@indigoai-us/hq-cli 5.345.75 → 5.345.77

package/CHANGELOG.md

@@ -2,6 +2,54 @@
 
 ## [Unreleased]
 
+## [5.345.77] — 2026-10-10
+- Local bots no longer fail a turn when the installed Codex is too old for the
+  model it was asked to use (often the model a newer Codex app set in your own
+  Codex settings). The bot runs the same turn once more on a model your Codex
+  supports and notes it in `hq bot status`.
+- A bot whose coding tool fails now tells you in plain words what is wrong and
+  the one thing to do (sign in, update, choose another model, or try again),
+  never the tool's raw error, and never blames the sign-in unless it is the
+  sign-in. The DM also carries a repair card for the HQ desktop app.
+- After five model failures in ten minutes a local bot now says it is pausing,
+  holds its turns for ten minutes, and then answers the next message, instead
+  of exiting and staying down until `hq bot start`. A good turn clears the
+  recorded failure from `hq bot status`, which now shows a hold and a plain
+  problem line instead of the raw error.
+- Bots created before this release: one that is still running restarts itself
+  onto the new hq-cli within a few minutes of the install and heals on its
+  first message. One that already exited after five failures on the old
+  release is brought back only by a login or reboot, the desktop's Start, or
+  `hq bot start`; after that it heals the same way.
+- New `hq bot set-model <name> <model|default>` sets a bot's own model without
+  touching the coding tool's settings.
+- New `hq bot probe (--runtime <runtime> | --bot <name>) [--model <model>]
+  --json` runs one tiny test turn exactly as a bot would, in an empty scratch
+  folder, and reports `{ ok, class, detail }`.
+- Added `hq members remove <email>` to end an active membership and drop that
+  person's file and secret grants. `hq members revoke` still only cancels
+  pending invites. Guests stay active members, so company-wide grants (`@all` /
+  Everyone in company) still apply to them; demoting to guest does not lock
+  someone out. `hq access <path> --as <email>` now accepts an email and shows
+  that person's effective access.
+
+## [5.345.76] — 2026-10-10
+
+- `hq bot` on macOS now finds the Codex CLI bundled in the ChatGPT or Codex
+  desktop app when `codex` is not on PATH, so a Mac with only the desktop app
+  can run a Codex assistant. PATH still wins.
+
+- `hq bot create --display-name` now accepts numbers after the first letter,
+  so names like "R2D2" or "StefanTest123" work.
+- Core delegate native commands now use the default-on kill-switch behavior when the flag snapshot or company context is unavailable. An explicit `core-native-delegate=false` override still selects the bundled shell.
+- `hq core rebuild-index companies` now renders the same company INDEX.md on every machine and every day, and skips the write
+  when the content is unchanged (logged as `unchanged`). The header line is now `> Auto-generated.` with no date. The `repos/`
+  and `data/` rows show fixed labels instead of local counts, `knowledge/` always shows a subdirectory count, symlinked
+  children are no longer counted, and project status comes from prd.json only, not local orchestrator state.
+- `hq lanes monitor-check` now recognizes a live `hq lanes watch` Monitor process when the hq
+  CLI is installed under a path containing spaces (for example the desktop toolchain under
+  `~/Library/Application Support/Indigo HQ/`). Previously those lanes stayed "uncovered" and the
+  Stop hook kept blocking the session.
 ## [5.345.75] — 2026-10-10
 
 - Native delegate manifest updates now use mode 0600 on POSIX, matching the

package/assets/scaffold/core/scripts/rebuild-companies-index.sh

@@ -2,11 +2,16 @@
 # rebuild-companies-index.sh — regenerate companies/{co}/INDEX.md for each company.
 #
 # Pure bash + jq. Zero Claude context. Iterates companies/*/ (skips _template,
-# dotfiles), summarizes top-level dirs, scans projects/*/prd.json and
-# workspace/orchestrator/{name}/state.json to populate the Projects table.
+# dotfiles), summarizes top-level dirs, scans projects/*/prd.json to populate
+# the Projects table.
+#
+# Output is deterministic: the same synced tree renders the same bytes on every
+# machine and every day. There is no date line, nothing reads local-only state
+# (repos/, data/, an embedded knowledge .git, workspace/orchestrator), and an
+# unchanged file is not rewritten.
 #
 # Schema per knowledge/public/hq-core/index-md-spec.md (Company Root variant):
-#   - "# {Company Title}" + "> Auto-generated. Updated: YYYY-MM-DD"
+#   - "# {Company Title}" + "> Auto-generated."
 #   - Top-level Name | Description table (dirs and 1-line desc)
 #   - "## Projects" table (Project | Status | Description)
 #   - "## Deployments" placeholder (None for now — manifest-driven enrichment deferred)
@@ -28,8 +33,6 @@ done
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 
-DATE=$(date -u +%Y-%m-%d)
-
 # Title-case a slug: "example-co" -> "Example Co"
 titleize() {
   echo "$1" | awk -F'-' '{
@@ -47,18 +50,13 @@ describe_dir() {
   [[ -d "$path" ]] || return 0
   case "$d" in
     data)
-      local n
-      n=$(find "$path" -mindepth 1 -maxdepth 1 ! -name '.*' 2>/dev/null | wc -l | tr -d ' ')
-      echo "${n} item(s)"
+      echo "Company data"
       ;;
     knowledge)
-      if [[ -e "${path}/.git" ]]; then
-        echo "Embedded git repo"
-      else
-        local n
-        n=$(find "$path" -mindepth 1 -maxdepth 1 -type d ! -name '.*' 2>/dev/null | wc -l | tr -d ' ')
-        echo "Inline knowledge (${n} subdirs)"
-      fi
+      local n
+      # Trailing slash: a symlinked knowledge/ is listed through its target.
+      n=$(find "${path}/" -mindepth 1 -maxdepth 1 -type d ! -name '.*' 2>/dev/null | wc -l | tr -d ' ')
+      echo "Company knowledge (${n} subdirs)"
       ;;
     settings)
       local n
@@ -81,9 +79,7 @@ describe_dir() {
       echo "${n} worker(s)"
       ;;
     repos)
-      local n
-      n=$(find "$path" -mindepth 1 -maxdepth 1 \( -type d -o -type l \) ! -name '.*' 2>/dev/null | wc -l | tr -d ' ')
-      echo "${n} repo link(s)"
+      echo "Local repo links (not synced)"
       ;;
     registry)
       local n
@@ -101,22 +97,10 @@ describe_dir() {
   esac
 }
 
-# Resolve project status: orchestrator state.json wins, else story-pass fallback.
+# Resolve project status from prd.json alone (story-pass check). The local
+# workspace/orchestrator state is not synced, so it is not consulted.
 project_status() {
-  local project="$1"
-  local prd="$2"
-  local state="workspace/orchestrator/${project}/state.json"
-  if [[ -f "$state" ]]; then
-    local raw
-    raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
-    case "$raw" in
-      completed|complete) echo "complete" ;;
-      in_progress|active|started) echo "active" ;;
-      archived) echo "archived" ;;
-      *) echo "$raw" ;;
-    esac
-    return
-  fi
+  local prd="$1"
   if [[ -f "$prd" ]]; then
     local total passes
     total=$(jq '[.userStories[]?] | length' "$prd" 2>/dev/null || echo 0)
@@ -148,6 +132,7 @@ trunc() {
 write_company_index() {
   local co="$1"
   local out="companies/${co}/INDEX.md"
+  local tmp="companies/${co}/.INDEX.md.$$.tmp"
   local title
   title=$(titleize "$co")
 
@@ -155,7 +140,7 @@ write_company_index() {
   {
     echo "# ${title}"
     echo ""
-    echo "> Auto-generated. Updated: ${DATE}"
+    echo "> Auto-generated."
     echo ""
     echo "| Name | Description |"
     echo "|------|-------------|"
@@ -187,7 +172,7 @@ write_company_index() {
           desc=$(jq -r '.description // ""' "$prd" 2>/dev/null || echo "")
         fi
         local status
-        status=$(project_status "$name" "$prd")
+        status=$(project_status "$prd")
         desc=$(sanitize_cell "$desc")
         desc=$(trunc "$desc" 110)
         [[ -z "$desc" ]] && desc="—"
@@ -201,9 +186,17 @@ write_company_index() {
     echo "## Deployments"
     echo ""
     echo "_See \`companies/manifest.yaml\` for deployment targets._"
-  } > "$out"
+  } > "$tmp"
 
-  echo "rebuild-companies-index: wrote ${out}" >&2
+  # Rewrite only when the content changed, so an unchanged index keeps its
+  # mtime and is not re-uploaded by HQ Sync.
+  if [[ -f "$out" ]] && cmp -s "$tmp" "$out"; then
+    rm -f "$tmp"
+    echo "rebuild-companies-index: unchanged ${out}" >&2
+  else
+    mv -f "$tmp" "$out"
+    echo "rebuild-companies-index: wrote ${out}" >&2
+  fi
 }
 
 COUNT=0

package/dist/command-catalog.generated.d.ts

@@ -2880,8 +2880,8 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly description: "Company slug";
         readonly hidden: false;
     }, {
-        readonly flags: "--as <person-uid>";
-        readonly description: "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)";
+        readonly flags: "--as <person>";
+        readonly description: "Check a person's access (email, prs_, or agt_ uid; self or owner/admin)";
         readonly hidden: false;
     }, {
         readonly flags: "--json";
@@ -3164,9 +3164,26 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "remove";
+        readonly description: "Remove an active member. Ends membership so company-wide grants no longer apply, and drops that person's file and secret grants. Accepts an email, prs_ personUid, agt_ agentUid, or full membership key.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <target>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "target";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "revoke";
-        readonly description: "Revoke a pending invite. Accepts an email, personUid, full membershipKey, or legacy inviteToken.";
+        readonly description: "Revoke a pending invite. For an active member, use `hq members remove` instead. Accepts an email, personUid, full membershipKey, or legacy inviteToken.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -15644,6 +15661,69 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "set-model";
+        readonly description: "Set the model this bot asks its runtime for (stored in the bot's own settings; the runtime's own config is never changed), or default to clear it";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <name> <model>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "name";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }, {
+            readonly name: "model";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "probe";
+        readonly description: "Run one minimal test turn with a runtime, model and thinking level exactly as a bot would, and say whether a bot set up that way can answer. Costs one tiny model turn on your own login; runs in an empty scratch folder, so no HQ settings or hooks load";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--runtime <runtime>";
+            readonly description: "Model CLI to check: claude|codex|grok (required unless --bot is given)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--bot <name>";
+            readonly description: "Check with this bot's saved runtime, model and thinking level (--runtime/--model/--effort override them)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--model <model>";
+            readonly description: "Model id to check, or default for the runtime's own default";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--effort <level>";
+            readonly description: "Thinking level to check";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--timeout <seconds>";
+            readonly description: "Give up after this many seconds";
+            readonly hidden: false;
+            readonly defaultValue: "120";
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print { ok, class, detail, ... } as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "intro";
         readonly description: "Have the bot re-send its introduction DM to you";

package/dist/command-catalog.generated.js

@@ -3473,8 +3473,8 @@ export const COMMAND_CATALOG = [
                 "hidden": false
             },
             {
-                "flags": "--as <person-uid>",
-                "description": "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)",
+                "flags": "--as <person>",
+                "description": "Check a person's access (email, prs_, or agt_ uid; self or owner/admin)",
                 "hidden": false
             },
             {
@@ -3825,9 +3825,29 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "remove",
+                "description": "Remove an active member. Ends membership so company-wide grants no longer apply, and drops that person's file and secret grants. Accepts an email, prs_ personUid, agt_ agentUid, or full membership key.",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <target>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "target",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "revoke",
-                "description": "Revoke a pending invite. Accepts an email, personUid, full membershipKey, or legacy inviteToken.",
+                "description": "Revoke a pending invite. For an active member, use `hq members remove` instead. Accepts an email, personUid, full membershipKey, or legacy inviteToken.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -19052,6 +19072,83 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "set-model",
+                "description": "Set the model this bot asks its runtime for (stored in the bot's own settings; the runtime's own config is never changed), or default to clear it",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <name> <model>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "name",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    },
+                    {
+                        "name": "model",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "probe",
+                "description": "Run one minimal test turn with a runtime, model and thinking level exactly as a bot would, and say whether a bot set up that way can answer. Costs one tiny model turn on your own login; runs in an empty scratch folder, so no HQ settings or hooks load",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--runtime <runtime>",
+                        "description": "Model CLI to check: claude|codex|grok (required unless --bot is given)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--bot <name>",
+                        "description": "Check with this bot's saved runtime, model and thinking level (--runtime/--model/--effort override them)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--model <model>",
+                        "description": "Model id to check, or default for the runtime's own default",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--effort <level>",
+                        "description": "Thinking level to check",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--timeout <seconds>",
+                        "description": "Give up after this many seconds",
+                        "hidden": false,
+                        "defaultValue": "120"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print { ok, class, detail, ... } as JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "intro",
                 "description": "Have the bot re-send its introduction DM to you",

package/dist/commands/access.d.ts

@@ -158,6 +158,7 @@ export declare function resolveAccessCompany(target: string, opts?: {
     company?: string;
     hqRoot?: string;
 }): string | undefined;
+export declare function resolveAccessAsPersonUid(token: string, companyUid: string, person: string): Promise<string>;
 export declare function runAccessForPerson(rawPath: string, personUid: string, opts?: {
     company?: string;
     hqRoot?: string;

package/dist/commands/access.js

@@ -641,7 +641,7 @@ export function registerAccessCommand(program) {
         .command("access <path-or-query>")
         .description("Tell whether a vault file exists and whether you can read it. Never a bare not-found. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.")
         .option("--company <slug>", "Company slug")
-        .option("--as <person-uid>", "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)")
+        .option("--as <person>", "Check a person's access (email, prs_, or agt_ uid; self or owner/admin)")
         .option("--json", "Print a single JSON object")
         .option("--no-fix", "Diagnose only: do not fetch, pin, or repair sync")
         .option("--yes", "Answer the one send-confirmation yes (hosts must pass this explicitly)")
@@ -680,11 +680,22 @@ export function resolveAccessCompany(target, opts) {
     const hqRoot = opts?.hqRoot ?? DEFAULT_HQ_ROOT;
     return opts?.company ?? slugFromTarget(target) ?? readActiveCompany(hqRoot);
 }
+export async function resolveAccessAsPersonUid(token, companyUid, person) {
+    const trimmed = person.trim();
+    if (/^(?:prs|agt)_[A-Za-z0-9_-]+$/.test(trimmed))
+        return trimmed;
+    const email = trimmed.toLowerCase();
+    if (!/^[^\s]+@[^\s]+$/.test(email)) {
+        throw new Error("Pass an email, or the person's exact prs_ or agt_ UID, to --as.");
+    }
+    const members = await listActiveMembers(token, companyUid);
+    const member = members.find((candidate) => candidate.personEmail?.trim().toLowerCase() === email);
+    if (member?.personUid)
+        return member.personUid;
+    throw new Error(`No active member has email '${email}' in this company. Run \`hq members list\`.`);
+}
 export async function runAccessForPerson(rawPath, personUid, opts) {
-    const uid = personUid.trim();
-    if (!/^(?:prs|agt)_[A-Za-z0-9_-]+$/.test(uid)) {
-        throw new Error("Pass the person's exact prs_ or agt_ UID to --as.");
-    }
+    const requested = personUid.trim();
     const pathSlug = slugFromTarget(rawPath);
     if (opts?.company && pathSlug && opts.company !== pathSlug) {
         throw new Error("The --company value does not match the company in the path.");
@@ -698,6 +709,7 @@ export async function runAccessForPerson(rawPath, personUid, opts) {
     }
     const { token } = await resolveBrowseSession();
     const companyUid = await getCompanyUid(token, company);
+    const uid = await resolveAccessAsPersonUid(token, companyUid, requested);
     const response = await vaultApiFetch({
         token,
         path: `/files/${encodeURIComponent(companyUid)}/members/${encodeURIComponent(uid)}/access`,

package/dist/commands/bot.d.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import { type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
+import { probeBotRuntime, type RuntimeProbeResult } from "../lib/bot/probe.js";
 import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type BotConfig, type BotRuntimeId, type LaunchctlExec } from "../lib/bot/index.js";
 /** Real launchctl; every failure is a non-ok result, never a throw. */
 export declare const defaultLaunchctl: LaunchctlExec;
@@ -134,6 +135,17 @@ export declare function runBotSet(nameArg: string, opts: {
     effort?: string;
     json?: boolean;
 }): Promise<void>;
+/** `hq bot probe`: exit code 0 when the runtime answered, 1 when it did not. */
+export declare function runBotProbe(opts: {
+    runtime?: string;
+    bot?: string;
+    model?: string;
+    effort?: string;
+    timeout?: string;
+    json?: boolean;
+}, deps?: {
+    probe?: typeof probeBotRuntime;
+}): Promise<RuntimeProbeResult>;
 /**
  * The one bot the caller means. Matches the local folder name, the cloud slug,
  * the display name, or the agt_ uid; an ambiguous name is refused rather than

package/dist/commands/bot.js

@@ -49,6 +49,8 @@ import { daemonPaths } from "../lib/daemon/paths.js";
 import { launchdLabel } from "../lib/bot/paths.js";
 import { isAncestorProcess } from "../lib/bot/self-process.js";
 import { runtimeDisplayName } from "../lib/bot/runtime-sign-in.js";
+import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
+import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
 import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, } from "../lib/bot/index.js";
 function collectRepeated(value, previous) {
     return [...previous, value];
@@ -994,8 +996,17 @@ async function runBotStatus(nameArg, opts) {
             const tool = runtimeDisplayName(status.runtimeSignIn.runtime);
             console.log(`  ${chalk.yellow(`${tool} needs to sign in again`)} — sign in from HQ, or run \`${status.runtimeSignIn.runtime} ${status.runtimeSignIn.runtime === "claude" ? "auth login" : "login"}\`, then \`hq bot restart ${name}\``);
         }
-        if (status.lastError)
-            console.log(`  last error: ${chalk.yellow(status.lastError)}`);
+        if (status.modelHold && new Date(status.modelHold.until).getTime() > Date.now()) {
+            console.log(`  ${chalk.yellow(`holding until ${status.modelHold.until}`)} after repeated model failures; the next message after that runs again`);
+        }
+        if (status.runtimeModelFallback) {
+            console.log(`  model:      ${chalk.yellow(`running on ${status.runtimeModelFallback.to}`)} because ${row.runtime} here is too old for ${status.runtimeModelFallback.from || "its configured model"}; update ${row.runtime} to use it`);
+        }
+        // The raw runtime text stays in the log (hq bot logs) and the JSON output.
+        if (status.lastError) {
+            const cls = classifyRuntimeFailure(status.lastError);
+            console.log(`  last problem: ${chalk.yellow(`${cls}: ${runtimeFailureReason(cls, row.runtime)}`)}  ${chalk.dim(`(details: hq bot logs ${name})`)}`);
+        }
     }
     console.log(chalk.dim(`  state dir:  ${dir}`));
 }
@@ -1278,6 +1289,32 @@ export async function runBotSet(nameArg, opts) {
     }
     console.log(chalk.green(`${name} now thinks with ${result.model ?? "the default model"} at ${result.effort} effort (from its next message).`));
 }
+/** `hq bot probe`: exit code 0 when the runtime answered, 1 when it did not. */
+export async function runBotProbe(opts, deps = {}) {
+    const saved = opts.bot ? requireBot(opts.bot).config : undefined;
+    const runtimeArg = opts.runtime ?? saved?.runtime;
+    if (!isBotRuntimeId(runtimeArg)) {
+        throw Object.assign(new Error(opts.runtime === undefined && !opts.bot ? `Pass --runtime <${BOT_RUNTIMES.join("|")}> or --bot <name>.` : `--runtime must be one of ${BOT_RUNTIMES.join(", ")}`), { expected: true });
+    }
+    const runtime = runtimeArg;
+    const model = opts.model !== undefined ? validateBotModel(opts.model) : saved?.model;
+    const effort = opts.effort !== undefined ? validateBotEffort(runtime, opts.effort) : saved?.effort;
+    const seconds = Number(opts.timeout ?? PROBE_DEFAULT_TIMEOUT_MS / 1000);
+    const timeoutMs = Number.isFinite(seconds) && seconds > 0 ? Math.round(seconds * 1000) : PROBE_DEFAULT_TIMEOUT_MS;
+    const result = await (deps.probe ?? probeBotRuntime)({
+        runtime,
+        ...(model ? { model } : {}),
+        ...(effort ? { effort } : {}),
+        timeoutMs,
+    });
+    if (!result.ok)
+        process.exitCode = 1;
+    if (opts.json)
+        console.log(JSON.stringify(result, null, 2));
+    else
+        console.log(result.ok ? chalk.green(result.detail) : chalk.red(result.detail));
+    return result;
+}
 async function runBotIntro(nameArg) {
     const { name, dir, config } = requireBot(nameArg);
     if (hasPromotionHold(dir))
@@ -1938,6 +1975,21 @@ export function registerBotCommand(program) {
         .option("--effort <level>", `Thinking level (claude ${BOT_EFFORT_LEVELS.claude.join("|")}; codex ${BOT_EFFORT_LEVELS.codex.join("|")}; grok ${BOT_EFFORT_LEVELS.grok.join("|")}), or default (${DEFAULT_BOT_EFFORT})`)
         .option("--json", "Print machine-readable JSON")
         .action((name, opts) => wrap(() => runBotSet(name, opts))());
+    bot
+        .command("set-model <name> <model>")
+        .description("Set the model this bot asks its runtime for (stored in the bot's own settings; the runtime's own config is never changed), or default to clear it")
+        .option("--json", "Print machine-readable JSON")
+        .action((name, model, opts) => wrap(() => runBotSet(name, { model, ...(opts.json ? { json: true } : {}) }))());
+    bot
+        .command("probe")
+        .description("Run one minimal test turn with a runtime, model and thinking level exactly as a bot would, and say whether a bot set up that way can answer. Costs one tiny model turn on your own login; runs in an empty scratch folder, so no HQ settings or hooks load")
+        .option("--runtime <runtime>", `Model CLI to check: ${BOT_RUNTIMES.join("|")} (required unless --bot is given)`)
+        .option("--bot <name>", "Check with this bot's saved runtime, model and thinking level (--runtime/--model/--effort override them)")
+        .option("--model <model>", "Model id to check, or default for the runtime's own default")
+        .option("--effort <level>", "Thinking level to check")
+        .option("--timeout <seconds>", "Give up after this many seconds", String(PROBE_DEFAULT_TIMEOUT_MS / 1000))
+        .option("--json", "Print { ok, class, detail, ... } as JSON")
+        .action((opts) => wrap(async () => { await runBotProbe(opts); })());
     bot
         .command("intro <name>")
         .description("Have the bot re-send its introduction DM to you")

package/dist/commands/core-native-family-flag.js

@@ -13,7 +13,7 @@ export async function coreNativeFamilyEnabled(flagKey) {
 export const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
 export const CORE_NATIVE_ONTOLOGY_FLAG = "core-native-ontology";
 export function coreNativeDelegateEnabled() {
-    return import("../lib/flag-registry.js").then(({ resolveProcessFlagGate }) => resolveProcessFlagGate(CORE_NATIVE_DELEGATE_FLAG, { fallback: false }, () => false));
+    return coreNativeFamilyEnabled(CORE_NATIVE_DELEGATE_FLAG);
 }
 export function coreNativeOntologyEnabled() {
     return coreNativeFamilyEnabled(CORE_NATIVE_ONTOLOGY_FLAG);

package/dist/commands/files.js

@@ -474,8 +474,9 @@ export function registerFilesCommand(program) {
             // store `granteeId === ""` on the wire, but a blank cell is confusing
             // in tabular output, so we render a human-readable phrase instead.
             function displayGrantee(e) {
-                if (e.granteeType === "company-wide")
-                    return "Everyone in company";
+                if (e.granteeType === "company-wide") {
+                    return "Everyone in company (including guests)";
+                }
                 return e.granteeId;
             }
             function printEntryTable(rows, showSource) {
@@ -531,6 +532,10 @@ export function registerFilesCommand(program) {
                 console.log("\nGranted on descendant prefixes (do not affect this prefix's access):");
                 printEntryTable(tree.children, true);
             }
+            const allEntries = [...tree.direct, ...tree.inherited, ...tree.children];
+            if (allEntries.some((entry) => entry.granteeType === "company-wide")) {
+                console.log(chalk.gray("\nCompany-wide grants apply to every active member, including guests. Demoting someone to guest does not exclude them. Use hq members remove to end membership, or hq access <path> --as <email> to see effective access."));
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));