@indigoai-us/hq-cli 5.119.11 → 5.119.12

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [5.119.12] — 2026-09-18
+
+### Fixed
+
+- `hq files cat … --company prs_<person-uid>` now reads the file instead of
+  refusing with "No company found for slug". Reading a DM attachment needs the
+  sender's vault as the scope, and `cat` resolved that value as a company slug
+  of its own, after the same fix landed on the presign path.
+
 ## [5.119.11] — 2026-09-18
 
 ### Added

package/dist/commands/files-browse.js

@@ -43,7 +43,7 @@ import { S3Client, ListObjectsV2Command, GetObjectCommand, } from "@aws-sdk/clie
 import { VaultClient, grantPathToPrefix, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, DEFAULT_COGNITO, buildVaultConfig, } from "../utils/cognito-session.js";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
-import { getCompanyUid, looksLikeCompanyUid, vaultApiFetch, } from "../utils/vault-api.js";
+import { getCompanyUid, looksLikeCompanyUid, looksLikePersonVaultUid, vaultApiFetch, } from "../utils/vault-api.js";
 import { resolveCanonicalPersonUid } from "./cloud.js";
 // ── Pure helpers ────────────────────────────────────────────────────────────
 /**
@@ -306,18 +306,37 @@ export async function runCat(input) {
     }
     else {
         const slug = input.companySlug ?? parseCompanySlugFromPath(key);
-        const entity = await vaultClient.entity.findInMyNamespace("company", slug);
-        if (!entity) {
-            throw new Error(`No company found for slug '${slug}' in your namespace. Confirm you have an active membership.`);
+        if (looksLikePersonVaultUid(slug)) {
+            // A `prs_` scope names a PERSON'S vault, which is where a DM attachment
+            // lives (`chat/attachments/dm/<uidA>--<uidB>/…`). There is no company
+            // entity to look up — `findInMyNamespace("company", …)` can only ever
+            // find a company, so it refuses the one scope the server accepts
+            // (hq-pro #3571 authorizes either member of the pair; hq-cli #644 made
+            // the presign path carry the ref). Go straight to the presign path and
+            // let the vault API's per-key gate decide.
+            //
+            // The key is already bucket-relative: a person vault has no
+            // `companies/<slug>/` anchor to strip. `Bucket` is inert on this path —
+            // the browse-vend company client presigns by companyUid + key and never
+            // reads it — so the scope ref is carried through for error messages.
+            bucket = slug;
+            s3Key = key;
+            s3 = requireCompanyClient(input.companyClient)({ companyUid: slug });
         }
-        if (!entity.bucketName) {
-            throw new Error(`Company '${slug}' (${entity.uid}) has no provisioned bucket.`);
+        else {
+            const entity = await vaultClient.entity.findInMyNamespace("company", slug);
+            if (!entity) {
+                throw new Error(`No company found for slug '${slug}' in your namespace. Confirm you have an active membership.`);
+            }
+            if (!entity.bucketName) {
+                throw new Error(`Company '${slug}' (${entity.uid}) has no provisioned bucket.`);
+            }
+            bucket = entity.bucketName;
+            // Translate the anchored CLI key into the company-relative bucket key.
+            s3Key = toBucketRelative(key, slug);
+            // COMPANY mode (HQ-59): GetObject → presign GET. No STS vend, no direct S3.
+            s3 = requireCompanyClient(input.companyClient)({ companyUid: entity.uid });
         }
-        bucket = entity.bucketName;
-        // Translate the anchored CLI key into the company-relative bucket key.
-        s3Key = toBucketRelative(key, slug);
-        // COMPANY mode (HQ-59): GetObject → presign GET. No STS vend, no direct S3.
-        s3 = requireCompanyClient(input.companyClient)({ companyUid: entity.uid });
     }
     // HQ-CLI-5: when writing to --out, create the parent directory BEFORE issuing
     // the presigned GET, so no synchronous filesystem call sits between receiving

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.119.11",
+  "version": "5.119.12",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {