@indigoai-us/hq-cli 5.101.5 → 5.101.7

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## [Unreleased]
+
+## [5.101.7] — 2026-08-17
+
+### Changed
+
+- **`hq outposts`** is now sourced from `@indigoai-us/hq-cloud` (≥ 6.15.5)
+  instead of being implemented in the CLI. The command surface and behavior are
+  unchanged; the control-plane client, box-side helpers, and command tree moved
+  into hq-cloud so they can also be consumed directly (including from a Next.js
+  app) via the new `@indigoai-us/hq-cloud/outposts` subpath exports. The CLI
+  keeps its own authenticated transport, so Sentry breadcrumbs, API-key routing,
+  and plan-gate handling are preserved.
+
+## [5.101.6] — 2026-08-17
+
+### Added
+
+- **`hq mesh`** — native work-mesh verbs in the CLI (Cognito + hq-pro REST +
+  `~/.hq/work-mesh/cache`). No pack helper required. Verbs: `check`
+  (`status` / `projects`), `start`, `progress`, `blocked`, `done`, `note`,
+  `story`, `doctor` (warms directory + inbox + pair DMs). Does **not** start
+  MQTT listen and is not `hq doctor` (hook guardrails). `--apply` Board PUTs
+  from local prd.json are not in the CLI yet.
+
+### Fixed
+
+- `hq mesh doctor` now keys `directory` / `inbox` / `contacts` on the real
+  `prs_*` / `agt_*` principal. `custom:entityUid` is read from the Cognito ID
+  token first; if the JWT has only email/sub (typical human access tokens),
+  doctor falls back to `/v1/realtime/credentials` and keeps only the uid —
+  AWS IoT creds are discarded. Leftover `session.json` is removed once the
+  real principal is known.
+
 ## [5.101.5] — 2026-08-17
 
 - No user-facing changes recorded.

package/dist/commands/mesh.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `hq mesh` — work-mesh verbs for agents and local sessions.
+ *
+ * Native hq-cli: Cognito + hq-pro REST + ~/.hq/work-mesh/cache. Does not
+ * require hq-pack-work-mesh on disk and does not start MQTT listen.
+ * Distinct from `hq doctor` (hook guardrails).
+ */
+import { Command } from "commander";
+import { type MeshCompany, type MeshThread } from "../lib/mesh/api.js";
+export declare function formatCheckLines(threads: MeshThread[], company: MeshCompany, projectId?: string): string[];
+export declare function registerMeshCommand(program: Command): void;
+//# sourceMappingURL=mesh.d.ts.map

package/dist/commands/mesh.js

@@ -0,0 +1,173 @@
+/**
+ * `hq mesh` — work-mesh verbs for agents and local sessions.
+ *
+ * Native hq-cli: Cognito + hq-pro REST + ~/.hq/work-mesh/cache. Does not
+ * require hq-pack-work-mesh on disk and does not start MQTT listen.
+ * Distinct from `hq doctor` (hook guardrails).
+ */
+import chalk from "chalk";
+import { loadCachedTokens } from "../utils/cognito-session.js";
+import { STORY_STATUSES, appendThreadEvent, callerLabelFromToken, ensureProjectThread, eventPayload, listActiveThreads, patchStoryStatus, requireToken, resolveMeshCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+export function formatCheckLines(threads, company, projectId) {
+    if (threads.length === 0) {
+        return ["Work mesh: no active project threads found."];
+    }
+    const scope = projectId
+        ? `${company.companySlug || company.companyUid}/${projectId}`
+        : company.companySlug || company.companyUid;
+    const lines = [`Work mesh: ${threads.length} active thread(s) for ${scope}`];
+    for (const thread of threads.slice(0, 8)) {
+        const owner = thread.ownerUid ? ` owner=${thread.ownerUid}` : "";
+        const summary = thread.progressSummary ||
+            thread.sourceSignalSummary ||
+            thread.blockedReason ||
+            "";
+        lines.push(`- ${thread.threadStatus ?? "unknown"} ${thread.threadId ?? "?"}${owner}${summary ? `: ${summary}` : ""}`);
+    }
+    return lines;
+}
+function fail(message) {
+    console.error(chalk.red(message));
+    process.exit(1);
+}
+function requireProject(opts) {
+    const project = opts.project?.trim();
+    if (!project)
+        fail("`--project <slug>` is required.");
+    return project;
+}
+async function withCompany(opts) {
+    const token = await requireToken();
+    const company = await resolveMeshCompany(token, opts.company);
+    return { token, company };
+}
+async function runCheck(opts) {
+    const { token, company } = await withCompany(opts);
+    const threads = await listActiveThreads(token, company.companyUid, opts.project);
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "check", company, projectId: opts.project, threads }, null, 2));
+        return;
+    }
+    for (const line of formatCheckLines(threads, company, opts.project)) {
+        console.log(line);
+    }
+}
+async function runEvent(verb, opts) {
+    const { token, company } = await withCompany(opts);
+    const projectId = requireProject(opts);
+    const ensured = await ensureProjectThread(token, company, projectId, {
+        threadId: opts.threadId,
+        summary: opts.summary,
+    });
+    const eventKind = verb === "start" ? "claim" : verb;
+    const event = await appendThreadEvent(token, company.companyUid, ensured.threadId, eventKind, eventPayload(eventKind, opts, callerLabelFromToken(token)));
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            action: verb,
+            eventKind,
+            company,
+            projectId,
+            threadId: ensured.threadId,
+            created: ensured.created,
+            ...event,
+        }, null, 2));
+        return;
+    }
+    console.log(`Work mesh: ${verb} ${ensured.threadId}${event.eventId ? ` (${event.eventId})` : ""}`);
+}
+async function runStory(opts) {
+    const storyId = opts.story?.trim();
+    const status = opts.status?.trim();
+    if (!storyId || !status || !STORY_STATUSES.has(status)) {
+        fail("story requires --story <id> and --status queued|in_progress|review|done");
+    }
+    const { token, company } = await withCompany(opts);
+    const projectId = requireProject(opts);
+    const patched = await patchStoryStatus(token, company.companyUid, projectId, storyId, status);
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "story", company, ...patched, storyId }, null, 2));
+        return;
+    }
+    console.log(`Work mesh: story ${storyId} → ${patched.status} (v${patched.version ?? "?"})`);
+}
+async function runDoctor(opts) {
+    if (opts.apply) {
+        fail("`hq mesh doctor --apply` (paced Board PUTs from local prd.json) is not in the CLI yet.\n" +
+            "Omit --apply to warm the conversation cache (directory, inbox, pair DMs).");
+    }
+    const token = await requireToken();
+    const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
+    const warmed = await warmMeshConversationCache(token, principalUid);
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "doctor", ...warmed }, null, 2));
+        return;
+    }
+    console.log(`Work mesh cache warmed at ${warmed.cacheRoot}` +
+        ` (directory=${warmed.directory} inbox=${warmed.inbox}` +
+        ` contacts=${warmed.contacts} pair-threads=${warmed.threads})`);
+}
+function wrap(action) {
+    return async () => {
+        try {
+            await action();
+        }
+        catch (err) {
+            fail(err instanceof Error ? err.message : String(err));
+        }
+    };
+}
+function collectRepeatable(value, previous = []) {
+    return previous.concat(value);
+}
+function addSharedFlags(cmd) {
+    return cmd
+        .option("--company <slug|uid>", "Company slug or cloud uid")
+        .option("--project <slug>", "HQ project slug / projectId")
+        .option("--thread-id <id>", "Explicit work thread id")
+        .option("--json", "Print machine-readable JSON");
+}
+export function registerMeshCommand(program) {
+    const mesh = program
+        .command("mesh")
+        .description("Work mesh — register project work, report progress, and warm ~/.hq/work-mesh/cache");
+    addSharedFlags(mesh
+        .command("check")
+        .alias("status")
+        .alias("projects")
+        .description("Show active work-mesh threads for a company/project")).action((opts) => wrap(() => runCheck(opts))());
+    addSharedFlags(mesh
+        .command("start")
+        .description("Ensure a project thread exists and claim/report start")
+        .option("--summary <text>", "What you are starting")).action((opts) => wrap(() => runEvent("start", opts))());
+    addSharedFlags(mesh
+        .command("progress")
+        .description("Append a progress event to the project thread")
+        .requiredOption("--summary <text>", "Progress summary")).action((opts) => wrap(() => runEvent("progress", opts))());
+    addSharedFlags(mesh
+        .command("blocked")
+        .description("Append a blocked event to the project thread")
+        .option("--reason <text>", "Why you are blocked")
+        .option("--ask <text>", "Repeatable ask", collectRepeatable)
+        .option("--summary <text>", "Optional summary")).action((opts) => wrap(() => runEvent("blocked", opts))());
+    addSharedFlags(mesh
+        .command("done")
+        .description("Mark the project thread done")
+        .option("--summary <text>", "What shipped")).action((opts) => wrap(() => runEvent("done", opts))());
+    addSharedFlags(mesh
+        .command("note")
+        .description("Append a note with no status change")
+        .option("--summary <text>", "Note text")).action((opts) => wrap(() => runEvent("note", opts))());
+    addSharedFlags(mesh
+        .command("story")
+        .description("PATCH one Board story status")
+        .requiredOption("--story <id>", "Story id, e.g. US-001")
+        .requiredOption("--status <status>", "queued|in_progress|review|done")).action((opts) => wrap(() => runStory(opts))());
+    mesh
+        .command("doctor")
+        .description("Warm ~/.hq/work-mesh/cache from hq-pro (directory, inbox, pair DMs). Not `hq doctor`.")
+        .option("--apply", "Reserved — Board PUTs from local prd are not in the CLI yet")
+        .option("--json", "Print machine-readable JSON")
+        .action((opts) => wrap(() => runDoctor(opts))());
+}
+//# sourceMappingURL=mesh.js.map

package/dist/commands/outposts.d.ts

@@ -1,240 +1,26 @@
 /**
- * `hq outposts` — manage your personal HQ Outposts (EC2 boxes) from the
- * terminal instead of the web console. Targets the hq-pro `/outpost/*`
- * control plane on `DEFAULT_VAULT_API_URL` via the shared `vaultApiFetch`
- * helper — the same routes the console's outpost panel calls.
+ * `hq outposts` — thin adapter over the Outpost command tree, which now lives in
+ * @indigoai-us/hq-cloud (`/outposts/cli`).
  *
- * Outposts are PERSONAL / caller-scoped: hq-pro keys every `/outpost/*` route
- * on the caller's Cognito sub, so there is no `--company`. `--id <outpostId>`
- * selects a specific box (passed as the `outpostId` query param); when omitted
- * hq-pro targets the caller's primary slot.
+ * The wire contract, the command surface, and the box-side helpers all moved out
+ * of the CLI so they can be shared — notably so a Next.js app can drive the same
+ * `/outpost/*` control plane through `@indigoai-us/hq-cloud/outposts`. All the CLI
+ * keeps is the wiring: its own authenticated transport (`vaultApiFetch`, which
+ * carries Sentry breadcrumbs, the `hqk_` route-rewrite table, and plan-gate
+ * decoding), its token resolution, and its cached-session read.
  *
- * Subcommands:
- *   hq outposts list                — every Outpost you own (row summaries)
- *   hq outposts status [--id]       — live detail for one box
- *   hq outposts codex-enable [--id] — enable / retry Codex on the box
- *   hq outposts login [--id]        — request a fresh login URL
- *   hq outposts destroy [--id] --yes — tear the box down (destructive; flag-guarded)
- *
- * NOTE: hq-pro exposes no rename or settings-mutation route for Outposts (the
- * web console can't rename them either), so this CLI wraps only the lifecycle
- * and status routes that exist. Renaming an Outpost is not a backend capability.
- */
-import { Command } from "commander";
-import { spawnSync } from "node:child_process";
-import { type BillingErrorPayload } from "../utils/billing-gate.js";
-/**
- * hq-pro's per-person cap envelope on a `409` provision block. Unlike every
- * other `/outpost/*` failure this body carries NO `message`/`error` field —
- * only the cap facts — so it has to be decoded structurally or the reason
- * degrades to a bare `res.statusText` ("Conflict").
- */
-export interface OutpostCappedPayload {
-    limit: number;
-    outposts: OutpostSummary[];
-}
-/** Decode hq-pro's `{ capped, limit, outposts }` cap envelope, if present. */
-export declare function parseCappedPayload(body: unknown): OutpostCappedPayload | undefined;
-/** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
-export declare class OutpostHttpError extends Error {
-    status: number;
-    step?: string;
-    /** hq-pro's billing envelope on a `402 billing_required` provision block. */
-    billing?: BillingErrorPayload;
-    /** hq-pro's cap envelope on a `409` provision block. */
-    capped?: OutpostCappedPayload;
-    constructor(status: number, message: string, step?: string, billing?: BillingErrorPayload, capped?: OutpostCappedPayload);
-}
-/** Row summary from `GET /outpost/list`. */
-export interface OutpostSummary {
-    outpostId: string;
-    state: string;
-    instanceName: string;
-    region: string;
-    agentRuntime: string;
-    platform: string;
-    createdAt: string;
-    [key: string]: unknown;
-}
-/**
- * Authenticated JSON round-trip against the outpost control plane. Throws
- * `OutpostHttpError` on any non-2xx (never swallows — hq-never-swallow-errors),
- * decoding hq-pro's `{ error | message, step }` envelope for the reason. The
- * `step` is preserved so callers can recognise the `destroy` route's
- * `teardown-incomplete` 409 (which means "retry", not "failed").
- */
-export declare function outpostRequest<T>(opts: {
-    token: string;
-    path: string;
-    method?: string;
-    body?: Record<string, unknown>;
-    query?: Record<string, string>;
-}): Promise<T>;
-/**
- * Provision the caller's Outpost. Sends the cached Cognito refresh token so the
- * box can authenticate AS the caller (the same body the console's
- * `provisionMyOutpost` sends). No duplicate is ever created: a caller already at
- * their per-person cap gets a `409` whose body lists their existing boxes —
- * thrown here as an `OutpostHttpError` carrying `capped` (hq-pro checks the cap
- * BEFORE activation billing, so a capped call is never charged). The refresh
- * token is sent over HTTPS and NEVER printed.
- */
-export declare function provisionOutpost(token: string, input: {
-    refreshToken: string;
-    clientIp?: string;
-    diskSizeGb?: number;
-    agentRuntime?: "claude" | "codex";
-}): Promise<Record<string, unknown>>;
-export declare function listOutposts(token: string): Promise<OutpostSummary[]>;
-export declare function getOutpostStatus(token: string, outpostId?: string): Promise<Record<string, unknown>>;
-export declare function enableCodex(token: string, outpostId?: string): Promise<Record<string, unknown>>;
-export declare function regenerateLoginUrl(token: string, outpostId?: string): Promise<Record<string, unknown>>;
-/**
- * Hand the box the one-time Claude sign-in code the operator got from the login
- * URL. hq-pro stores it as the row's pending code; the box polls for it, feeds
- * it to `claude`, and flips itself `awaiting-claude-login → ready`. This is the
- * terminal-native equivalent of pasting the code into the web console.
- */
-export declare function submitLoginCode(token: string, code: string, outpostId?: string): Promise<Record<string, unknown>>;
-export declare function destroyOutpost(token: string, outpostId?: string): Promise<Record<string, unknown>>;
-/** Result of `POST /outpost/exec` — a terminal SSM invocation on the box. */
-export interface OutpostExecResult {
-    ok: true;
-    outpostId: string;
-    instanceId: string;
-    commandId: string;
-    /** SSM invocation status (Success | Failed | Cancelled). */
-    status: string;
-    /** Remote process exit code, or null when SSM reported none. */
-    exitCode: number | null;
-    stdout: string;
-    stderr: string;
-    /** True when SSM clipped stdout/stderr at its inline output limit. */
-    truncated: boolean;
-}
-/**
- * Run a one-shot shell command on the caller's Outpost via `POST /outpost/exec`
- * (server-brokered SSM — no SSH). Throws `OutpostHttpError` on a non-2xx, whose
- * `step` distinguishes not-ready / platform-unsupported / timeout / ssm.
- */
-export declare function execOutpost(token: string, command: string, outpostId?: string): Promise<OutpostExecResult>;
-/** Presigned input-upload details from `mode: "stage"`. */
-export interface OutpostExecStage {
-    ok: true;
-    userId: string;
-    outpostId: string;
-    key: string;
-    putUrl: string;
-    getUrl: string;
-    expiresInSeconds: number;
-}
-/** Asynchronous SSM command details from `mode: "submit"`. */
-export interface OutpostExecSubmission {
-    ok: true;
-    userId: string;
-    outpostId: string;
-    instanceId: string;
-    commandId: string;
-    outputPrefix: string;
-    /** Shell budget applied server-side (AWS-RunShellScript executionTimeout). */
-    executionTimeoutSeconds?: number;
-}
-/** Poll response from `mode: "result"`; streams arrive only when terminal. */
-export interface OutpostExecAsyncResult {
-    ok: true;
-    userId: string;
-    outpostId: string;
-    status: string;
-    done: boolean;
-    exitCode?: number | null;
-    stdout?: string;
-    stderr?: string;
-    truncated?: boolean;
-}
-export declare function stageExecInput(token: string, outpostId?: string): Promise<OutpostExecStage>;
-export declare function submitExec(token: string, command: string, outpostId?: string, timeoutSeconds?: number): Promise<OutpostExecSubmission>;
-export declare function fetchExecResult(token: string, commandId: string, outpostId?: string): Promise<OutpostExecAsyncResult>;
-/** Preserve a single command string; safely join argv when Commander split it. */
-export declare function joinCommandParts(commandParts: string[]): string;
-/**
- * Prefix that best-effort `cd`s into the box's HQ checkout before running the
- * caller's command. `exec` runs over two transports with two different default
- * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
- * SSH lands in the login user's home — so without this, `hq outposts exec -- pwd`
- * printed an unhelpful, transport-dependent directory. Initialize a real root
- * home for the SSM case before resolving the HQ folder: tools run by the caller
- * (notably `gh`) otherwise treat the HQ checkout as their home and can create
- * root-owned machine state inside it. The trailing `|| true` keeps the command
- * running from the default directory when no HQ checkout is present, so exec
- * never fails merely because the box has no HQ folder.
- */
-export declare const REMOTE_HQ_DIR_PREFIX = "export HOME=\"${HOME:-/root}\"; cd \"$HOME/hq\" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true";
-/** Wrap `command` so it runs from the box's HQ folder (see REMOTE_HQ_DIR_PREFIX). */
-export declare function withRemoteHqDir(command: string): string;
-/** SSH connection details vended by `POST /outpost/ssh-access`. */
-export interface OutpostSshAccess {
-    outpostId: string;
-    platform: "ec2" | "lightsail";
-    host: string;
-    port: number;
-    username: string;
-    /** PEM private key for the box. SENSITIVE — never printed or logged. */
-    privateKey: string;
-}
-/**
- * Fetch SSH connection info + key for the caller's Outpost and open the caller's
- * IP on the box's SSH port. Used to reach a Lightsail box (no SSM). Throws
- * `OutpostHttpError` on a non-2xx.
+ * `vaultApiFetch` satisfies hq-cloud's `OutpostTransport` structurally — the
+ * option bags match field-for-field — so it is passed straight through with no
+ * adapter shim.
  */
-export declare function getOutpostSshAccess(token: string, outpostId?: string): Promise<OutpostSshAccess>;
+import type { Command } from "commander";
+import type { ReplicaSyncDependencies } from "@indigoai-us/hq-cloud/outposts/node";
 /**
- * Run `command` on the box over SSH using vended access details. Writes the
- * private key to a locked-down temp file, runs a non-interactive `ssh`, and
- * returns stdout/stderr/exitCode. The key file + a throwaway known_hosts file
- * are always cleaned up; the key is never printed. `exitCode` is `null` only
- * when `ssh` itself couldn't run (e.g. binary missing) — surfaced via `error`.
- */
-export declare function execViaSsh(access: OutpostSshAccess, command: string): {
-    stdout: string;
-    stderr: string;
-    exitCode: number | null;
-    error?: string;
-};
-/** The small local-environment surface used by `outposts self-deploy`. */
-export interface SelfDeployDependencies {
-    spawnSync: (command: string, args: string[], options?: Parameters<typeof spawnSync>[2]) => ReturnType<typeof spawnSync>;
-    readTextFile: (file: string) => string;
-    loadCachedTokens: () => {
-        refreshToken?: string;
-        idToken?: string;
-    } | undefined;
-    getUid: () => number | undefined;
-    isStdinTty: () => boolean;
-    confirm: () => Promise<boolean>;
-    defaultHqRoot: () => string;
-    invokingUser: () => string;
-}
-/**
- * The extra local surface `replica-sync` needs on top of the self-deploy set:
- * two filesystem probes for the repos clone. Kept as an extension so the
- * `self-deploy` dependency surface stays minimal.
- */
-export interface ReplicaSyncDependencies extends SelfDeployDependencies {
-    pathExists: (p: string) => boolean;
-    mkdirp: (p: string) => void;
-}
-/** One repo entry resolved from `personal/data/repos.yaml`. */
-export interface ReplicaRepo {
-    url: string;
-    visibility: "public" | "private";
-    name: string;
-}
-/**
- * Parse `personal/data/repos.yaml` into a clone list. Pure + exported for
- * tests. Mirrors setup.sh's `clone_repos`: `visibility` defaults to public,
- * `name` defaults to the URL basename. Malformed entries are skipped, never
- * thrown.
+ * Register the `hq outposts` command group.
+ *
+ * `selfDeployOverrides` lets a test replace the box-side host-environment probes
+ * (spawnSync, /etc/os-release reads, uid checks) without a real EC2 host; it is
+ * unused in production.
  */
-export declare function parseReposManifest(yamlText: string): ReplicaRepo[];
 export declare function registerOutpostsCommand(program: Command, selfDeployOverrides?: Partial<ReplicaSyncDependencies>): void;
 //# sourceMappingURL=outposts.d.ts.map