@indigoai-us/hq-cli 5.345.199 → 5.345.201

package/dist/commands/cloud.js

@@ -22,7 +22,7 @@ import * as path from "path";
 import { share, getStateDir, listJournals, createIgnoreFilter, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, readSyncProgress, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { syncLeg } from "../utils/sync-operation-lock.js";
 import { SYNC_WATCHDOG_EXIT_CODE, SYNC_WATCHDOG_REPORT_GRACE_MS, SyncWatchdogTimeoutError, createSnapshotProgressProbe, resolveSyncWatchdogLimits, withSyncWatchdog, } from "../utils/sync-watchdog.js";
-import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, IdentitySwapRefusal, cognitoCachePrincipalUid, isDefinitivePersonAuthRejection, isIdentitySwapRefusal, loadCachedTokens, } from "../utils/cognito-session.js";
+import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, IdentitySwapRefusal, cognitoCachePrincipalUid, isDefinitivePersonAuthRejection, isIdentitySwapRefusal, loadCachedTokens, refreshCachedSession, } from "../utils/cognito-session.js";
 import { resolveUploadAuthor } from "../utils/upload-author.js";
 import { companyFolderExceedsThreshold, emitNarrowHint, isStrictRefusal, resolveBannerLevel, resolveNarrowHintPresentationLevel, resolveNarrowHintMinBytes, } from "../lib/narrow-hint-banner.js";
 import { beginSyncHealthReport, classifySyncFailure, } from "../utils/client-health.js";
@@ -90,6 +90,80 @@ export class SyncSessionExpiredError extends Error {
         this.name = "SyncSessionExpiredError";
     }
 }
+/** Shown when the vault rejected the session even after a forced refresh. */
+export const SYNC_SESSION_REJECTED_MESSAGE = "The HQ server rejected your session even after it was refreshed, so the saved sign-in is no longer accepted. `hq auth status` only checks the saved expiry, not the server. Run `hq login`, then rerun the sync.";
+/** Reason text when token acquisition does not settle within the bound. */
+export const SYNC_TOKEN_TIMEOUT_REASON = "timed out waiting for the sign-in service";
+/** Longest a single token acquisition or refresh may take before the sync fails. */
+export const SYNC_TOKEN_TIMEOUT_MS = 45_000;
+/**
+ * The vault rejected the session after a forced refresh had already replaced
+ * the saved token. Retrying again cannot help; the user has to sign in again.
+ */
+export class SyncSessionRejectedError extends Error {
+    constructor() {
+        super(SYNC_SESSION_REJECTED_MESSAGE);
+        this.name = "SyncSessionRejectedError";
+    }
+}
+/** Reject with a named "unavailable" error when `promise` has not settled within `ms`. */
+function withTokenTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new SyncSessionExpiredError("unavailable", SYNC_TOKEN_TIMEOUT_REASON)), ms);
+        timer.unref?.();
+    });
+    return Promise.race([promise, timeout]).finally(() => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    });
+}
+/**
+ * feedback_3d752910: the vault can reject a token that still looks valid in the
+ * local cache (revoked or replaced server-side). The cached expiry check never
+ * notices, and `hq auth refresh` is a no-op for a valid-looking token, so every
+ * sync kept presenting the same rejected token. On a vault 401, force one real
+ * refresh and rerun the sync once. A second rejection is reported as a rejected
+ * session (sign in again), never retried again.
+ */
+export async function runWithRejectedSessionRecovery(run, deps = {}) {
+    const forceRefresh = deps.forceRefresh ?? (() => refreshCachedSession({ force: true }));
+    try {
+        return await run();
+    }
+    catch (err) {
+        if (!isVaultAuthRejection(err))
+            throw err;
+        // The getter already failed to produce a token; a forced refresh would hit
+        // the same failure. Report the real cause.
+        const firstFailure = deps.recordedFailure?.();
+        if (firstFailure)
+            throw firstFailure;
+        await deps.onRetry?.();
+        let refreshed;
+        try {
+            refreshed = await withTokenTimeout(forceRefresh(), SYNC_TOKEN_TIMEOUT_MS);
+        }
+        catch (refreshErr) {
+            throw refreshErr instanceof SyncSessionExpiredError
+                ? refreshErr
+                : classifyRefreshFailure(refreshErr);
+        }
+        if (!refreshed.refreshed) {
+            throw classifyRefreshFailure(new Error(refreshed.reason ?? "refresh failed"));
+        }
+        try {
+            return await run();
+        }
+        catch (retryErr) {
+            if (isVaultAuthRejection(retryErr)) {
+                // A getter failure surfaced as a 401 is not a server rejection.
+                throw deps.recordedFailure?.() ?? new SyncSessionRejectedError();
+            }
+            throw retryErr;
+        }
+    }
+}
 /**
  * Per-config record of the last token-function failure. hq-cloud's one-shot
  * 401 retry swallows getter errors and rethrows the original 401, so
@@ -128,6 +202,7 @@ function classifyRefreshFailure(err) {
  */
 export function buildSyncVaultConfig(initialToken, deps = {}) {
     const ensureToken = deps.ensureToken ?? (() => ensureCognitoToken({ interactive: false }));
+    const tokenTimeoutMs = deps.tokenTimeoutMs ?? SYNC_TOKEN_TIMEOUT_MS;
     const runPrincipal = cognitoCachePrincipalUid(initialToken);
     // A start token with no sub/entityUid cannot be bound to a principal, and a
     // null binding would accept any later identity-less token. Refuse up front.
@@ -142,7 +217,7 @@ export function buildSyncVaultConfig(initialToken, deps = {}) {
             throw refused;
         let token;
         try {
-            token = await ensureToken();
+            token = await withTokenTimeout(ensureToken(), tokenTimeoutMs);
         }
         catch (err) {
             const failure = isIdentitySwapRefusal(err) ? err : classifyRefreshFailure(err);
@@ -177,7 +252,9 @@ function isVaultAuthRejection(err) {
  * CLI are released independently.
  */
 export function formatSyncFailure(err, ctx = {}) {
-    if (err instanceof SyncSessionExpiredError || isIdentitySwapRefusal(err)) {
+    if (err instanceof SyncSessionExpiredError ||
+        err instanceof SyncSessionRejectedError ||
+        isIdentitySwapRefusal(err)) {
         return err.message;
     }
     if (isVaultAuthRejection(err)) {
@@ -1622,87 +1699,101 @@ export function registerCloudCommands(program) {
             console.log(chalk.bold("\nHQ Sync — Pull"));
             console.log(`  HQ root:  ${options.hqRoot}`);
             console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}\n`);
-            const accessToken = await ensureSyncCognitoToken();
-            const vaultConfig = buildSyncVaultConfig(accessToken);
-            runVaultConfig = vaultConfig;
-            // US-011 (2026-05-21 fix): resolve the caller's sync-config for
-            // the targeted membership BEFORE the pull, so we can (a) emit the
-            // narrow-hint banner after success if still on all-mode and
-            // (b) respect strict-mode refusal mirror of the --all + sync-now
-            // paths. Failure to resolve degrades silently — pull still works,
-            // banner just stays quiet (same as the catch in runPullAll).
-            const narrowHintLevel = resolveBannerLevel();
-            const pullClient = new VaultClient(vaultConfig);
-            const { resolvedCompanyUid, resolvedMode } = await resolvePerCompanyPullPlan(pullClient, options.company);
-            // DEV-1768: resolve the REAL effective scope (mode + prefixSet) and
-            // thread it into the pull below — not just the banner. Best-effort;
-            // degrades to "all" inside the resolver on any failure.
-            const pullScope = await resolveCliPullScope(pullClient, options.company, options.hqRoot);
-            // Size gate: only a large local folder is nudged / strict-refused.
-            const nudgeExceedsSize = resolvedMode === "all" &&
-                resolvedCompanyUid !== undefined &&
-                narrowNudgeExceedsSize(options.hqRoot, options.company);
-            const strictRefusal = resolvedMode === "all" &&
-                nudgeExceedsSize &&
-                isStrictRefusal(resolvedMode, narrowHintLevel) &&
-                options.modeAll !== true;
-            const bannerLevel = resolveNarrowHintPresentationLevel(narrowHintLevel, strictRefusal);
-            // Strict-mode refusal: matches runPullAll + runNowSingle behavior.
-            // Default banner level is 'hint' which never triggers refusal —
-            // wired now so a future release can flip the default to 'strict'
-            // (still size-gated) without re-touching this command.
-            if (strictRefusal &&
-                resolvedMode === "all" &&
-                resolvedCompanyUid) {
-                emitNarrowHint({
-                    companyUid: resolvedCompanyUid,
-                    syncMode: resolvedMode,
-                    level: bannerLevel,
+            // feedback_3d752910: one forced refresh and rerun when the vault
+            // rejects a token that still looks valid in the local cache.
+            await runWithRejectedSessionRecovery(async () => {
+                runVaultConfig = undefined;
+                const accessToken = await withTokenTimeout(ensureSyncCognitoToken(), SYNC_TOKEN_TIMEOUT_MS);
+                const vaultConfig = buildSyncVaultConfig(accessToken);
+                runVaultConfig = vaultConfig;
+                // US-011 (2026-05-21 fix): resolve the caller's sync-config for
+                // the targeted membership BEFORE the pull, so we can (a) emit the
+                // narrow-hint banner after success if still on all-mode and
+                // (b) respect strict-mode refusal mirror of the --all + sync-now
+                // paths. Failure to resolve degrades silently — pull still works,
+                // banner just stays quiet (same as the catch in runPullAll).
+                const narrowHintLevel = resolveBannerLevel();
+                const pullClient = new VaultClient(vaultConfig);
+                const { resolvedCompanyUid, resolvedMode } = await resolvePerCompanyPullPlan(pullClient, options.company);
+                // DEV-1768: resolve the REAL effective scope (mode + prefixSet) and
+                // thread it into the pull below — not just the banner. Best-effort;
+                // degrades to "all" inside the resolver on any failure.
+                const pullScope = await resolveCliPullScope(pullClient, options.company, options.hqRoot);
+                // Size gate: only a large local folder is nudged / strict-refused.
+                const nudgeExceedsSize = resolvedMode === "all" &&
+                    resolvedCompanyUid !== undefined &&
+                    narrowNudgeExceedsSize(options.hqRoot, options.company);
+                const strictRefusal = resolvedMode === "all" &&
+                    nudgeExceedsSize &&
+                    isStrictRefusal(resolvedMode, narrowHintLevel) &&
+                    options.modeAll !== true;
+                const bannerLevel = resolveNarrowHintPresentationLevel(narrowHintLevel, strictRefusal);
+                // Strict-mode refusal: matches runPullAll + runNowSingle behavior.
+                // Default banner level is 'hint' which never triggers refusal —
+                // wired now so a future release can flip the default to 'strict'
+                // (still size-gated) without re-touching this command.
+                if (strictRefusal &&
+                    resolvedMode === "all" &&
+                    resolvedCompanyUid) {
+                    emitNarrowHint({
+                        companyUid: resolvedCompanyUid,
+                        syncMode: resolvedMode,
+                        level: bannerLevel,
+                    });
+                    console.error(chalk.red("\n✗ Pull refused: strict narrow-hint mode is on and this " +
+                        "company's local folder has grown large. Run `hq sync narrow --apply` " +
+                        "to migrate, or re-run with --mode-all."));
+                    process.exit(1);
+                }
+                const excludePrefixes = readScopeExcludePrefixes(pullScope);
+                syncHealth = beginSyncHealthReport();
+                const result = await syncLeg({
+                    company: options.company,
+                    onConflict: options.onConflict,
+                    vaultConfig,
+                    hqRoot: options.hqRoot,
+                    ...(pullScope?.syncMode !== undefined
+                        ? { syncMode: pullScope.syncMode }
+                        : {}),
+                    ...(pullScope?.prefixSet !== undefined
+                        ? { prefixSet: pullScope.prefixSet }
+                        : {}),
+                    // Sessions-exclusion: never materialize excluded prefixes even for
+                    // a wide-STS owner.
+                    ...(excludePrefixes ? { excludePrefixes } : {}),
+                    ...(options.forceScopeShrink ? { forceScopeShrink: true } : {}),
                 });
-                console.error(chalk.red("\n✗ Pull refused: strict narrow-hint mode is on and this " +
-                    "company's local folder has grown large. Run `hq sync narrow --apply` " +
-                    "to migrate, or re-run with --mode-all."));
-                process.exit(1);
-            }
-            const excludePrefixes = readScopeExcludePrefixes(pullScope);
-            syncHealth = beginSyncHealthReport();
-            const result = await syncLeg({
-                company: options.company,
-                onConflict: options.onConflict,
-                vaultConfig,
-                hqRoot: options.hqRoot,
-                ...(pullScope?.syncMode !== undefined
-                    ? { syncMode: pullScope.syncMode }
-                    : {}),
-                ...(pullScope?.prefixSet !== undefined
-                    ? { prefixSet: pullScope.prefixSet }
-                    : {}),
-                // Sessions-exclusion: never materialize excluded prefixes even for
-                // a wide-STS owner.
-                ...(excludePrefixes ? { excludePrefixes } : {}),
-                ...(options.forceScopeShrink ? { forceScopeShrink: true } : {}),
-            });
-            if (result.aborted) {
-                console.log(chalk.yellow(`\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
-                await syncHealth.failed();
-                process.exit(1);
-            }
-            recordFirstWorkBearingSync({
-                filesDownloaded: result.filesDownloaded,
-                aborted: result.aborted,
-            });
-            console.log(chalk.green(`\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
-            // Emit the hint banner after success so it appears alongside the
-            // summary line. Mirrors the wiring in runPullAll and runNowSingle.
-            // Size-gated: only a large local folder is nudged.
-            if (resolvedMode === "all" && nudgeExceedsSize && resolvedCompanyUid) {
-                emitNarrowHint({
-                    companyUid: resolvedCompanyUid,
-                    syncMode: resolvedMode,
-                    level: bannerLevel,
+                if (result.aborted) {
+                    console.log(chalk.yellow(`\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
+                    await syncHealth.failed();
+                    process.exit(1);
+                }
+                recordFirstWorkBearingSync({
+                    filesDownloaded: result.filesDownloaded,
+                    aborted: result.aborted,
                 });
-            }
-            await syncHealth.succeeded();
+                console.log(chalk.green(`\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`));
+                // Emit the hint banner after success so it appears alongside the
+                // summary line. Mirrors the wiring in runPullAll and runNowSingle.
+                // Size-gated: only a large local folder is nudged.
+                if (resolvedMode === "all" && nudgeExceedsSize && resolvedCompanyUid) {
+                    emitNarrowHint({
+                        companyUid: resolvedCompanyUid,
+                        syncMode: resolvedMode,
+                        level: bannerLevel,
+                    });
+                }
+                await syncHealth.succeeded();
+            }, {
+                recordedFailure: () => syncAuthFailureFor(runVaultConfig),
+                onRetry: async () => {
+                    console.error(chalk.yellow("HQ rejected the session; refreshing once and retrying."));
+                    // Close the first attempt's health report; the rerun opens its own.
+                    const first = syncHealth;
+                    syncHealth = undefined;
+                    await first?.failed("AUTH_EXPIRED");
+                },
+            });
         }
         catch (err) {
             if (syncHealth)

package/dist/commands/creators.js

@@ -1,6 +1,7 @@
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 /**
  * Testable core. Submits the application and maps the server response to a
  * single human-readable message. Throws on hard failures.
@@ -46,7 +47,7 @@ export function registerCreatorsCommand(program) {
         .action(async (options) => {
         try {
             const result = await runCreatorApply({ reason: options.reason, handle: options.handle }, {
-                getAccessToken: () => ensureCognitoToken({ interactive: true }),
+                getAccessToken: () => ensureCognitoToken({ interactive: gatedInteractiveLogin() }),
                 post: (token, body) => vaultApiFetch({
                     token,
                     path: "/v1/creators/request-access",

package/dist/commands/deploy-domains.js

@@ -907,12 +907,16 @@ function availabilityLabel(kind) {
 function isOfferable(kind) {
     return kind === "available" || kind === "premium";
 }
+/** hq-pro sends the registrar currency as lowercase "usd". Either case is US dollars. */
+function isUsdCurrency(currency) {
+    return typeof currency === "string" && currency.toUpperCase() === "USD";
+}
 function moneyFromCents(cents, currency) {
     if (typeof cents !== "number" || !Number.isFinite(cents) || cents < 0 || !Number.isInteger(cents))
         return undefined;
     const amount = cents / 100;
     const text = Number.isInteger(amount) ? `$${amount}` : `$${amount.toFixed(2)}`;
-    if (typeof currency === "string" && currency !== "" && currency !== "USD")
+    if (typeof currency === "string" && currency !== "" && !isUsdCurrency(currency))
         return `${text} ${currency}`;
     return text;
 }
@@ -1053,7 +1057,7 @@ function registrarCurrency(result) {
 /** First-year amount comparable to --price. A quote in another currency is not one. */
 function usdFirstYearAmount(result) {
     const currency = registrarCurrency(result);
-    if (currency !== undefined && currency !== "USD")
+    if (currency !== undefined && !isUsdCurrency(currency))
         return undefined;
     const registrar = result.registrarPrice;
     const block = registrar && typeof registrar === "object" ? registrar : undefined;
@@ -1067,7 +1071,7 @@ function usdFirstYearAmount(result) {
 }
 function assertMatchingUsdPrice(match, quote, expectedPriceUsd) {
     const currency = registrarCurrency(match);
-    if (currency !== undefined && currency !== "USD") {
+    if (currency !== undefined && !isUsdCurrency(currency)) {
         const shown = quote.firstYear
             ? `The registrar's first-year price is ${quote.firstYear}, not US dollars.`
             : "The registrar's first-year price is not in US dollars.";
@@ -1362,7 +1366,7 @@ async function renewAction(domainArg, autoRenew, options) {
     const cents = detail.renewalPriceCents;
     const currency = detail.currency;
     const amount = moneyFromCents(cents, currency);
-    if (typeof cents !== "number" || !Number.isSafeInteger(cents) || cents < 0 || currency !== "USD" || !amount || !terms) {
+    if (typeof cents !== "number" || !Number.isSafeInteger(cents) || cents < 0 || !isUsdCurrency(currency) || !amount || !terms) {
         throw new DeployDomainsError("Could not load complete USD renewal terms. Nothing was changed. Try again later.", "RENEWAL_TERMS_UNAVAILABLE");
     }
     const nextRenewal = detail.nextRenewalAt ?? detail.expiresAt;

package/dist/commands/library-remove.js

@@ -44,6 +44,7 @@ import * as readline from "node:readline";
 import chalk from "chalk";
 import { isCloudPlaceholderName, parseCloudPlaceholder } from "@indigoai-us/hq-cloud";
 import { OFFLOAD_PREFIX, PLACEHOLDER_SUFFIX, digestFile, resolvePlaceholder } from "./storage-offload.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 /** A company library blob key: `.hq-offload/blobs/<64 lowercase hex>`. */
 const BLOB_KEY_PATTERN = /^\.hq-offload\/blobs\/([0-9a-f]{64})$/;
 /** hq-pro caps an asset search at 50 hits. */
@@ -637,7 +638,7 @@ export function registerLibraryRemoveCommand(library) {
                 import("../utils/manifest.js"),
             ]);
             const credential = await resolveVaultCredentialForCapability("files:write", "library rm", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const apiKey = credential.kind === "api-key";

package/dist/commands/library.js

@@ -41,6 +41,7 @@ import { defaultLibraryIo, resolveLibrarySyncScope, runLibraryAdd, runLibraryTag
 import { captionAddedAsset, extractCaptionFrames, runLibraryDescribe, runLocalClaude } from "./library-caption.js";
 import { LIBRARY_LINK_DEFAULT_MINUTES, LIBRARY_LINK_MAX_MINUTES, runLibraryLink } from "./library-link.js";
 import { registerLibraryRemoveCommand } from "./library-remove.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 /** Mirrors hq-pro's MAX_ASSET_SEARCH_TAGS / tag length bound. */
 export const MAX_LIBRARY_SEARCH_TAGS = 20;
 const MAX_TAG_LENGTH = 100;
@@ -445,7 +446,7 @@ export function registerLibraryCommand(program) {
             };
             const result = await runLibrarySearch(queryParts.join(" "), searchOptions, {
                 getToken: async () => (await resolveVaultCredentialForCapability("search:query", "library search", {
-                    interactive: true,
+                    interactive: gatedInteractiveLogin(),
                 })).token,
                 post: (token, body) => vaultApiFetch({ token, path: "/v1/search", method: "POST", body }),
                 searchLocal: (query, opts) => searchLocalAssets(query, opts, defaultLocalEnv()),
@@ -476,7 +477,7 @@ export function registerLibraryCommand(program) {
         .action(async (sources, options) => {
         try {
             const credential = await resolveVaultCredentialForCapability("files:write", "library add", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const hqRoot = findHqRoot();
@@ -561,7 +562,7 @@ export function registerLibraryCommand(program) {
         .action(async (target, options) => {
         try {
             const credential = await resolveVaultCredentialForCapability("files:read", "library describe", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const hqRoot = findHqRoot();
@@ -618,7 +619,7 @@ export function registerLibraryCommand(program) {
         .action(async (target, options) => {
         try {
             const credential = await resolveVaultCredentialForCapability("files:read", "library link", {
-                interactive: true,
+                interactive: gatedInteractiveLogin(),
             });
             const { token } = credential;
             const result = await runLibraryLink(target, { company: options.company, expiresMinutes: options.expires }, {

package/dist/commands/mesh.d.ts

@@ -1,10 +1,3 @@
-/**
- * `hq mesh` — work-mesh verbs for agents and local sessions.
- *
- * Native hq-cli: Cognito + hq-pro REST + ~/.hq/work-mesh/cache. Does not
- * require hq-pack-work-mesh on disk and does not start MQTT listen.
- * Distinct from `hq doctor` (hook guardrails).
- */
 import { Command } from "commander";
 import { type MeshCompany, type MeshProjectRepo, type MeshProjectStoryInput, type MeshThread } from "../lib/mesh/api.js";
 import { UnknownProjectStoryStateError } from "../lib/mesh/story-status.js";

package/dist/commands/mesh.js

@@ -1,3 +1,4 @@
+import { reportingRuntimeAllowed } from "../lib/mesh/live/reporting-privacy.js";
 /**
  * `hq mesh` — work-mesh verbs for agents and local sessions.
  *
@@ -1123,6 +1124,7 @@ async function runPrdSync(opts) {
     }));
     const poster = createEmitPoster({ token, baseUrl: resolveVaultApiBase(process.env) });
     const emitted = await emitEvents({
+        reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()),
         workMeshRoot: meshRoot,
         poster,
         newEvents: events,
@@ -2534,6 +2536,7 @@ async function runSessionEnqueue(cliKind, opts) {
         baseUrl: resolveVaultApiBase(process.env),
     });
     const summary = await emitEvents({
+        reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()),
         workMeshRoot: meshRoot,
         poster,
         newEvents: [event],
@@ -2617,7 +2620,7 @@ async function runMeshEmit(opts) {
         skipped = backlog.skipped;
         newEvents = backlog.events;
     }
-    const summary = await emitEvents({ workMeshRoot: meshRoot, poster, newEvents });
+    const summary = await emitEvents({ reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()), workMeshRoot: meshRoot, poster, newEvents });
     const out = {
         ok: true,
         action: "emit",
@@ -2643,6 +2646,7 @@ async function runSessionFlush(opts) {
         baseUrl: resolveVaultApiBase(process.env),
     });
     const summary = await flushSessionEvents({
+        reportingAllowed: () => reportingRuntimeAllowed(isMachineIdentity()),
         workMeshRoot: workMeshHomeRoot(),
         workContextRoot: workContextHomeRoot(),
         poster,

package/dist/commands/sync-held.js

@@ -19,6 +19,7 @@ import { VaultClient, PERSONAL_VAULT_JOURNAL_SLUG, getStateDir } from "@indigoai
 import { buildVaultConfig, cognitoSubjectFromToken, ensureCognitoToken } from "../utils/cognito-session.js";
 import { decodeJwtPayload } from "../utils/person-token-cache.js";
 import { resolveCanonicalPersonUid } from "./cloud.js";
+import { gatedInteractiveLogin } from "../utils/interactive-caller.js";
 export const HELD_UNAVAILABLE_MESSAGE = "this HQ build cannot list or release held uploads yet; update HQ and try again";
 export function fenceExports(mod = hqCloud) {
     const list = mod.listPushIdentityFences;
@@ -157,11 +158,10 @@ export async function resolveHeldIdentity(options, io) {
     return { sub, personalUid };
 }
 export function createDefaultSyncHeldDeps() {
-    const tty = process.stdin.isTTY === true && process.stdout.isTTY === true;
     return {
         exports: fenceExports(),
         stateDir: getStateDir(),
-        identity: (options) => resolveHeldIdentity({ needPersonal: options.needPersonal, interactive: options.interactive && tty }, {
+        identity: (options) => resolveHeldIdentity({ needPersonal: options.needPersonal, interactive: gatedInteractiveLogin(options.interactive) }, {
             ensureToken: (interactive) => ensureCognitoToken({ interactive }),
             listPersons: async (token) => (await new VaultClient(buildVaultConfig(token)).entity.listByType("person")),
         }),

package/dist/lib/bot/api.d.ts

@@ -243,6 +243,14 @@ export declare class BotApi {
         createdAt?: string;
         state?: string;
     }>;
+    /**
+     * POST /v1/agents/{agentUid}/failure-reports, as the bot. The same route
+     * the HQ Fleet Runtime's HQ DM adapter files a failed turn through; the
+     * payload mirrors its `build_upload`. Returns the id HQ stored it under.
+     */
+    reportFailure(agentUid: string, report: Record<string, unknown>): Promise<{
+        reportId: string | null;
+    }>;
     /** POST|DELETE /v1/notify/reactions on a DM message (best-effort thinking status). */
     setReaction(input: {
         peerUid: string;

package/dist/lib/bot/api.js

@@ -163,6 +163,15 @@ export class BotApi {
         const { body } = await this.call("/v1/notify/dm", { method: "POST", body: payload });
         return body;
     }
+    /**
+     * POST /v1/agents/{agentUid}/failure-reports, as the bot. The same route
+     * the HQ Fleet Runtime's HQ DM adapter files a failed turn through; the
+     * payload mirrors its `build_upload`. Returns the id HQ stored it under.
+     */
+    async reportFailure(agentUid, report) {
+        const { body } = await this.call(`/v1/agents/${encodeURIComponent(agentUid)}/failure-reports`, { method: "POST", body: report });
+        return { reportId: typeof body?.reportId === "string" && body.reportId.trim() ? body.reportId.trim() : null };
+    }
     /** POST|DELETE /v1/notify/reactions on a DM message (best-effort thinking status). */
     async setReaction(input, present) {
         try {

package/dist/lib/bot/fleet-download.d.ts

@@ -0,0 +1,27 @@
+/** A download that receives no bytes for this long is treated as stalled and retried. */
+export declare const FLEET_DOWNLOAD_STALL_MS = 90000;
+/** How many times a stalled or broken download is resumed before giving up. */
+export declare const FLEET_DOWNLOAD_MAX_RESUMES = 5;
+export interface FleetDownloadProgress {
+    name: string;
+    received: number;
+    total: number | null;
+}
+export interface FleetDownloadOptions {
+    fetch?: typeof fetch;
+    headers?: Record<string, string>;
+    stallMs?: number;
+    maxResumes?: number;
+    onProgress?: (progress: FleetDownloadProgress) => void;
+}
+/**
+ * Download `url` into `destination`, writing through `<destination>.part` and
+ * resuming from the bytes already there. Every attempt that receives nothing
+ * for `stallMs` is retried from where it stopped, up to `maxResumes` times.
+ * The file is renamed into place only when the body ended cleanly and, when
+ * the server told us its size, the sizes match.
+ */
+export declare function downloadFleetFile(url: string, destination: string, options?: FleetDownloadOptions): Promise<string>;
+/** sha256 of a file on disk, streamed. */
+export declare function fileSha256(file: string): string;
+//# sourceMappingURL=fleet-download.d.ts.map