@indigoai-us/hq-cli 5.110.0 → 5.111.1

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [5.111.1] — 2026-09-14
+
+### Fixed
+
+- A new bot's first message no longer tells its signed-in owner they are not
+  signed in. While the bot fetched its own sign-in, a check of the owner's
+  sign-in in the same process could read the bot's credentials instead and find
+  no account. Sign-in reads now wait for that to finish.
+- When a bot cannot read its owner's account right away, it tries again before
+  answering, and never asks a signed-in owner to sign in or run a command. The
+  bot's log now records why an owner check failed.
+
+## [5.111.0] — 2026-09-14
+
+### Added
+
+- `hq skill delete <target>`: delete a company skill and all of its files for
+  everyone. Accepts a `skl_…` id, a SKILL.md path, or a skill slug; names the
+  skill and asks for confirmation (`--yes` skips it, and it refuses to run
+  unattended without `--yes`). Synced copies are removed on the next sync.
+  Requires access-admin rights on the skill.
+
 ## [5.110.0] — 2026-09-14
 
 ### Added

package/dist/commands/skill.d.ts

@@ -5,12 +5,13 @@
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
- * SKILL.md and cannot overwrite live content. Structured suggest/list/review
- * commands intentionally are not registered.
+ * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
+ * a skill and its files for the whole company (confirmation unless --yes).
+ * Structured suggest/list/review commands intentionally are not registered.
  */
 import { Command } from "commander";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
 export declare const SKILL_UID_PATTERN: RegExp;
 export declare const SKILL_SLUG_PATTERN: RegExp;
@@ -98,9 +99,17 @@ export declare function mapSkillError(status: number, body: Record<string, unkno
 export declare function skillApiError(status: number, body: Record<string, unknown>, opts?: {
     machineIdentity?: boolean;
 }): Error;
+export type SkillConfirmFn = (message: string) => Promise<boolean>;
+/**
+ * Resolve a delete target: a `skl_…` uid, a SKILL.md path or its directory, or
+ * a bare skill slug under `companies/<company>/skills/<slug>/`.
+ */
+export declare function resolveDeleteTarget(target: string, cwd: string, hqRoot: string, companySlug: string): string;
 interface SkillCommandDeps {
     ensureToken?: typeof ensureCognitoToken;
     apiFetch?: typeof vaultApiFetch;
+    confirm?: SkillConfirmFn;
+    resolveCompanyUid?: typeof getCompanyUid;
     cwd?: () => string;
     hqRoot?: string;
     syncFile?: (input: SkillSyncInput) => Promise<SkillSyncResult>;

package/dist/commands/skill.js

@@ -5,8 +5,9 @@
  * immutable UID, surfaces its generated runtime wrapper, and syncs it.
  * `hq skill propose <uid|path> --message "…"` posts a whole-skill comment to
  * the same improvement thread shown in HQ Console. It never uploads a modified
- * SKILL.md and cannot overwrite live content. Structured suggest/list/review
- * commands intentionally are not registered.
+ * SKILL.md and cannot overwrite live content. `hq skill delete <target>` removes
+ * a skill and its files for the whole company (confirmation unless --yes).
+ * Structured suggest/list/review commands intentionally are not registered.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -14,7 +15,8 @@ import chalk from "chalk";
 import yaml from "js-yaml";
 import { share } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken, DEFAULT_HQ_ROOT, buildVaultConfig, isMachineIdentity, } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import * as readline from "node:readline";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 import { surfaceCompanySkill } from "../lib/company-skill-wrapper.js";
 import { AuthError } from "../utils/auth-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
@@ -322,6 +324,31 @@ export function skillApiError(status, body, opts = {}) {
     }
     return new Error(message);
 }
+function realConfirm(message) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(answer.trim()));
+        });
+    });
+}
+/**
+ * Resolve a delete target: a `skl_…` uid, a SKILL.md path or its directory, or
+ * a bare skill slug under `companies/<company>/skills/<slug>/`.
+ */
+export function resolveDeleteTarget(target, cwd, hqRoot, companySlug) {
+    if (SKILL_UID_PATTERN.test(target))
+        return target;
+    const asPath = path.resolve(cwd, target);
+    if (!fs.existsSync(asPath) && SKILL_SLUG_PATTERN.test(target)) {
+        return resolveSkillUid(canonicalCompanySkillPath(hqRoot, companySlug, target), cwd);
+    }
+    return resolveSkillUid(target, cwd);
+}
 export function registerSkillCommand(program, deps = {}) {
     const ensureToken = deps.ensureToken ?? ensureCognitoToken;
     const apiFetch = deps.apiFetch ?? vaultApiFetch;
@@ -329,6 +356,8 @@ export function registerSkillCommand(program, deps = {}) {
     const hqRoot = deps.hqRoot ?? DEFAULT_HQ_ROOT;
     const syncFile = deps.syncFile ?? defaultSyncFile;
     const surfaceSkillFn = deps.surfaceSkillFn ?? surfaceCompanySkill;
+    const confirm = deps.confirm ?? realConfirm;
+    const resolveCompanyUid = deps.resolveCompanyUid ?? getCompanyUid;
     const skill = program
         .command("skill")
         .description("Create company skills and discuss improvements")
@@ -516,6 +545,53 @@ export function registerSkillCommand(program, deps = {}) {
         console.log(`  Message:  ${posted.body}`);
         console.log(chalk.dim("  Review it in HQ Console → Skills → Improvements"));
     });
+    skill
+        .command("delete <target>")
+        .description("Delete a company skill and all of its files for everyone (skl_… uid, SKILL.md path, or skill slug). Prompts for confirmation unless --yes.")
+        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
+        .action(async (target, opts) => {
+        const parentOpts = skill.opts();
+        const resolvedRoot = path.resolve(parentOpts.hqRoot ?? hqRoot);
+        const companySlug = resolveCompanySlug(parentOpts.company, resolvedRoot);
+        const skillUid = resolveDeleteTarget(target, cwd(), resolvedRoot, companySlug);
+        const token = await ensureToken();
+        const companyUid = await resolveCompanyUid(token, companySlug);
+        const skillPath = `/v1/skills/${encodeURIComponent(companyUid)}/${encodeURIComponent(skillUid)}`;
+        const detail = await apiFetch({ token, path: skillPath, method: "GET" });
+        if (!detail.ok) {
+            const body = (await detail.json().catch(() => ({})));
+            throw skillApiError(detail.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const { skill: record } = (await detail.json());
+        const name = typeof record?.name === "string" ? record.name : skillUid;
+        if (opts.yes !== true) {
+            if (!process.stdin.isTTY) {
+                throw localSkillError(`Refusing to delete '${name}' without confirmation. Re-run with --yes.`);
+            }
+            const ok = await confirm(`Delete skill '${name}' (${skillUid}) and all of its files for everyone in ${companySlug}? This can't be undone from the CLI.`);
+            if (!ok) {
+                console.log("Cancelled — nothing was deleted.");
+                return;
+            }
+        }
+        const response = await apiFetch({ token, path: skillPath, method: "DELETE" });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            throw skillApiError(response.status, body, {
+                machineIdentity: isMachineIdentity(),
+            });
+        }
+        const result = (await response.json());
+        console.log(chalk.green(`Skill deleted: ${name}`));
+        console.log(`  Skill:    ${skillUid}`);
+        console.log(`  Files:    ${typeof result.filesDeleted === "number" ? result.filesDeleted : 0} removed`);
+        if (result.tombstoneIncomplete === true) {
+            console.warn(chalk.yellow("⚠ Some synced computers may not be told to remove their copy. Delete it locally if it reappears."));
+        }
+        console.log(chalk.dim("  Local copies are removed on the next sync (hq sync now)."));
+    });
     return skill;
 }
 //# sourceMappingURL=skill.js.map

package/dist/lib/bot/owner-context.d.ts

@@ -29,6 +29,10 @@ export type OwnerContext = {
     ownerUid: string;
     reason: string;
     checkedAt: string;
+    /** True when the owner's sign-in exists and only reading their account failed. */
+    signedIn?: boolean;
+    /** Technical cause, for logs only; never shown to the model. */
+    detail?: string;
 } | {
     status: "mismatch";
     ownerUid: string;
@@ -48,8 +52,12 @@ export interface OwnerLookupIo {
         status: string;
     }>>;
     now?: () => Date;
+    /** Test seam for the retry pause. */
+    sleep?: (ms: number) => Promise<void>;
 }
 export declare const defaultOwnerLookupIo: OwnerLookupIo;
+/** A read right after sign-in or bot start can fail once; try again before reporting it. */
+export declare const OWNER_LOOKUP_RETRY_DELAYS_MS: number[];
 export declare function lookupOwnerContext(ownerUid: string, io?: OwnerLookupIo): Promise<OwnerContext>;
 /** Successful lookups are reused for 5 minutes, failures retried after 1 minute. */
 export declare const OWNER_CONTEXT_TTL_MS: number;

package/dist/lib/bot/owner-context.js

@@ -33,6 +33,23 @@ export const defaultOwnerLookupIo = {
         return data.memberships;
     },
 };
+/** A read right after sign-in or bot start can fail once; try again before reporting it. */
+export const OWNER_LOOKUP_RETRY_DELAYS_MS = [1_000, 2_000];
+async function withRetry(fn, io) {
+    const sleep = io.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let lastErr;
+    for (const delay of [0, ...OWNER_LOOKUP_RETRY_DELAYS_MS]) {
+        if (delay)
+            await sleep(delay);
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    throw lastErr;
+}
 export async function lookupOwnerContext(ownerUid, io = defaultOwnerLookupIo) {
     const checkedAt = (io.now ?? (() => new Date()))().toISOString();
     let token;
@@ -44,22 +61,23 @@ export async function lookupOwnerContext(ownerUid, io = defaultOwnerLookupIo) {
     }
     let signedInAs;
     try {
-        signedInAs = await io.callerPersonUid(token);
+        signedInAs = await withRetry(() => io.callerPersonUid(token), io);
     }
     catch (err) {
-        return { status: "unavailable", ownerUid, reason: `could not confirm who is signed in (${message(err)})`, checkedAt };
+        // The raw error ("…Sign in to HQ once…") would read to the model as "not signed in".
+        return { status: "unavailable", ownerUid, reason: "their HQ account could not be read just now", detail: message(err), checkedAt, signedIn: true };
     }
     if (signedInAs !== ownerUid)
         return { status: "mismatch", ownerUid, signedInAs, checkedAt };
     try {
-        const rows = await io.memberships(token);
+        const rows = await withRetry(() => io.memberships(token), io);
         const companies = rows
             .filter((m) => m.status === "active")
             .map((m) => ({ companyUid: m.companyUid, ...(m.companySlug ? { companySlug: m.companySlug } : {}), role: m.role }));
         return { status: "ok", ownerUid, companies, checkedAt };
     }
     catch (err) {
-        return { status: "unavailable", ownerUid, reason: `could not read your owner's companies (${message(err)})`, checkedAt };
+        return { status: "unavailable", ownerUid, reason: `could not read your owner's companies (${message(err)})`, checkedAt, signedIn: true };
     }
 }
 /** Successful lookups are reused for 5 minutes, failures retried after 1 minute. */
@@ -141,6 +159,12 @@ export function ownerContextBlock(ctx, agentUid) {
             `The HQ sign-in on this computer belongs to ${ctx.signedInAs}, not your owner, so your owner's companies could not be checked. ` +
                 "Do not say which companies your owner belongs to; tell them you could not check and why.";
     }
+    else if (ctx.signedIn) {
+        body =
+            `Your owner IS signed in to HQ on this computer, but their companies could not be checked: ${ctx.reason}. ` +
+                "Do not guess and do not say they have no company. Do not ask them to sign in or to run any command: " +
+                "say you could not read their account just now and that you will check again on their next message.";
+    }
     else {
         body =
             `Your owner's companies could not be checked: ${ctx.reason}. ` +

package/dist/lib/bot/run.js

@@ -311,7 +311,14 @@ export async function runBot(deps) {
         // by other people, who must not be handed the owner's companies.
         if (deps.ownerContext && sessionScope === "dm") {
             try {
-                prompt = `${ownerContextBlock(await deps.ownerContext(), config.agentUid)}\n\n${prompt}`;
+                const owner = await deps.ownerContext();
+                if (owner.status === "unavailable") {
+                    log("warn", `owner context unavailable: ${owner.reason}${owner.detail ? ` (${owner.detail})` : ""}`);
+                }
+                else if (owner.status === "mismatch") {
+                    log("warn", `owner context mismatch: signed in as ${owner.signedInAs}`);
+                }
+                prompt = `${ownerContextBlock(owner, config.agentUid)}\n\n${prompt}`;
             }
             catch (err) {
                 log("warn", `owner context unavailable: ${err instanceof Error ? err.message : String(err)}`);

package/dist/utils/cognito-session.js

@@ -18,6 +18,7 @@
  *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -496,19 +497,39 @@ export function describeCognitoTokenSource(opts = {}) {
  * `HQ_MACHINE_TOKEN_STATE_DIR` instead. Restores the prior env afterwards.
  */
 export async function withMachineTokenStateDir(fn, opts = {}) {
-    const home = opts.home ?? os.homedir();
-    const env = opts.env ?? process.env;
-    const prev = process.env.HQ_STATE_DIR;
-    process.env.HQ_STATE_DIR = machineTokenStateDir(home, env);
-    try {
-        return await fn();
-    }
-    finally {
-        if (prev === undefined)
-            delete process.env.HQ_STATE_DIR;
-        else
-            process.env.HQ_STATE_DIR = prev;
-    }
+    return withTokenStateDirSection(async () => {
+        const home = opts.home ?? os.homedir();
+        const env = opts.env ?? process.env;
+        const prev = process.env.HQ_STATE_DIR;
+        process.env.HQ_STATE_DIR = machineTokenStateDir(home, env);
+        try {
+            return await fn();
+        }
+        finally {
+            if (prev === undefined)
+                delete process.env.HQ_STATE_DIR;
+            else
+                process.env.HQ_STATE_DIR = prev;
+        }
+    });
+}
+/**
+ * The token cache location (`HQ_STATE_DIR`) is process-wide, and a machine mint
+ * points it at the machine cache across an await. A person-session read in the
+ * same process while that mint is in flight would load the MACHINE tokens: a
+ * local bot's resident (machine identity for its own calls) checking its
+ * owner's sign-in at startup got the bot's token and "No person entity found".
+ * Every section that swaps or reads the cache location runs one at a time;
+ * nested sections (a person read falling back to a machine mint) run inline.
+ */
+const tokenStateDirSection = new AsyncLocalStorage();
+let tokenStateDirTail = Promise.resolve();
+function withTokenStateDirSection(fn) {
+    if (tokenStateDirSection.getStore())
+        return fn();
+    const run = tokenStateDirTail.then(() => tokenStateDirSection.run(true, fn));
+    tokenStateDirTail = run.catch(() => undefined);
+    return run;
 }
 async function ensureMachineTokens() {
     return withMachineTokenStateDir(() => getValidMachineTokens(DEFAULT_COGNITO));
@@ -567,6 +588,11 @@ function markPersonSessionRejected(accessToken) {
  * a browser.
  */
 export async function ensureCognitoToken(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return ensureCognitoTokenUnserialized(options);
+    return withTokenStateDirSection(() => ensureCognitoTokenUnserialized(options));
+}
+async function ensureCognitoTokenUnserialized(options) {
     const interactive = options.interactive ?? true;
     // Machine identities (company agents) mint sessions on demand via
     // USER_PASSWORD_AUTH — no refresh-token dance, no browser. The vault API's
@@ -631,6 +657,11 @@ export async function ensureCognitoToken(options = {}) {
  * identical to `ensureCognitoToken` there.
  */
 export async function ensureCognitoIdToken(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return ensureCognitoIdTokenUnserialized(options);
+    return withTokenStateDirSection(() => ensureCognitoIdTokenUnserialized(options));
+}
+async function ensureCognitoIdTokenUnserialized(options) {
     const interactive = options.interactive ?? true;
     if (wantsMachineCognitoTokens(options)) {
         const machine = await ensureMachineTokensMaybeFallback(options);
@@ -704,6 +735,11 @@ export function buildVaultConfig(authToken) {
  * reason string and can decide what to do next. Never opens a browser.
  */
 export async function refreshCachedSession(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return refreshCachedSessionUnserialized(options);
+    return withTokenStateDirSection(() => refreshCachedSessionUnserialized(options));
+}
+async function refreshCachedSessionUnserialized(options) {
     // Machine identities have no refresh token; ensure a valid cached machine
     // session without forcing a re-mint when the cache is already healthy.
     // Tokens land under the dedicated machine/daemon state dir.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.110.0",
+  "version": "5.111.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {