@indigoai-us/hq-cli 5.345.196 → 5.345.198

package/CHANGELOG.md

@@ -2,6 +2,91 @@
 
 ## [Unreleased]
 
+## [5.345.198] — 2026-11-04
+- A personal bot that locked itself to its HQ's only company no longer resumes old conversations under that lock after the HQ gains a second company, loses its only company, or switches to a different one. On restart it archives those conversations and starts fresh, as it already did when a bot's company settings changed. A company bot whose bot.json lists "personal" as well as its company now starts normally after this upgrade, including with unfinished work, instead of stopping with "could not isolate previous company conversations". A personal bot no longer treats an extra top-level manifest key such as `version:` or `deployments:` as a company, and it reads a manifest saved with a UTF-8 byte order mark.
+- A local bot no longer asks "Which company is this for?" in every channel when its HQ has only one company. A personal bot (including one created before bot kinds existed) with no company in bot.json now locks its sessions to the HQ's only company, scheduled jobs included. A bot with two or more real companies stays unbound and does not guess. A "personal" entry in a company bot's membership list no longer counts as a second company.
+- `hq deploy domains search` prints whether each name is available, taken, not available because it is already delegated, premium, or unsupported, plus the registrar first-year and renewal prices. When the server is in test mode it prints "Test mode: sandbox prices. Nothing real is registered or charged." Taken and delegated names are not offered for purchase.
+- `hq deploy domains buy` takes `--use app:<app id>`, `base`, or `hold`. The confirmation shows the registrar first-year price, the renewal, the hosting tier, the 60-day transfer lock, and that purchases are final. It sends that use and the consent record. It buys only when the quote has a US dollar first-year price that matches `--price`. A retry with `--idempotency-key` still sends that order when search says the name is missing or taken.
+- `hq deploy domains owned` lists purchased domains. `show` prints one domain with its nameservers, whether the registrar nameservers are set, what it is attached to, and its events. `renew cancel` and `renew resume` turn automatic renewal off and back on.
+- `hq deploy domains records list` prints each record id. `add`, `set`, and `delete` manage DNS records on a purchased domain and mark the records HQ has locked.
+- Require explicit confirmation before changing domain auto-renewal, disclose renewal markup, and show purchase notices before --yes submissions.
+- `hq secrets exec`, `hq secrets env` and `hq secrets get --reveal` work inside
+  a company Outpost job (a delegated `HQ_MACHINE_SESSION_FILE` session). They
+  used to fail with "Company workload principal is unsupported on this route"
+  because they read through the batch route, which hq-pro refuses to a company
+  Outpost. Under such a session each requested secret is now read with
+  `GET /secrets/{companyUid}/name/{name}`, the company comes from the session
+  (no `--company` needed; a different company is refused), no telemetry event
+  is sent, and nothing is cached. The Outpost still reads only secrets shared
+  with its `out_…` principal (`hq secrets --company <co> share NAME --with
+  out_…`). People, API keys and agents keep the batch route.
+- Company Outpost jobs cannot read script-locked secrets. Under an Outpost
+  session the secrets commands now say so instead of "Reveal is disabled".
+- Refuse CLI release tags without a fresh, commit-bound local check that all four pinned HQ Fleet Local files are published. `pnpm release:tag` runs the authenticated preflight before pushing a tag; CI needs no new credential.
+- `hq bot restart`, `hq bot restore` and `hq bot create` now say why the HQ Fleet
+  Runtime download is unavailable when a machine has no GitHub token: HQ has not
+  published that runtime release yet, or the HQ sign-in on the machine could not
+  be used. Before, both cases showed the same "Sign in with `hq login`" error
+  even for a signed-in customer.
+- `hq-hook`: each `~/.hq/logs/hook-engine.jsonl` line is now written to the file in one piece. Hooks that ran at the same time could mix their lines together, because a line went to the file one JSON token at a time. A test runs eight writers at once and checks every line reads back as whole JSON.
+- macOS hook package notarization now authenticates with an App Store Connect
+  API key (`notarytool --key/--key-id/--issuer`), as the desktop app release
+  does, instead of an Apple ID and app-specific password. The signing script
+  writes the `.p8` key to an owner-only file in the runner temp directory and
+  removes it on exit, and it fails before signing with an error naming
+  `APPLE_API_KEY_ID`, `APPLE_API_ISSUER_ID` and `APPLE_API_PRIVATE_KEY` when any
+  of them is empty. A rejected submission now prints the notary log. The release
+  workflow passes the three API key secrets and no longer passes `APPLE_ID` or
+  `APPLE_PASSWORD`.
+- macOS hook package signing now adds its temporary keychain to the user
+  keychain search list before `codesign`, as the desktop app release does, and
+  restores the saved list on exit. Without it `codesign` reported "no identity
+  found" even with a valid identity in the keychain. The script also checks the
+  keychain before signing and fails with a clear error naming
+  `APPLE_SIGNING_IDENTITY` when no valid identity matches it, printing only the
+  identity count. Darwin packages still need the `APPLE_CERTIFICATE` secret re-set
+  to the current Developer ID Application certificate before they can sign.
+- `hq-hook`: the Linux package check no longer fails a good binary when the
+  docker client writes a notice to stderr; only hq-hook's own stderr inside
+  the Amazon Linux 2023 container counts. The image is pinned by digest and
+  its pull is retried up to three times with backoff.
+- `hq-hook`: the Linux x64 and arm64 hook packages now link against glibc
+  2.28 instead of the build runner's 2.39, so they run on Amazon Linux 2023,
+  Debian 11 and Ubuntu 20.04 without the loader writing "weak version
+  'GLIBC_2.39' not found" to stderr on every call. The package build now
+  fails if a Linux binary references a newer glibc version or writes to
+  stderr on Amazon Linux 2023.
+- `hq integrations connect google` and `hq integrations reconnect google --connect`
+  now send you to the HQ console Integrations page, where Google Workspace signs
+  in. Before, they posted a name no catalog entry matched and ended with
+  "mcpUrl is required" and no link. Connecting any other name the catalog cannot
+  resolve now says so and points at `hq integrations catalog` and `--mcp-url`.
+- `hq signals run` no longer fails the extract step with `worklist failed:
+  spawnSync bash ETIMEDOUT` on a company with a large meetings backlog. The
+  listing call's budget now grows with the item cap (60 seconds plus 10 seconds
+  per item, 260 seconds at the default cap of 20) instead of a flat 60 seconds,
+  because every item without an audience in its frontmatter costs one `hq files
+  acl` lookup over the network.
+
+## [5.345.197] — 2026-11-03
+- `hq-hook`: the `block-credential-file-read` port follows the round-7 bash
+  guard (hq-core-staging #1770) and its pin moves to it. A git or npm `://`
+  operand counts as a URL only with a known scheme, no `.`/`..` segment, no
+  `^`/`#` mark and no folder named like the scheme
+  (`git diff --no-index /dev/null a://../i#d_rsa` blocks). zsh `$~`,
+  `setopt globsubst` in any spelling, `emulate` and similar forms make a `^`
+  or `#` anywhere in the command block. git configuration that runs a command
+  (`git -c alias.x='!cat f' x`, pager, textconv, helpers, `git config`,
+  `GIT_EXTERNAL_DIFF` and similar) is analysed as a command, and
+  `GIT_CONFIG_*` variables, `--config-env` for those keys, computed `-c`
+  keys and the `ext::` transport block. A git option the guard does not know
+  before the subcommand blocks, alias arguments keep their quoting, a `://`
+  operand stays a URL only in a single simple command with no `-C`, the
+  command that `xargs`, `find -exec` or `parallel` runs is analysed, and git
+  configuration keys are matched without case on the fast path and in the
+  full-check gate. The vendored fixture and corpus are refreshed. The port
+  flag stays off.
+
 ## [5.345.196] — 2026-11-03
 - Local bots on the HQ Fleet Runtime answer simple questions directly and hand
   anything that needs a tool to a background helper. The bot replies with one

package/dist/command-catalog.generated.d.ts

@@ -20189,7 +20189,7 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
     }, {
         readonly name: "domains";
-        readonly description: "Manage custom domains on your deployed apps, and buy domains";
+        readonly description: "Manage custom domains on your deployed apps, buy domains, and edit their DNS";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -20197,7 +20197,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly usage: "[options] [command]";
         readonly helpText: readonly [{
             readonly position: "after";
-            readonly text: "\nadd, remove and buy ask for approval in an interactive terminal. Without one (a script, CI, or a Windows shell that does not report a terminal, such as Git Bash under mintty), pass --yes.";
+            readonly text: "\nadd, remove and buy ask for approval in an interactive terminal. buy accepts y or --yes. Without a terminal (a script, CI, or a Windows shell that does not report a terminal, such as Git Bash under mintty), pass --yes.";
         }];
         readonly arguments: readonly [];
         readonly options: readonly [];
@@ -20452,7 +20452,7 @@ export declare const COMMAND_CATALOG: readonly [{
             }];
         }, {
             readonly name: "search";
-            readonly description: "Check whether a domain can be bought, and its price";
+            readonly description: "Check whether a domain can be bought, with availability and registrar prices";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;
@@ -20477,7 +20477,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly subcommands: readonly [];
         }, {
             readonly name: "buy";
-            readonly description: "Buy a domain for the company (owner or admin)";
+            readonly description: "Buy a domain for the company and say what it is for (owner or admin)";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly helpOption: true;
@@ -20491,8 +20491,12 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "";
             }];
             readonly options: readonly [{
+                readonly flags: "--use <use>";
+                readonly description: "what the domain is for: app:<app id>, base, or hold";
+                readonly hidden: false;
+            }, {
                 readonly flags: "--price <usd>";
-                readonly description: "first-year price shown by 'hq deploy domains search'";
+                readonly description: "first-year registrar price shown by 'hq deploy domains search'";
                 readonly hidden: false;
             }, {
                 readonly flags: "--registrant-file <path>";
@@ -20508,7 +20512,52 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }, {
                 readonly flags: "--yes";
-                readonly description: "buy without a prompt";
+                readonly description: "buy without a prompt, after you have read the transfer lock and final-purchase notice";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "print machine-readable JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "owned";
+            readonly description: "List domains this company bought";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "use this company instead of the active company";
+                readonly hidden: false;
+            }, {
+                readonly flags: "--json";
+                readonly description: "print machine-readable JSON";
+                readonly hidden: false;
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "show";
+            readonly description: "Show one purchased domain, including nameservers and events";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: false;
+            readonly usage: "[options] <domain>";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [{
+                readonly name: "domain";
+                readonly required: true;
+                readonly variadic: false;
+                readonly description: "";
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "use this company instead of the active company";
                 readonly hidden: false;
             }, {
                 readonly flags: "--json";
@@ -20516,6 +20565,238 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly hidden: false;
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "renew";
+            readonly description: "Turn automatic renewal off or back on for a purchased domain";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: true;
+            readonly usage: "[options] [command]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [{
+                readonly name: "cancel";
+                readonly description: "Stop automatic renewal for a purchased domain";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <domain>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "domain";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--yes";
+                    readonly description: "Confirm the billing setting change";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }, {
+                readonly name: "resume";
+                readonly description: "Turn automatic renewal back on for a purchased domain";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <domain>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "domain";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--yes";
+                    readonly description: "Confirm the billing setting change";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }];
+        }, {
+            readonly name: "records";
+            readonly description: "Manage DNS records on a domain this company bought";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly helpOption: true;
+            readonly helpCommand: true;
+            readonly usage: "[options] [command]";
+            readonly helpText: readonly [];
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [{
+                readonly name: "list";
+                readonly description: "List DNS records, marking the ones HQ has locked";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <domain>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "domain";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }, {
+                readonly name: "add";
+                readonly description: "Add a DNS record";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <domain>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "domain";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--type <type>";
+                    readonly description: "A, AAAA, CNAME, MX, TXT, SRV, or CAA";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--name <name>";
+                    readonly description: "record name, such as www or the full domain";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--value <value>";
+                    readonly description: "record value (repeat for more than one)";
+                    readonly hidden: false;
+                    readonly defaultValue: readonly [];
+                }, {
+                    readonly flags: "--ttl <seconds>";
+                    readonly description: "time to live in seconds";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }, {
+                readonly name: "set";
+                readonly description: "Change a DNS record by id, or by name and type";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <domain>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "domain";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--record <id>";
+                    readonly description: "record id from 'hq deploy domains records list'";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--name <name>";
+                    readonly description: "record name, together with --type";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--type <type>";
+                    readonly description: "record type, together with --name";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--value <value>";
+                    readonly description: "replacement value (repeat for more than one)";
+                    readonly hidden: false;
+                    readonly defaultValue: readonly [];
+                }, {
+                    readonly flags: "--ttl <seconds>";
+                    readonly description: "replacement time to live in seconds";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }, {
+                readonly name: "delete";
+                readonly description: "Delete a DNS record by id, or by name and type";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly helpOption: true;
+                readonly helpCommand: false;
+                readonly usage: "[options] <domain>";
+                readonly helpText: readonly [];
+                readonly arguments: readonly [{
+                    readonly name: "domain";
+                    readonly required: true;
+                    readonly variadic: false;
+                    readonly description: "";
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--record <id>";
+                    readonly description: "record id from 'hq deploy domains records list'";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--name <name>";
+                    readonly description: "record name, together with --type";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--type <type>";
+                    readonly description: "record type, together with --name";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--company <slug>";
+                    readonly description: "use this company instead of the active company";
+                    readonly hidden: false;
+                }, {
+                    readonly flags: "--json";
+                    readonly description: "print machine-readable JSON";
+                    readonly hidden: false;
+                }];
+                readonly subcommands: readonly [];
+            }];
         }];
     }];
 }, {