@indigoai-us/hq-cli 5.136.0 → 5.138.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.138.0] — 2026-09-23
+
+### Fixed
+
+- `hq dm accept`, `decline`, and `block` now resolve pending requests to the
+  server's `personUid` field instead of sending unsupported action body fields.
+
+## [5.137.0] — 2026-09-23
+### Added
+
+- Added `hq channels members <channel>` to print channel members for human and machine-principal sessions, with a `--json` format for scripts.
+
 ## [5.136.0] — 2026-09-23
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -2333,7 +2333,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "accept";
-        readonly description: "Accept a pending connection request (by email, personUid, or pairKey). Their held message is then delivered.";
+        readonly description: "Accept a pending connection request (by requester email, personUid, or pairKey from `hq dm requests`). Their held message is then delivered.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <person>";
@@ -2346,7 +2346,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "decline";
-        readonly description: "Decline a pending connection request (by email, personUid, or pairKey).";
+        readonly description: "Decline a pending connection request (by requester email, personUid, or pairKey from `hq dm requests`).";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <person>";
@@ -2359,7 +2359,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "block";
-        readonly description: "Block a person so they can't send you further requests (by email, personUid, or pairKey).";
+        readonly description: "Block a person so they can't send you further requests (by requester email, personUid, or pairKey from `hq dm requests`).";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <person>";
@@ -2388,6 +2388,22 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly arguments: readonly [];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "members";
+        readonly description: "Print the members of one of your DM channels.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <channel>";
+        readonly arguments: readonly [{
+            readonly name: "channel";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Output the member array as JSON.";
+        }];
+        readonly subcommands: readonly [];
     }];
 }, {
     readonly name: "onboard";

package/dist/command-catalog.generated.js

@@ -3001,7 +3001,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "accept",
-                "description": "Accept a pending connection request (by email, personUid, or pairKey). Their held message is then delivered.",
+                "description": "Accept a pending connection request (by requester email, personUid, or pairKey from `hq dm requests`). Their held message is then delivered.",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <person>",
@@ -3017,7 +3017,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "decline",
-                "description": "Decline a pending connection request (by email, personUid, or pairKey).",
+                "description": "Decline a pending connection request (by requester email, personUid, or pairKey from `hq dm requests`).",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <person>",
@@ -3033,7 +3033,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "block",
-                "description": "Block a person so they can't send you further requests (by email, personUid, or pairKey).",
+                "description": "Block a person so they can't send you further requests (by requester email, personUid, or pairKey from `hq dm requests`).",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <person>",
@@ -3067,6 +3067,27 @@ export const COMMAND_CATALOG = [
                 "arguments": [],
                 "options": [],
                 "subcommands": []
+            },
+            {
+                "name": "members",
+                "description": "Print the members of one of your DM channels.",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <channel>",
+                "arguments": [
+                    {
+                        "name": "channel",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Output the member array as JSON."
+                    }
+                ],
+                "subcommands": []
             }
         ]
     },

package/dist/commands/channels.d.ts

@@ -1,5 +1,5 @@
 import { Command } from "commander";
-import { type ChannelSummary } from "./dm.js";
+import { type CallerIdentity, type ChannelMember, type ChannelSummary } from "./dm.js";
 /**
  * Human label for a channel row. Named channels (personal/company) show their
  * name + a `hq dm <slug>` hint; unnamed group DMs are identified by their
@@ -12,5 +12,13 @@ export declare function describeChannel(c: ChannelSummary): string;
  * fetched list) so the formatting is unit-testable without network/auth.
  */
 export declare function formatChannelsList(channels: ChannelSummary[]): string;
+/**
+ * Remove the caller from a channel roster before it is used for mentions.
+ * Machine principals identify themselves with the JWT uid; human sessions can
+ * also match the roster's email when the uid claim is absent.
+ */
+export declare function excludeCallerFromChannelMembers(members: ChannelMember[], caller: CallerIdentity): ChannelMember[];
+/** Render the roster as either dm-bind's tab-separated format or JSON. */
+export declare function formatChannelMembers(members: ChannelMember[], json: boolean): string;
 export declare function registerChannelsCommand(program: Command): void;
 //# sourceMappingURL=channels.d.ts.map

package/dist/commands/channels.js

@@ -1,7 +1,7 @@
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
-import { channelSlug } from "./dm.js";
+import { callerFromToken, channelSlug, fetchChannelMembers, fetchChannels, matchChannelsByName, } from "./dm.js";
 /**
  * Human label for a channel row. Named channels (personal/company) show their
  * name + a `hq dm <slug>` hint; unnamed group DMs are identified by their
@@ -42,6 +42,31 @@ export function formatChannelsList(channels) {
     }
     return lines.join("\n");
 }
+/**
+ * Remove the caller from a channel roster before it is used for mentions.
+ * Machine principals identify themselves with the JWT uid; human sessions can
+ * also match the roster's email when the uid claim is absent.
+ */
+export function excludeCallerFromChannelMembers(members, caller) {
+    return members.filter((member) => {
+        if (caller.personUid && member.personUid === caller.personUid)
+            return false;
+        if (caller.email &&
+            member.email &&
+            member.email.trim().toLowerCase() === caller.email) {
+            return false;
+        }
+        return true;
+    });
+}
+/** Render the roster as either dm-bind's tab-separated format or JSON. */
+export function formatChannelMembers(members, json) {
+    if (json)
+        return JSON.stringify(members);
+    return members
+        .map((member) => `${member.displayName ?? ""}\t${member.personUid}`)
+        .join("\n");
+}
 async function runChannelsList() {
     try {
         const token = await ensureCognitoToken();
@@ -64,6 +89,29 @@ async function runChannelsList() {
         process.exit(1);
     }
 }
+async function runChannelsMembers(channelName, opts) {
+    try {
+        const token = await ensureCognitoToken();
+        const channels = await fetchChannels(token);
+        const matches = matchChannelsByName(channels, channelName);
+        if (matches.length === 0) {
+            console.error(chalk.red(`No channel named '${channelName}' — run \`hq channels\` to see your channels.`));
+            process.exit(1);
+        }
+        if (matches.length > 1) {
+            const scopes = matches.map((match) => match.scope ?? "?").join(", ");
+            console.error(chalk.red(`'${channelName}' matches ${matches.length} channels (${scopes}) — this is ambiguous.`));
+            process.exit(1);
+        }
+        const members = await fetchChannelMembers(token, matches[0].channelId);
+        const visibleMembers = excludeCallerFromChannelMembers(members, callerFromToken(token));
+        console.log(formatChannelMembers(visibleMembers, opts.json === true));
+    }
+    catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 export function registerChannelsCommand(program) {
     const channels = program
         .command("channels")
@@ -74,5 +122,12 @@ export function registerChannelsCommand(program) {
         .action(async () => {
         await runChannelsList();
     });
+    channels
+        .command("members <channel>")
+        .description("Print the members of one of your DM channels.")
+        .option("--json", "Output the member array as JSON.")
+        .action(async (channelName, opts) => {
+        await runChannelsMembers(channelName, opts);
+    });
 }
 //# sourceMappingURL=channels.js.map

package/dist/commands/dm.d.ts

@@ -175,23 +175,24 @@ export interface ConnectionRequest {
  */
 export declare function matchRequest(requests: ConnectionRequest[], identifier: string): ConnectionRequest | null;
 /**
- * Build the POST body for an accept/decline/block action. Prefers a resolved
- * pairKey (from a matched pending request); otherwise falls back to the
- * recipient identifier the backend can resolve (`withPersonUid` for a prs_ UID,
- * `toEmail`-style is not supported by the connections endpoints so we send
- * `withEmail`). Pure → unit-testable.
+ * Build the POST body for an accept/decline/block action. The connections
+ * endpoints accept the requester's `personUid`, so resolve friendly email or
+ * pairKey input through the pending request before building the body. Pure →
+ * unit-testable.
  *
  * Throws Error with a user-facing message when the identifier can't be resolved.
  */
 export declare function buildConnectionActionBody(identifier: string, matched: ConnectionRequest | null): {
-    pairKey: string;
-} | {
-    withPersonUid: string;
-} | {
-    withEmail: string;
+    personUid: string;
 };
 /** Fetch the caller's channels (GET /v1/notify/channels). */
 export declare function fetchChannels(token: string): Promise<ChannelSummary[]>;
+/**
+ * Fetch a channel's roster (GET /v1/notify/channels/{id}/members). Any member
+ * who can read the channel may read its members, so this is the same gate the
+ * post itself passes. Used to resolve `@name` mentions into participant uids.
+ */
+export declare function fetchChannelMembers(token: string, channelId: string): Promise<ChannelMember[]>;
 /** One incoming DM as returned by GET /v1/notify/inbox. */
 export interface DmInboxEvent {
     eventId: string;

package/dist/commands/dm.js

@@ -355,25 +355,22 @@ export function matchRequest(requests, identifier) {
     return null;
 }
 /**
- * Build the POST body for an accept/decline/block action. Prefers a resolved
- * pairKey (from a matched pending request); otherwise falls back to the
- * recipient identifier the backend can resolve (`withPersonUid` for a prs_ UID,
- * `toEmail`-style is not supported by the connections endpoints so we send
- * `withEmail`). Pure → unit-testable.
+ * Build the POST body for an accept/decline/block action. The connections
+ * endpoints accept the requester's `personUid`, so resolve friendly email or
+ * pairKey input through the pending request before building the body. Pure →
+ * unit-testable.
  *
  * Throws Error with a user-facing message when the identifier can't be resolved.
  */
 export function buildConnectionActionBody(identifier, matched) {
     if (matched) {
-        return { pairKey: matched.pairKey };
+        return { personUid: matched.fromPersonUid };
     }
     const r = identifier.trim();
     const rcpt = detectRecipient(r);
     if (rcpt?.toPersonUid)
-        return { withPersonUid: rcpt.toPersonUid };
-    if (rcpt?.toEmail)
-        return { withEmail: rcpt.toEmail };
-    throw new Error(`Could not resolve '${identifier}' to a pending request — pass the requester's email, personUid, or the pairKey from \`hq dm requests\`.`);
+        return { personUid: rcpt.toPersonUid };
+    throw new Error(`Could not resolve '${identifier}' to a pending request — pass the requester's email or personUid, or a pairKey from \`hq dm requests\`.`);
 }
 const CONNECTION_ACTIONS = {
     accept: { path: "accept", done: "Connection accepted" },
@@ -503,7 +500,7 @@ export async function fetchChannels(token) {
  * who can read the channel may read its members, so this is the same gate the
  * post itself passes. Used to resolve `@name` mentions into participant uids.
  */
-async function fetchChannelMembers(token, channelId) {
+export async function fetchChannelMembers(token, channelId) {
     const res = await vaultApiFetch({
         token,
         path: `/v1/notify/channels/${encodeURIComponent(channelId)}/members`,
@@ -1328,19 +1325,19 @@ export function registerDmCommand(program) {
     });
     dm
         .command("accept <person>")
-        .description("Accept a pending connection request (by email, personUid, or pairKey). Their held message is then delivered.")
+        .description("Accept a pending connection request (by requester email, personUid, or pairKey from `hq dm requests`). Their held message is then delivered.")
         .action(async (person) => {
         await runConnectionAction("accept", person);
     });
     dm
         .command("decline <person>")
-        .description("Decline a pending connection request (by email, personUid, or pairKey).")
+        .description("Decline a pending connection request (by requester email, personUid, or pairKey from `hq dm requests`).")
         .action(async (person) => {
         await runConnectionAction("decline", person);
     });
     dm
         .command("block <person>")
-        .description("Block a person so they can't send you further requests (by email, personUid, or pairKey).")
+        .description("Block a person so they can't send you further requests (by requester email, personUid, or pairKey from `hq dm requests`).")
         .action(async (person) => {
         await runConnectionAction("block", person);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.136.0",
+  "version": "5.138.0",
   "description": "HQ by Indigo management CLI \u2014 modules and cloud sync",
   "main": "dist/index.js",
   "bin": {