@indigoai-us/hq-cli 5.345.198 → 5.345.200

package/dist/lib/mesh/live/flush.d.ts

@@ -24,6 +24,8 @@ export declare const HELD_MAX_LINES = 20000;
 export declare const PROJECT_REBIND_INTERVAL_MS = 60000;
 export type HeldReason = "STATE_ABSENT" | "NEEDS_COMPANY" | "COMPANY_CONFLICT" | "NEEDS_PROJECT" | "HELD_EXPIRED" | "HELD_OVERFLOW";
 export interface FlushDeps {
+    /** Production callers re-read the shared person preference before each flush. */
+    reportingAllowed?: () => Promise<boolean>;
     workMeshRoot: string;
     workContextRoot: string;
     poster: SessionEventsPoster;

package/dist/lib/mesh/live/flush.js

@@ -9,9 +9,10 @@
  * 2xx responses are accounted per eventId (accepted / duplicates / rejected).
  */
 import * as fs from "node:fs";
+import { reportingLocallyDisabled } from "./reporting-privacy.js";
 import * as path from "node:path";
 import { readMetaCompanySlug, resolveCompany } from "../../work-context/company.js";
-import { companyBindingChanged, reboundSessionProjection, } from "../../work-context/company-rebind.js";
+import { companyBindingChanged, isNonCloudCompanySlug, reboundSessionProjection, } from "../../work-context/company-rebind.js";
 import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../work-context/repo-remote.js";
 import { rebindNeedsProjectOnPrompt } from "../../work-context/prompt-rebind.js";
 import { readSessionState, updateSessionState, writeSessionState } from "../../work-context/state.js";
@@ -172,6 +173,12 @@ async function postBatchWithRetries(poster, body, deps) {
  * Recovers orphan `*.claimed` files first; restores unprocessed lines on throw.
  */
 export async function flushSessionEvents(inputDeps) {
+    const env = inputDeps.env ?? process.env;
+    if (reportingLocallyDisabled(env) ||
+        (inputDeps.reportingAllowed && !(await inputDeps.reportingAllowed()))) {
+        return { claimed: 0, posted: 0, held: 0, dropped: 0, deadLettered: 0,
+            restored: 0, batches: 0, heldClaimed: false, heldOverflow: 0 };
+    }
     // One resolver per flush: git lookups are cached per cwd for this flush only.
     const deps = {
         ...inputDeps,
@@ -268,6 +275,30 @@ export async function flushSessionEvents(inputDeps) {
                 break sessionLoop;
             let state = readSessionState(sessionId, deps.workContextRoot);
             state = applySessionMetaCompanyRebind(sessionId, items, state, deps, now);
+            // Personal is the documented non-cloud scope, even if an old projection
+            // still contains a company UID or a pending presence leave.
+            if (isNonCloudCompanySlug(state?.companySlug) || items.some(item => isNonCloudCompanySlug(eventText(item.event, "companySlug")))) {
+                summary.dropped += items.length;
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
+            if (state?.companyConfidence === "device_default" && deps.authorizeDeviceDefaultTenant) {
+                await deps.authorizeDeviceDefaultTenant(state);
+                state = readSessionState(sessionId, deps.workContextRoot) ?? state;
+            }
+            if (state?.companyConfidence === "device_default") {
+                summary.held += appendHeldLinesIfAbsent(items.map(item => heldEnvelope(item.event, "NEEDS_COMPANY", item.heldAt ?? now().toISOString())), deps.workMeshRoot);
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
+            if (isNonCloudCompanySlug(state?.companySlug)) {
+                summary.dropped += items.length;
+                for (const item of items)
+                    markDisposed(item.event);
+                continue;
+            }
             const leaveResult = await postPresenceLeaveIfNeeded({
                 sessionId,
                 items,
@@ -726,7 +757,7 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now, uidCache)
     // Stay synchronous unless a uid lookup is needed: the flush loop's
     // microtask ordering is relied on by retry/back-pressure timing.
     const company = resolveHeldCompany(sessionId, items, state, deps);
-    if (!company)
+    if (!company || isNonCloudCompanySlug(company.slug))
         return state;
     if (company.uid) {
         return writeHeldCompanyBinding(sessionId, state, { uid: company.uid, slug: company.slug, source: company.source }, deps, now);
@@ -996,7 +1027,7 @@ function classifySession(state) {
         state.companyUid === state.ownerMismatch.companyUid) {
         return { action: "drop", reason: "owner_mismatch" };
     }
-    if (state.contextStatus === "needs_company") {
+    if (state.companyConfidence === "device_default" || state.contextStatus === "needs_company") {
         return { action: "hold", heldReason: "NEEDS_COMPANY" };
     }
     if (state.contextStatus === "company_conflict") {

package/dist/lib/mesh/live/reporting-privacy.d.ts

@@ -0,0 +1,7 @@
+/** Match the off controls used by the hook and handoff command. */
+export declare function reportingLocallyDisabled(env?: NodeJS.ProcessEnv): boolean;
+/** Legacy emit must not let the server infer a company for conversation text. */
+export declare function mayEmitConversation(event: Record<string, unknown>, env?: NodeJS.ProcessEnv): boolean;
+/** Fleet identities have no person preference; operator and local controls still apply. */
+export declare function reportingRuntimeAllowed(machine: boolean, env?: NodeJS.ProcessEnv): Promise<boolean>;
+//# sourceMappingURL=reporting-privacy.d.ts.map

package/dist/lib/mesh/live/reporting-privacy.js

@@ -0,0 +1,47 @@
+import { anywhereRuntimeAllowed } from "../../anywhere-person-setting.js";
+import { anywhereRuntimeEnabledFromSnapshot } from "../../anywhere-runtime-fast-flag.js";
+import { hqAnywhereRuntimeLocallyDisabled } from "../../anywhere-runtime-flag-key.js";
+import { isNonCloudCompanySlug } from "../../work-context/company-rebind.js";
+import { readMetaCompanySlug, resolveCompany } from "../../work-context/company.js";
+import { deriveRemoteOwnerSlug, deriveRepoIdentityKey } from "../../work-context/repo-remote.js";
+import { workContextRoot } from "../../work-context/paths.js";
+import { readSessionState } from "../../work-context/state.js";
+/** Match the off controls used by the hook and handoff command. */
+export function reportingLocallyDisabled(env = process.env) {
+    const hooks = (env.HQ_DISABLED_HOOKS ?? "").split(",").map(value => value.trim());
+    return ["1", "true", "TRUE", "yes", "YES", "on", "ON"].includes(env.HQ_WORK_MESH_DISABLED ?? "") ||
+        hooks.some(value => ["*", "work-mesh", "work-mesh-live"].includes(value)) ||
+        hqAnywhereRuntimeLocallyDisabled(env);
+}
+/** Legacy emit must not let the server infer a company for conversation text. */
+export function mayEmitConversation(event, env = process.env) {
+    if (event.kind !== "session_end" && typeof event.summary !== "string")
+        return true;
+    if (typeof event.sessionId !== "string" || !event.sessionId.trim())
+        return false;
+    const evidence = event.evidence && typeof event.evidence === "object"
+        ? event.evidence : {};
+    const text = (key) => typeof evidence[key] === "string" ? evidence[key] : undefined;
+    const root = workContextRoot(undefined, env);
+    const state = readSessionState(event.sessionId, root);
+    const meta = readMetaCompanySlug(event.sessionId, text("hqRoot"));
+    if (isNonCloudCompanySlug(meta) || isNonCloudCompanySlug(state?.companySlug) || isNonCloudCompanySlug(text("companySlug")) ||
+        state?.companyConfidence === "device_default" || state?.contextStatus === "untracked")
+        return false;
+    // The flushing process is not the originating session. Its spawn/company
+    // identity cannot authorize historical conversation text.
+    const resolved = resolveCompany({ root, sessionId: event.sessionId,
+        env: { HQ_AGENT_IDENTITY_FILE: "" },
+        cwd: text("cwd"), hqRoot: text("hqRoot"),
+        remoteOwnerSlug: deriveRemoteOwnerSlug({ cwd: text("cwd"), hqRoot: text("hqRoot") }) ?? undefined,
+        repoIdentityKey: text("cwd") ? deriveRepoIdentityKey({ cwd: text("cwd") }) ?? undefined : undefined,
+        trusted: { companySlug: text("companySlug") }, existingState: state });
+    return resolved.status === "resolved" && !isNonCloudCompanySlug(resolved.company.slug);
+}
+/** Fleet identities have no person preference; operator and local controls still apply. */
+export async function reportingRuntimeAllowed(machine, env = process.env) {
+    if (reportingLocallyDisabled(env))
+        return false;
+    return machine ? anywhereRuntimeEnabledFromSnapshot(env) : anywhereRuntimeAllowed(env);
+}
+//# sourceMappingURL=reporting-privacy.js.map

package/dist/lib/mesh/live/spool.d.ts

@@ -44,6 +44,14 @@ export declare function recoverOrphanClaims(root: string): {
 };
 export declare function removeClaimFile(claimPath: string | null): void;
 export declare function deadLetterNonEmpty(root?: string): boolean;
+/**
+ * Visit each line of a JSONL file without loading the whole file into one
+ * string. Queue files (dead-letter especially) can grow past V8's ~512 MB
+ * string ceiling, where readFileSync(..., "utf8") throws. Splits on the raw
+ * newline byte so multi-byte UTF-8 sequences are never cut. Returns false when
+ * the file cannot be opened.
+ */
+export declare function forEachJsonlLine(filePath: string, visit: (line: string) => void): boolean;
 export declare function countJsonlLines(filePath: string): number;
 /** Count held eventIds once; legacy rows without an eventId remain line-counted. */
 export declare function countDistinctHeldEvents(filePath: string): number;

package/dist/lib/mesh/live/spool.js

@@ -334,40 +334,71 @@ export function deadLetterNonEmpty(root) {
         return false;
     }
 }
+/** Chunk size for streaming JSONL reads. */
+const JSONL_READ_CHUNK_BYTES = 1024 * 1024;
+/**
+ * Visit each line of a JSONL file without loading the whole file into one
+ * string. Queue files (dead-letter especially) can grow past V8's ~512 MB
+ * string ceiling, where readFileSync(..., "utf8") throws. Splits on the raw
+ * newline byte so multi-byte UTF-8 sequences are never cut. Returns false when
+ * the file cannot be opened.
+ */
+export function forEachJsonlLine(filePath, visit) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+    }
+    catch {
+        return false;
+    }
+    try {
+        const chunk = Buffer.alloc(JSONL_READ_CHUNK_BYTES);
+        let carry = Buffer.alloc(0);
+        for (;;) {
+            const n = fs.readSync(fd, chunk, 0, chunk.length, null);
+            if (n <= 0)
+                break;
+            let data = carry.length > 0 ? Buffer.concat([carry, chunk.subarray(0, n)]) : chunk.subarray(0, n);
+            let start = 0;
+            for (let nl = data.indexOf(0x0a, start); nl !== -1; nl = data.indexOf(0x0a, start)) {
+                visit(data.toString("utf8", start, nl));
+                start = nl + 1;
+            }
+            carry = Buffer.from(data.subarray(start));
+            data = Buffer.alloc(0);
+        }
+        if (carry.length > 0)
+            visit(carry.toString("utf8"));
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    return true;
+}
 export function countJsonlLines(filePath) {
-    if (!fs.existsSync(filePath))
-        return 0;
-    const raw = fs.readFileSync(filePath, "utf8");
     let n = 0;
-    for (const line of raw.split("\n")) {
+    forEachJsonlLine(filePath, (line) => {
         if (line.trim())
             n += 1;
-    }
+    });
     return n;
 }
 /** Count held eventIds once; legacy rows without an eventId remain line-counted. */
 export function countDistinctHeldEvents(filePath) {
-    let raw;
-    try {
-        raw = fs.readFileSync(filePath, "utf8");
-    }
-    catch {
-        // A concurrent claim can rename held.jsonl between existence and read checks.
-        return 0;
-    }
     const seen = new Set();
     let count = 0;
-    for (const line of raw.split("\n")) {
+    // A concurrent claim can rename held.jsonl away; a missing file counts as 0.
+    forEachJsonlLine(filePath, (line) => {
         if (!line.trim())
-            continue;
+            return;
         const eventId = heldEventId(line);
         if (eventId) {
             if (seen.has(eventId))
-                continue;
+                return;
             seen.add(eventId);
         }
         count += 1;
-    }
+    });
     return count;
 }
 function record(value) {
@@ -413,17 +444,12 @@ function isUnattributedLine(line) {
     }
 }
 function countUnattributedJsonlLines(filePath) {
-    if (!fs.existsSync(filePath))
-        return 0;
-    try {
-        return fs
-            .readFileSync(filePath, "utf8")
-            .split("\n")
-            .filter((line) => line.trim() && isUnattributedLine(line)).length;
-    }
-    catch {
-        return 0;
-    }
+    let n = 0;
+    forEachJsonlLine(filePath, (line) => {
+        if (line.trim() && isUnattributedLine(line))
+            n += 1;
+    });
+    return n;
 }
 /**
  * Count the actionable, unfiled events across all local delivery queues.
@@ -438,27 +464,20 @@ export function countUnattributedEvents(root) {
     return { spool, held, deadLetter, total: spool + held + deadLetter };
 }
 function countUnattributedHeldEvents(filePath) {
-    let raw;
-    try {
-        raw = fs.readFileSync(filePath, "utf8");
-    }
-    catch {
-        // A concurrent held claim may rename this file between the read and open.
-        return 0;
-    }
     const seen = new Set();
     let count = 0;
-    for (const line of raw.split("\n")) {
+    // A concurrent held claim may rename this file away; a missing file counts as 0.
+    forEachJsonlLine(filePath, (line) => {
         if (!line.trim() || !isUnattributedLine(line))
-            continue;
+            return;
         const eventId = heldEventId(line);
         if (eventId) {
             if (seen.has(eventId))
-                continue;
+                return;
             seen.add(eventId);
         }
         count += 1;
-    }
+    });
     return count;
 }
 //# sourceMappingURL=spool.js.map

package/dist/lib/plan-limit-nag.d.ts

@@ -49,6 +49,28 @@ export declare const OVER_NAG_INTERVAL_MS: number;
  * as the bare key rather than a guess.
  */
 export declare const PLAN_LIMIT_DIMENSION_LABELS: Record<string, string>;
+/**
+ * The account a nag payload is about, as hq-pro labels it (`account` beside
+ * `planLimits`). One command can touch a personal vault and a company vault,
+ * so the line names which one is over (feedback_b1867fe6).
+ */
+export type PlanLimitAccount = {
+    kind: "person";
+} | {
+    kind: "company";
+    slug: string | null;
+};
+/**
+ * Render one amount of a resource. Storage arrives in bytes; printed raw it
+ * reads as "47012700666 of 10737418240". It is shown in GB with one decimal,
+ * so a 10 GB ceiling reads "10.0 GB", matching the plan's own wording.
+ */
+export declare function formatPlanLimitAmount(key: string, n: number): string;
+/**
+ * The account as a noun phrase: "your personal account", "the acme company",
+ * or "this account" when an older hq-pro sent no label.
+ */
+export declare function planLimitAccountPhrase(account: PlanLimitAccount | null | undefined): string;
 export interface PlanLimitEntry {
     used: number;
     limit: number;
@@ -75,10 +97,13 @@ export declare function recordPlanLimitStatus(body: unknown, opts?: {
 /**
  * The over-limit per-turn line (US-036 §2.2). One line, not the old box: it
  * now repeats up to four times a day, and a multi-line box at that cadence
- * reads as breakage rather than as a nag. It states the two paused things and
- * never claims the workspace has stopped working.
+ * reads as breakage rather than as a nag. It names the account and states the
+ * facts. It claims no pause: being over is not being refused. A refusal comes
+ * back from hq-pro as its own error with its own sentence, and that is the
+ * only place a pause is reported (feedback_b1867fe6, where this line told a
+ * person their uploads were paused right after two uploads succeeded).
  */
-export declare function buildOverLine(overEntries: Array<[string, PlanLimitEntry]>, upgradeUrl: string): string;
+export declare function buildOverLine(overEntries: Array<[string, PlanLimitEntry]>, upgradeUrl: string, account?: PlanLimitAccount | null): string;
 /**
  * The notice a personal feature refusal prints. `upgradeUrl` is the server's
  * own checkout target; an older hq-pro sends none, and the line then names the
@@ -95,7 +120,7 @@ export declare function renderPersonalPlanFeatureNotice(feature: string, upgrade
  * their own story, and a notice that announces a pause nobody is experiencing
  * reads as a bug.
  */
-export declare function renderThresholdNotice(crossing: PlanLimitThresholdCrossing, upgradeUrl: string): string;
+export declare function renderThresholdNotice(crossing: PlanLimitThresholdCrossing, upgradeUrl: string, account?: PlanLimitAccount | null): string;
 /**
  * Print every crossing this machine has not already printed for this episode.
  *
@@ -106,6 +131,7 @@ export declare function renderThresholdNotice(crossing: PlanLimitThresholdCrossi
 export declare function emitPlanLimitThresholdNotice(crossings: readonly PlanLimitThresholdCrossing[], upgradeUrl: string | null, opts?: {
     write?: (s: string) => void;
     statePath?: string;
+    account?: PlanLimitAccount | null;
 }): void;
 /**
  * Emit a plan-limit nag to stderr at command completion.

package/dist/lib/plan-limit-nag.js

@@ -63,6 +63,52 @@ export const PLAN_LIMIT_DIMENSION_LABELS = {
     deployments: "deployments",
     storageBytes: "storage",
 };
+/**
+ * Bytes in one GB as plan limits count them: 2^30. hq-pro stores the "10 GB"
+ * and "2 GB" storage ceilings as GiB and its limit emails print them as
+ * "10 GB" / "2 GB"; `lib/billing/usage-cost.ts` uses the same unit
+ * (BYTES_PER_GB). Kept local so this hot-path module loads no billing code.
+ */
+const STORAGE_BYTES_PER_GB = 1024 ** 3;
+/**
+ * Render one amount of a resource. Storage arrives in bytes; printed raw it
+ * reads as "47012700666 of 10737418240". It is shown in GB with one decimal,
+ * so a 10 GB ceiling reads "10.0 GB", matching the plan's own wording.
+ */
+export function formatPlanLimitAmount(key, n) {
+    if (key !== "storageBytes")
+        return String(n);
+    return `${(n / STORAGE_BYTES_PER_GB).toFixed(1)} GB`;
+}
+/**
+ * The account as a noun phrase: "your personal account", "the acme company",
+ * or "this account" when an older hq-pro sent no label.
+ */
+export function planLimitAccountPhrase(account) {
+    if (account?.kind === "person")
+        return "your personal account";
+    if (account?.kind === "company" && account.slug)
+        return `the ${account.slug} company`;
+    return "this account";
+}
+function parseAccount(body) {
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return null;
+    }
+    const raw = body.account;
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const rec = raw;
+    if (rec.kind === "person")
+        return { kind: "person" };
+    if (rec.kind === "company") {
+        const slug = typeof rec.slug === "string" && rec.slug.trim().length > 0
+            ? rec.slug.trim()
+            : null;
+        return { kind: "company", slug };
+    }
+    return null;
+}
 function dimensionSuffix(key) {
     const label = PLAN_LIMIT_DIMENSION_LABELS[key];
     return label && label !== key ? ` (${label})` : "";
@@ -252,14 +298,15 @@ export function recordPlanLimitStatus(body, opts = {}) {
                 legacyUrl: status?.upgradeUrl ?? PLAN_LIMIT_UPGRADE_URL,
             });
         }
+        const account = parseAccount(body);
         if (status !== null) {
             const anyOver = Object.values(status.limits).some((e) => e.over);
-            lastSeen = { ...status, anyOver, upgradeUrl: resolvedUpgradeUrl };
+            lastSeen = { ...status, anyOver, upgradeUrl: resolvedUpgradeUrl, account };
         }
         // Independent of `planLimits`: the server can announce a crossing on a
         // response whose nag map this CLI could not parse, and the notice is the
         // one surface that must land inside a session that is already running.
-        emitPlanLimitThresholdNotice(crossings, resolvedUpgradeUrl, opts);
+        emitPlanLimitThresholdNotice(crossings, resolvedUpgradeUrl, { ...opts, account });
     }
     catch {
         // Never throw from record path.
@@ -287,7 +334,7 @@ function formatPct(entry) {
     return `${Math.round((entry.used / entry.limit) * 100)}%`;
 }
 function formatEntryLine(key, entry) {
-    return `${key} at ${entry.used}/${entry.limit} (${formatPct(entry)})${dimensionSuffix(key)}`;
+    return `${key} at ${formatPlanLimitAmount(key, entry.used)}/${formatPlanLimitAmount(key, entry.limit)} (${formatPct(entry)})${dimensionSuffix(key)}`;
 }
 /**
  * Read the whole state file. A missing, unreadable or malformed file is an
@@ -360,16 +407,18 @@ function withinNagWindow(shownAt, nowMs) {
 /**
  * The over-limit per-turn line (US-036 §2.2). One line, not the old box: it
  * now repeats up to four times a day, and a multi-line box at that cadence
- * reads as breakage rather than as a nag. It states the two paused things and
- * never claims the workspace has stopped working.
+ * reads as breakage rather than as a nag. It names the account and states the
+ * facts. It claims no pause: being over is not being refused. A refusal comes
+ * back from hq-pro as its own error with its own sentence, and that is the
+ * only place a pause is reported (feedback_b1867fe6, where this line told a
+ * person their uploads were paused right after two uploads succeeded).
  */
-export function buildOverLine(overEntries, upgradeUrl) {
+export function buildOverLine(overEntries, upgradeUrl, account = null) {
     const facts = overEntries
-        .map(([key, entry]) => `${PLAN_LIMIT_DIMENSION_LABELS[key] ?? key} ${entry.used} of ${entry.limit}`)
+        .map(([key, entry]) => `${PLAN_LIMIT_DIMENSION_LABELS[key] ?? key} ${formatPlanLimitAmount(key, entry.used)} of ${formatPlanLimitAmount(key, entry.limit)}`)
         .join(", ");
     // US-024: names no plan and offers no upgrade; the link is the Billing page.
-    return (`⚠ Over this account's limits: ${facts}. New files and new secrets are paused. ` +
-        `Billing: ${upgradeUrl}`);
+    return `⚠ Over ${planLimitAccountPhrase(account)}'s limits: ${facts}. Billing: ${upgradeUrl}`;
 }
 // ---------------------------------------------------------------------------
 // Personal feature notice (US-054, copy per US-024)
@@ -424,12 +473,14 @@ function dimensionName(resource) {
  * their own story, and a notice that announces a pause nobody is experiencing
  * reads as a bug.
  */
-export function renderThresholdNotice(crossing, upgradeUrl) {
+export function renderThresholdNotice(crossing, upgradeUrl, account = null) {
     const name = dimensionName(crossing.resource);
-    const counts = `${crossing.used} of ${crossing.limit}`;
+    const counts = `${formatPlanLimitAmount(crossing.resource, crossing.used)} of ${formatPlanLimitAmount(crossing.resource, crossing.limit)}`;
+    // An unlabelled payload (older hq-pro) keeps the original wording.
+    const where = account ? ` for ${planLimitAccountPhrase(account)}` : "";
     const headline = crossing.band === "over"
-        ? `You are past your ${name} limit (${counts}).`
-        : `You have reached 80% of your ${name} limit (${counts}).`;
+        ? `You are past your ${name} limit${where} (${counts}).`
+        : `You have reached 80% of your ${name} limit${where} (${counts}).`;
     return `${headline} Billing: ${upgradeUrl}`;
 }
 /**
@@ -461,7 +512,7 @@ export function emitPlanLimitThresholdNotice(crossings, upgradeUrl, opts = {}) {
                 continue;
             thresholdsShownThisSession.set(key, crossing.firstSeenAt);
             printed[key] = crossing.firstSeenAt;
-            write(chalk.yellow(renderThresholdNotice(crossing, resolvedUpgradeUrl)) + "\n");
+            write(chalk.yellow(renderThresholdNotice(crossing, resolvedUpgradeUrl, opts.account ?? null)) + "\n");
             if (isCliLimitResourceKind(crossing.resource)) {
                 queueCliLimitNoticeExposure(crossing.resource, "advisory");
             }
@@ -489,7 +540,7 @@ export function emitPlanLimitNag(opts = {}) {
         const write = opts.write ?? ((s) => process.stderr.write(s));
         const now = opts.now ?? (() => new Date());
         const statePath = opts.statePath ?? defaultStatePath();
-        const { limits, anyOver, upgradeUrl } = lastSeen;
+        const { limits, anyOver, upgradeUrl, account } = lastSeen;
         const resolvedUpgradeUrl = upgradeUrl ??
             planLimitUpgradeFallbackUrl(resolveProcessFlagCompanyContext().companySlug, PLAN_LIMIT_UPGRADE_URL);
         const entries = Object.entries(limits);
@@ -504,7 +555,7 @@ export function emitPlanLimitNag(opts = {}) {
                 return;
             overShownThisSession = true;
             const overEntries = entries.filter(([, e]) => e.over);
-            const line = buildOverLine(overEntries, resolvedUpgradeUrl);
+            const line = buildOverLine(overEntries, resolvedUpgradeUrl, account);
             write(chalk.yellow(line) + "\n");
             const resourceKind = overEntries[0]?.[0];
             if (resourceKind && isCliLimitResourceKind(resourceKind)) {
@@ -520,7 +571,7 @@ export function emitPlanLimitNag(opts = {}) {
         if (worst === null)
             return;
         warningShownThisSession = true;
-        const line = `⚠ Nearing this account's limits: ${formatEntryLine(worst.key, worst.entry)}. Make room before you hit the cap. Billing: ${resolvedUpgradeUrl}`;
+        const line = `⚠ Nearing ${planLimitAccountPhrase(account)}'s limits: ${formatEntryLine(worst.key, worst.entry)}. Make room before you hit the cap. Billing: ${resolvedUpgradeUrl}`;
         write(chalk.yellow(line) + "\n");
         if (isCliLimitResourceKind(worst.key)) {
             queueCliLimitNoticeExposure(worst.key, "advisory");

package/dist/lib/signals/engine.d.ts

@@ -1,3 +1,4 @@
+import { type IncrementalOptions } from "./incremental.js";
 import { localDate } from "./local-date.js";
 import { type LockTakeover } from "./run-lock.js";
 import { type UploadDeps } from "./steps/upload.js";
@@ -130,6 +131,9 @@ export interface RunSignalsResult {
     alerts?: Record<string, RaiseSignalsFailureAlertsResult>;
 }
 export interface RunSignalsOptions {
+    source?: string;
+    incremental?: boolean;
+    incrementalOptions?: IncrementalOptions;
     hqRoot: string;
     company?: string;
     dryRun?: boolean;

package/dist/lib/signals/engine.js

@@ -12,7 +12,8 @@ import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import yaml from "js-yaml";
-import { loadSignalsSettings } from "./settings.js";
+import { loadSignalsSettings, loadIncrementalSettings } from "./settings.js";
+import { createIncrementalStep } from "./incremental.js";
 import { localDate } from "./local-date.js";
 import { guardedWrite, WriteGuardError } from "./write-guard.js";
 import { acquireCompanyLock, withSummaryLock } from "./run-lock.js";
@@ -46,6 +47,7 @@ export const defaultSpawn = (cmd, args, opts) => {
         cwd: opts.cwd,
         env: opts.env ?? process.env,
         encoding: "utf8",
+        input: opts.input,
         maxBuffer: 64 * 1024 * 1024,
         ...(opts.timeoutMs !== undefined ? { timeout: opts.timeoutMs, killSignal: "SIGKILL" } : {}),
     });
@@ -246,9 +248,22 @@ export async function runSignals(opts) {
     const stepChoice = opts.step ?? "all";
     const dryRun = opts.dryRun === true;
     const settings = loadSignalsSettings(hqRoot);
-    const maxTurns = opts.maxTurns ?? settings.maxTurns;
-    const maxBudgetUsd = opts.maxBudgetUsd ?? settings.maxBudgetUsd;
+    if (opts.source !== undefined || opts.incremental) {
+        if (!opts.source || !opts.incremental || !opts.company)
+            throw new SignalsUsageError("--source and --incremental require each other and --company");
+        if ((opts.step && opts.step !== "all" && opts.step !== "extract") || opts.redo?.length)
+            throw new SignalsUsageError("--incremental cannot be combined with --redo or another step");
+        if (!/^[a-zA-Z0-9_-]+:[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(opts.source))
+            throw new SignalsUsageError("invalid --source: expected <channel>:<file>");
+    }
+    const limits = opts.incremental ? loadIncrementalSettings(hqRoot) : settings;
+    const maxTurns = opts.maxTurns ?? limits.maxTurns;
+    const maxBudgetUsd = opts.maxBudgetUsd ?? limits.maxBudgetUsd;
+    if (!Number.isInteger(maxTurns) || maxTurns < 1 || !Number.isFinite(maxBudgetUsd) || maxBudgetUsd < 0)
+        throw new SignalsUsageError("invalid model cost limits");
     const stepImpls = { ...DEFAULT_STEPS, ...(opts.steps ?? {}) };
+    if (opts.incremental)
+        stepImpls.extract = createIncrementalStep(opts.source, opts.incrementalOptions);
     if (opts.company !== undefined && !SLUG_RE.test(opts.company)) {
         throw new SignalsUsageError(`invalid company slug: ${opts.company}`);
     }
@@ -266,12 +281,14 @@ export async function runSignals(opts) {
     const companies = opts.company !== undefined ? [opts.company] : listCompanies(hqRoot);
     const start = now();
     const date = localDate(start);
-    const lateStart = trigger === "job" && start.getHours() >= settings.lateStartHour;
+    const lateStart = !opts.incremental && trigger === "job" && start.getHours() >= settings.lateStartHour;
     let plan = stepChoice === "all" ? STEP_ORDER : STEP_ORDER.filter((s) => s === stepChoice);
     if (stepChoice !== "all")
         plan = plan.slice(0, 1);
     if (lateStart)
         plan = plan.filter((s) => s === "garden").slice(0, 1);
+    if (opts.incremental)
+        plan = ["extract"];
     const records = [];
     const locked = [];
     for (const company of companies) {
@@ -324,7 +341,10 @@ export async function runSignals(opts) {
         };
         const finish = () => {
             const decidedSkip = record.skipReason;
+            const previousJobRanAt = record.jobRanAt;
             finalizeRecord(record, { lateStart, lateStartHour: settings.lateStartHour, finishedAt: now() });
+            if (opts.incremental)
+                record.jobRanAt = previousJobRanAt;
             if (dryRun) {
                 if (!decidedSkip) {
                     record.status = "dry-run";
@@ -343,7 +363,7 @@ export async function runSignals(opts) {
             // 2. The day's job already ran: do nothing and leave the record as it is.
             const prior = readJson(hqRoot, rel);
             const priorJobRanAt = typeof prior?.jobRanAt === "string" ? prior.jobRanAt : null;
-            if (trigger === "job" && !opts.force && prior && priorJobRanAt) {
+            if (!opts.incremental && trigger === "job" && !opts.force && prior && priorJobRanAt) {
                 process.stderr.write(`hq signals: ${company}: already-ran (the job ran at ${priorJobRanAt})\n`);
                 records.push({ ...prior, alreadyRanToday: true });
                 continue;

package/dist/lib/signals/incremental.d.ts

@@ -0,0 +1,42 @@
+import { type PriorSignal } from "./steps/extract.js";
+import type { SignalsStep, StepContext } from "./steps/types.js";
+export { meetingSignalSourceRef } from "../hot-channels/meeting-source-ref.js";
+export interface IncrementalCursor {
+    revision: number;
+    segment_count: number;
+    last_run_at: string;
+    signal_ids: string[];
+    digest: string;
+    pending_events?: SignalWritten[];
+}
+export interface SourceSnapshot {
+    sourceRef: string;
+    text: string;
+    segmentCount: number;
+    revision?: number;
+    audience: string[];
+}
+export type SourceReader = (ctx: StepContext, id: string) => Promise<SourceSnapshot>;
+export type SignalWritten = {
+    event: "signal.written";
+    signal_id: string;
+    type: string;
+    source_ref: string;
+    company: string;
+    key: string;
+};
+export interface IncrementalOptions {
+    readers?: Readonly<Record<string, SourceReader>>;
+    /** US-004/005 integration seam: one callback per newly persisted signal. */
+    onSignalWritten?: (event: SignalWritten) => Promise<void>;
+}
+export declare const SOURCE_READERS: Readonly<Record<string, SourceReader>>;
+export declare function readIncrementalSource(ctx: StepContext, ref: string, readers?: Readonly<Record<string, SourceReader>>): Promise<SourceSnapshot>;
+export declare function cursorPath(company: string, sourceRef: string): string;
+/** Only read the current audience partition, never another audience's signals. */
+export declare function priorSignalsFor(ctx: StepContext, sourceRef: string, audience: string[]): Array<PriorSignal & {
+    key: string;
+    live: boolean;
+}>;
+export declare function createIncrementalStep(source: string, options?: IncrementalOptions): SignalsStep;
+//# sourceMappingURL=incremental.d.ts.map