@indigoai-us/hq-cli 5.111.0 → 5.111.1

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.111.1] — 2026-09-14
+
+### Fixed
+
+- A new bot's first message no longer tells its signed-in owner they are not
+  signed in. While the bot fetched its own sign-in, a check of the owner's
+  sign-in in the same process could read the bot's credentials instead and find
+  no account. Sign-in reads now wait for that to finish.
+- When a bot cannot read its owner's account right away, it tries again before
+  answering, and never asks a signed-in owner to sign in or run a command. The
+  bot's log now records why an owner check failed.
+
 ## [5.111.0] — 2026-09-14
 
 ### Added

package/dist/lib/bot/owner-context.d.ts

@@ -29,6 +29,10 @@ export type OwnerContext = {
     ownerUid: string;
     reason: string;
     checkedAt: string;
+    /** True when the owner's sign-in exists and only reading their account failed. */
+    signedIn?: boolean;
+    /** Technical cause, for logs only; never shown to the model. */
+    detail?: string;
 } | {
     status: "mismatch";
     ownerUid: string;
@@ -48,8 +52,12 @@ export interface OwnerLookupIo {
         status: string;
     }>>;
     now?: () => Date;
+    /** Test seam for the retry pause. */
+    sleep?: (ms: number) => Promise<void>;
 }
 export declare const defaultOwnerLookupIo: OwnerLookupIo;
+/** A read right after sign-in or bot start can fail once; try again before reporting it. */
+export declare const OWNER_LOOKUP_RETRY_DELAYS_MS: number[];
 export declare function lookupOwnerContext(ownerUid: string, io?: OwnerLookupIo): Promise<OwnerContext>;
 /** Successful lookups are reused for 5 minutes, failures retried after 1 minute. */
 export declare const OWNER_CONTEXT_TTL_MS: number;

package/dist/lib/bot/owner-context.js

@@ -33,6 +33,23 @@ export const defaultOwnerLookupIo = {
         return data.memberships;
     },
 };
+/** A read right after sign-in or bot start can fail once; try again before reporting it. */
+export const OWNER_LOOKUP_RETRY_DELAYS_MS = [1_000, 2_000];
+async function withRetry(fn, io) {
+    const sleep = io.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let lastErr;
+    for (const delay of [0, ...OWNER_LOOKUP_RETRY_DELAYS_MS]) {
+        if (delay)
+            await sleep(delay);
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    throw lastErr;
+}
 export async function lookupOwnerContext(ownerUid, io = defaultOwnerLookupIo) {
     const checkedAt = (io.now ?? (() => new Date()))().toISOString();
     let token;
@@ -44,22 +61,23 @@ export async function lookupOwnerContext(ownerUid, io = defaultOwnerLookupIo) {
     }
     let signedInAs;
     try {
-        signedInAs = await io.callerPersonUid(token);
+        signedInAs = await withRetry(() => io.callerPersonUid(token), io);
     }
     catch (err) {
-        return { status: "unavailable", ownerUid, reason: `could not confirm who is signed in (${message(err)})`, checkedAt };
+        // The raw error ("…Sign in to HQ once…") would read to the model as "not signed in".
+        return { status: "unavailable", ownerUid, reason: "their HQ account could not be read just now", detail: message(err), checkedAt, signedIn: true };
     }
     if (signedInAs !== ownerUid)
         return { status: "mismatch", ownerUid, signedInAs, checkedAt };
     try {
-        const rows = await io.memberships(token);
+        const rows = await withRetry(() => io.memberships(token), io);
         const companies = rows
             .filter((m) => m.status === "active")
             .map((m) => ({ companyUid: m.companyUid, ...(m.companySlug ? { companySlug: m.companySlug } : {}), role: m.role }));
         return { status: "ok", ownerUid, companies, checkedAt };
     }
     catch (err) {
-        return { status: "unavailable", ownerUid, reason: `could not read your owner's companies (${message(err)})`, checkedAt };
+        return { status: "unavailable", ownerUid, reason: `could not read your owner's companies (${message(err)})`, checkedAt, signedIn: true };
     }
 }
 /** Successful lookups are reused for 5 minutes, failures retried after 1 minute. */
@@ -141,6 +159,12 @@ export function ownerContextBlock(ctx, agentUid) {
             `The HQ sign-in on this computer belongs to ${ctx.signedInAs}, not your owner, so your owner's companies could not be checked. ` +
                 "Do not say which companies your owner belongs to; tell them you could not check and why.";
     }
+    else if (ctx.signedIn) {
+        body =
+            `Your owner IS signed in to HQ on this computer, but their companies could not be checked: ${ctx.reason}. ` +
+                "Do not guess and do not say they have no company. Do not ask them to sign in or to run any command: " +
+                "say you could not read their account just now and that you will check again on their next message.";
+    }
     else {
         body =
             `Your owner's companies could not be checked: ${ctx.reason}. ` +

package/dist/lib/bot/run.js

@@ -311,7 +311,14 @@ export async function runBot(deps) {
         // by other people, who must not be handed the owner's companies.
         if (deps.ownerContext && sessionScope === "dm") {
             try {
-                prompt = `${ownerContextBlock(await deps.ownerContext(), config.agentUid)}\n\n${prompt}`;
+                const owner = await deps.ownerContext();
+                if (owner.status === "unavailable") {
+                    log("warn", `owner context unavailable: ${owner.reason}${owner.detail ? ` (${owner.detail})` : ""}`);
+                }
+                else if (owner.status === "mismatch") {
+                    log("warn", `owner context mismatch: signed in as ${owner.signedInAs}`);
+                }
+                prompt = `${ownerContextBlock(owner, config.agentUid)}\n\n${prompt}`;
             }
             catch (err) {
                 log("warn", `owner context unavailable: ${err instanceof Error ? err.message : String(err)}`);

package/dist/utils/cognito-session.js

@@ -18,6 +18,7 @@
  *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -496,19 +497,39 @@ export function describeCognitoTokenSource(opts = {}) {
  * `HQ_MACHINE_TOKEN_STATE_DIR` instead. Restores the prior env afterwards.
  */
 export async function withMachineTokenStateDir(fn, opts = {}) {
-    const home = opts.home ?? os.homedir();
-    const env = opts.env ?? process.env;
-    const prev = process.env.HQ_STATE_DIR;
-    process.env.HQ_STATE_DIR = machineTokenStateDir(home, env);
-    try {
-        return await fn();
-    }
-    finally {
-        if (prev === undefined)
-            delete process.env.HQ_STATE_DIR;
-        else
-            process.env.HQ_STATE_DIR = prev;
-    }
+    return withTokenStateDirSection(async () => {
+        const home = opts.home ?? os.homedir();
+        const env = opts.env ?? process.env;
+        const prev = process.env.HQ_STATE_DIR;
+        process.env.HQ_STATE_DIR = machineTokenStateDir(home, env);
+        try {
+            return await fn();
+        }
+        finally {
+            if (prev === undefined)
+                delete process.env.HQ_STATE_DIR;
+            else
+                process.env.HQ_STATE_DIR = prev;
+        }
+    });
+}
+/**
+ * The token cache location (`HQ_STATE_DIR`) is process-wide, and a machine mint
+ * points it at the machine cache across an await. A person-session read in the
+ * same process while that mint is in flight would load the MACHINE tokens: a
+ * local bot's resident (machine identity for its own calls) checking its
+ * owner's sign-in at startup got the bot's token and "No person entity found".
+ * Every section that swaps or reads the cache location runs one at a time;
+ * nested sections (a person read falling back to a machine mint) run inline.
+ */
+const tokenStateDirSection = new AsyncLocalStorage();
+let tokenStateDirTail = Promise.resolve();
+function withTokenStateDirSection(fn) {
+    if (tokenStateDirSection.getStore())
+        return fn();
+    const run = tokenStateDirTail.then(() => tokenStateDirSection.run(true, fn));
+    tokenStateDirTail = run.catch(() => undefined);
+    return run;
 }
 async function ensureMachineTokens() {
     return withMachineTokenStateDir(() => getValidMachineTokens(DEFAULT_COGNITO));
@@ -567,6 +588,11 @@ function markPersonSessionRejected(accessToken) {
  * a browser.
  */
 export async function ensureCognitoToken(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return ensureCognitoTokenUnserialized(options);
+    return withTokenStateDirSection(() => ensureCognitoTokenUnserialized(options));
+}
+async function ensureCognitoTokenUnserialized(options) {
     const interactive = options.interactive ?? true;
     // Machine identities (company agents) mint sessions on demand via
     // USER_PASSWORD_AUTH — no refresh-token dance, no browser. The vault API's
@@ -631,6 +657,11 @@ export async function ensureCognitoToken(options = {}) {
  * identical to `ensureCognitoToken` there.
  */
 export async function ensureCognitoIdToken(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return ensureCognitoIdTokenUnserialized(options);
+    return withTokenStateDirSection(() => ensureCognitoIdTokenUnserialized(options));
+}
+async function ensureCognitoIdTokenUnserialized(options) {
     const interactive = options.interactive ?? true;
     if (wantsMachineCognitoTokens(options)) {
         const machine = await ensureMachineTokensMaybeFallback(options);
@@ -704,6 +735,11 @@ export function buildVaultConfig(authToken) {
  * reason string and can decide what to do next. Never opens a browser.
  */
 export async function refreshCachedSession(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return refreshCachedSessionUnserialized(options);
+    return withTokenStateDirSection(() => refreshCachedSessionUnserialized(options));
+}
+async function refreshCachedSessionUnserialized(options) {
     // Machine identities have no refresh token; ensure a valid cached machine
     // session without forcing a re-mint when the cache is already healthy.
     // Tokens land under the dedicated machine/daemon state dir.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.111.0",
+  "version": "5.111.1",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {