@indigoai-us/hq-cli 5.14.1 → 5.16.0

package/.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: CI
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with
+      # an empty BUNDLED_DSN. That's intentional — the DSN is publish-only.
+      - run: npm run build --if-present
+      - run: npm run typecheck --if-present
+      - run: npm test --if-present

package/.github/workflows/publish.yml

@@ -0,0 +1,86 @@
+name: Publish to npm
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
+          # token-exchange flow. See hq-cloud's publish.yml for the full
+          # rationale (npm 10.x produces masked-404 failures on publish PUT).
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - run: node --version && npm --version
+      - run: npm ci
+
+      - name: Build
+        run: npm run build --if-present
+        env:
+          # generate-dsn.mjs fatals when GITHUB_JOB=publish and this var is
+          # missing. Set this as a repo secret to bundle a Sentry DSN into the
+          # published binary.
+          HQ_CLI_PUBLISH_SENTRY_DSN: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
+
+      # Inject Sentry debug IDs into compiled JS + map files. Must run after
+      # tsc and BEFORE publish so the installed binary carries the same debugId
+      # as the artifacts uploaded to Sentry, enabling debugId-based source-map
+      # resolution for globally-installed CLI users.
+      - name: Inject Sentry source map debug IDs
+        run: npx -y @sentry/cli@^2 sourcemaps inject dist/
+
+      # Pre-publish cross-package smoke test (Bug A guard).
+      #
+      # @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
+      # (^5.1.0). The smoke installs a freshly-packed tarball into an isolated
+      # tmpdir — outside this repo — so transitive @indigoai-us/* deps resolve
+      # from the npm registry, NOT from a local checkout. Booting `hq --version`
+      # then exercises the full module-load graph. If hq-cloud removed or
+      # renamed a symbol hq-cli imports, this catches it BEFORE the publish PUT.
+      #
+      # Bypass: set repo-or-workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1.
+      - name: Pre-publish smoke test
+        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH != '1' }}
+        run: bash .github/workflows/scripts/smoke-test-pkg.sh hq
+
+      - name: WARN — pre-publish smoke bypassed
+        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH == '1' }}
+        run: |
+          echo "::warning::WORKFLOW_ALLOW_BROKEN_PUBLISH=1 — pre-publish cross-package smoke test was BYPASSED. This release may ship a DOA package."
+
+      # Trusted-publisher OIDC; no NODE_AUTH_TOKEN. No --provenance (private
+      # repo limitation since npm 2026-05-10). Pre-release versions (with '-')
+      # get --tag rc to keep latest dist-tag pointing at stable releases only.
+      - name: Publish to npm
+        id: publish
+        run: |
+          NAME=$(jq -r .name package.json)
+          VER=$(jq -r .version package.json)
+          if npm view "$NAME@$VER" version >/dev/null 2>&1; then
+            echo "$NAME@$VER already on npm — skipping"
+          else
+            if echo "$VER" | grep -q '-'; then
+              npm publish --access public --tag rc
+            else
+              npm publish --access public
+            fi
+            echo "published=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload sourcemaps to Sentry
+        if: steps.publish.outputs.published == 'true'
+        run: |
+          VER=$(jq -r .version package.json)
+          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: indigo-d0
+          SENTRY_PROJECT: hq

package/.github/workflows/scripts/smoke-test-pkg.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# smoke-test-pkg.sh — pre-publish cross-package import smoke test (Bug A guard).
+#
+# Single-package adaptation of the same script used in the legacy hq monorepo.
+# The monorepo version operated on `packages/$PKG/package.json`; this version
+# reads `./package.json` because each extracted repo is a single package at
+# its root.
+#
+# Install the package in an isolated tmpdir — using a freshly-packed tarball
+# when the package.json version is new, or fetching the existing name@version
+# from npm when it is already published — then boot the binary with
+# `--version`. The boot exercises the full module-load graph and the
+# transitive `@indigoai-us/*` resolution path a customer's `npm install`
+# would take. If the boot fails the script exits non-zero and the workflow
+# aborts before any further publish steps run.
+#
+# Why we don't skip when the consumer's version is already on npm:
+#   @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
+#   (^5.1.0). A producer bump (published from indigoai-us/hq-cloud) re-resolves
+#   this consumer's transitive deps on the next fresh install, so an already-
+#   published consumer is NOT actually "locked." If the new producer drops or
+#   renames a symbol the published consumer imports, `hq --version` crashes
+#   on every fresh install starting the moment the producer publishes.
+#
+# Usage:
+#   smoke-test-pkg.sh <bin-name>
+# Example:
+#   smoke-test-pkg.sh hq
+
+set -uo pipefail
+
+BIN=${1:?usage: smoke-test-pkg.sh <bin-name>}
+
+PKG_JSON="package.json"
+if [ ! -f "$PKG_JSON" ]; then
+  echo "::error::smoke-test-pkg.sh: $PKG_JSON not found (cwd: $(pwd))"
+  exit 2
+fi
+
+NAME=$(jq -r .name "$PKG_JSON")
+VER=$(jq -r .version "$PKG_JSON")
+
+# Pick the install target. Already on npm → install by name@version so the
+# smoke matches what a customer would actually receive. Not yet on npm →
+# pack the local repo; the next publish step will push that exact byte-for-
+# byte content. Either way, `npm install` happens OUTSIDE this repo so
+# transitive @indigoai-us/* deps resolve from the registry.
+INSTALL_SOURCE=""
+if npm view "$NAME@$VER" version >/dev/null 2>&1; then
+  INSTALL_TARGET="$NAME@$VER"
+  INSTALL_SOURCE="npm registry (consumer version already published)"
+else
+  TARBALL_RELATIVE=$(npm pack --silent --pack-destination /tmp)
+  if [ -z "$TARBALL_RELATIVE" ]; then
+    echo "::error::npm pack produced no tarball for $NAME"
+    exit 1
+  fi
+  INSTALL_TARGET="/tmp/$TARBALL_RELATIVE"
+  if [ ! -f "$INSTALL_TARGET" ]; then
+    echo "::error::expected tarball at $INSTALL_TARGET not found"
+    exit 1
+  fi
+  INSTALL_SOURCE="packed tarball ($TARBALL_RELATIVE)"
+fi
+
+echo "::group::smoke test: $NAME@$VER via $INSTALL_SOURCE"
+
+SMOKE=$(mktemp -d)
+pushd "$SMOKE" >/dev/null
+
+printf '%s' '{"name":"smoke","version":"0.0.0","private":true}' > package.json
+
+if ! npm install --no-audit --no-fund --no-package-lock "$INSTALL_TARGET" >/tmp/smoke-install.log 2>&1; then
+  echo "::error::pre-publish smoke install FAILED for $NAME@$VER:"
+  tail -50 /tmp/smoke-install.log
+  popd >/dev/null
+  echo "::endgroup::"
+  exit 1
+fi
+
+set +e
+OUT=$("./node_modules/.bin/$BIN" --version 2>&1)
+CODE=$?
+set -e
+
+popd >/dev/null
+
+if [ "$CODE" -ne 0 ]; then
+  echo "::error::pre-publish smoke FAILED for $NAME@$VER (exit $CODE):"
+  echo "::error::$OUT"
+  echo "::error::Likely cause: a cross-package symbol was changed (added, removed, renamed) in another @indigoai-us/* package without keeping this consumer's import in sync. Bump this consumer (or revert the producer change) and re-tag, OR set the repo/workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1 to override (audited)."
+  echo "::endgroup::"
+  exit 1
+fi
+
+echo "✓ smoke ok: $NAME@$VER → $BIN --version → $OUT  (via $INSTALL_SOURCE)"
+echo "::endgroup::"

package/dist/commands/cloud-provision.d.ts

@@ -111,7 +111,32 @@ export interface VaultClient {
      * entity.
      */
     listMyPersonEntities(): Promise<VaultEntity[]>;
+    /**
+     * Legacy global-uniqueness lookup. Under the per-user-namespace model
+     * (hq-pro 2026-05-15) this can return any tenant's entity when more
+     * than one user holds the same slug, OR `null` when the caller doesn't
+     * have it but a different user does. Kept on the interface for any
+     * remaining callers, but `provisionCompany` now uses
+     * `checkSlugInMyNamespace` instead — same-slug-different-owner is
+     * legitimate and should NOT trigger reuse of the stranger's entity.
+     */
     findCompanyBySlug(slug: string): Promise<VaultEntity | null>;
+    /**
+     * Caller-scoped slug availability check via
+     * `GET /entity/check-slug/me?type=company&slug=...`. Returns
+     * `{available: true}` when the caller's namespace
+     * (owned ∪ active-member-of, soft-deleted excluded) doesn't hold the
+     * slug, or `{available: false, conflictingCompanyUid}` when it does
+     * — `provisionCompany` reuses the `conflictingCompanyUid` as the
+     * idempotent entity instead of creating a duplicate.
+     */
+    checkSlugInMyNamespace(slug: string): Promise<{
+        available: boolean;
+        conflictingCompanyUid?: string;
+    }>;
+    /** Fetch a company entity by uid. Used to materialize the entity
+     * after `checkSlugInMyNamespace` reports a same-namespace collision. */
+    getCompanyByUid(uid: string): Promise<VaultEntity>;
     createCompanyEntity(input: {
         slug: string;
         name: string;

package/dist/commands/cloud-provision.js

@@ -28,7 +28,7 @@
  *       `initial_sync.ok=false`). Manifest + config may have been written.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5573abae-ee71-5106-94e7-3485e3e0fbb2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="925baddc-7b12-5ad4-b64f-d7e20bd0daab")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -164,7 +164,20 @@ export function ensureManifestEntryForProvision(hqRoot, slug) {
     if (path.basename(expected) !== slug)
         return;
     const dir = companyDirPath(hqRoot, slug);
-    if (!fs.existsSync(dir))
+    // Must be an actual directory, not a stray file. fs.existsSync returns true
+    // for regular files too — without this guard, auto-insert would fire on a
+    // file at `companies/<slug>`, provisionCompany would then create the vault
+    // entity and patch manifest.yaml before writeCompanyConfig's `mkdir -p .hq`
+    // exploded with ENOTDIR. statSync swallows the not-found case so a missing
+    // path is treated the same as before (no auto-insert).
+    let dirStat;
+    try {
+        dirStat = fs.statSync(dir);
+    }
+    catch {
+        return;
+    }
+    if (!dirStat.isDirectory())
         return;
     const raw = fs.readFileSync(mPath, "utf-8");
     let parsed;
@@ -282,6 +295,28 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             }
             return data.entity;
         },
+        async checkSlugInMyNamespace(slug) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(slug)}`;
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            return (await res.json());
+        },
+        async getCompanyByUid(uid) {
+            const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            if (!data.entity) {
+                throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
+            }
+            return data.entity;
+        },
         async createCompanyEntity(input) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity`;
             const body = {
@@ -298,9 +333,15 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             });
             if (!res.ok) {
                 const text = await safeBody(res);
-                // 409 means a concurrent client created it between our GET and POST —
-                // surface it as a vault error. The orchestrator is responsible for
-                // retrying GET if it wants idempotency on collisions.
+                // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+                // in their namespace (owned ∪ active-member-of). Under the
+                // per-user-namespace model this is the new same-user-collision
+                // signal — distinct from the legacy global EntityAlreadyExists.
+                // The CLI normally reaches `createCompanyEntity` only after
+                // `checkSlugInMyNamespace` reported `available: true`, so a
+                // 409 here means a race between the pre-check and the POST.
+                // Surface the response body verbatim so the caller can see the
+                // `code` + `conflictingCompanyUid` and resolve / retry.
                 throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
             }
             const data = (await res.json());
@@ -380,13 +421,51 @@ export async function provisionCompany(options) {
         throw new ProvisionError(2, 'No person entity found for this Cognito identity. Run `hq onboard` first to create your HQ identity, then re-run `hq cloud provision company`. (Provision was halted before any cloud-side resources were created.)');
     }
     log(`pre-flight ok — caller has ${persons.length} person entity(ies)`);
-    let entity = await vaultClient.findCompanyBySlug(options.slug);
+    // Per-user-namespace-aware reuse-or-create. Replaces the legacy
+    // global `findCompanyBySlug` lookup, which under the per-user model
+    // (hq-pro 2026-05-15) returns ANY tenant's entity when more than one
+    // user holds the same slug, OR null when a different user has it —
+    // both wrong for the CLI's "reuse mine, or create" intent.
+    //
+    // `--owner` override: `options.ownerUid`, when set, lets a caller
+    // create the entity under a DIFFERENT person's ownership (e.g. an
+    // admin provisioning on behalf of someone). `/entity/check-slug/me`
+    // answers about the CALLER's namespace, not the target owner's, so
+    // the pre-check is meaningless in that case. Codex P2 on PR 7
+    // flagged this. The gate: only run the namespace check when the
+    // owner is the caller (or defaulted to the caller — i.e. no
+    // --owner supplied). On override, fall through to
+    // `createCompanyEntity` and let the server's authoritative 409
+    // (which IS scoped to the target's namespace, per the
+    // callerIsOwner gate on POST /entity in hq-pro PR 67) surface any
+    // real conflict.
+    //
+    // `callerIsOwner` is `true` whenever `options.ownerUid` is unset
+    // (defaults to caller server-side) OR — when set — happens to
+    // match the caller's own person UID(s) from `listMyPersonEntities`.
+    const callerOwnedUids = new Set(persons.map((p) => p.uid));
+    const callerIsOwner = !options.ownerUid || callerOwnedUids.has(options.ownerUid);
+    let entity;
     let createdEntity = false;
-    if (entity) {
-        log(`reusing existing vault entity uid=${entity.uid}`);
+    if (callerIsOwner) {
+        const slugCheck = await vaultClient.checkSlugInMyNamespace(options.slug);
+        if (!slugCheck.available && slugCheck.conflictingCompanyUid) {
+            log(`reusing existing vault entity uid=${slugCheck.conflictingCompanyUid} (slug already in caller's namespace)`);
+            entity = await vaultClient.getCompanyByUid(slugCheck.conflictingCompanyUid);
+        }
+        else {
+            log(`slug available in caller's namespace — creating vault entity`);
+            entity = await vaultClient.createCompanyEntity({
+                slug: options.slug,
+                name: options.name ?? options.slug,
+                ownerUid: options.ownerUid,
+            });
+            createdEntity = true;
+            log(`created vault entity uid=${entity.uid}`);
+        }
     }
     else {
-        log(`vault entity not found — creating`);
+        log(`--owner ${options.ownerUid} differs from caller's person(s); skipping namespace pre-check (server authoritatively gates per-target-namespace)`);
         entity = await vaultClient.createCompanyEntity({
             slug: options.slug,
             name: options.name ?? options.slug,
@@ -536,4 +615,4 @@ export function registerCloudProvisionCommands(program) {
     });
 }
 //# sourceMappingURL=cloud-provision.js.map
-//# debugId=5573abae-ee71-5106-94e7-3485e3e0fbb2
+//# debugId=925baddc-7b12-5ad4-b64f-d7e20bd0daab

package/dist/commands/meetings.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerMeetingsCommand(program: Command): void;
+//# sourceMappingURL=meetings.d.ts.map