@indigoai-us/hq-cli 5.111.1 → 5.112.0

package/dist/command-registration-plan.d.ts

@@ -0,0 +1,394 @@
+import type { Command } from "commander";
+/**
+ * The one authoritative registration plan for eager validation and lazy
+ * invocation. Multi-module roots keep the old registration order here.
+ */
+export declare const REGISTRATION_PLAN: readonly [{
+    readonly type: "group";
+    readonly root: "modules";
+    readonly id: "modules";
+    readonly name: "modules";
+    readonly description: "Module management commands";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/add.js";
+    readonly exportName: "registerAddCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/sync.js";
+    readonly exportName: "registerSyncCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/list.js";
+    readonly exportName: "registerListCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "modules";
+    readonly parent: "modules";
+    readonly module: "./commands/update.js";
+    readonly exportName: "registerUpdateCommand";
+}, {
+    readonly type: "group";
+    readonly root: "packages";
+    readonly id: "packages";
+    readonly name: "packages";
+    readonly description: "Package management commands";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-install.js";
+    readonly exportName: "registerPackageInstallCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-remove.js";
+    readonly exportName: "registerPackageRemoveCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-update.js";
+    readonly exportName: "registerPackageUpdateCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/pkg-list.js";
+    readonly exportName: "registerPackageListCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packages";
+    readonly parent: "packages";
+    readonly module: "./commands/packs.js";
+    readonly exportName: "registerPacksCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "packs";
+    readonly parent: "program";
+    readonly module: "./commands/packs.js";
+    readonly exportName: "registerPacksCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "install";
+    readonly parent: "program";
+    readonly module: "./commands/pkg-install.js";
+    readonly exportName: "registerPackageInstallCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "remove";
+    readonly parent: "program";
+    readonly module: "./commands/pkg-remove.js";
+    readonly exportName: "registerPackageRemoveCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "publish";
+    readonly parent: "program";
+    readonly module: "./commands/publish.js";
+    readonly exportName: "registerPublishCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "creators";
+    readonly parent: "program";
+    readonly module: "./commands/creators.js";
+    readonly exportName: "registerCreatorsCommand";
+}, {
+    readonly type: "group";
+    readonly root: "sync";
+    readonly id: "sync";
+    readonly name: "sync";
+    readonly description: "Cloud sync commands — sync HQ to S3 for mobile access";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/cloud.js";
+    readonly exportName: "registerCloudCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/sync-mode.js";
+    readonly exportName: "registerSyncModeCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/sync-narrow.js";
+    readonly exportName: "registerSyncNarrowCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "sync";
+    readonly parent: "sync";
+    readonly module: "./commands/sync-manifest.js";
+    readonly exportName: "registerSyncManifestCommand";
+}, {
+    readonly type: "group";
+    readonly root: "cloud";
+    readonly id: "cloud";
+    readonly name: "cloud";
+    readonly description: "Cloud commands — provision entities and manage cloud-backed companies";
+}, {
+    readonly type: "registrar";
+    readonly root: "cloud";
+    readonly parent: "cloud";
+    readonly module: "./commands/cloud-provision.js";
+    readonly exportName: "registerCloudProvisionCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "cloud";
+    readonly parent: "cloud";
+    readonly module: "./commands/cloud-demote.js";
+    readonly exportName: "registerCloudDemoteCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "team-sync";
+    readonly parent: "program";
+    readonly module: "./commands/team-sync.js";
+    readonly exportName: "registerTeamSyncCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "login";
+    readonly parent: "program";
+    readonly module: "./commands/login.js";
+    readonly exportName: "registerLoginCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "logout";
+    readonly parent: "program";
+    readonly module: "./commands/logout.js";
+    readonly exportName: "registerLogoutCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "whoami";
+    readonly parent: "program";
+    readonly module: "./commands/whoami.js";
+    readonly exportName: "registerWhoamiCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "auth";
+    readonly parent: "program";
+    readonly module: "./commands/auth.js";
+    readonly exportName: "registerAuthCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "secrets";
+    readonly parent: "program";
+    readonly module: "./commands/secrets.js";
+    readonly exportName: "registerSecretsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "db";
+    readonly parent: "program";
+    readonly module: "./commands/db.js";
+    readonly exportName: "registerDbCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "api-keys";
+    readonly parent: "program";
+    readonly module: "./commands/api-keys.js";
+    readonly exportName: "registerApiKeysCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "run";
+    readonly parent: "program";
+    readonly module: "./commands/run.js";
+    readonly exportName: "registerRunCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "groups";
+    readonly parent: "program";
+    readonly module: "./commands/groups.js";
+    readonly exportName: "registerGroupsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "workers";
+    readonly parent: "program";
+    readonly module: "./commands/workers.js";
+    readonly exportName: "registerWorkersCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "group-grants";
+    readonly parent: "program";
+    readonly module: "./commands/group-grants.js";
+    readonly exportName: "registerGroupGrantsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "files";
+    readonly parent: "program";
+    readonly module: "./commands/files.js";
+    readonly exportName: "registerFilesCommand";
+    readonly result: "files";
+}, {
+    readonly type: "registrar";
+    readonly root: "files";
+    readonly parent: "files";
+    readonly module: "./commands/files-browse.js";
+    readonly exportName: "registerFilesBrowseCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "access";
+    readonly parent: "program";
+    readonly module: "./commands/access.js";
+    readonly exportName: "registerAccessCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "skill";
+    readonly parent: "program";
+    readonly module: "./commands/skill.js";
+    readonly exportName: "registerSkillCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "members";
+    readonly parent: "program";
+    readonly module: "./commands/members.js";
+    readonly exportName: "registerMembersCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "people";
+    readonly parent: "program";
+    readonly module: "./commands/people.js";
+    readonly exportName: "registerPeopleCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "dm";
+    readonly parent: "program";
+    readonly module: "./commands/dm.js";
+    readonly exportName: "registerDmCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "channels";
+    readonly parent: "program";
+    readonly module: "./commands/channels.js";
+    readonly exportName: "registerChannelsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "onboard";
+    readonly parent: "program";
+    readonly module: "./commands/onboard.js";
+    readonly exportName: "registerOnboardCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "feedback";
+    readonly parent: "program";
+    readonly module: "./commands/feedback.js";
+    readonly exportName: "registerFeedbackCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "meetings";
+    readonly parent: "program";
+    readonly module: "./commands/meetings.js";
+    readonly exportName: "registerMeetingsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "sources";
+    readonly parent: "program";
+    readonly module: "./commands/sources.js";
+    readonly exportName: "registerSourcesCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "signals";
+    readonly parent: "program";
+    readonly module: "./commands/signals.js";
+    readonly exportName: "registerSignalsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "integrations";
+    readonly parent: "program";
+    readonly module: "./commands/integrations.js";
+    readonly exportName: "registerIntegrationsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "reindex";
+    readonly parent: "program";
+    readonly module: "./commands/reindex.js";
+    readonly exportName: "registerReindexCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "rescue";
+    readonly parent: "program";
+    readonly module: "./commands/rescue.js";
+    readonly exportName: "registerRescueCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "mcp";
+    readonly parent: "program";
+    readonly module: "./commands/mcp-status.js";
+    readonly exportName: "registerMcpCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "crm";
+    readonly parent: "program";
+    readonly module: "./commands/crm.js";
+    readonly exportName: "registerCrmCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "company";
+    readonly parent: "program";
+    readonly module: "./commands/company.js";
+    readonly exportName: "registerCompanyCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "agents";
+    readonly parent: "program";
+    readonly module: "./commands/agents.js";
+    readonly exportName: "registerAgentsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "outposts";
+    readonly parent: "program";
+    readonly module: "./commands/outposts.js";
+    readonly exportName: "registerOutpostsCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "billing";
+    readonly parent: "program";
+    readonly module: "./commands/billing.js";
+    readonly exportName: "registerBillingCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "core";
+    readonly parent: "program";
+    readonly module: "./commands/core.js";
+    readonly exportName: "registerCoreCommands";
+}, {
+    readonly type: "registrar";
+    readonly root: "search";
+    readonly parent: "program";
+    readonly module: "./commands/search.js";
+    readonly exportName: "registerSearchCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "index";
+    readonly parent: "program";
+    readonly module: "./commands/index-cmd.js";
+    readonly exportName: "registerIndexCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "doctor";
+    readonly parent: "program";
+    readonly module: "./commands/doctor.js";
+    readonly exportName: "registerDoctorCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "mesh";
+    readonly parent: "program";
+    readonly module: "./commands/mesh.js";
+    readonly exportName: "registerMeshCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "bot";
+    readonly parent: "program";
+    readonly module: "./commands/bot.js";
+    readonly exportName: "registerBotCommand";
+}];
+export declare function registerAllCommands(program: Command): Promise<void>;
+export declare function registerCommandRoot(program: Command, root: string): Promise<boolean>;
+//# sourceMappingURL=command-registration-plan.d.ts.map

package/dist/command-registration-plan.js

@@ -0,0 +1,103 @@
+/**
+ * The one authoritative registration plan for eager validation and lazy
+ * invocation. Multi-module roots keep the old registration order here.
+ */
+export const REGISTRATION_PLAN = [
+    { type: "group", root: "modules", id: "modules", name: "modules", description: "Module management commands" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/add.js", exportName: "registerAddCommand" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/sync.js", exportName: "registerSyncCommand" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/list.js", exportName: "registerListCommand" },
+    { type: "registrar", root: "modules", parent: "modules", module: "./commands/update.js", exportName: "registerUpdateCommand" },
+    { type: "group", root: "packages", id: "packages", name: "packages", description: "Package management commands" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-install.js", exportName: "registerPackageInstallCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-remove.js", exportName: "registerPackageRemoveCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-update.js", exportName: "registerPackageUpdateCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/pkg-list.js", exportName: "registerPackageListCommand" },
+    { type: "registrar", root: "packages", parent: "packages", module: "./commands/packs.js", exportName: "registerPacksCommand" },
+    { type: "registrar", root: "packs", parent: "program", module: "./commands/packs.js", exportName: "registerPacksCommand" },
+    { type: "registrar", root: "install", parent: "program", module: "./commands/pkg-install.js", exportName: "registerPackageInstallCommand" },
+    { type: "registrar", root: "remove", parent: "program", module: "./commands/pkg-remove.js", exportName: "registerPackageRemoveCommand" },
+    { type: "registrar", root: "publish", parent: "program", module: "./commands/publish.js", exportName: "registerPublishCommand" },
+    { type: "registrar", root: "creators", parent: "program", module: "./commands/creators.js", exportName: "registerCreatorsCommand" },
+    { type: "group", root: "sync", id: "sync", name: "sync", description: "Cloud sync commands — sync HQ to S3 for mobile access" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/cloud.js", exportName: "registerCloudCommands" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-mode.js", exportName: "registerSyncModeCommand" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-narrow.js", exportName: "registerSyncNarrowCommand" },
+    { type: "registrar", root: "sync", parent: "sync", module: "./commands/sync-manifest.js", exportName: "registerSyncManifestCommand" },
+    { type: "group", root: "cloud", id: "cloud", name: "cloud", description: "Cloud commands — provision entities and manage cloud-backed companies" },
+    { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-provision.js", exportName: "registerCloudProvisionCommands" },
+    { type: "registrar", root: "cloud", parent: "cloud", module: "./commands/cloud-demote.js", exportName: "registerCloudDemoteCommands" },
+    { type: "registrar", root: "team-sync", parent: "program", module: "./commands/team-sync.js", exportName: "registerTeamSyncCommand" },
+    { type: "registrar", root: "login", parent: "program", module: "./commands/login.js", exportName: "registerLoginCommand" },
+    { type: "registrar", root: "logout", parent: "program", module: "./commands/logout.js", exportName: "registerLogoutCommand" },
+    { type: "registrar", root: "whoami", parent: "program", module: "./commands/whoami.js", exportName: "registerWhoamiCommand" },
+    { type: "registrar", root: "auth", parent: "program", module: "./commands/auth.js", exportName: "registerAuthCommands" },
+    { type: "registrar", root: "secrets", parent: "program", module: "./commands/secrets.js", exportName: "registerSecretsCommand" },
+    { type: "registrar", root: "db", parent: "program", module: "./commands/db.js", exportName: "registerDbCommand" },
+    { type: "registrar", root: "api-keys", parent: "program", module: "./commands/api-keys.js", exportName: "registerApiKeysCommand" },
+    { type: "registrar", root: "run", parent: "program", module: "./commands/run.js", exportName: "registerRunCommand" },
+    { type: "registrar", root: "groups", parent: "program", module: "./commands/groups.js", exportName: "registerGroupsCommand" },
+    { type: "registrar", root: "workers", parent: "program", module: "./commands/workers.js", exportName: "registerWorkersCommand" },
+    { type: "registrar", root: "group-grants", parent: "program", module: "./commands/group-grants.js", exportName: "registerGroupGrantsCommand" },
+    { type: "registrar", root: "files", parent: "program", module: "./commands/files.js", exportName: "registerFilesCommand", result: "files" },
+    { type: "registrar", root: "files", parent: "files", module: "./commands/files-browse.js", exportName: "registerFilesBrowseCommands" },
+    { type: "registrar", root: "access", parent: "program", module: "./commands/access.js", exportName: "registerAccessCommand" },
+    { type: "registrar", root: "skill", parent: "program", module: "./commands/skill.js", exportName: "registerSkillCommand" },
+    { type: "registrar", root: "members", parent: "program", module: "./commands/members.js", exportName: "registerMembersCommand" },
+    { type: "registrar", root: "people", parent: "program", module: "./commands/people.js", exportName: "registerPeopleCommand" },
+    { type: "registrar", root: "dm", parent: "program", module: "./commands/dm.js", exportName: "registerDmCommand" },
+    { type: "registrar", root: "channels", parent: "program", module: "./commands/channels.js", exportName: "registerChannelsCommand" },
+    { type: "registrar", root: "onboard", parent: "program", module: "./commands/onboard.js", exportName: "registerOnboardCommand" },
+    { type: "registrar", root: "feedback", parent: "program", module: "./commands/feedback.js", exportName: "registerFeedbackCommand" },
+    { type: "registrar", root: "meetings", parent: "program", module: "./commands/meetings.js", exportName: "registerMeetingsCommand" },
+    { type: "registrar", root: "sources", parent: "program", module: "./commands/sources.js", exportName: "registerSourcesCommand" },
+    { type: "registrar", root: "signals", parent: "program", module: "./commands/signals.js", exportName: "registerSignalsCommand" },
+    { type: "registrar", root: "integrations", parent: "program", module: "./commands/integrations.js", exportName: "registerIntegrationsCommand" },
+    { type: "registrar", root: "reindex", parent: "program", module: "./commands/reindex.js", exportName: "registerReindexCommand" },
+    { type: "registrar", root: "rescue", parent: "program", module: "./commands/rescue.js", exportName: "registerRescueCommand" },
+    { type: "registrar", root: "mcp", parent: "program", module: "./commands/mcp-status.js", exportName: "registerMcpCommand" },
+    { type: "registrar", root: "crm", parent: "program", module: "./commands/crm.js", exportName: "registerCrmCommand" },
+    { type: "registrar", root: "company", parent: "program", module: "./commands/company.js", exportName: "registerCompanyCommand" },
+    { type: "registrar", root: "agents", parent: "program", module: "./commands/agents.js", exportName: "registerAgentsCommand" },
+    { type: "registrar", root: "outposts", parent: "program", module: "./commands/outposts.js", exportName: "registerOutpostsCommand" },
+    { type: "registrar", root: "billing", parent: "program", module: "./commands/billing.js", exportName: "registerBillingCommand" },
+    { type: "registrar", root: "core", parent: "program", module: "./commands/core.js", exportName: "registerCoreCommands" },
+    { type: "registrar", root: "search", parent: "program", module: "./commands/search.js", exportName: "registerSearchCommand" },
+    { type: "registrar", root: "index", parent: "program", module: "./commands/index-cmd.js", exportName: "registerIndexCommand" },
+    { type: "registrar", root: "doctor", parent: "program", module: "./commands/doctor.js", exportName: "registerDoctorCommand" },
+    { type: "registrar", root: "mesh", parent: "program", module: "./commands/mesh.js", exportName: "registerMeshCommand" },
+    { type: "registrar", root: "bot", parent: "program", module: "./commands/bot.js", exportName: "registerBotCommand" },
+];
+async function executePlan(program, steps) {
+    const parents = new Map([["program", program]]);
+    for (const step of steps) {
+        if (step.type === "group") {
+            parents.set(step.id, program.command(step.name).description(step.description));
+            continue;
+        }
+        const parent = parents.get(step.parent);
+        if (!parent)
+            throw new Error(`Missing command parent '${step.parent}' for '${step.exportName}'`);
+        const imported = await import(step.module);
+        const register = imported[step.exportName];
+        if (!register)
+            throw new Error(`Missing command registrar '${step.exportName}' from '${step.module}'`);
+        const result = register(parent);
+        if (step.result) {
+            if (!result)
+                throw new Error(`Command registrar '${step.exportName}' did not return '${step.result}'`);
+            parents.set(step.result, result);
+        }
+    }
+}
+export async function registerAllCommands(program) {
+    await executePlan(program, REGISTRATION_PLAN);
+}
+export async function registerCommandRoot(program, root) {
+    const steps = REGISTRATION_PLAN.filter((step) => step.root === root);
+    if (steps.length === 0)
+        return false;
+    await executePlan(program, steps);
+    return true;
+}
+//# sourceMappingURL=command-registration-plan.js.map

package/dist/commands/core.js

@@ -46,6 +46,7 @@ import { archiveOldThreads } from "../lib/core-utils/archive-old-threads.js";
 import { qmdReindexAfterSync } from "../lib/core-utils/qmd-reindex-after-sync.js";
 import { softTimeoutCommand } from "../lib/core-utils/soft-timeout.js";
 import { timeoutGuardCommand } from "../lib/core-utils/timeout-guard.js";
+import { readSentryReportStdin, reportSentryEvent } from "../lib/core-utils/sentry-report.js";
 /**
  * These commands are now native implementations. Their retained shell assets
  * are deliberately claimed in SCAFFOLD_ONLY_ASSETS: loose HQ trees still ship
@@ -457,6 +458,23 @@ export function registerCoreCommands(program) {
         if (code !== 0)
             process.exit(code);
     });
+    // `hq core sentry report` — constrained, stderr-diagnostic-only transport
+    // for hook health events. Event data is accepted only on stdin so it never
+    // appears in the process list shared by the fleet.
+    core
+        .command("sentry")
+        .description("Constrained diagnostics transport for HQ hooks")
+        .command("report")
+        .description("Report one validated hook diagnostic from stdin")
+        .option("--dry-run", "validate and print the scrubbed Sentry event projection without sending")
+        .option("--timeout-ms <milliseconds>", "bounded Sentry flush budget (1-5000ms)")
+        .action(async (options) => {
+        const stdin = await readSentryReportStdin(process.stdin);
+        const timeoutMs = options.timeoutMs === undefined ? undefined : Number(options.timeoutMs);
+        const result = await reportSentryEvent(stdin ?? "", { dryRun: options.dryRun, timeoutMs });
+        if (result.code !== 0)
+            process.exitCode = result.code;
+    });
     return core;
 }
 //# sourceMappingURL=core.js.map

package/dist/commands/whoami.d.ts

@@ -2,5 +2,22 @@
  * hq whoami — displays current user or 'not logged in'
  */
 import { Command } from 'commander';
+export interface WhoamiTokenIdentity {
+    email?: string;
+    sub?: string;
+    delegatedEmail?: string;
+    delegatedSub?: string;
+    entityType?: string;
+    entityUid?: string;
+}
+export interface WhoamiDisplayIdentity {
+    email?: string;
+    sub?: string;
+}
+/**
+ * Resolves the person represented by an ID token without pairing a delegated
+ * email with the token subject of the delegating machine.
+ */
+export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
 export declare function registerWhoamiCommand(program: Command): void;
 //# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.js

@@ -5,11 +5,33 @@ import chalk from 'chalk';
 import { loadCachedTokens, isExpiring, loadMachineCreds, } from '@indigoai-us/hq-cloud';
 import { peekIdToken as decodeIdToken } from "../utils/id-token.js";
 import { loadMachineCachedTokens, resolveCognitoTokenSource } from "../utils/cognito-session.js";
+/**
+ * Resolves the person represented by an ID token without pairing a delegated
+ * email with the token subject of the delegating machine.
+ */
+export function resolveWhoamiIdentity(identity) {
+    if (identity.email !== undefined && identity.sub !== undefined) {
+        return { email: identity.email, sub: identity.sub };
+    }
+    if (identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined) {
+        return { email: identity.delegatedEmail, sub: identity.delegatedSub };
+    }
+    if (identity.email !== undefined || identity.sub !== undefined) {
+        return { email: identity.email, sub: identity.sub };
+    }
+    return {};
+}
 function peekIdToken(idToken) {
     const decoded = decodeIdToken(idToken);
     return {
         email: typeof decoded.email === "string" ? decoded.email : undefined,
         sub: typeof decoded.sub === "string" ? decoded.sub : undefined,
+        delegatedEmail: typeof decoded["custom:delegatedEmail"] === "string"
+            ? decoded["custom:delegatedEmail"]
+            : undefined,
+        delegatedSub: typeof decoded["custom:delegatedSub"] === "string"
+            ? decoded["custom:delegatedSub"]
+            : undefined,
         entityType: typeof decoded["custom:entityType"] === "string"
             ? decoded["custom:entityType"]
             : undefined,
@@ -34,6 +56,7 @@ export function registerWhoamiCommand(program) {
                 const machineCreds = machine ? loadMachineCreds() : null;
                 const identityCache = machine ? loadMachineCachedTokens() : cached;
                 const identity = identityCache ? peekIdToken(identityCache.idToken) : {};
+                const displayedIdentity = resolveWhoamiIdentity(identity);
                 const claims = identityCache ? decodeIdToken(identityCache.idToken) : {};
                 // Modern credentials carry the canonical UID. Legacy caches may only
                 // supply a UID when their subject is bound to the selected username.
@@ -48,7 +71,7 @@ export function registerWhoamiCommand(program) {
                     schemaVersion: 1,
                     authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
                     tokenSource: machine ? 'machine' : 'person',
-                    email: machine ? null : identity.email ?? null,
+                    email: machine ? null : displayedIdentity.email ?? null,
                     personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
                     agentUid,
                     username: machineCreds?.username ?? null,
@@ -72,11 +95,11 @@ export function registerWhoamiCommand(program) {
                 return;
             }
             if (isExpiring(cached, 0)) {
-                const who = peekIdToken(cached.idToken).email ?? 'unknown';
+                const who = resolveWhoamiIdentity(peekIdToken(cached.idToken)).email ?? 'unknown';
                 console.log(chalk.yellow(`Session expired for ${who}. Run 'hq login' to re-authenticate.`));
                 return;
             }
-            const { email, sub } = peekIdToken(cached.idToken);
+            const { email, sub } = resolveWhoamiIdentity(peekIdToken(cached.idToken));
             console.log(`Logged in as ${email ?? 'unknown'}${sub ? ` (${sub})` : ''}`);
         }
         catch (error) {