@indigoai-us/hq-cli 5.345.85 → 5.345.87

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+## [5.345.87] — 2026-10-11
+- `hq bot create setup` no longer fails when HQ's assistant is already on this
+  computer. It answers `ok` with `outcome` `existing`, `adopted` or `created`,
+  and applies `--display-name`, `--intro` and `--kickoff` when it brings the
+  assistant back from HQ (the intro and kickoff are kept on this computer;
+  only the name is saved in HQ). The name goes through the new name route, or
+  stays on this computer when the server does not have that route yet.
+  `create`, `adopt`, `restore`, `rm` and `set` now take a per-bot lock, so two
+  of them for the same bot run one after the other instead of racing (a lock
+  left by a crashed command is reclaimed). `hq bot list`, `list --remote` and
+  `restore` report each bot's `displayName` (never its handle) and `role`
+  (`assistant` for HQ's setup assistant).
+- New `hq bot set <name> --display-name <name> [--json]` renames a bot. The
+  name is saved in HQ (the bot's name, profile and saved settings together),
+  then on this computer, and a running bot restarts so it introduces itself by
+  the new name. A stopped bot stays stopped. When the server does not have the
+  name route yet, the name is kept on this computer (`nameSaved: "local-only"`);
+  if HQ refuses the name, nothing changes.
+- `hq storage offload` no longer repeats "Nothing was uploaded or changed." when linked worktrees still use every old file version.
+- A refused `hq storage prune --json` now includes a plain `message` in `local`, the same as offload's refusal. Existing fields are unchanged.
+- A dry run of `hq storage prune` or `hq storage offload` that predicts a refusal now exits 0 instead of 4 or 5. The JSON still reports `refused` and `message`, and an offload dry run also reports `history.would_refuse` (`code`, `message`, `holders`), which is `null` when a real run would go ahead. A real run that refuses still exits 4 (nothing to free) or 5 (precondition).
+
+## [5.345.86] — 2026-10-11
+- New `hq scan secrets`: an offline secret scanner for the pre-commit gate. It
+  checks the staged changes (or given files) against the gitleaks default rule
+  set, vendored from gitleaks v8.30.1 under its MIT license, plus HQ's own
+  token patterns. It needs no network, account or API quota, and reports the
+  rule, file and line without printing the value. Exit codes: 0 clean, 1
+  possible secret, 2 the scan could not run.
+
 ## [5.345.85] — 2026-10-11
 - Session-start orphan reports and reap leases are keyed by HQ root, report ended-session waiting lanes, and surface the latest completed orphan count in startup context even after a skipped sweep. `hq lanes reap --legacy` also identifies abandoned legacy conduct pool loops and only stops verified process identities when `--stop --reason` is supplied.
 

package/dist/command-catalog.generated.d.ts

@@ -5375,6 +5375,43 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly subcommands: readonly [];
     }];
+}, {
+    readonly name: "scan";
+    readonly description: "Local, offline scanners";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly helpOption: true;
+    readonly helpCommand: true;
+    readonly usage: "[options] [command]";
+    readonly helpText: readonly [];
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "secrets";
+        readonly description: "Scan staged changes (or files) for secrets; exits 1 on a finding";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] [files...]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "files";
+            readonly required: false;
+            readonly variadic: true;
+            readonly description: "Scan these files instead of the staged changes";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--staged";
+            readonly description: "Scan the staged changes (default when no files are given)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print findings as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }];
 }, {
     readonly name: "reindex";
     readonly description: "Surface namespaced skills, materialize legacy knowledge repos, regenerate the workers registry, and trust HQ hooks for Codex, Grok, and Claude Code";
@@ -15784,7 +15821,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "set";
-        readonly description: "Change the model and thinking level a bot uses (applies from its next message)";
+        readonly description: "Change the model and thinking level a bot uses (applies from its next message), or the name people see for it (saved in HQ; a running bot restarts to use it)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -15801,6 +15838,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--model <model>";
             readonly description: "Model id for the runtime CLI, or default for the CLI's own default";
             readonly hidden: false;
+        }, {
+            readonly flags: "--display-name <name>";
+            readonly description: "The name people see for the bot in HQ (up to 35 chars). The handle stays <name>";
+            readonly hidden: false;
         }, {
             readonly flags: "--effort <level>";
             readonly description: "Thinking level (claude low|medium|high|xhigh|max; codex minimal|low|medium|high|xhigh; grok low|medium|high|xhigh), or default (medium)";

package/dist/command-catalog.generated.js

@@ -6535,6 +6535,51 @@ export const COMMAND_CATALOG = [
             }
         ]
     },
+    {
+        "name": "scan",
+        "description": "Local, offline scanners",
+        "aliases": [],
+        "hidden": false,
+        "helpOption": true,
+        "helpCommand": true,
+        "usage": "[options] [command]",
+        "helpText": [],
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "secrets",
+                "description": "Scan staged changes (or files) for secrets; exits 1 on a finding",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] [files...]",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "files",
+                        "required": false,
+                        "variadic": true,
+                        "description": "Scan these files instead of the staged changes"
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--staged",
+                        "description": "Scan the staged changes (default when no files are given)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print findings as JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            }
+        ]
+    },
     {
         "name": "reindex",
         "description": "Surface namespaced skills, materialize legacy knowledge repos, regenerate the workers registry, and trust HQ hooks for Codex, Grok, and Claude Code",
@@ -19221,7 +19266,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "set",
-                "description": "Change the model and thinking level a bot uses (applies from its next message)",
+                "description": "Change the model and thinking level a bot uses (applies from its next message), or the name people see for it (saved in HQ; a running bot restarts to use it)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -19242,6 +19287,11 @@ export const COMMAND_CATALOG = [
                         "description": "Model id for the runtime CLI, or default for the CLI's own default",
                         "hidden": false
                     },
+                    {
+                        "flags": "--display-name <name>",
+                        "description": "The name people see for the bot in HQ (up to 35 chars). The handle stays <name>",
+                        "hidden": false
+                    },
                     {
                         "flags": "--effort <level>",
                         "description": "Thinking level (claude low|medium|high|xhigh|max; codex minimal|low|medium|high|xhigh; grok low|medium|high|xhigh), or default (medium)",

package/dist/command-registration-plan.d.ts

@@ -358,6 +358,12 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/import-scan.js";
     readonly exportName: "registerImportCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "scan";
+    readonly parent: "program";
+    readonly module: "./commands/scan.js";
+    readonly exportName: "registerScanCommand";
 }, {
     readonly type: "registrar";
     readonly root: "reindex";

package/dist/command-registration-plan.js

@@ -62,6 +62,7 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "signals", parent: "program", module: "./commands/signals.js", exportName: "registerSignalsCommand" },
     { type: "registrar", root: "integrations", parent: "program", module: "./commands/integrations.js", exportName: "registerIntegrationsCommand" },
     { type: "registrar", root: "import", parent: "program", module: "./commands/import-scan.js", exportName: "registerImportCommand" },
+    { type: "registrar", root: "scan", parent: "program", module: "./commands/scan.js", exportName: "registerScanCommand" },
     { type: "registrar", root: "reindex", parent: "program", module: "./commands/reindex.js", exportName: "registerReindexCommand" },
     { type: "registrar", root: "rescue", parent: "program", module: "./commands/rescue.js", exportName: "registerRescueCommand" },
     { type: "registrar", root: "mcp", parent: "program", module: "./commands/mcp-status.js", exportName: "registerMcpCommand" },

package/dist/commands/bot.d.ts

@@ -1,7 +1,7 @@
 import { Command } from "commander";
 import { type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
 import { probeBotRuntime, type RuntimeProbeResult } from "../lib/bot/probe.js";
-import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type BotConfig, type BotRuntimeId, type LaunchctlExec } from "../lib/bot/index.js";
+import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type BotConfig, type BotRuntimeId, type LaunchctlExec, type BotRole } from "../lib/bot/index.js";
 /** Real launchctl; every failure is a non-ok result, never a throw. */
 export declare const defaultLaunchctl: LaunchctlExec;
 /** The desktop app creates HQ's setup bot under this name, always from the `setup` worker. */
@@ -61,7 +61,13 @@ export interface BotRow {
     memory: BotMemoryMode;
     /** Absolute memory folder. */
     memoryDir: string;
+    /**
+     * The name people see: the cloud's name when HQ could be asked, else the
+     * copy in bot.json. Never the handle or slug; absent when there is no name.
+     */
     displayName?: string;
+    /** "assistant" for HQ's setup assistant, null for every other bot. */
+    role: BotRole;
     intro?: string;
     kickoff?: string;
 }
@@ -101,7 +107,7 @@ export declare function resolveCreateKind(opts: {
     kind: BotKind;
     companies: string[];
 };
-export declare function runBotCreate(nameArg: string, opts: {
+export interface BotCreateOptions {
     runtime?: string;
     model?: string;
     effort?: string;
@@ -116,7 +122,19 @@ export declare function runBotCreate(nameArg: string, opts: {
     memory?: string;
     kind?: string;
     company?: string[];
-}): Promise<void>;
+}
+/**
+ * Which way `hq bot create` went. For HQ's setup assistant all three are a
+ * success: "existing" (already set up here), "adopted" (brought back from the
+ * cloud), "created" (new). Any other bot that already exists here still fails.
+ */
+export type BotCreateOutcome = "existing" | "adopted" | "created";
+/**
+ * `hq bot create`. Runs under the bot's lock, so a create racing an adopt,
+ * restore, rm or set of the same bot waits for it instead of tripping over
+ * its half-written folder.
+ */
+export declare function runBotCreate(nameArg: string, opts: BotCreateOptions): Promise<void>;
 export declare function runBotCompanies(nameArg: string, opts: {
     add?: string[];
     remove?: string[];
@@ -126,15 +144,27 @@ export declare function runBotWorkers(opts: {
     json?: boolean;
 }): Promise<void>;
 /**
- * `hq bot set <name> --model <id|default> --effort <level|default>`: change
- * what the bot thinks with. bot.json is re-read on every turn, so the next
- * message uses it; no restart.
+ * `hq bot set <name> [--model <id|default>] [--effort <level|default>]
+ * [--display-name <name>]`: change what the bot thinks with, or the name
+ * people see.
+ *
+ * Model and thinking level live in bot.json, which is re-read on every turn,
+ * so the next message uses them; no restart.
+ *
+ * A name is written to HQ first (PUT /v1/agents/{uid}/display-name: entity
+ * name, profile and saved settings together), then to bot.json. A running bot
+ * builds its system prompt once at start, so it is restarted to pick the name
+ * up; a stopped bot is left stopped. A server without the name route yet keeps
+ * the name on this computer only (`nameSaved: "local-only"`); any other refusal
+ * from HQ changes nothing and fails.
  */
-export declare function runBotSet(nameArg: string, opts: {
+export interface BotSetOptions {
     model?: string;
     effort?: string;
+    displayName?: string;
     json?: boolean;
-}): Promise<void>;
+}
+export declare function runBotSet(nameArg: string, opts: BotSetOptions): Promise<void>;
 /** `hq bot probe`: exit code 0 when the runtime answered, 1 when it did not. */
 export declare function runBotProbe(opts: {
     runtime?: string;
@@ -219,16 +249,22 @@ export declare function configFromLocalConfig(input: {
     hqRoot: string;
     dir: string;
     local: BotLocalConfig | null;
-    overrides?: {
-        runtime?: BotRuntimeId;
-        model?: string;
-    };
+    overrides?: BotAdoptOverrides;
     preserveFirstStart?: boolean;
     now?: () => Date;
 }): {
     config: BotConfig;
     notes: string[];
 };
+/** What an adopt may set over the settings the cloud kept for the bot. */
+export interface BotAdoptOverrides {
+    runtime?: BotRuntimeId;
+    model?: string;
+    /** The name for this start (create's --display-name), over yesterday's saved one. */
+    displayName?: string;
+    intro?: string;
+    kickoff?: string;
+}
 export interface BotAdoptResult {
     name: string;
     agentUid: string;
@@ -241,6 +277,10 @@ export interface BotAdoptResult {
     memoryDir: string;
     /** True when the cloud had no saved settings and defaults were used. */
     defaulted: boolean;
+    /** The name people see, from the saved settings (or this start's override); null when it has none. */
+    displayName: string | null;
+    /** "assistant" for HQ's setup assistant, else null. */
+    role: BotRole;
     notes: string[];
     daemon: string | null;
 }
@@ -259,6 +299,10 @@ export interface BotRestoreRow {
     detail: string;
     /** Present only on a bot skipped because this computer cannot run it. */
     reason?: BotNotRunnableReason;
+    /** The name people see (the cloud's), never the handle or slug; null when it has none. */
+    displayName: string | null;
+    /** "assistant" for HQ's setup assistant, else null. */
+    role: BotRole;
 }
 /**
  * `hq bot restore` — every local bot this account owns that is not set up on
@@ -285,6 +329,10 @@ export interface RemoteBotRow {
     runnable: boolean;
     /** Why not, when `runnable` is false: the same vocabulary adopt and restore use. */
     reason: BotNotRunnableReason | null;
+    /** The name people see (the cloud's), never the handle or slug; null when it has none. */
+    displayName: string | null;
+    /** "assistant" for HQ's setup assistant, else null. */
+    role: BotRole;
 }
 export declare function registerBotCommand(program: Command): void;
 //# sourceMappingURL=bot.d.ts.map