appears only when a path resolves outside the company folder or its link target cannot be read. The push error text changes for anyone pushing a path missing from `.hqinclude` (feedback_6afa6ce4).
+- When every file under the paths you name in `hq sync push` falls outside your write access, the push now names each requested path as the blocker and points at `hq access <path>`. It still exits 1 (feedback_5baccb9e).
+- `hq access` on a file that is on this computer but not in the vault now checks write access. When an ACL blocks writes, it reports the new outcome `no-write-access` (exit 3) and names the blocking ACL row (`writeBlockedBy` in `--json`), instead of `never-existed` (feedback_5baccb9e).
+- `hq core rebuild-index` (projects, company-knowledge, companies, all) now stays inside the session's bound company set, read exactly as `core/scripts/hq-session.sh get company_slugs` reports it. In a bound session a run with no company rebuilds only the bound companies, and a company outside the set or `--all-companies` is refused before anything is written. Session state that cannot be read (unreadable metadata, a garbled or unreadable `workspace/sessions/.current`, a bound company that is no longer a real directory) refuses the rebuild. An unbound session keeps the every-company rebuild with a warning, so automation is unaffected, and a personal-only session's `all` rebuilds the non-company indexes. `cli.rebuild-index-company-scope` is now a default-on kill switch; turned off, the company root indexes go back to the every-company rebuild with a warning. (feedback_f4468815)
+- `hq scan secrets --range <base>[..<head>]` scans only the lines a branch added: every commit of the range, the lines each merge commit introduced itself, and the net diff from the merge base. A secret added in any commit, including a merge resolution, is caught even if a later commit deletes it. Lines already on the base and older versions of untouched lines are no longer flagged. Added binary files are scanned as text up to 10 MB (larger ones are warned about). It applies the exact-value allowlists committed in the base's `.gitleaks.toml` and adds the base's `[[rules]]` to the built-in rules; rules a branch adds are not run, and a repo rule cannot replace or switch off a built-in one. A reversed range or a git failure exits 2; an empty range warns. `commit-secret-scan.sh pr-check` can use it in place of its whole-file history scan. (feedback_b0af3152)
+- `hq secrets generate-link` prints the link as a clickable OSC-8 hyperlink when stdout is a terminal that supports it (iTerm2, WezTerm, VS Code, Ghostty, kitty, Windows Terminal, VTE; on a TTY only, the `FORCE_HYPERLINK` env var set to `1` or `0` overrides detection), and as the plain URL otherwise. Output to a pipe or file is unchanged and never gets escape sequences, whatever `FORCE_HYPERLINK` says. Control characters (C0, DEL, C1) are stripped from the URL, secret name and expiry before printing, and `[`/`]` are escaped in the Markdown label. New `--format markdown` prints one Markdown link line on stdout, with the expiry and one-time-use note on stderr, so `$(...)` and pipes capture only the link; the link label never contains the token. New `--json` (or `--format json`) prints `{ url, expiresAt, secretName }`.
+- Security: `hq secrets exec --script` and `hq run --script` now release script-locked secrets only to the approved script itself. When any requested secret is script-locked (or the vault does not report its lock state), the command after `--` must be the script (for example `-- ./script.sh args`) or an allowlisted system interpreter followed directly by it (for example `-- bash script.sh args`). Any other command, a shell `-c` string, or a wrapper such as `env` or `xargs` is refused with exit 1 and nothing is injected. The script's `#!` interpreter goes through the same allowlist, and `#!/usr/bin/env X` is resolved on a fixed system PATH. Allowlisted interpreters are sh, dash, ksh, bash (with `--noprofile --norc`), zsh (with `-f`), python3 (with `-I -S`) and node; each must be root-owned and not writable by other users, so Homebrew installs are refused. The script is read once, hash-checked, copied to a private 0700 directory and that copy is run; `HQ_APPROVED_SCRIPT` and `HQ_APPROVED_SCRIPT_DIR` name the original path and its directory (use them to load neighbour files, since `$0` names the copy). The copy is removed on exit, SIGINT, SIGTERM and SIGHUP. `hq run --script` no longer loads the schema through varlock: it reads the schema and local env files in a strict mode that accepts only `KEY=hq(...)`, plain literals and the decorators `@hqCompany`, `@required`, `@optional`, `@sensitive`, `@public`, `@defaultRequired` and `@defaultSensitive`. Any other resolver (such as `exec()`) or decorator (such as `@plugin` or `@import`) is refused before a secret is fetched. The bound child's environment is built from an allowlist: HOME, USER, LOGNAME, LANG, LC_*, TERM, TZ and TMPDIR from the caller, plus the injected values. Injected secrets and schema literals may not use proxy, CA/TLS, pager/editor, HOME/XDG, locale/terminfo, interpreter or inherited names (for example `HTTPS_PROXY`, `SSL_CERT_FILE`, `NODE_TLS_REJECT_UNAUTHORIZED`, `HOME`, `PAGER`, `LESSOPEN`, `EDITOR`, `NLSPATH`, `TMPDIR`); Tool-config names (`AWS_ENDPOINT_URL*`, `AWS_CA_BUNDLE`, `AWS_CONFIG_FILE`, `AWS_SHARED_CREDENTIALS_FILE`, `AWS_PROFILE`, `KUBECONFIG`, `DOCKER_*`, `PIP_*`, `NPM_CONFIG_*`, `BROWSER`, `GNUPGHOME`, `TF_CLI_CONFIG_FILE`, `GOPROXY`, `GOFLAGS`, `CARGO_*`, `SUDO_ASKPASS`) are refused too. With `hq run --script`, schema and local env literals are accepted only for `NODE_ENV`, `APP_ENV`, `ENVIRONMENT`, `LOG_LEVEL`, `LOG_FORMAT`, `CI`, `NO_COLOR` and `FORCE_COLOR`; any other literal is refused before any fetch, and other values must come from the vault through `hq()`. Other caller variables such as `AWS_*` no longer reach a bound script. The private copy is written under `/tmp`, not the caller's `TMPDIR`. The binding controls which entrypoint receives the secret, not what that entrypoint runs. A same-user caller can still influence tools the script calls through dotfiles in HOME (`~/.gitconfig`, `~/.curlrc`, `~/.ssh/config`), so use `hq secrets sandbox` when real isolation matters. The child gets PATH `/usr/bin:/bin:/usr/sbin:/sbin` and loses interpreter and loader injection variables (`BASH_ENV`, `FPATH`, `PYTHON*`, `NODE_OPTIONS`, `NODE_PATH`, `RUBY*`, `GEM_*`, `BUNDLE_*`, `PERL*`, `LD_*`, `DYLD_*`, `OPENSSL_*`, `GIO_*`, `GCONV_PATH`, `LOCPATH`, `GLIBC_TUNABLES`, `DEVELOPER_DIR`, exported bash functions). A bound launch is refused when a secret, or an `hq run` schema or local env value, uses one of those names or `PATH`. The API-key fetch path now reads the secret's lock state too, so API-key callers with unlocked secrets keep working. For `hq secrets exec --script`, secrets the vault marks as not script-locked still go to the command as given. Breaking: every `hq run --script` run uses the strict schema reader and the literal allowlist, including runs whose secrets are not script-locked, so an ordinary literal such as `API_BASE_URL=https://...` now fails.
+- `hq sync now` has two opt-in limits for scheduled or unattended jobs: `--max-idle <seconds>` (or `HQ_SYNC_MAX_IDLE`) and `--max-runtime <seconds>` (or `HQ_SYNC_MAX_RUNTIME`). Both are off by default, so a sync you start yourself is never stopped. With a limit set, a run that has no file planned, transferred, or skipped for the idle time, or that runs past the total time, prints a message saying the sync watchdog stopped it, records a failed sync, and exits with code 124. Time spent with a Mac or Linux laptop asleep does not count. The remote listing and planning step of each company does not register as progress, so set `--max-idle` longer than your slowest planning step. A check in a worker thread also ends the process if it is stuck in a loop that never yields, or if it hangs after the watchdog stops it. That forced stop exits with 137 on macOS and Linux (SIGKILL), not 124. The hang that prompted this, where `hq sync now --all --on-conflict keep` held a CPU core for hours, is fixed in the sync engine and the vault service. Feedback b7c00a62-fa46-417d-93a5-67119263d13f.
+
 ## [5.345.170] — 2026-10-25
 - `hq access --fix` now labels its suggested recipient as an access contact and explicitly distinguishes an ACL creator from a fallback company owner or admin. The label no longer implies that the contact wrote the file; access checks and sharing permissions are unchanged.
 

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -283,7 +283,7 @@ if ! jq '.status = "sending"' "$MANIFEST" > "$TMP_MANIFEST" || ! mv "$TMP_MANIFE
   rm -f "$TMP_MANIFEST"
   die "could not persist sending state; no DM attempted"
 fi
-DM_OUT="$(hq dm "$PRINCIPAL" "$HEADLINE" --audience both --prompt-file "$PROMPT" --details-file "$BRIEF")" \
+DM_OUT="$(hq dm "$PRINCIPAL" "$HEADLINE" --audience human --prompt-file "$PROMPT" --details-file "$BRIEF")" \
   || die "hq dm delivery outcome is uncertain; status is sending, inspect DM history before retrying"
 
 EVENT_ID="$(printf '%s' "$DM_OUT" | grep -oE 'eventId[: ]+[A-Za-z0-9_-]+' | head -1 | sed -E 's/eventId[: ]+//' || true)"

package/dist/command-catalog.generated.d.ts

@@ -1044,6 +1044,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--force-scope-shrink";
             readonly description: "When a scope shrink would un-track locally-modified files, proceed anyway. Dirty files are KEPT on disk (only un-tracked); clean out-of-scope files are quarantined under .hq/scope-quarantine/.";
             readonly hidden: false;
+        }, {
+            readonly flags: "--max-idle <seconds>";
+            readonly description: "For scheduled or unattended runs: stop with exit code 124 after this many seconds with no file planned, transferred or skipped. The remote listing and planning phase of a leg reports no progress, so set this longer than your slowest planning phase. Laptop sleep does not count. (default: HQ_SYNC_MAX_IDLE, else off)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--max-runtime <seconds>";
+            readonly description: "For scheduled or unattended runs: stop with exit code 124 if the run has not finished after this many seconds, even while it is making progress. Laptop sleep does not count. (default: HQ_SYNC_MAX_RUNTIME, else off)";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -2287,6 +2295,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Token expiry duration (e.g. 24h, 2d, 30m)";
             readonly hidden: false;
             readonly defaultValue: "24h";
+        }, {
+            readonly flags: "--format <format>";
+            readonly description: "Output format: text (default; OSC-8 hyperlink on a supporting TTY, plain URL otherwise; FORCE_HYPERLINK=1/0 overrides detection on a TTY only), markdown (one Markdown link line on stdout, details on stderr), json";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print { url, expiresAt, secretName } as JSON (same as --format json)";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {
@@ -3035,7 +3051,7 @@ export declare const COMMAND_CATALOG: readonly [{
     }];
 }, {
     readonly name: "files";
-    readonly description: "Manage file access controls in HQ vault. A trailing folder slash (foo/) is a private folder; the quoted glob 'foo/*' shares all children.";
+    readonly description: "Manage file access controls in HQ vault. A trailing folder slash (foo/) is a private folder; the quoted glob 'foo/*' shares all children, and a quoted 'clients/*/reports' shares that folder under every client.";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly helpOption: true;
@@ -3050,7 +3066,7 @@ export declare const COMMAND_CATALOG: readonly [{
     }];
     readonly subcommands: readonly [{
         readonly name: "share";
-        readonly description: "Share file paths. foo/ is a private folder (children stay creator-only); quote the shared-folder glob 'foo/*' so the shell passes it literally. Without --with: mint a share-session URL and open it in the browser. With --with: grant access directly to a person, group, or @all.";
+        readonly description: "Share file paths. foo/ is a private folder (children stay creator-only); quote the shared-folder glob 'foo/*', or a one-folder wildcard such as 'clients/*/reports', so the shell passes it literally. Without --with: mint a share-session URL and open it in the browser. With --with: grant access directly to a person, group, or @all.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -3393,7 +3409,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly usage: "[options] [vault-path...]";
     readonly helpText: readonly [{
         readonly position: "after";
-        readonly text: "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it)\n  4  ambiguous (several keys matched; pick one)\n\nWith several paths, each gets its own result block and the exit code is the\nhighest one across the paths.\n";
+        readonly text: "\nExit codes:\n  0  local or not-synced (file exists and you can read it)\n  2  never-existed (the path was never created)\n  3  no-access (the file exists but you cannot read it), or\n     no-write-access (the file is on disk, not in the vault, and you cannot\n     write to it, so a push cannot upload it)\n  4  ambiguous (several keys matched; pick one)\n\nWith several paths, each gets its own result block and the exit code is the\nhighest one across the paths.\n";
     }];
     readonly arguments: readonly [{
         readonly name: "vault-path";
@@ -3999,7 +4015,7 @@ export declare const COMMAND_CATALOG: readonly [{
     }];
 }, {
     readonly name: "dm";
-    readonly description: "Send and read direct messages, and manage connection requests. Messages to a person send to them; messages to an agent, a channel or a group are tagged for agents and folded away from people by default. Pass --for-human or --audience human|agent|both to override.";
+    readonly description: "Send and read direct messages, and manage connection requests. Messages sent from a person login are always tagged for people. When an agent or bot sends, messages to an agent, a channel or a group are tagged for agents and folded away from people by default. Pass --for-human or --audience human to tag a message for people; --audience agent|both is for agents and bots only.";
     readonly aliases: readonly [];
     readonly hidden: false;
     readonly helpOption: true;
@@ -4066,7 +4082,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--audience <human|agent|both>";
-            readonly description: "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both. Default: human for a person, agent for an agent, a channel or a group. Wins over --for-human.";
+            readonly description: "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both. agent and both are for agents and bots only; a person login always sends human. Default for agents and bots: human for a person, agent for an agent, a channel or a group. Wins over --for-human.";
             readonly hidden: false;
         }, {
             readonly flags: "--for-human";
@@ -5346,6 +5362,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--company <slug>";
             readonly description: "Company slug, e.g. indigo";
             readonly hidden: false;
+        }, {
+            readonly flags: "--account <id-or-label>";
+            readonly description: "Which account of the app: its connection id or account label";
+            readonly hidden: false;
         }, {
             readonly flags: "--describe <tool>";
             readonly description: "Print the full input schema for one tool";
@@ -5379,6 +5399,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--connection <id>";
             readonly description: "Connection id (acct_…)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--account <id-or-label>";
+            readonly description: "Which account of the app: its connection id or account label";
+            readonly hidden: false;
         }, {
             readonly flags: "--company <slug>";
             readonly description: "Company slug, e.g. indigo";
@@ -5634,6 +5658,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--force";
             readonly description: "Connect again even if this app is already connected";
             readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "Connect it as your own personal connection (not --company <slug>, which picks the company)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--company-owned";
+            readonly description: "Connect it as a connection the whole company owns (needs permission to add company apps)";
+            readonly hidden: false;
         }, {
             readonly flags: "--json";
             readonly description: "Machine-readable output";
@@ -5703,6 +5735,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--connect";
             readonly description: "For a revoked row, run `connect <domain>` to re-add and revive it";
             readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "With --connect: re-add it as your own personal connection";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--company-owned";
+            readonly description: "With --connect: re-add it as a connection the whole company owns";
+            readonly hidden: false;
         }, {
             readonly flags: "--json";
             readonly description: "Machine-readable output";
@@ -6328,7 +6368,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }, {
             readonly flags: "--repo <dir>";
-            readonly description: "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths";
+            readonly description: "With files: apply this repo's committed .gitleaks.toml allowlists, matching repo-relative paths. With --range: the repo to scan (default: the current directory)";
             readonly hidden: false;
         }, {
             readonly flags: "--snapshot-root <dir>";
@@ -6338,6 +6378,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--allowlist-rev <rev>";
             readonly description: "With --repo: read .gitleaks.toml from this commit instead of HEAD";
             readonly hidden: false;
+        }, {
+            readonly flags: "--range <range>";
+            readonly description: "Scan the lines added in <base>..<head> (head defaults to HEAD), every commit included, with the base's .gitleaks.toml allowlists and the repo's [[rules]]";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }];
@@ -8500,6 +8544,41 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "pull";
+        readonly description: "Download one file from an Outpost through a short-lived download link (for files too large for exec output). <outpost> is the Outpost id (`primary` for your first box). The remote path must be inside the Outpost user's home or HQ dir; relative and ~ paths start at the home dir. The file is saved to [local-path], or to the remote file name in the current directory.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <outpost> <remote-path> [local-path]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "outpost";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }, {
+            readonly name: "remote-path";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }, {
+            readonly name: "local-path";
+            readonly required: false;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--force";
+            readonly description: "Replace the local file if it already exists";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Emit raw JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "terminal";
         readonly description: "Open an interactive terminal on an Outpost — a real TTY over SSM Session Manager (no SSH, no local AWS credentials). Requires the AWS session-manager-plugin installed locally. With --forward, tunnels a port on the box to your machine instead of opening a shell.";
@@ -18262,6 +18341,22 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly arguments: readonly [];
             readonly options: readonly [];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "sync-core-reconcile";
+            readonly description: "Read each company's new-sync-engine switch and write this machine's engine homes and legacy off-switches";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--hq-root <path>";
+                readonly description: "HQ folder the engine works against";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "remote-control";
             readonly description: "Keep `claude remote-control` running in a tmux session in the HQ folder";
@@ -18384,6 +18479,62 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }];
     }];
+}, {
+    readonly name: "sync-core";
+    readonly description: "Move this machine's vaults between the current sync and the new sync engine, following each company's switch";
+    readonly aliases: readonly [];
+    readonly hidden: true;
+    readonly helpOption: true;
+    readonly helpCommand: true;
+    readonly usage: "[options] [command]";
+    readonly helpText: readonly [];
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "reconcile";
+        readonly description: "Read each company's switch, install the engine when needed, and write the engine homes and legacy off-switches";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--hq-root <path>";
+            readonly description: "HQ folder (default: the daemon's)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--companies-only";
+            readonly description: "Never move the personal vault (agent boxes)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--token-file <path>";
+            readonly description: "Token file the engine reads (default: this user's hq sign-in)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print the written rollout state as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "status";
+        readonly description: "Show which vaults are on the new sync engine on this machine";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }];
 }, {
     readonly name: "bot";
     readonly description: "Personal local bots that run on this computer with your own model login";
@@ -18546,7 +18697,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--runtime <runtime>";
             readonly description: "Model CLI to run the bot with: claude|codex|grok";
             readonly hidden: false;
-            readonly defaultValue: "claude";
+        }, {
+            readonly flags: "--hq-fleet-runtime";
+            readonly description: "Create this personal bot with the local HQ Fleet Runtime";
+            readonly hidden: false;
         }, {
             readonly flags: "--model <model>";
             readonly description: "Model override passed to the runtime CLI";
@@ -18818,6 +18972,51 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "auth";
+        readonly description: "Sign a runtime-backed personal bot in to ChatGPT, Grok, Claude, or another supported provider";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <name>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "name";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--provider <provider>";
+            readonly description: "Provider: chatgpt, grok, claude, or a runtime provider id";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--model <model>";
+            readonly description: "Model id; required for providers without a built-in personal-bot default";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--api-key";
+            readonly description: "Read an API key from stdin instead of starting device authorization";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--base-url <url>";
+            readonly description: "Provider API base URL; required for custom runtime providers";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--transport <transport>";
+            readonly description: "Provider transport: chat_completions, anthropic_messages, or codex_responses";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--no-browser";
+            readonly description: "Do not open a browser during device authorization";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "logs";
         readonly description: "Show the bot's log";