@indigoai-us/hq-cli 5.103.2 → 5.103.4

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.103.4] — 2026-08-19
+
+## [5.103.3] — 2026-08-19
+
 ## [5.103.2] — 2026-08-19
 
 ## [5.103.1] — 2026-08-18

package/dist/commands/integrations-connect.js

@@ -435,7 +435,7 @@ export function registerConnectCommands(integrations) {
         .command("catalog [query]")
         .alias("search")
         .description("Browse or search apps you can connect")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--limit <n>", "How many entries to show (max 100)", "60")
         .option("--json", "Machine-readable output")
         .action(async (query, opts) => {
@@ -484,7 +484,7 @@ export function registerConnectCommands(integrations) {
     integrations
         .command("inspect <app>")
         .description("Show what an app exposes before you connect it")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {
         const token = await ensureCognitoIdToken();
@@ -511,7 +511,7 @@ export function registerConnectCommands(integrations) {
     integrations
         .command("discover <docsUrl>")
         .description("Find a connectable server from an app's documentation page")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--json", "Machine-readable output")
         .action(async (docsUrl, opts) => {
         const token = await ensureCognitoIdToken();
@@ -536,7 +536,7 @@ export function registerConnectCommands(integrations) {
         .command("connect [app]")
         .alias("add")
         .description("Connect an app — by domain, catalog entry, docs page, or MCP URL")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--entry-id <id>", "Catalog entry id (from `hq integrations catalog --json`)")
         .option("--mcp-url <url>", "Connect a specific MCP endpoint directly")
         .option("--docs-url <url>", "Find the endpoint from a documentation page first")
@@ -592,7 +592,7 @@ export function registerConnectCommands(integrations) {
     integrations
         .command("reconnect [app]")
         .description("Re-authenticate a connected app whose credentials stopped working")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--token <key>", "API key (prefer --token-stdin)")

package/dist/commands/integrations-manage.js

@@ -26,6 +26,22 @@ const POLICY_BLURB = {
     confirm: "a company owner approves each change first",
     deny: "changes are refused",
 };
+/**
+ * hq-pro seeds a connection's default write grant as a company-wide entry with
+ * granteeId `"*"` (seedFactoryWriteGrants), and its grant validation rejects an
+ * EMPTY granteeId even for company-wide. So a company-wide write grant must
+ * carry `"*"` — not `""`. Using `""` made `grant --to everyone` fail with
+ * "Invalid writeAllowlist entry" and `ungrant --from everyone` never match the
+ * seeded entry ("nothing to remove"). Person/group/email grantees carry a real
+ * id and are unaffected.
+ */
+const COMPANY_WIDE_GRANTEE_ID = "*";
+/** The write-allowlist granteeId for a principal (company-wide is the wildcard). */
+function writeGrantGranteeId(principal) {
+    return principal.granteeType === "company-wide"
+        ? COMPANY_WIDE_GRANTEE_ID
+        : (principal.granteeId ?? "");
+}
 /**
  * Parse a grantee from the one string a person would actually type.
  *
@@ -116,7 +132,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("show [app]")
         .description("Show one connected app in full")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--json", "Machine-readable output")
@@ -158,7 +174,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("policy [app]")
         .description("Show or change whether an app's changes need approval")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--set <mode>", "auto-allow, confirm, or deny")
@@ -205,7 +221,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("grants [app]")
         .description("Show who is authorized to run an app's change-making tools")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--json", "Machine-readable output")
@@ -245,7 +261,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("grant [app]")
         .description("Authorize someone to run one of an app's change-making tools")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .requiredOption("--tool <name>", "The tool to authorize")
@@ -271,7 +287,7 @@ export function registerManageCommands(integrations) {
         const snapshot = connection.writeAllowlist ?? [];
         const merged = mergeGrant(snapshot, toolName, {
             granteeType: principal.granteeType,
-            granteeId: principal.granteeId ?? "",
+            granteeId: writeGrantGranteeId(principal),
             permission: opts.permission,
         });
         const result = await patchAllowlistIfUnchanged(token, companyUid, connection.id, snapshot, merged);
@@ -284,7 +300,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("ungrant [app]")
         .description("Remove a per-tool authorization, leaving only the app's default access")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .requiredOption("--tool <name>", "The tool to stop authorizing")
@@ -314,7 +330,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("access [app]")
         .description("Show who in the company can use a connected app")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--json", "Machine-readable output")
@@ -332,7 +348,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("share [app]")
         .description("Let someone in the company use a connected app")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .requiredOption("--with <principal>", "Email, uid, or `everyone`")
@@ -362,7 +378,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("unshare [app]")
         .description("Stop someone from using a connected app")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .requiredOption("--from <principal>", "Email, uid, or `everyone`")
@@ -387,7 +403,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("audit")
         .description("Recent activity across the company's connected apps")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Only this app")
         .option("--limit <n>", "How many events to show", "20")
         .option("--json", "Machine-readable output")
@@ -430,7 +446,7 @@ export function registerManageCommands(integrations) {
     integrations
         .command("pending")
         .description("Calls that were queued for an owner's approval")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
@@ -470,7 +486,7 @@ export function registerManageCommands(integrations) {
         .command("disconnect [app]")
         .alias("remove")
         .description("Disconnect an app and delete its stored credentials")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--yes", "Skip the confirmation prompt")
@@ -557,7 +573,7 @@ export function mergeGrant(current, toolName, entry) {
  * dropped entirely rather than persisted as an empty rule.
  */
 export function removeGrant(current, toolName, principal) {
-    const granteeId = principal.granteeId ?? "";
+    const granteeId = writeGrantGranteeId(principal);
     let removed = false;
     const next = [];
     for (const grant of current) {

package/dist/commands/integrations.d.ts

@@ -16,7 +16,7 @@
  *   hq integrations reconnect [app]          Re-authenticate a broken app.
  *
  * Use:
- *   hq integrations list                     Connected apps for the company.
+ *   hq integrations list --company indigo    Connected apps for a company.
  *   hq integrations show [app]               One app in full.
  *   hq integrations tools --provider <p>     What the connected app can do.
  *   hq integrations call <tool> --provider <p> --args '<json>'
@@ -35,8 +35,10 @@
  * outcome is surfaced clearly with the exact approve command to run.
  *
  * Auth: Cognito ID token via the shared session cache (`hq auth refresh`
- * semantics); company resolves like every other command — `--company <slug>`
- * or the caller's single active membership. Never hardcoded.
+ * semantics); company resolves like every other command — pass a company SLUG
+ * with `--company <slug>` (e.g. `--company indigo`), which is preferred over a
+ * raw `cmp_…` uid, or rely on the caller's single active membership. Never
+ * hardcoded.
  *
  * Shared primitives (error taxonomy, HTTP guards, connection resolution) live
  * in `integrations-core.ts` and are re-exported below so existing importers

package/dist/commands/integrations.js

@@ -16,7 +16,7 @@
  *   hq integrations reconnect [app]          Re-authenticate a broken app.
  *
  * Use:
- *   hq integrations list                     Connected apps for the company.
+ *   hq integrations list --company indigo    Connected apps for a company.
  *   hq integrations show [app]               One app in full.
  *   hq integrations tools --provider <p>     What the connected app can do.
  *   hq integrations call <tool> --provider <p> --args '<json>'
@@ -35,8 +35,10 @@
  * outcome is surfaced clearly with the exact approve command to run.
  *
  * Auth: Cognito ID token via the shared session cache (`hq auth refresh`
- * semantics); company resolves like every other command — `--company <slug>`
- * or the caller's single active membership. Never hardcoded.
+ * semantics); company resolves like every other command — pass a company SLUG
+ * with `--company <slug>` (e.g. `--company indigo`), which is preferred over a
+ * raw `cmp_…` uid, or rely on the caller's single active membership. Never
+ * hardcoded.
  *
  * Shared primitives (error taxonomy, HTTP guards, connection resolution) live
  * in `integrations-core.ts` and are re-exported below so existing importers
@@ -58,7 +60,7 @@ export function registerIntegrationsCommand(program) {
     integrations
         .command("list")
         .description("List the company's connected apps")
-        .option("--company <slug>", "Company slug (defaults to your single active company)")
+        .option("--company <slug>", "Company slug, e.g. indigo (defaults to your single active company)")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
@@ -90,7 +92,7 @@ export function registerIntegrationsCommand(program) {
         .description("List what a connected app can do")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
@@ -123,7 +125,7 @@ export function registerIntegrationsCommand(program) {
         .description("Call one of a connected app's tools (approval-gated when it changes things)")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
-        .option("--company <slug>", "Company slug")
+        .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--args <json>", "Tool arguments as JSON", "{}")
         .option("--idempotency-key <key>", "Stable key so retries execute at most once (default: generated)")
         .option("--json", "Machine-readable output")
@@ -172,10 +174,11 @@ export function registerIntegrationsCommand(program) {
         // A tool that ran but FAILED (`isError: true`) still has its payload
         // printed — the error text is the useful part — but the command exits
         // non-zero so a script or agent can tell failure from success without
-        // parsing output. The flag is on the raw gateway result, not the
-        // unwrapped payload.
+        // parsing output. The gateway double-wraps the provider result as a
+        // text-content string, so `isError` lands on the UNWRAPPED payload, not
+        // on the raw envelope; check both levels so either shape is caught.
         printJson(payload);
-        if (gatewayResultIsError(message.result)) {
+        if (gatewayResultIsError(payload) || gatewayResultIsError(message.result)) {
             process.exitCode = 1;
         }
     });
@@ -187,7 +190,7 @@ export function registerIntegrationsCommand(program) {
             : "Reject a queued call (owner only)")
             .option("--provider <slug>", "Connected app (e.g. linear)")
             .option("--connection <id>", "Connection id (acct_…)")
-            .option("--company <slug>", "Company slug")
+            .option("--company <slug>", "Company slug, e.g. indigo")
             .option("--json", "Machine-readable output")
             .action(async (queueId, opts) => {
             const token = await ensureCognitoIdToken();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.103.2",
+  "version": "5.103.4",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {