@indigoai-us/hq-cli 5.12.1 → 5.12.3

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## [5.12.3] — 2026-05-12
+
+### Added
+
+- **`hq files share <prefix>...` (no `--with`) — browser-launched share-session flow.**
+  Mints an encrypted single-use token via `POST /files/{companyUid}/share-session`,
+  opens the default browser to `https://hq.{co}.com/share-session/<token>`, and lets
+  the issuer batch-pick recipients (members, groups, "Share with All") with per-recipient
+  read/write before submitting all grants in one round-trip. Variadic — accepts multiple
+  paths in a single invocation: `hq files share path/a/ path/b/ path/c/`.
+
+- **`--no-open` flag on `hq files share`** — prints the share-session URL without
+  launching a browser. Useful for headless contexts (SSH sessions, CI, paste-into-chat
+  workflows). Output includes the URL, paths, and `expiresAt` timestamp.
+
+- **`--with @all` for company-wide grants.** Writes a single ACL entry with
+  `granteeType: 'company-wide'` covering every active member of the company, replacing
+  the legacy `open: true` flag pattern with explicit, individually-revocable grants.
+  Works on both `hq files share` and `hq files unshare`. Members added after the grant
+  resolve through the company-wide entry automatically at vend-time — no ACL re-write
+  needed.
+
+### Fixed
+
+- **`hq --version` now prints the correct version.** The embedded version
+  constant had drifted from `package.json` since 5.12.1 (the 5.12.2 release
+  still reported `5.12.1`).
+
+### Backwards Compatibility
+
+- The legacy direct-grant form (`hq files share <prefix> --with <principal> --permission <level>`)
+  is unchanged. The browser flow only triggers when `--with` is absent. Scripted
+  automation calling the direct-grant form requires no changes.
+
+### Security Notes
+
+- Share-session tokens are AES-256-GCM encrypted with the master key and pin the issuer's
+  identity, the requested paths, and `maxPermissionByPath` at mint time. The web page
+  cannot grant beyond what the issuer had at mint, even if mutated client-side.
+- Default TTL: 15 minutes. Bounded `60s..7d` server-side.
+- Single-use: the submit endpoint claims the token's nonce atomically (DynamoDB
+  `attribute_not_exists`); a second submit returns 409.
+- **Treat share-session URLs as live capabilities** — do not paste them into commits,
+  thread files, journals, or any persistent surface. The 15-minute TTL is defense
+  in depth, not a license to log them.
+
+## [5.12.2] — 2026-05-10
+
+### Added
+
+- **`hq sync pull --all`** — fan out across every company you're a member of
+  plus your personal vault into `<hq-root>` in one shot. Companies land at
+  `<hq-root>/companies/<slug>`; the personal vault syncs at `<hq-root>` itself.
+  Mirrors the orchestration `hq-sync-runner --companies --direction pull` does
+  but reachable from the CLI front-end. Used by the Outpost cloud-init to
+  prime `/home/ec2-user/hq` on first boot.
+
 ## [5.12.1] — 2026-05-09
 
 ### Fixed

package/dist/commands/cloud.d.ts

@@ -13,5 +13,62 @@
  *   hq sync status            — show local journal summary
  */
 import { Command } from "commander";
+import { type ConflictStrategy } from "@indigoai-us/hq-cloud";
+export interface PullAllVaultClient {
+    listMyMemberships(): Promise<Array<{
+        companyUid: string;
+    }>>;
+    listPersonEntities(): Promise<Array<{
+        uid: string;
+        type: string;
+        slug: string;
+        bucketName?: string;
+        createdAt: string;
+    }>>;
+    getEntity(uid: string): Promise<{
+        slug?: string;
+        name?: string;
+    } | null>;
+}
+export interface SyncCallOptions {
+    company: string;
+    hqRoot: string;
+    onConflict?: ConflictStrategy;
+    personalMode?: boolean;
+    journalSlug?: string;
+}
+export interface SyncCallResult {
+    filesDownloaded: number;
+    bytesDownloaded: number;
+    filesSkipped: number;
+    conflicts: number;
+    conflictPaths: string[];
+    aborted: boolean;
+}
+export interface PullAllDeps {
+    vaultClient: PullAllVaultClient;
+    sync: (options: SyncCallOptions) => Promise<SyncCallResult>;
+}
+export interface PullAllOptions {
+    hqRoot: string;
+    onConflict?: ConflictStrategy;
+}
+export interface PullAllRow {
+    slug: string;
+    result?: SyncCallResult;
+    error?: string;
+}
+export interface PullAllResult {
+    attempted: number;
+    filesDownloaded: number;
+    bytesDownloaded: number;
+    conflicts: number;
+    errors: Array<{
+        company: string;
+        message: string;
+    }>;
+    perCompany: PullAllRow[];
+}
+export declare function pullAll(options: PullAllOptions, deps: PullAllDeps): Promise<PullAllResult>;
 export declare function registerCloudCommands(program: Command): void;
 //# sourceMappingURL=cloud.d.ts.map

package/dist/commands/cloud.js

@@ -13,12 +13,86 @@
  *   hq sync status            — show local journal summary
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="213f074e-13c2-5b95-9519-813adf9adfa9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e7f5f66e-78d5-5787-acb4-fe35424f69c9")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, sync, readJournal, getJournalPath, loadCachedTokens, } from "@indigoai-us/hq-cloud";
+import { share, sync, readJournal, getJournalPath, loadCachedTokens, VaultClient, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
+// Oldest-first by createdAt, ties broken by uid lexicographic — matches
+// `pickCanonicalPersonEntity` in @indigoai-us/hq-cloud so the CLI lands on
+// the same person bucket that `hq-sync-runner` picks.
+function pickCanonicalPerson(persons) {
+    const onlyPersons = persons.filter((e) => e.type === "person");
+    if (onlyPersons.length === 0)
+        return null;
+    return [...onlyPersons].sort((a, b) => {
+        if (a.createdAt !== b.createdAt)
+            return a.createdAt < b.createdAt ? -1 : 1;
+        return a.uid < b.uid ? -1 : 1;
+    })[0];
+}
+export async function pullAll(options, deps) {
+    const memberships = await deps.vaultClient.listMyMemberships();
+    const persons = await deps.vaultClient.listPersonEntities();
+    const plan = [];
+    for (const m of memberships) {
+        let slug = m.companyUid;
+        try {
+            const info = await deps.vaultClient.getEntity(m.companyUid);
+            if (info?.slug)
+                slug = info.slug;
+        }
+        catch {
+            // Best-effort — keep UID as the row label rather than aborting the run.
+        }
+        plan.push({
+            slug,
+            syncOptions: {
+                company: m.companyUid,
+                hqRoot: options.hqRoot,
+                ...(options.onConflict ? { onConflict: options.onConflict } : {}),
+            },
+        });
+    }
+    const personal = pickCanonicalPerson(persons);
+    if (personal) {
+        plan.push({
+            slug: "personal",
+            syncOptions: {
+                company: personal.uid,
+                hqRoot: options.hqRoot,
+                personalMode: true,
+                journalSlug: "personal",
+                ...(options.onConflict ? { onConflict: options.onConflict } : {}),
+            },
+        });
+    }
+    const result = {
+        attempted: 0,
+        filesDownloaded: 0,
+        bytesDownloaded: 0,
+        conflicts: 0,
+        errors: [],
+        perCompany: [],
+    };
+    for (const entry of plan) {
+        result.attempted += 1;
+        try {
+            const r = await deps.sync(entry.syncOptions);
+            result.filesDownloaded += r.filesDownloaded;
+            result.bytesDownloaded += r.bytesDownloaded;
+            result.conflicts += r.conflicts;
+            result.perCompany.push({ slug: entry.slug, result: r });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            result.errors.push({ company: entry.slug, message });
+            result.perCompany.push({ slug: entry.slug, error: message });
+        }
+    }
+    return result;
+}
 export function registerCloudCommands(program) {
     program
         .command("push")
@@ -143,7 +217,14 @@ export function registerCloudCommands(program) {
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
         .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
+        .option("--all", "Pull every company you are a member of plus your personal vault " +
+        "into <hq-root>. Companies land at <hq-root>/companies/<slug>; " +
+        "the personal vault syncs at <hq-root>. Ignores --company.")
         .action(async (options) => {
+        if (options.all) {
+            await runPullAll(options.hqRoot, options.onConflict);
+            return;
+        }
         try {
             console.log(chalk.bold("\nHQ Sync — Pull"));
             console.log(`  HQ root:  ${options.hqRoot}`);
@@ -211,6 +292,68 @@ export function registerCloudCommands(program) {
         }
     });
 }
+async function runPullAll(hqRoot, onConflict) {
+    console.log(chalk.bold("\nHQ Sync — Pull (all)"));
+    console.log(`  HQ root:  ${hqRoot}`);
+    console.log(`  Strategy: ${onConflict ?? "(interactive)"}\n`);
+    let result;
+    try {
+        const accessToken = await ensureCognitoToken();
+        const vaultConfig = buildVaultConfig(accessToken);
+        const realClient = new VaultClient(vaultConfig);
+        const adapter = {
+            listMyMemberships: () => realClient.listMyMemberships(),
+            listPersonEntities: () => realClient.entity.listByType("person"),
+            getEntity: async (uid) => {
+                try {
+                    return await realClient.entity.get(uid);
+                }
+                catch {
+                    return null;
+                }
+            },
+        };
+        result = await pullAll({ hqRoot, ...(onConflict ? { onConflict } : {}) }, {
+            vaultClient: adapter,
+            sync: (opts) => sync({
+                company: opts.company,
+                hqRoot: opts.hqRoot,
+                vaultConfig,
+                ...(opts.onConflict ? { onConflict: opts.onConflict } : {}),
+                ...(opts.personalMode !== undefined
+                    ? { personalMode: opts.personalMode }
+                    : {}),
+                ...(opts.journalSlug !== undefined
+                    ? { journalSlug: opts.journalSlug }
+                    : {}),
+            }),
+        });
+    }
+    catch (err) {
+        console.error(chalk.red("\n✗ Pull-all failed:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    for (const row of result.perCompany) {
+        if (row.error) {
+            console.log(chalk.red(`  ✗ ${row.slug}: ${row.error}`));
+        }
+        else if (row.result) {
+            const r = row.result;
+            const status = r.aborted ? chalk.yellow("⚠") : chalk.green("✓");
+            console.log(`  ${status} ${row.slug}: ${r.filesDownloaded} file(s), ` +
+                `${formatBytes(r.bytesDownloaded)}, ` +
+                `${r.filesSkipped} skipped, ${r.conflicts} conflict(s)` +
+                (r.aborted ? " — aborted" : ""));
+        }
+    }
+    const errored = result.errors.length;
+    const summary = `\nPulled ${result.filesDownloaded} file(s) ` +
+        `(${formatBytes(result.bytesDownloaded)}) across ${result.attempted} ` +
+        `target(s); ${result.conflicts} conflict(s); ${errored} error(s)`;
+    console.log(errored > 0 ? chalk.yellow(summary) : chalk.green(summary));
+    if (errored > 0)
+        process.exit(1);
+}
 function formatBytes(bytes) {
     if (bytes === 0)
         return "0 B";
@@ -266,4 +409,4 @@ function resolveUploadAuthorFromCache() {
     }
 }
 //# sourceMappingURL=cloud.js.map
-//# debugId=213f074e-13c2-5b95-9519-813adf9adfa9
+//# debugId=e7f5f66e-78d5-5787-acb4-fe35424f69c9

package/dist/commands/files.d.ts

@@ -1,3 +1,44 @@
 import { Command } from "commander";
+/**
+ * Parse a human-friendly duration string ("15m", "1h", "24h", "2d") into
+ * milliseconds. Returns null on parse failure. Mirrors the parser used in
+ * `secrets generate-link` but kept local so files.ts can be tested in
+ * isolation without importing the much larger secrets command surface.
+ */
+export declare function parseDuration(input: string): number | null;
+/** PRD upper bound on browser-launch share-session expiry. */
+export declare const MAX_SHARE_SESSION_EXPIRY_MS: number;
+export interface ShareSessionResponse {
+    url: string;
+    token?: string;
+    expiresAt: string;
+    nonce?: string;
+    paths?: string[];
+    maxPermissionByPath?: Record<string, string>;
+}
+export interface MintShareSessionParams {
+    token: string;
+    companyUid: string;
+    paths: string[];
+    expiresInMs?: number;
+}
+/**
+ * POST /files/{companyUid}/share-session — mint a browser-launch share
+ * session token. Returns the parsed response. Throws ShareSessionHttpError
+ * with a status + actionable message for any non-2xx so callers can render
+ * a single consistent error path.
+ */
+export declare function mintShareSession(params: MintShareSessionParams): Promise<ShareSessionResponse>;
+export declare class ShareSessionHttpError extends Error {
+    readonly status: number;
+    readonly path?: string | undefined;
+    constructor(status: number, message: string, path?: string | undefined);
+}
+/**
+ * Map a ShareSessionHttpError to user-facing copy. Centralizes the
+ * status → message mapping so the share command and any future caller
+ * stay in sync.
+ */
+export declare function formatShareSessionError(err: ShareSessionHttpError): string;
 export declare function registerFilesCommand(program: Command): void;
 //# sourceMappingURL=files.d.ts.map