@indigoai-us/hq-cli 5.103.5 → 5.103.7

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.103.7] — 2026-08-19
+
+### Fixed
+
+- The checkpoint stop-gate and `hq core checkpoint` REMINDER now order the turn
+  checkpoint-first / user-reply-last. App-runtime Claude Code hosts collapse
+  assistant text that precedes a tool call, so the old "reply first, checkpoint
+  as final action" contract silently hid the substantive reply from the user.
+
+## [5.103.6] — 2026-08-19
+
 ## [5.103.5] — 2026-08-19
 
 ## [5.103.4] — 2026-08-19

package/assets/scaffold/core/scripts/checkpoint-stop-gate.sh

@@ -120,7 +120,7 @@ set -uo pipefail
             *) [ -d "$gate_root/companies/$bound_co" ] && gate_bound=1 ;;
           esac
           if [ "$gate_bound" = 0 ]; then
-            company_reason="$(printf 'This session has not declared its scope, and a scope is required before the turn can end. Decide where this work belongs, then bind the session as the FINAL action of the turn and end the turn immediately after:\n\n  bash %s/core/scripts/hq-session.sh --session-id %s set company_slug <company-slug>\n\nUse a real tenant slug from companies/manifest.yaml — the company this session is actually working in, never an invented one. If this session does no company-scoped work, bind it to the reserved personal scope instead:\n\n  bash %s/core/scripts/hq-session.sh --session-id %s set company_slug personal\n\nAn operator can also disable this requirement for the run by exporting HQ_CHECKPOINT_GATE=0.' "$gate_root" "$gate_session_id" "$gate_root" "$gate_session_id")"
+            company_reason="$(printf 'This session has not declared its scope, and a scope is required before the turn can end. Decide where this work belongs, then bind the session and finish the turn with your user-facing reply as the final text after the command output:\n\n  bash %s/core/scripts/hq-session.sh --session-id %s set company_slug <company-slug>\n\nUse a real tenant slug from companies/manifest.yaml — the company this session is actually working in, never an invented one. If this session does no company-scoped work, bind it to the reserved personal scope instead:\n\n  bash %s/core/scripts/hq-session.sh --session-id %s set company_slug personal\n\nAn operator can also disable this requirement for the run by exporting HQ_CHECKPOINT_GATE=0.' "$gate_root" "$gate_session_id" "$gate_root" "$gate_session_id")"
             printf '{"decision":"block","reason":%s}\n' "$(printf '%s' "$company_reason" | hq_json_encode)"
             exit 0
           fi
@@ -327,7 +327,7 @@ set -uo pipefail
 
   # Built with printf rather than concatenation so the session id can appear in
   # both commands without re-splitting the message into fragments.
-  reason="$(printf 'This turn changed something, so it needs an end-of-turn checkpoint. Two different audiences are involved — do not conflate them:\n\n1. THE USER reads your normal chat reply. If you owe them anything — a result, a link, an answer, a status — say it in the reply as usual. The checkpoint is invisible to them and is NOT a message to them; running it does not count as having replied.\n2. THE SIBLING (a background maintenance agent) reads the checkpoint payload. It never sees your chat reply, so anything it needs must go into the flags.\n\nSo: finish whatever you owe the user in the reply first, then run the checkpoint as the FINAL action of the turn and end the turn immediately after it. The checkpoint output ends with a REMINDER restating this contract: if it catches you having skipped the user-facing reply, deliver that overdue reply — nothing else — and then end the turn; otherwise add no commentary after the command.\n\n  hq core checkpoint --session-id %s --trigger stop-gate --summary "<what changed, in one line>" [--file <path>] [--decision "<choice and why>"] [--learning "<reusable rule>"] [--next "<outstanding step>"]\n\nOnly --summary is required, and the repeatable flags are what the sibling uses to enrich the record, distil policies and update the indexes — a bare summary gives it almost nothing to work with. Write them as machine record, not prose for the user, and pass each one that genuinely applies:\n  --file      every path you created or modified this turn\n  --decision  a choice you made that a reader would otherwise have to reverse-engineer\n  --learning  a rule that changes how someone acts next time, not a restatement of what just happened\n  --next      work that is genuinely still outstanding\nOmit a flag rather than padding it: an empty or invented learning is worse than none.\n\nIf this turn only read or inspected things and changed no state, the correct call instead is:\n\n  hq core checkpoint --session-id %s --idle' "$session_id" "$session_id")"
+  reason="$(printf 'This turn changed something, so it needs an end-of-turn checkpoint. Two different audiences are involved — do not conflate them:\n\n1. THE USER reads your normal chat reply. If you owe them anything — a result, a link, an answer, a status — say it in the reply as usual. The checkpoint is invisible to them and is NOT a message to them; running it does not count as having replied.\n2. THE SIBLING (a background maintenance agent) reads the checkpoint payload. It never sees your chat reply, so anything it needs must go into the flags.\n\nORDER (this app folds any text that precedes a tool call into a collapsed sub-message — only text AFTER the last tool call renders in full): run the checkpoint FIRST, then deliver your COMPLETE user-facing reply as the final text of the turn. Every link, URL, instruction, command, and decision the user needs MUST appear in that final post-checkpoint message, restated in full even if you already wrote it earlier in the turn — earlier text is collapsed and the user will not see it.\n\n  hq core checkpoint --session-id %s --trigger stop-gate --summary "<what changed, in one line>" [--file <path>] [--decision "<choice and why>"] [--learning "<reusable rule>"] [--next "<outstanding step>"]\n\nOnly --summary is required, and the repeatable flags are what the sibling uses to enrich the record, distil policies and update the indexes — a bare summary gives it almost nothing to work with. Write them as machine record, not prose for the user, and pass each one that genuinely applies:\n  --file      every path you created or modified this turn\n  --decision  a choice you made that a reader would otherwise have to reverse-engineer\n  --learning  a rule that changes how someone acts next time, not a restatement of what just happened\n  --next      work that is genuinely still outstanding\nOmit a flag rather than padding it: an empty or invented learning is worse than none.\n\nIf this turn only read or inspected things and changed no state, the correct call instead is:\n\n  hq core checkpoint --session-id %s --idle' "$session_id" "$session_id")"
 
   # Codex surfaces a blocked Stop reason as a synthetic user prompt. Preserve
   # the actionable instruction out-of-band, then use the stable marker covered

package/dist/commands/api-keys.js

@@ -190,7 +190,11 @@ export function registerApiKeysCommand(program) {
             const deployCapabilities = capabilities.filter((cap) => cap === "deploy:write" || cap === "deploy:read");
             const expiresAt = parseExpires(opts.expires);
             const token = await requireCognitoForApiKeys("api-keys create");
-            const companyUid = await getCompanyUid(token, apiKeys.opts().company);
+            // The company selector the caller typed (a slug, e.g. `indigo`, unless
+            // they passed a raw uid). Kept so the metadata can lead with the slug
+            // instead of only the resolved uid.
+            const companyRef = apiKeys.opts().company;
+            const companyUid = await getCompanyUid(token, companyRef);
             const res = await vaultApiFetch({
                 token,
                 path: "/v1/api-keys",
@@ -224,7 +228,12 @@ export function registerApiKeysCommand(program) {
             console.log(chalk.bold("Metadata"));
             console.log(`  Key ID: ${data.apiKey.keyId}`);
             console.log(`  Name: ${data.apiKey.name}`);
-            console.log(`  Company: ${data.apiKey.companyUid}`);
+            // Lead with the slug the caller typed (uid in parens, since the key is
+            // uid-bound); fall back to the bare uid when they passed a uid or relied
+            // on a single active membership.
+            console.log(`  Company: ${companyRef && companyRef !== data.apiKey.companyUid
+                ? `${companyRef} (${data.apiKey.companyUid})`
+                : data.apiKey.companyUid}`);
             console.log(`  Permission: ${data.apiKey.scope.permission}`);
             console.log(`  Capabilities: ${formatCapabilities(data.apiKey.scope.capabilities ?? capabilities)}`);
             console.log(`  Prefixes: ${formatPrefixes(data.apiKey.scope.allowedPrefixes)}`);

package/dist/commands/core-checkpoint.d.ts

@@ -15,9 +15,10 @@ type SpawnableBackend = Exclude<Backend, "none">;
  * findings only in the checkpoint payload — which the user never sees. This
  * line rides the command output (the one channel guaranteed to reach the
  * calling agent) to force the user-facing reply. Deliberately conditional so
- * it composes with the Stop-gate prompt's "reply first, checkpoint last, then
- * end the turn" ordering: an agent that already replied is told to end the
- * turn, not to add commentary. Mirrors the hq-core policies
+ * it composes with the Stop-gate prompt's "checkpoint first, reply last"
+ * ordering: some hosts (the desktop app runtime) do not reliably display
+ * assistant text that precedes a tool call, so the reply must come after
+ * the checkpoint output as the final text of the turn. Mirrors the hq-core policies
  * `checkpoint-is-bookkeeping-not-user-communication` and
  * `checkpoint-is-not-the-user-report`.
  */

package/dist/commands/core-checkpoint.js

@@ -46,17 +46,19 @@ class CheckpointUsageError extends Error {
  * findings only in the checkpoint payload — which the user never sees. This
  * line rides the command output (the one channel guaranteed to reach the
  * calling agent) to force the user-facing reply. Deliberately conditional so
- * it composes with the Stop-gate prompt's "reply first, checkpoint last, then
- * end the turn" ordering: an agent that already replied is told to end the
- * turn, not to add commentary. Mirrors the hq-core policies
+ * it composes with the Stop-gate prompt's "checkpoint first, reply last"
+ * ordering: some hosts (the desktop app runtime) do not reliably display
+ * assistant text that precedes a tool call, so the reply must come after
+ * the checkpoint output as the final text of the turn. Mirrors the hq-core policies
  * `checkpoint-is-bookkeeping-not-user-communication` and
  * `checkpoint-is-not-the-user-report`.
  */
 export const CHECKPOINT_REPLY_REMINDER = "checkpoint: REMINDER — this checkpoint is invisible bookkeeping; the user never sees it " +
-    "and it does NOT count as your reply. If your reply to the user already contains " +
-    "everything of substance from this turn, end the turn now. If anything — results, " +
-    "findings, decisions, state changes, anything awaiting their input — exists only in this " +
-    "checkpoint or your head, deliver it to the user in plain language before ending the turn.";
+    "and it does NOT count as your reply. Now write your user-facing reply as the FINAL text " +
+    "of the turn — everything of substance from this turn (results, findings, decisions, " +
+    "state changes, anything awaiting their input) — even if you already wrote it earlier: " +
+    "assistant text that precedes a tool call is not reliably shown to the user on all " +
+    "hosts. Then end the turn.";
 function printResult(line) {
     process.stdout.write(`${line}\n`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.103.5",
+  "version": "5.103.7",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {