@indigoai-us/hq-cli 5.111.0 → 5.111.2

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [5.111.2] — 2026-09-15
+
+## [5.111.1] — 2026-09-14
+
+### Fixed
+
+- A new bot's first message no longer tells its signed-in owner they are not
+  signed in. While the bot fetched its own sign-in, a check of the owner's
+  sign-in in the same process could read the bot's credentials instead and find
+  no account. Sign-in reads now wait for that to finish.
+- When a bot cannot read its owner's account right away, it tries again before
+  answering, and never asks a signed-in owner to sign in or run a command. The
+  bot's log now records why an owner check failed.
+
 ## [5.111.0] — 2026-09-14
 
 ### Added

package/dist/commands/whoami.d.ts

@@ -2,5 +2,22 @@
  * hq whoami — displays current user or 'not logged in'
  */
 import { Command } from 'commander';
+export interface WhoamiTokenIdentity {
+    email?: string;
+    sub?: string;
+    delegatedEmail?: string;
+    delegatedSub?: string;
+    entityType?: string;
+    entityUid?: string;
+}
+export interface WhoamiDisplayIdentity {
+    email?: string;
+    sub?: string;
+}
+/**
+ * Resolves the person represented by an ID token without pairing a delegated
+ * email with the token subject of the delegating machine.
+ */
+export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
 export declare function registerWhoamiCommand(program: Command): void;
 //# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.js

@@ -5,11 +5,33 @@ import chalk from 'chalk';
 import { loadCachedTokens, isExpiring, loadMachineCreds, } from '@indigoai-us/hq-cloud';
 import { peekIdToken as decodeIdToken } from "../utils/id-token.js";
 import { loadMachineCachedTokens, resolveCognitoTokenSource } from "../utils/cognito-session.js";
+/**
+ * Resolves the person represented by an ID token without pairing a delegated
+ * email with the token subject of the delegating machine.
+ */
+export function resolveWhoamiIdentity(identity) {
+    if (identity.email !== undefined && identity.sub !== undefined) {
+        return { email: identity.email, sub: identity.sub };
+    }
+    if (identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined) {
+        return { email: identity.delegatedEmail, sub: identity.delegatedSub };
+    }
+    if (identity.email !== undefined || identity.sub !== undefined) {
+        return { email: identity.email, sub: identity.sub };
+    }
+    return {};
+}
 function peekIdToken(idToken) {
     const decoded = decodeIdToken(idToken);
     return {
         email: typeof decoded.email === "string" ? decoded.email : undefined,
         sub: typeof decoded.sub === "string" ? decoded.sub : undefined,
+        delegatedEmail: typeof decoded["custom:delegatedEmail"] === "string"
+            ? decoded["custom:delegatedEmail"]
+            : undefined,
+        delegatedSub: typeof decoded["custom:delegatedSub"] === "string"
+            ? decoded["custom:delegatedSub"]
+            : undefined,
         entityType: typeof decoded["custom:entityType"] === "string"
             ? decoded["custom:entityType"]
             : undefined,
@@ -34,6 +56,7 @@ export function registerWhoamiCommand(program) {
                 const machineCreds = machine ? loadMachineCreds() : null;
                 const identityCache = machine ? loadMachineCachedTokens() : cached;
                 const identity = identityCache ? peekIdToken(identityCache.idToken) : {};
+                const displayedIdentity = resolveWhoamiIdentity(identity);
                 const claims = identityCache ? decodeIdToken(identityCache.idToken) : {};
                 // Modern credentials carry the canonical UID. Legacy caches may only
                 // supply a UID when their subject is bound to the selected username.
@@ -48,7 +71,7 @@ export function registerWhoamiCommand(program) {
                     schemaVersion: 1,
                     authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
                     tokenSource: machine ? 'machine' : 'person',
-                    email: machine ? null : identity.email ?? null,
+                    email: machine ? null : displayedIdentity.email ?? null,
                     personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
                     agentUid,
                     username: machineCreds?.username ?? null,
@@ -72,11 +95,11 @@ export function registerWhoamiCommand(program) {
                 return;
             }
             if (isExpiring(cached, 0)) {
-                const who = peekIdToken(cached.idToken).email ?? 'unknown';
+                const who = resolveWhoamiIdentity(peekIdToken(cached.idToken)).email ?? 'unknown';
                 console.log(chalk.yellow(`Session expired for ${who}. Run 'hq login' to re-authenticate.`));
                 return;
             }
-            const { email, sub } = peekIdToken(cached.idToken);
+            const { email, sub } = resolveWhoamiIdentity(peekIdToken(cached.idToken));
             console.log(`Logged in as ${email ?? 'unknown'}${sub ? ` (${sub})` : ''}`);
         }
         catch (error) {

package/dist/lib/bot/owner-context.d.ts

@@ -29,6 +29,10 @@ export type OwnerContext = {
     ownerUid: string;
     reason: string;
     checkedAt: string;
+    /** True when the owner's sign-in exists and only reading their account failed. */
+    signedIn?: boolean;
+    /** Technical cause, for logs only; never shown to the model. */
+    detail?: string;
 } | {
     status: "mismatch";
     ownerUid: string;
@@ -48,8 +52,12 @@ export interface OwnerLookupIo {
         status: string;
     }>>;
     now?: () => Date;
+    /** Test seam for the retry pause. */
+    sleep?: (ms: number) => Promise<void>;
 }
 export declare const defaultOwnerLookupIo: OwnerLookupIo;
+/** A read right after sign-in or bot start can fail once; try again before reporting it. */
+export declare const OWNER_LOOKUP_RETRY_DELAYS_MS: number[];
 export declare function lookupOwnerContext(ownerUid: string, io?: OwnerLookupIo): Promise<OwnerContext>;
 /** Successful lookups are reused for 5 minutes, failures retried after 1 minute. */
 export declare const OWNER_CONTEXT_TTL_MS: number;

package/dist/lib/bot/owner-context.js

@@ -33,6 +33,23 @@ export const defaultOwnerLookupIo = {
         return data.memberships;
     },
 };
+/** A read right after sign-in or bot start can fail once; try again before reporting it. */
+export const OWNER_LOOKUP_RETRY_DELAYS_MS = [1_000, 2_000];
+async function withRetry(fn, io) {
+    const sleep = io.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    let lastErr;
+    for (const delay of [0, ...OWNER_LOOKUP_RETRY_DELAYS_MS]) {
+        if (delay)
+            await sleep(delay);
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    throw lastErr;
+}
 export async function lookupOwnerContext(ownerUid, io = defaultOwnerLookupIo) {
     const checkedAt = (io.now ?? (() => new Date()))().toISOString();
     let token;
@@ -44,22 +61,23 @@ export async function lookupOwnerContext(ownerUid, io = defaultOwnerLookupIo) {
     }
     let signedInAs;
     try {
-        signedInAs = await io.callerPersonUid(token);
+        signedInAs = await withRetry(() => io.callerPersonUid(token), io);
     }
     catch (err) {
-        return { status: "unavailable", ownerUid, reason: `could not confirm who is signed in (${message(err)})`, checkedAt };
+        // The raw error ("…Sign in to HQ once…") would read to the model as "not signed in".
+        return { status: "unavailable", ownerUid, reason: "their HQ account could not be read just now", detail: message(err), checkedAt, signedIn: true };
     }
     if (signedInAs !== ownerUid)
         return { status: "mismatch", ownerUid, signedInAs, checkedAt };
     try {
-        const rows = await io.memberships(token);
+        const rows = await withRetry(() => io.memberships(token), io);
         const companies = rows
             .filter((m) => m.status === "active")
             .map((m) => ({ companyUid: m.companyUid, ...(m.companySlug ? { companySlug: m.companySlug } : {}), role: m.role }));
         return { status: "ok", ownerUid, companies, checkedAt };
     }
     catch (err) {
-        return { status: "unavailable", ownerUid, reason: `could not read your owner's companies (${message(err)})`, checkedAt };
+        return { status: "unavailable", ownerUid, reason: `could not read your owner's companies (${message(err)})`, checkedAt, signedIn: true };
     }
 }
 /** Successful lookups are reused for 5 minutes, failures retried after 1 minute. */
@@ -141,6 +159,12 @@ export function ownerContextBlock(ctx, agentUid) {
             `The HQ sign-in on this computer belongs to ${ctx.signedInAs}, not your owner, so your owner's companies could not be checked. ` +
                 "Do not say which companies your owner belongs to; tell them you could not check and why.";
     }
+    else if (ctx.signedIn) {
+        body =
+            `Your owner IS signed in to HQ on this computer, but their companies could not be checked: ${ctx.reason}. ` +
+                "Do not guess and do not say they have no company. Do not ask them to sign in or to run any command: " +
+                "say you could not read their account just now and that you will check again on their next message.";
+    }
     else {
         body =
             `Your owner's companies could not be checked: ${ctx.reason}. ` +

package/dist/lib/bot/run.js

@@ -311,7 +311,14 @@ export async function runBot(deps) {
         // by other people, who must not be handed the owner's companies.
         if (deps.ownerContext && sessionScope === "dm") {
             try {
-                prompt = `${ownerContextBlock(await deps.ownerContext(), config.agentUid)}\n\n${prompt}`;
+                const owner = await deps.ownerContext();
+                if (owner.status === "unavailable") {
+                    log("warn", `owner context unavailable: ${owner.reason}${owner.detail ? ` (${owner.detail})` : ""}`);
+                }
+                else if (owner.status === "mismatch") {
+                    log("warn", `owner context mismatch: signed in as ${owner.signedInAs}`);
+                }
+                prompt = `${ownerContextBlock(owner, config.agentUid)}\n\n${prompt}`;
             }
             catch (err) {
                 log("warn", `owner context unavailable: ${err instanceof Error ? err.message : String(err)}`);

package/dist/lib/plan-limit-nag.d.ts

@@ -15,7 +15,7 @@
  * Additive only — never throws, never touches `process.exitCode`, never
  * writes to stdout. Env off-switch: `HQ_NO_PLAN_LIMIT_NAG=1`.
  */
-export declare const PLAN_LIMIT_UPGRADE_URL = "https://app.indigo-hq.com/billing/upgrade";
+export declare const PLAN_LIMIT_UPGRADE_URL = "https://hq.computer/billing/upgrade";
 export interface PlanLimitEntry {
     used: number;
     limit: number;

package/dist/lib/plan-limit-nag.js

@@ -19,7 +19,7 @@ import chalk from "chalk";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-export const PLAN_LIMIT_UPGRADE_URL = "https://app.indigo-hq.com/billing/upgrade";
+export const PLAN_LIMIT_UPGRADE_URL = "https://hq.computer/billing/upgrade";
 const DAY_MS = 24 * 60 * 60 * 1000;
 /** Module-level last-seen cell — overwritten by each successful parse. */
 let lastSeen = null;
@@ -58,9 +58,24 @@ function parseEntry(value) {
     }
     return { used: rec.used, limit: rec.limit, over: rec.over };
 }
+/** Validate the server-provided optional upgrade URL without throwing. */
+function parseUpgradeUrl(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        const parsed = new URL(value);
+        // hq-pro permits an environment-configured console base URL, so stages
+        // cannot use a production-host allowlist. HTTPS is the trust boundary.
+        return parsed.protocol === "https:" ? parsed.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Defensively parse a decoded JSON body for a well-formed top-level
- * `planLimits` object. Malformed or absent → null. Never throws.
+ * `planLimits` object and its optional `upgradeUrl`. Malformed or absent →
+ * null. Never throws.
  */
 function parsePlanLimits(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body)) {
@@ -81,7 +96,12 @@ function parsePlanLimits(body) {
         out[key] = entry;
         anyValid = true;
     }
-    return anyValid ? out : null;
+    return anyValid
+        ? {
+            limits: out,
+            upgradeUrl: parseUpgradeUrl(planLimits.upgradeUrl),
+        }
+        : null;
 }
 /**
  * Record plan-limit status from a decoded JSON response body.
@@ -90,11 +110,11 @@ function parsePlanLimits(body) {
  */
 export function recordPlanLimitStatus(body) {
     try {
-        const limits = parsePlanLimits(body);
-        if (limits === null)
+        const status = parsePlanLimits(body);
+        if (status === null)
             return;
-        const anyOver = Object.values(limits).some((e) => e.over);
-        lastSeen = { limits, anyOver };
+        const anyOver = Object.values(status.limits).some((e) => e.over);
+        lastSeen = { ...status, anyOver };
     }
     catch {
         // Never throw from record path.
@@ -150,9 +170,9 @@ function writeShownAt(statePath, shownAt) {
 function withinDayWindow(shownAt, nowMs) {
     return nowMs - shownAt < DAY_MS;
 }
-function buildOverBox(overEntries) {
+function buildOverBox(overEntries, upgradeUrl) {
     const title = "⚠ HQ plan limit exceeded";
-    const upgrade = `Upgrade: ${PLAN_LIMIT_UPGRADE_URL}`;
+    const upgrade = `Upgrade: ${upgradeUrl}`;
     const resourceLines = overEntries.map(([key, entry]) => `  ${key}: ${entry.used}/${entry.limit}`);
     const contentLines = [title, "", ...resourceLines, "", upgrade];
     const innerWidth = Math.max(...contentLines.map((l) => l.length), 40);
@@ -178,7 +198,8 @@ export function emitPlanLimitNag(opts = {}) {
         const write = opts.write ?? ((s) => process.stderr.write(s));
         const now = opts.now ?? (() => new Date());
         const statePath = opts.statePath ?? defaultStatePath();
-        const { limits, anyOver } = lastSeen;
+        const { limits, anyOver, upgradeUrl } = lastSeen;
+        const resolvedUpgradeUrl = upgradeUrl ?? PLAN_LIMIT_UPGRADE_URL;
         const entries = Object.entries(limits);
         if (entries.length === 0)
             return;
@@ -191,7 +212,7 @@ export function emitPlanLimitNag(opts = {}) {
                 return;
             overShownThisSession = true;
             const overEntries = entries.filter(([, e]) => e.over);
-            const box = buildOverBox(overEntries);
+            const box = buildOverBox(overEntries, resolvedUpgradeUrl);
             write(chalk.yellow(box) + "\n");
             writeShownAt(statePath, nowMs);
             return;
@@ -203,7 +224,7 @@ export function emitPlanLimitNag(opts = {}) {
         if (worst === null)
             return;
         warningShownThisSession = true;
-        const line = `⚠ HQ free plan: ${formatEntryLine(worst.key, worst.entry)}. Upgrade: ${PLAN_LIMIT_UPGRADE_URL}`;
+        const line = `⚠ HQ free plan: ${formatEntryLine(worst.key, worst.entry)}. Upgrade: ${resolvedUpgradeUrl}`;
         write(chalk.yellow(line) + "\n");
     }
     catch {

package/dist/utils/cognito-session.js

@@ -18,6 +18,7 @@
  *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -496,19 +497,39 @@ export function describeCognitoTokenSource(opts = {}) {
  * `HQ_MACHINE_TOKEN_STATE_DIR` instead. Restores the prior env afterwards.
  */
 export async function withMachineTokenStateDir(fn, opts = {}) {
-    const home = opts.home ?? os.homedir();
-    const env = opts.env ?? process.env;
-    const prev = process.env.HQ_STATE_DIR;
-    process.env.HQ_STATE_DIR = machineTokenStateDir(home, env);
-    try {
-        return await fn();
-    }
-    finally {
-        if (prev === undefined)
-            delete process.env.HQ_STATE_DIR;
-        else
-            process.env.HQ_STATE_DIR = prev;
-    }
+    return withTokenStateDirSection(async () => {
+        const home = opts.home ?? os.homedir();
+        const env = opts.env ?? process.env;
+        const prev = process.env.HQ_STATE_DIR;
+        process.env.HQ_STATE_DIR = machineTokenStateDir(home, env);
+        try {
+            return await fn();
+        }
+        finally {
+            if (prev === undefined)
+                delete process.env.HQ_STATE_DIR;
+            else
+                process.env.HQ_STATE_DIR = prev;
+        }
+    });
+}
+/**
+ * The token cache location (`HQ_STATE_DIR`) is process-wide, and a machine mint
+ * points it at the machine cache across an await. A person-session read in the
+ * same process while that mint is in flight would load the MACHINE tokens: a
+ * local bot's resident (machine identity for its own calls) checking its
+ * owner's sign-in at startup got the bot's token and "No person entity found".
+ * Every section that swaps or reads the cache location runs one at a time;
+ * nested sections (a person read falling back to a machine mint) run inline.
+ */
+const tokenStateDirSection = new AsyncLocalStorage();
+let tokenStateDirTail = Promise.resolve();
+function withTokenStateDirSection(fn) {
+    if (tokenStateDirSection.getStore())
+        return fn();
+    const run = tokenStateDirTail.then(() => tokenStateDirSection.run(true, fn));
+    tokenStateDirTail = run.catch(() => undefined);
+    return run;
 }
 async function ensureMachineTokens() {
     return withMachineTokenStateDir(() => getValidMachineTokens(DEFAULT_COGNITO));
@@ -567,6 +588,11 @@ function markPersonSessionRejected(accessToken) {
  * a browser.
  */
 export async function ensureCognitoToken(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return ensureCognitoTokenUnserialized(options);
+    return withTokenStateDirSection(() => ensureCognitoTokenUnserialized(options));
+}
+async function ensureCognitoTokenUnserialized(options) {
     const interactive = options.interactive ?? true;
     // Machine identities (company agents) mint sessions on demand via
     // USER_PASSWORD_AUTH — no refresh-token dance, no browser. The vault API's
@@ -631,6 +657,11 @@ export async function ensureCognitoToken(options = {}) {
  * identical to `ensureCognitoToken` there.
  */
 export async function ensureCognitoIdToken(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return ensureCognitoIdTokenUnserialized(options);
+    return withTokenStateDirSection(() => ensureCognitoIdTokenUnserialized(options));
+}
+async function ensureCognitoIdTokenUnserialized(options) {
     const interactive = options.interactive ?? true;
     if (wantsMachineCognitoTokens(options)) {
         const machine = await ensureMachineTokensMaybeFallback(options);
@@ -704,6 +735,11 @@ export function buildVaultConfig(authToken) {
  * reason string and can decide what to do next. Never opens a browser.
  */
 export async function refreshCachedSession(options = {}) {
+    if (wantsMachineCognitoTokens(options))
+        return refreshCachedSessionUnserialized(options);
+    return withTokenStateDirSection(() => refreshCachedSessionUnserialized(options));
+}
+async function refreshCachedSessionUnserialized(options) {
     // Machine identities have no refresh token; ensure a valid cached machine
     // session without forcing a re-mint when the cache is already healthy.
     // Tokens land under the dedicated machine/daemon state dir.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.111.0",
+  "version": "5.111.2",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {