@indigoai-us/hq-cli 5.14.1 → 5.15.0

package/.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: CI
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with
+      # an empty BUNDLED_DSN. That's intentional — the DSN is publish-only.
+      - run: npm run build --if-present
+      - run: npm run typecheck --if-present
+      - run: npm test --if-present

package/.github/workflows/publish.yml

@@ -0,0 +1,86 @@
+name: Publish to npm
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
+          # token-exchange flow. See hq-cloud's publish.yml for the full
+          # rationale (npm 10.x produces masked-404 failures on publish PUT).
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - run: node --version && npm --version
+      - run: npm ci
+
+      - name: Build
+        run: npm run build --if-present
+        env:
+          # generate-dsn.mjs fatals when GITHUB_JOB=publish and this var is
+          # missing. Set this as a repo secret to bundle a Sentry DSN into the
+          # published binary.
+          HQ_CLI_PUBLISH_SENTRY_DSN: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
+
+      # Inject Sentry debug IDs into compiled JS + map files. Must run after
+      # tsc and BEFORE publish so the installed binary carries the same debugId
+      # as the artifacts uploaded to Sentry, enabling debugId-based source-map
+      # resolution for globally-installed CLI users.
+      - name: Inject Sentry source map debug IDs
+        run: npx -y @sentry/cli@^2 sourcemaps inject dist/
+
+      # Pre-publish cross-package smoke test (Bug A guard).
+      #
+      # @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
+      # (^5.1.0). The smoke installs a freshly-packed tarball into an isolated
+      # tmpdir — outside this repo — so transitive @indigoai-us/* deps resolve
+      # from the npm registry, NOT from a local checkout. Booting `hq --version`
+      # then exercises the full module-load graph. If hq-cloud removed or
+      # renamed a symbol hq-cli imports, this catches it BEFORE the publish PUT.
+      #
+      # Bypass: set repo-or-workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1.
+      - name: Pre-publish smoke test
+        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH != '1' }}
+        run: bash .github/workflows/scripts/smoke-test-pkg.sh hq
+
+      - name: WARN — pre-publish smoke bypassed
+        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH == '1' }}
+        run: |
+          echo "::warning::WORKFLOW_ALLOW_BROKEN_PUBLISH=1 — pre-publish cross-package smoke test was BYPASSED. This release may ship a DOA package."
+
+      # Trusted-publisher OIDC; no NODE_AUTH_TOKEN. No --provenance (private
+      # repo limitation since npm 2026-05-10). Pre-release versions (with '-')
+      # get --tag rc to keep latest dist-tag pointing at stable releases only.
+      - name: Publish to npm
+        id: publish
+        run: |
+          NAME=$(jq -r .name package.json)
+          VER=$(jq -r .version package.json)
+          if npm view "$NAME@$VER" version >/dev/null 2>&1; then
+            echo "$NAME@$VER already on npm — skipping"
+          else
+            if echo "$VER" | grep -q '-'; then
+              npm publish --access public --tag rc
+            else
+              npm publish --access public
+            fi
+            echo "published=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload sourcemaps to Sentry
+        if: steps.publish.outputs.published == 'true'
+        run: |
+          VER=$(jq -r .version package.json)
+          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: indigo-d0
+          SENTRY_PROJECT: hq

package/.github/workflows/scripts/smoke-test-pkg.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# smoke-test-pkg.sh — pre-publish cross-package import smoke test (Bug A guard).
+#
+# Single-package adaptation of the same script used in the legacy hq monorepo.
+# The monorepo version operated on `packages/$PKG/package.json`; this version
+# reads `./package.json` because each extracted repo is a single package at
+# its root.
+#
+# Install the package in an isolated tmpdir — using a freshly-packed tarball
+# when the package.json version is new, or fetching the existing name@version
+# from npm when it is already published — then boot the binary with
+# `--version`. The boot exercises the full module-load graph and the
+# transitive `@indigoai-us/*` resolution path a customer's `npm install`
+# would take. If the boot fails the script exits non-zero and the workflow
+# aborts before any further publish steps run.
+#
+# Why we don't skip when the consumer's version is already on npm:
+#   @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
+#   (^5.1.0). A producer bump (published from indigoai-us/hq-cloud) re-resolves
+#   this consumer's transitive deps on the next fresh install, so an already-
+#   published consumer is NOT actually "locked." If the new producer drops or
+#   renames a symbol the published consumer imports, `hq --version` crashes
+#   on every fresh install starting the moment the producer publishes.
+#
+# Usage:
+#   smoke-test-pkg.sh <bin-name>
+# Example:
+#   smoke-test-pkg.sh hq
+
+set -uo pipefail
+
+BIN=${1:?usage: smoke-test-pkg.sh <bin-name>}
+
+PKG_JSON="package.json"
+if [ ! -f "$PKG_JSON" ]; then
+  echo "::error::smoke-test-pkg.sh: $PKG_JSON not found (cwd: $(pwd))"
+  exit 2
+fi
+
+NAME=$(jq -r .name "$PKG_JSON")
+VER=$(jq -r .version "$PKG_JSON")
+
+# Pick the install target. Already on npm → install by name@version so the
+# smoke matches what a customer would actually receive. Not yet on npm →
+# pack the local repo; the next publish step will push that exact byte-for-
+# byte content. Either way, `npm install` happens OUTSIDE this repo so
+# transitive @indigoai-us/* deps resolve from the registry.
+INSTALL_SOURCE=""
+if npm view "$NAME@$VER" version >/dev/null 2>&1; then
+  INSTALL_TARGET="$NAME@$VER"
+  INSTALL_SOURCE="npm registry (consumer version already published)"
+else
+  TARBALL_RELATIVE=$(npm pack --silent --pack-destination /tmp)
+  if [ -z "$TARBALL_RELATIVE" ]; then
+    echo "::error::npm pack produced no tarball for $NAME"
+    exit 1
+  fi
+  INSTALL_TARGET="/tmp/$TARBALL_RELATIVE"
+  if [ ! -f "$INSTALL_TARGET" ]; then
+    echo "::error::expected tarball at $INSTALL_TARGET not found"
+    exit 1
+  fi
+  INSTALL_SOURCE="packed tarball ($TARBALL_RELATIVE)"
+fi
+
+echo "::group::smoke test: $NAME@$VER via $INSTALL_SOURCE"
+
+SMOKE=$(mktemp -d)
+pushd "$SMOKE" >/dev/null
+
+printf '%s' '{"name":"smoke","version":"0.0.0","private":true}' > package.json
+
+if ! npm install --no-audit --no-fund --no-package-lock "$INSTALL_TARGET" >/tmp/smoke-install.log 2>&1; then
+  echo "::error::pre-publish smoke install FAILED for $NAME@$VER:"
+  tail -50 /tmp/smoke-install.log
+  popd >/dev/null
+  echo "::endgroup::"
+  exit 1
+fi
+
+set +e
+OUT=$("./node_modules/.bin/$BIN" --version 2>&1)
+CODE=$?
+set -e
+
+popd >/dev/null
+
+if [ "$CODE" -ne 0 ]; then
+  echo "::error::pre-publish smoke FAILED for $NAME@$VER (exit $CODE):"
+  echo "::error::$OUT"
+  echo "::error::Likely cause: a cross-package symbol was changed (added, removed, renamed) in another @indigoai-us/* package without keeping this consumer's import in sync. Bump this consumer (or revert the producer change) and re-tag, OR set the repo/workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1 to override (audited)."
+  echo "::endgroup::"
+  exit 1
+fi
+
+echo "✓ smoke ok: $NAME@$VER → $BIN --version → $OUT  (via $INSTALL_SOURCE)"
+echo "::endgroup::"

package/dist/commands/cloud-provision.js

@@ -28,7 +28,7 @@
  *       `initial_sync.ok=false`). Manifest + config may have been written.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5573abae-ee71-5106-94e7-3485e3e0fbb2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3c9e69f3-8137-5db1-8692-e38774558f61")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -164,7 +164,20 @@ export function ensureManifestEntryForProvision(hqRoot, slug) {
     if (path.basename(expected) !== slug)
         return;
     const dir = companyDirPath(hqRoot, slug);
-    if (!fs.existsSync(dir))
+    // Must be an actual directory, not a stray file. fs.existsSync returns true
+    // for regular files too — without this guard, auto-insert would fire on a
+    // file at `companies/<slug>`, provisionCompany would then create the vault
+    // entity and patch manifest.yaml before writeCompanyConfig's `mkdir -p .hq`
+    // exploded with ENOTDIR. statSync swallows the not-found case so a missing
+    // path is treated the same as before (no auto-insert).
+    let dirStat;
+    try {
+        dirStat = fs.statSync(dir);
+    }
+    catch {
+        return;
+    }
+    if (!dirStat.isDirectory())
         return;
     const raw = fs.readFileSync(mPath, "utf-8");
     let parsed;
@@ -536,4 +549,4 @@ export function registerCloudProvisionCommands(program) {
     });
 }
 //# sourceMappingURL=cloud-provision.js.map
-//# debugId=5573abae-ee71-5106-94e7-3485e3e0fbb2
+//# debugId=3c9e69f3-8137-5db1-8692-e38774558f61

package/dist/commands/meetings.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerMeetingsCommand(program: Command): void;
+//# sourceMappingURL=meetings.d.ts.map

package/dist/commands/meetings.js

@@ -0,0 +1,374 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8237a835-5842-52be-bb27-c4ffb7944d89")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+function formatDuration(seconds) {
+    const h = Math.floor(seconds / 3600);
+    const m = Math.floor((seconds % 3600) / 60);
+    const s = Math.floor(seconds % 60);
+    if (h > 0)
+        return `${h}h ${m}m`;
+    if (m > 0)
+        return `${m}m ${s}s`;
+    return `${s}s`;
+}
+function formatTimestamp(ts) {
+    const m = Math.floor(ts / 60);
+    const s = Math.floor(ts % 60);
+    return `${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
+}
+function statusBadge(status) {
+    switch (status) {
+        case "completed":
+            return chalk.green(status);
+        case "recording":
+            return chalk.red(status);
+        case "processing":
+            return chalk.yellow(status);
+        case "failed":
+            return chalk.red(status);
+        default:
+            return chalk.dim(status);
+    }
+}
+async function resolveShortId(token, prefix, query) {
+    if (prefix.includes("-") && prefix.length > 8)
+        return prefix;
+    const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
+    if (!res.ok)
+        return prefix;
+    const data = (await res.json());
+    const matches = data.meetings.filter((m) => m.meetingId.startsWith(prefix));
+    if (matches.length === 1)
+        return matches[0].meetingId;
+    if (matches.length > 1) {
+        console.error(chalk.red(`Ambiguous ID prefix "${prefix}" — matches ${matches.length} meetings. Use a longer prefix.`));
+        process.exit(1);
+    }
+    return prefix;
+}
+async function handleApiError(res) {
+    const body = (await res.json().catch(() => ({})));
+    if (res.status === 401) {
+        console.error(chalk.red("Not authenticated — run `hq login` first"));
+    }
+    else if (res.status === 403) {
+        console.error(chalk.red(body.error ?? "Not authorized"));
+    }
+    else if (res.status === 404) {
+        console.error(chalk.red(body.error ?? "Not found"));
+    }
+    else {
+        console.error(chalk.red(`API error (${res.status}): ${body.error ?? res.statusText}`));
+    }
+    process.exit(1);
+}
+function printMeetingTable(meetings) {
+    if (meetings.length === 0) {
+        console.log(chalk.dim("  No meetings found."));
+        return;
+    }
+    const ID_W = 8;
+    const TITLE_W = Math.min(40, Math.max(10, ...meetings.map((m) => m.title.length)));
+    const DATE_W = 16;
+    const DUR_W = 8;
+    const STATUS_W = 12;
+    const PARTS_W = 6;
+    const FLAGS_W = 5;
+    console.log(chalk.bold([
+        "ID".padEnd(ID_W),
+        "TITLE".padEnd(TITLE_W),
+        "DATE".padEnd(DATE_W),
+        "DUR".padEnd(DUR_W),
+        "STATUS".padEnd(STATUS_W),
+        "PARTS".padEnd(PARTS_W),
+        "FLAGS",
+    ].join("  ")));
+    for (const m of meetings) {
+        const id = m.meetingId.slice(0, 8);
+        const title = m.title.length > TITLE_W ? m.title.slice(0, TITLE_W - 1) + "…" : m.title;
+        const date = new Date(m.startTime).toLocaleDateString("en-US", {
+            month: "short",
+            day: "numeric",
+            hour: "2-digit",
+            minute: "2-digit",
+        });
+        const dur = formatDuration(m.duration);
+        const flags = [
+            m.hasTranscript ? "T" : "",
+            m.hasNotes ? "N" : "",
+        ].filter(Boolean).join("") || "-";
+        console.log([
+            chalk.cyan(id.padEnd(ID_W)),
+            title.padEnd(TITLE_W),
+            chalk.dim(date.padEnd(DATE_W)),
+            dur.padEnd(DUR_W),
+            statusBadge(m.status).padEnd(STATUS_W + 10), // chalk adds escape chars
+            String(m.participantCount).padEnd(PARTS_W),
+            flags,
+        ].join("  "));
+    }
+}
+export function registerMeetingsCommand(program) {
+    const meetings = program
+        .command("meetings")
+        .description("View and search meeting recordings, transcripts, and notes")
+        .option("--company <slug>", "Company slug (for multi-company users)")
+        .option("--json", "Output raw JSON instead of formatted text");
+    // ── hq meetings list ──────────────────────────────────────────────
+    meetings
+        .command("list")
+        .description("List recorded meetings (newest first)")
+        .option("--limit <n>", "Number of meetings to return (default: 20)")
+        .option("--next <token>", "Pagination token from a previous response")
+        .action(async (opts) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (opts.limit)
+                query.limit = opts.limit;
+            if (opts.next)
+                query.nextToken = opts.next;
+            if (companySlug)
+                query.companyId = companySlug;
+            const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
+            if (!res.ok)
+                await handleApiError(res);
+            const data = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            console.log(chalk.bold(`\nMeetings (${data.meetings.length}):\n`));
+            printMeetingTable(data.meetings);
+            if (data.nextToken) {
+                console.log(chalk.dim(`\n  More results available. Run with --next ${data.nextToken}`));
+            }
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings get <id> ──────────────────────────────────────────
+    meetings
+        .command("get <meetingId>")
+        .description("Show meeting details")
+        .action(async (rawId) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                query.companyId = companySlug;
+            const meetingId = await resolveShortId(token, rawId, query);
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+                query,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const detail = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(detail, null, 2));
+                return;
+            }
+            console.log(chalk.bold(`\n${detail.title}\n`));
+            console.log(`  ID:       ${chalk.cyan(detail.meetingId)}`);
+            console.log(`  Status:   ${statusBadge(detail.status)}`);
+            console.log(`  Date:     ${new Date(detail.startTime).toLocaleString()}`);
+            console.log(`  Duration: ${formatDuration(detail.duration)}`);
+            console.log(`  Source:   ${detail.sourceApp} (${detail.botProvider})`);
+            console.log(`  Shared:   ${detail.isShared ? "yes" : "no"}`);
+            if (detail.participants.length > 0) {
+                console.log(chalk.bold("\n  Participants:"));
+                for (const p of detail.participants) {
+                    const name = p.name ?? p.email;
+                    const role = p.role === "organizer" ? chalk.yellow(" (organizer)") : "";
+                    console.log(`    - ${name}${role}`);
+                }
+            }
+            const flags = [];
+            if (detail.hasTranscript)
+                flags.push("transcript");
+            if (detail.hasNotes)
+                flags.push("notes");
+            if (flags.length > 0) {
+                console.log(chalk.dim(`\n  Available: ${flags.join(", ")}. Use \`hq meetings transcript ${detail.meetingId.slice(0, 8)}\` or \`hq meetings notes ${detail.meetingId.slice(0, 8)}\`.`));
+            }
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings search <query> ─────────────────────────────────────
+    meetings
+        .command("search <query>")
+        .description("Search meetings by title or participant name")
+        .action(async (query) => {
+        try {
+            const token = await ensureCognitoToken();
+            const params = { q: query };
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                params.companyId = companySlug;
+            const res = await vaultApiFetch({
+                token,
+                path: "/v1/meetings/search",
+                query: params,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const data = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            console.log(chalk.bold(`\nSearch results for "${data.query}" (${data.results.length}):\n`));
+            printMeetingTable(data.results);
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings transcript <id> ────────────────────────────────────
+    meetings
+        .command("transcript <meetingId>")
+        .description("Print the meeting transcript")
+        .action(async (rawId) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                query.companyId = companySlug;
+            const meetingId = await resolveShortId(token, rawId, query);
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+                query,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const detail = (await res.json());
+            if (!detail.documentUrl) {
+                console.error(chalk.red("No document URL available for this meeting."));
+                process.exit(1);
+            }
+            const docRes = await fetch(detail.documentUrl);
+            if (!docRes.ok) {
+                console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+                process.exit(1);
+            }
+            const doc = (await docRes.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(doc.transcript, null, 2));
+                return;
+            }
+            if (!doc.transcript || doc.transcript.length === 0) {
+                console.log(chalk.yellow("No transcript available for this meeting."));
+                return;
+            }
+            console.log(chalk.bold(`\nTranscript: ${doc.title}\n`));
+            for (const seg of doc.transcript) {
+                const time = formatTimestamp(seg.startTime);
+                console.log(`${chalk.dim(time)}  ${chalk.cyan(seg.speaker)}`);
+                console.log(`        ${seg.text}\n`);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings notes <id> ─────────────────────────────────────────
+    meetings
+        .command("notes <meetingId>")
+        .description("Print AI-generated meeting notes")
+        .action(async (rawId) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                query.companyId = companySlug;
+            const meetingId = await resolveShortId(token, rawId, query);
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+                query,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const detail = (await res.json());
+            if (!detail.documentUrl) {
+                console.error(chalk.red("No document URL available for this meeting."));
+                process.exit(1);
+            }
+            const docRes = await fetch(detail.documentUrl);
+            if (!docRes.ok) {
+                console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+                process.exit(1);
+            }
+            const doc = (await docRes.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(doc.notes, null, 2));
+                return;
+            }
+            if (!doc.notes) {
+                console.log(chalk.yellow("No notes available for this meeting."));
+                return;
+            }
+            const notes = doc.notes;
+            console.log(chalk.bold(`\nMeeting Notes: ${doc.title}\n`));
+            console.log(chalk.bold("Summary"));
+            console.log(`  ${notes.summary}\n`);
+            if (notes.keyPoints.length > 0) {
+                console.log(chalk.bold("Key Points"));
+                for (const point of notes.keyPoints) {
+                    console.log(`  • ${point}`);
+                }
+                console.log();
+            }
+            if (notes.decisions.length > 0) {
+                console.log(chalk.bold("Decisions"));
+                for (const d of notes.decisions) {
+                    console.log(`  ✓ ${d}`);
+                }
+                console.log();
+            }
+            if (notes.actionItems.length > 0) {
+                console.log(chalk.bold("Action Items"));
+                for (const item of notes.actionItems) {
+                    const assignee = item.assignee ? chalk.dim(` → ${item.assignee}`) : "";
+                    console.log(`  □ ${item.task}${assignee}`);
+                }
+                console.log();
+            }
+            if (notes.participantContributions.length > 0) {
+                console.log(chalk.bold("Participant Contributions"));
+                for (const p of notes.participantContributions) {
+                    console.log(`  ${p.name} (${p.speakingTimePercent}%)`);
+                    console.log(`    ${chalk.dim(p.topicsSummary)}`);
+                }
+                console.log();
+            }
+            console.log(chalk.dim(`Generated by ${notes.model} at ${notes.generatedAt}`));
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=meetings.js.map
+//# debugId=8237a835-5842-52be-bb27-c4ffb7944d89

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9cc0bf93-9c18-53aa-addd-954425115886")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="15889dc3-5d7e-5fb9-8df3-33d5aebdc945")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -29,6 +29,7 @@ import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerMembersCommand } from "./commands/members.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
+import { registerMeetingsCommand } from "./commands/meetings.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
 import { CLI_VERSION } from "./cli-version.js";
@@ -102,6 +103,8 @@ registerMembersCommand(program);
 registerOnboardCommand(program);
 // Feedback (subcommand group — hq feedback bug|feature)
 registerFeedbackCommand(program);
+// Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
+registerMeetingsCommand(program);
 (async () => {
     try {
         Sentry.addBreadcrumb({
@@ -120,4 +123,4 @@ registerFeedbackCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=9cc0bf93-9c18-53aa-addd-954425115886
+//# debugId=15889dc3-5d7e-5fb9-8df3-33d5aebdc945

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.14.1",
+  "version": "5.15.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -29,8 +29,9 @@
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
+    "@types/semver": "^7.5.8",
     "typescript": "^5.7.0",
-    "@types/semver": "^7.5.8"
+    "vitest": "^4.1.2"
   },
   "repository": {
     "type": "git",

package/src/commands/cloud-provision.test.ts

@@ -236,6 +236,22 @@ describe("ensureManifestEntryForProvision", () => {
     expect(() => validateManifestAndDir(tmpRoot, "indigo")).toThrow();
   });
 
+  it("does NOT insert when companies/<slug> exists as a regular file (not a dir)", () => {
+    seedManifest(tmpRoot, { other: { status: "active" } });
+    // Create a regular file at companies/indigo (not a directory). Without
+    // the isDirectory() guard, existsSync would return true and the helper
+    // would auto-insert — then provisionCompany would create the vault
+    // entity + patch manifest BEFORE writeCompanyConfig's mkdir failed with
+    // ENOTDIR. Verify no mutation.
+    const companiesDir = path.join(tmpRoot, "companies");
+    fs.mkdirSync(companiesDir, { recursive: true });
+    fs.writeFileSync(path.join(companiesDir, "indigo"), "not a directory");
+    const before = fs.readFileSync(manifestPath(tmpRoot), "utf-8");
+    ensureManifestEntryForProvision(tmpRoot, "indigo");
+    const after = fs.readFileSync(manifestPath(tmpRoot), "utf-8");
+    expect(after).toBe(before);
+  });
+
   it("does NOT insert when manifest file is missing entirely", () => {
     seedCompanyDir(tmpRoot, "indigo");
     expect(() =>

package/src/commands/cloud-provision.ts

@@ -302,7 +302,19 @@ export function ensureManifestEntryForProvision(
   if (expectedParent !== companiesDir) return;
   if (path.basename(expected) !== slug) return;
   const dir = companyDirPath(hqRoot, slug);
-  if (!fs.existsSync(dir)) return;
+  // Must be an actual directory, not a stray file. fs.existsSync returns true
+  // for regular files too — without this guard, auto-insert would fire on a
+  // file at `companies/<slug>`, provisionCompany would then create the vault
+  // entity and patch manifest.yaml before writeCompanyConfig's `mkdir -p .hq`
+  // exploded with ENOTDIR. statSync swallows the not-found case so a missing
+  // path is treated the same as before (no auto-insert).
+  let dirStat: fs.Stats;
+  try {
+    dirStat = fs.statSync(dir);
+  } catch {
+    return;
+  }
+  if (!dirStat.isDirectory()) return;
   const raw = fs.readFileSync(mPath, "utf-8");
   let parsed: unknown;
   try {

package/src/commands/meetings.ts

@@ -0,0 +1,487 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+
+interface MeetingListItem {
+  meetingId: string;
+  title: string;
+  startTime: string;
+  endTime: string;
+  duration: number;
+  participantCount: number;
+  status: string;
+  hasTranscript: boolean;
+  hasNotes: boolean;
+}
+
+interface MeetingDetail {
+  meetingId: string;
+  title: string;
+  startTime: string;
+  endTime: string;
+  duration: number;
+  participants: Array<{ email: string; name: string | null; role: string }>;
+  calendarEventId: string | null;
+  botProvider: string;
+  sourceApp: string;
+  companyId: string;
+  status: string;
+  recallBotId: string | null;
+  isShared: boolean;
+  createdAt: string;
+  updatedAt: string;
+  documentUrl: string;
+  hasTranscript: boolean;
+  hasNotes: boolean;
+}
+
+interface TranscriptSegment {
+  speaker: string;
+  text: string;
+  startTime: number;
+  endTime: number;
+}
+
+interface MeetingNotes {
+  summary: string;
+  keyPoints: string[];
+  decisions: string[];
+  actionItems: Array<{ task: string; assignee: string | null }>;
+  participantContributions: Array<{
+    name: string;
+    speakingTimePercent: number;
+    topicsSummary: string;
+  }>;
+  model: string;
+  generatedAt: string;
+}
+
+interface MeetingDocument {
+  meetingId: string;
+  title: string;
+  startTime: string;
+  endTime: string;
+  duration: number;
+  participants: Array<{ email: string; name: string | null; role: string }>;
+  status: string;
+  transcript: TranscriptSegment[] | null;
+  notes: MeetingNotes | null;
+}
+
+function formatDuration(seconds: number): string {
+  const h = Math.floor(seconds / 3600);
+  const m = Math.floor((seconds % 3600) / 60);
+  const s = Math.floor(seconds % 60);
+  if (h > 0) return `${h}h ${m}m`;
+  if (m > 0) return `${m}m ${s}s`;
+  return `${s}s`;
+}
+
+function formatTimestamp(ts: number): string {
+  const m = Math.floor(ts / 60);
+  const s = Math.floor(ts % 60);
+  return `${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
+}
+
+function statusBadge(status: string): string {
+  switch (status) {
+    case "completed":
+      return chalk.green(status);
+    case "recording":
+      return chalk.red(status);
+    case "processing":
+      return chalk.yellow(status);
+    case "failed":
+      return chalk.red(status);
+    default:
+      return chalk.dim(status);
+  }
+}
+
+async function resolveShortId(
+  token: string,
+  prefix: string,
+  query: Record<string, string>,
+): Promise<string> {
+  if (prefix.includes("-") && prefix.length > 8) return prefix;
+  const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
+  if (!res.ok) return prefix;
+  const data = (await res.json()) as { meetings: MeetingListItem[] };
+  const matches = data.meetings.filter((m) => m.meetingId.startsWith(prefix));
+  if (matches.length === 1) return matches[0].meetingId;
+  if (matches.length > 1) {
+    console.error(chalk.red(`Ambiguous ID prefix "${prefix}" — matches ${matches.length} meetings. Use a longer prefix.`));
+    process.exit(1);
+  }
+  return prefix;
+}
+
+async function handleApiError(res: Response): Promise<never> {
+  const body = (await res.json().catch(() => ({}))) as Record<string, string>;
+  if (res.status === 401) {
+    console.error(chalk.red("Not authenticated — run `hq login` first"));
+  } else if (res.status === 403) {
+    console.error(chalk.red(body.error ?? "Not authorized"));
+  } else if (res.status === 404) {
+    console.error(chalk.red(body.error ?? "Not found"));
+  } else {
+    console.error(chalk.red(`API error (${res.status}): ${body.error ?? res.statusText}`));
+  }
+  process.exit(1);
+}
+
+function printMeetingTable(meetings: MeetingListItem[]): void {
+  if (meetings.length === 0) {
+    console.log(chalk.dim("  No meetings found."));
+    return;
+  }
+
+  const ID_W = 8;
+  const TITLE_W = Math.min(40, Math.max(10, ...meetings.map((m) => m.title.length)));
+  const DATE_W = 16;
+  const DUR_W = 8;
+  const STATUS_W = 12;
+  const PARTS_W = 6;
+  const FLAGS_W = 5;
+
+  console.log(
+    chalk.bold(
+      [
+        "ID".padEnd(ID_W),
+        "TITLE".padEnd(TITLE_W),
+        "DATE".padEnd(DATE_W),
+        "DUR".padEnd(DUR_W),
+        "STATUS".padEnd(STATUS_W),
+        "PARTS".padEnd(PARTS_W),
+        "FLAGS",
+      ].join("  "),
+    ),
+  );
+
+  for (const m of meetings) {
+    const id = m.meetingId.slice(0, 8);
+    const title = m.title.length > TITLE_W ? m.title.slice(0, TITLE_W - 1) + "…" : m.title;
+    const date = new Date(m.startTime).toLocaleDateString("en-US", {
+      month: "short",
+      day: "numeric",
+      hour: "2-digit",
+      minute: "2-digit",
+    });
+    const dur = formatDuration(m.duration);
+    const flags = [
+      m.hasTranscript ? "T" : "",
+      m.hasNotes ? "N" : "",
+    ].filter(Boolean).join("") || "-";
+
+    console.log(
+      [
+        chalk.cyan(id.padEnd(ID_W)),
+        title.padEnd(TITLE_W),
+        chalk.dim(date.padEnd(DATE_W)),
+        dur.padEnd(DUR_W),
+        statusBadge(m.status).padEnd(STATUS_W + 10), // chalk adds escape chars
+        String(m.participantCount).padEnd(PARTS_W),
+        flags,
+      ].join("  "),
+    );
+  }
+}
+
+export function registerMeetingsCommand(program: Command): void {
+  const meetings = program
+    .command("meetings")
+    .description("View and search meeting recordings, transcripts, and notes")
+    .option("--company <slug>", "Company slug (for multi-company users)")
+    .option("--json", "Output raw JSON instead of formatted text");
+
+  // ── hq meetings list ──────────────────────────────────────────────
+
+  meetings
+    .command("list")
+    .description("List recorded meetings (newest first)")
+    .option("--limit <n>", "Number of meetings to return (default: 20)")
+    .option("--next <token>", "Pagination token from a previous response")
+    .action(async (opts: { limit?: string; next?: string }) => {
+      try {
+        const token = await ensureCognitoToken();
+        const query: Record<string, string> = {};
+        const companySlug = meetings.opts().company as string | undefined;
+
+        if (opts.limit) query.limit = opts.limit;
+        if (opts.next) query.nextToken = opts.next;
+        if (companySlug) query.companyId = companySlug;
+
+        const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
+        if (!res.ok) await handleApiError(res);
+
+        const data = (await res.json()) as {
+          meetings: MeetingListItem[];
+          nextToken?: string;
+        };
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(data, null, 2));
+          return;
+        }
+
+        console.log(chalk.bold(`\nMeetings (${data.meetings.length}):\n`));
+        printMeetingTable(data.meetings);
+
+        if (data.nextToken) {
+          console.log(
+            chalk.dim(`\n  More results available. Run with --next ${data.nextToken}`),
+          );
+        }
+        console.log();
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+
+  // ── hq meetings get <id> ──────────────────────────────────────────
+
+  meetings
+    .command("get <meetingId>")
+    .description("Show meeting details")
+    .action(async (rawId: string) => {
+      try {
+        const token = await ensureCognitoToken();
+        const query: Record<string, string> = {};
+        const companySlug = meetings.opts().company as string | undefined;
+        if (companySlug) query.companyId = companySlug;
+
+        const meetingId = await resolveShortId(token, rawId, query);
+        const res = await vaultApiFetch({
+          token,
+          path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+          query,
+        });
+        if (!res.ok) await handleApiError(res);
+
+        const detail = (await res.json()) as MeetingDetail;
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(detail, null, 2));
+          return;
+        }
+
+        console.log(chalk.bold(`\n${detail.title}\n`));
+        console.log(`  ID:       ${chalk.cyan(detail.meetingId)}`);
+        console.log(`  Status:   ${statusBadge(detail.status)}`);
+        console.log(`  Date:     ${new Date(detail.startTime).toLocaleString()}`);
+        console.log(`  Duration: ${formatDuration(detail.duration)}`);
+        console.log(`  Source:   ${detail.sourceApp} (${detail.botProvider})`);
+        console.log(`  Shared:   ${detail.isShared ? "yes" : "no"}`);
+
+        if (detail.participants.length > 0) {
+          console.log(chalk.bold("\n  Participants:"));
+          for (const p of detail.participants) {
+            const name = p.name ?? p.email;
+            const role = p.role === "organizer" ? chalk.yellow(" (organizer)") : "";
+            console.log(`    - ${name}${role}`);
+          }
+        }
+
+        const flags = [];
+        if (detail.hasTranscript) flags.push("transcript");
+        if (detail.hasNotes) flags.push("notes");
+        if (flags.length > 0) {
+          console.log(
+            chalk.dim(`\n  Available: ${flags.join(", ")}. Use \`hq meetings transcript ${detail.meetingId.slice(0, 8)}\` or \`hq meetings notes ${detail.meetingId.slice(0, 8)}\`.`),
+          );
+        }
+        console.log();
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+
+  // ── hq meetings search <query> ─────────────────────────────────────
+
+  meetings
+    .command("search <query>")
+    .description("Search meetings by title or participant name")
+    .action(async (query: string) => {
+      try {
+        const token = await ensureCognitoToken();
+        const params: Record<string, string> = { q: query };
+        const companySlug = meetings.opts().company as string | undefined;
+        if (companySlug) params.companyId = companySlug;
+
+        const res = await vaultApiFetch({
+          token,
+          path: "/v1/meetings/search",
+          query: params,
+        });
+        if (!res.ok) await handleApiError(res);
+
+        const data = (await res.json()) as {
+          results: MeetingListItem[];
+          query: string;
+        };
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(data, null, 2));
+          return;
+        }
+
+        console.log(chalk.bold(`\nSearch results for "${data.query}" (${data.results.length}):\n`));
+        printMeetingTable(data.results);
+        console.log();
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+
+  // ── hq meetings transcript <id> ────────────────────────────────────
+
+  meetings
+    .command("transcript <meetingId>")
+    .description("Print the meeting transcript")
+    .action(async (rawId: string) => {
+      try {
+        const token = await ensureCognitoToken();
+        const query: Record<string, string> = {};
+        const companySlug = meetings.opts().company as string | undefined;
+        if (companySlug) query.companyId = companySlug;
+
+        const meetingId = await resolveShortId(token, rawId, query);
+        const res = await vaultApiFetch({
+          token,
+          path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+          query,
+        });
+        if (!res.ok) await handleApiError(res);
+
+        const detail = (await res.json()) as MeetingDetail;
+        if (!detail.documentUrl) {
+          console.error(chalk.red("No document URL available for this meeting."));
+          process.exit(1);
+        }
+
+        const docRes = await fetch(detail.documentUrl);
+        if (!docRes.ok) {
+          console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+          process.exit(1);
+        }
+
+        const doc = (await docRes.json()) as MeetingDocument;
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(doc.transcript, null, 2));
+          return;
+        }
+
+        if (!doc.transcript || doc.transcript.length === 0) {
+          console.log(chalk.yellow("No transcript available for this meeting."));
+          return;
+        }
+
+        console.log(chalk.bold(`\nTranscript: ${doc.title}\n`));
+        for (const seg of doc.transcript) {
+          const time = formatTimestamp(seg.startTime);
+          console.log(`${chalk.dim(time)}  ${chalk.cyan(seg.speaker)}`);
+          console.log(`        ${seg.text}\n`);
+        }
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+
+  // ── hq meetings notes <id> ─────────────────────────────────────────
+
+  meetings
+    .command("notes <meetingId>")
+    .description("Print AI-generated meeting notes")
+    .action(async (rawId: string) => {
+      try {
+        const token = await ensureCognitoToken();
+        const query: Record<string, string> = {};
+        const companySlug = meetings.opts().company as string | undefined;
+        if (companySlug) query.companyId = companySlug;
+
+        const meetingId = await resolveShortId(token, rawId, query);
+        const res = await vaultApiFetch({
+          token,
+          path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+          query,
+        });
+        if (!res.ok) await handleApiError(res);
+
+        const detail = (await res.json()) as MeetingDetail;
+        if (!detail.documentUrl) {
+          console.error(chalk.red("No document URL available for this meeting."));
+          process.exit(1);
+        }
+
+        const docRes = await fetch(detail.documentUrl);
+        if (!docRes.ok) {
+          console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+          process.exit(1);
+        }
+
+        const doc = (await docRes.json()) as MeetingDocument;
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(doc.notes, null, 2));
+          return;
+        }
+
+        if (!doc.notes) {
+          console.log(chalk.yellow("No notes available for this meeting."));
+          return;
+        }
+
+        const notes = doc.notes;
+        console.log(chalk.bold(`\nMeeting Notes: ${doc.title}\n`));
+
+        console.log(chalk.bold("Summary"));
+        console.log(`  ${notes.summary}\n`);
+
+        if (notes.keyPoints.length > 0) {
+          console.log(chalk.bold("Key Points"));
+          for (const point of notes.keyPoints) {
+            console.log(`  • ${point}`);
+          }
+          console.log();
+        }
+
+        if (notes.decisions.length > 0) {
+          console.log(chalk.bold("Decisions"));
+          for (const d of notes.decisions) {
+            console.log(`  ✓ ${d}`);
+          }
+          console.log();
+        }
+
+        if (notes.actionItems.length > 0) {
+          console.log(chalk.bold("Action Items"));
+          for (const item of notes.actionItems) {
+            const assignee = item.assignee ? chalk.dim(` → ${item.assignee}`) : "";
+            console.log(`  □ ${item.task}${assignee}`);
+          }
+          console.log();
+        }
+
+        if (notes.participantContributions.length > 0) {
+          console.log(chalk.bold("Participant Contributions"));
+          for (const p of notes.participantContributions) {
+            console.log(`  ${p.name} (${p.speakingTimePercent}%)`);
+            console.log(`    ${chalk.dim(p.topicsSummary)}`);
+          }
+          console.log();
+        }
+
+        console.log(chalk.dim(`Generated by ${notes.model} at ${notes.generatedAt}`));
+        console.log();
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+}

package/src/index.ts

@@ -29,6 +29,7 @@ import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerMembersCommand } from "./commands/members.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
+import { registerMeetingsCommand } from "./commands/meetings.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import {
   maybeWarnNewVersion,
@@ -130,6 +131,9 @@ registerOnboardCommand(program);
 // Feedback (subcommand group — hq feedback bug|feature)
 registerFeedbackCommand(program);
 
+// Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
+registerMeetingsCommand(program);
+
 (async () => {
   try {
     Sentry.addBreadcrumb({

package/tsconfig.json

@@ -1,6 +1,17 @@
 {
-  "extends": "../../tsconfig.base.json",
   "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "resolveJsonModule": true,
     "outDir": "dist",
     "rootDir": "src"
   },