@indigoai-us/hq-cli 5.14.1 → 5.16.0

package/dist/commands/meetings.js

@@ -0,0 +1,374 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8237a835-5842-52be-bb27-c4ffb7944d89")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+function formatDuration(seconds) {
+    const h = Math.floor(seconds / 3600);
+    const m = Math.floor((seconds % 3600) / 60);
+    const s = Math.floor(seconds % 60);
+    if (h > 0)
+        return `${h}h ${m}m`;
+    if (m > 0)
+        return `${m}m ${s}s`;
+    return `${s}s`;
+}
+function formatTimestamp(ts) {
+    const m = Math.floor(ts / 60);
+    const s = Math.floor(ts % 60);
+    return `${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
+}
+function statusBadge(status) {
+    switch (status) {
+        case "completed":
+            return chalk.green(status);
+        case "recording":
+            return chalk.red(status);
+        case "processing":
+            return chalk.yellow(status);
+        case "failed":
+            return chalk.red(status);
+        default:
+            return chalk.dim(status);
+    }
+}
+async function resolveShortId(token, prefix, query) {
+    if (prefix.includes("-") && prefix.length > 8)
+        return prefix;
+    const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
+    if (!res.ok)
+        return prefix;
+    const data = (await res.json());
+    const matches = data.meetings.filter((m) => m.meetingId.startsWith(prefix));
+    if (matches.length === 1)
+        return matches[0].meetingId;
+    if (matches.length > 1) {
+        console.error(chalk.red(`Ambiguous ID prefix "${prefix}" — matches ${matches.length} meetings. Use a longer prefix.`));
+        process.exit(1);
+    }
+    return prefix;
+}
+async function handleApiError(res) {
+    const body = (await res.json().catch(() => ({})));
+    if (res.status === 401) {
+        console.error(chalk.red("Not authenticated — run `hq login` first"));
+    }
+    else if (res.status === 403) {
+        console.error(chalk.red(body.error ?? "Not authorized"));
+    }
+    else if (res.status === 404) {
+        console.error(chalk.red(body.error ?? "Not found"));
+    }
+    else {
+        console.error(chalk.red(`API error (${res.status}): ${body.error ?? res.statusText}`));
+    }
+    process.exit(1);
+}
+function printMeetingTable(meetings) {
+    if (meetings.length === 0) {
+        console.log(chalk.dim("  No meetings found."));
+        return;
+    }
+    const ID_W = 8;
+    const TITLE_W = Math.min(40, Math.max(10, ...meetings.map((m) => m.title.length)));
+    const DATE_W = 16;
+    const DUR_W = 8;
+    const STATUS_W = 12;
+    const PARTS_W = 6;
+    const FLAGS_W = 5;
+    console.log(chalk.bold([
+        "ID".padEnd(ID_W),
+        "TITLE".padEnd(TITLE_W),
+        "DATE".padEnd(DATE_W),
+        "DUR".padEnd(DUR_W),
+        "STATUS".padEnd(STATUS_W),
+        "PARTS".padEnd(PARTS_W),
+        "FLAGS",
+    ].join("  ")));
+    for (const m of meetings) {
+        const id = m.meetingId.slice(0, 8);
+        const title = m.title.length > TITLE_W ? m.title.slice(0, TITLE_W - 1) + "…" : m.title;
+        const date = new Date(m.startTime).toLocaleDateString("en-US", {
+            month: "short",
+            day: "numeric",
+            hour: "2-digit",
+            minute: "2-digit",
+        });
+        const dur = formatDuration(m.duration);
+        const flags = [
+            m.hasTranscript ? "T" : "",
+            m.hasNotes ? "N" : "",
+        ].filter(Boolean).join("") || "-";
+        console.log([
+            chalk.cyan(id.padEnd(ID_W)),
+            title.padEnd(TITLE_W),
+            chalk.dim(date.padEnd(DATE_W)),
+            dur.padEnd(DUR_W),
+            statusBadge(m.status).padEnd(STATUS_W + 10), // chalk adds escape chars
+            String(m.participantCount).padEnd(PARTS_W),
+            flags,
+        ].join("  "));
+    }
+}
+export function registerMeetingsCommand(program) {
+    const meetings = program
+        .command("meetings")
+        .description("View and search meeting recordings, transcripts, and notes")
+        .option("--company <slug>", "Company slug (for multi-company users)")
+        .option("--json", "Output raw JSON instead of formatted text");
+    // ── hq meetings list ──────────────────────────────────────────────
+    meetings
+        .command("list")
+        .description("List recorded meetings (newest first)")
+        .option("--limit <n>", "Number of meetings to return (default: 20)")
+        .option("--next <token>", "Pagination token from a previous response")
+        .action(async (opts) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (opts.limit)
+                query.limit = opts.limit;
+            if (opts.next)
+                query.nextToken = opts.next;
+            if (companySlug)
+                query.companyId = companySlug;
+            const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
+            if (!res.ok)
+                await handleApiError(res);
+            const data = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            console.log(chalk.bold(`\nMeetings (${data.meetings.length}):\n`));
+            printMeetingTable(data.meetings);
+            if (data.nextToken) {
+                console.log(chalk.dim(`\n  More results available. Run with --next ${data.nextToken}`));
+            }
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings get <id> ──────────────────────────────────────────
+    meetings
+        .command("get <meetingId>")
+        .description("Show meeting details")
+        .action(async (rawId) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                query.companyId = companySlug;
+            const meetingId = await resolveShortId(token, rawId, query);
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+                query,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const detail = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(detail, null, 2));
+                return;
+            }
+            console.log(chalk.bold(`\n${detail.title}\n`));
+            console.log(`  ID:       ${chalk.cyan(detail.meetingId)}`);
+            console.log(`  Status:   ${statusBadge(detail.status)}`);
+            console.log(`  Date:     ${new Date(detail.startTime).toLocaleString()}`);
+            console.log(`  Duration: ${formatDuration(detail.duration)}`);
+            console.log(`  Source:   ${detail.sourceApp} (${detail.botProvider})`);
+            console.log(`  Shared:   ${detail.isShared ? "yes" : "no"}`);
+            if (detail.participants.length > 0) {
+                console.log(chalk.bold("\n  Participants:"));
+                for (const p of detail.participants) {
+                    const name = p.name ?? p.email;
+                    const role = p.role === "organizer" ? chalk.yellow(" (organizer)") : "";
+                    console.log(`    - ${name}${role}`);
+                }
+            }
+            const flags = [];
+            if (detail.hasTranscript)
+                flags.push("transcript");
+            if (detail.hasNotes)
+                flags.push("notes");
+            if (flags.length > 0) {
+                console.log(chalk.dim(`\n  Available: ${flags.join(", ")}. Use \`hq meetings transcript ${detail.meetingId.slice(0, 8)}\` or \`hq meetings notes ${detail.meetingId.slice(0, 8)}\`.`));
+            }
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings search <query> ─────────────────────────────────────
+    meetings
+        .command("search <query>")
+        .description("Search meetings by title or participant name")
+        .action(async (query) => {
+        try {
+            const token = await ensureCognitoToken();
+            const params = { q: query };
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                params.companyId = companySlug;
+            const res = await vaultApiFetch({
+                token,
+                path: "/v1/meetings/search",
+                query: params,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const data = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            console.log(chalk.bold(`\nSearch results for "${data.query}" (${data.results.length}):\n`));
+            printMeetingTable(data.results);
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings transcript <id> ────────────────────────────────────
+    meetings
+        .command("transcript <meetingId>")
+        .description("Print the meeting transcript")
+        .action(async (rawId) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                query.companyId = companySlug;
+            const meetingId = await resolveShortId(token, rawId, query);
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+                query,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const detail = (await res.json());
+            if (!detail.documentUrl) {
+                console.error(chalk.red("No document URL available for this meeting."));
+                process.exit(1);
+            }
+            const docRes = await fetch(detail.documentUrl);
+            if (!docRes.ok) {
+                console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+                process.exit(1);
+            }
+            const doc = (await docRes.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(doc.transcript, null, 2));
+                return;
+            }
+            if (!doc.transcript || doc.transcript.length === 0) {
+                console.log(chalk.yellow("No transcript available for this meeting."));
+                return;
+            }
+            console.log(chalk.bold(`\nTranscript: ${doc.title}\n`));
+            for (const seg of doc.transcript) {
+                const time = formatTimestamp(seg.startTime);
+                console.log(`${chalk.dim(time)}  ${chalk.cyan(seg.speaker)}`);
+                console.log(`        ${seg.text}\n`);
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── hq meetings notes <id> ─────────────────────────────────────────
+    meetings
+        .command("notes <meetingId>")
+        .description("Print AI-generated meeting notes")
+        .action(async (rawId) => {
+        try {
+            const token = await ensureCognitoToken();
+            const query = {};
+            const companySlug = meetings.opts().company;
+            if (companySlug)
+                query.companyId = companySlug;
+            const meetingId = await resolveShortId(token, rawId, query);
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}`,
+                query,
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const detail = (await res.json());
+            if (!detail.documentUrl) {
+                console.error(chalk.red("No document URL available for this meeting."));
+                process.exit(1);
+            }
+            const docRes = await fetch(detail.documentUrl);
+            if (!docRes.ok) {
+                console.error(chalk.red(`Failed to download meeting document (${docRes.status})`));
+                process.exit(1);
+            }
+            const doc = (await docRes.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(doc.notes, null, 2));
+                return;
+            }
+            if (!doc.notes) {
+                console.log(chalk.yellow("No notes available for this meeting."));
+                return;
+            }
+            const notes = doc.notes;
+            console.log(chalk.bold(`\nMeeting Notes: ${doc.title}\n`));
+            console.log(chalk.bold("Summary"));
+            console.log(`  ${notes.summary}\n`);
+            if (notes.keyPoints.length > 0) {
+                console.log(chalk.bold("Key Points"));
+                for (const point of notes.keyPoints) {
+                    console.log(`  • ${point}`);
+                }
+                console.log();
+            }
+            if (notes.decisions.length > 0) {
+                console.log(chalk.bold("Decisions"));
+                for (const d of notes.decisions) {
+                    console.log(`  ✓ ${d}`);
+                }
+                console.log();
+            }
+            if (notes.actionItems.length > 0) {
+                console.log(chalk.bold("Action Items"));
+                for (const item of notes.actionItems) {
+                    const assignee = item.assignee ? chalk.dim(` → ${item.assignee}`) : "";
+                    console.log(`  □ ${item.task}${assignee}`);
+                }
+                console.log();
+            }
+            if (notes.participantContributions.length > 0) {
+                console.log(chalk.bold("Participant Contributions"));
+                for (const p of notes.participantContributions) {
+                    console.log(`  ${p.name} (${p.speakingTimePercent}%)`);
+                    console.log(`    ${chalk.dim(p.topicsSummary)}`);
+                }
+                console.log();
+            }
+            console.log(chalk.dim(`Generated by ${notes.model} at ${notes.generatedAt}`));
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=meetings.js.map
+//# debugId=8237a835-5842-52be-bb27-c4ffb7944d89

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9cc0bf93-9c18-53aa-addd-954425115886")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="15889dc3-5d7e-5fb9-8df3-33d5aebdc945")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -29,6 +29,7 @@ import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerMembersCommand } from "./commands/members.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
+import { registerMeetingsCommand } from "./commands/meetings.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
 import { CLI_VERSION } from "./cli-version.js";
@@ -102,6 +103,8 @@ registerMembersCommand(program);
 registerOnboardCommand(program);
 // Feedback (subcommand group — hq feedback bug|feature)
 registerFeedbackCommand(program);
+// Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
+registerMeetingsCommand(program);
 (async () => {
     try {
         Sentry.addBreadcrumb({
@@ -120,4 +123,4 @@ registerFeedbackCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=9cc0bf93-9c18-53aa-addd-954425115886
+//# debugId=15889dc3-5d7e-5fb9-8df3-33d5aebdc945

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.14.1",
+  "version": "5.16.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -29,8 +29,9 @@
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
+    "@types/semver": "^7.5.8",
     "typescript": "^5.7.0",
-    "@types/semver": "^7.5.8"
+    "vitest": "^4.1.2"
   },
   "repository": {
     "type": "git",

package/src/commands/cloud-provision.test.ts

@@ -236,6 +236,22 @@ describe("ensureManifestEntryForProvision", () => {
     expect(() => validateManifestAndDir(tmpRoot, "indigo")).toThrow();
   });
 
+  it("does NOT insert when companies/<slug> exists as a regular file (not a dir)", () => {
+    seedManifest(tmpRoot, { other: { status: "active" } });
+    // Create a regular file at companies/indigo (not a directory). Without
+    // the isDirectory() guard, existsSync would return true and the helper
+    // would auto-insert — then provisionCompany would create the vault
+    // entity + patch manifest BEFORE writeCompanyConfig's mkdir failed with
+    // ENOTDIR. Verify no mutation.
+    const companiesDir = path.join(tmpRoot, "companies");
+    fs.mkdirSync(companiesDir, { recursive: true });
+    fs.writeFileSync(path.join(companiesDir, "indigo"), "not a directory");
+    const before = fs.readFileSync(manifestPath(tmpRoot), "utf-8");
+    ensureManifestEntryForProvision(tmpRoot, "indigo");
+    const after = fs.readFileSync(manifestPath(tmpRoot), "utf-8");
+    expect(after).toBe(before);
+  });
+
   it("does NOT insert when manifest file is missing entirely", () => {
     seedCompanyDir(tmpRoot, "indigo");
     expect(() =>
@@ -566,6 +582,20 @@ describe("provisionCompany", () => {
       listMyPersonEntities: vi.fn().mockResolvedValue([
         { uid: "prs_01H", type: "person", slug: "test-user", name: "Test User" },
       ]),
+      // Default to "slug available in caller's namespace" so happy-path
+      // tests fall through to createCompanyEntity. Reuse-path tests
+      // override with {available: false, conflictingCompanyUid: ...}
+      // and supply a getCompanyByUid that returns the existing entity.
+      checkSlugInMyNamespace: vi
+        .fn()
+        .mockResolvedValue({ available: true }),
+      getCompanyByUid: vi
+        .fn()
+        .mockRejectedValue(
+          new Error(
+            "getCompanyByUid called without an explicit per-test mock — happy path should never hit it",
+          ),
+        ),
       findCompanyBySlug: vi.fn().mockResolvedValue(null),
       createCompanyEntity: vi.fn(),
       ...overrides,
@@ -700,7 +730,13 @@ describe("provisionCompany", () => {
       kmsKeyId: null,
     };
     const vaultClient = makeVaultClient({
-      findCompanyBySlug: vi.fn().mockResolvedValue(entity),
+      // Reuse path under the per-user-namespace model: checkSlugInMyNamespace
+      // reports `available: false` with the existing entity's uid, and
+      // getCompanyByUid materializes the full entity for downstream use.
+      checkSlugInMyNamespace: vi
+        .fn()
+        .mockResolvedValue({ available: false, conflictingCompanyUid: entity.uid }),
+      getCompanyByUid: vi.fn().mockResolvedValue(entity),
       createCompanyEntity: vi.fn(),
     });
     const result = await provisionCompany({
@@ -715,6 +751,7 @@ describe("provisionCompany", () => {
     expect(result.created_entity).toBe(false);
     expect(result.kms_key_id).toBeNull();
     expect(vaultClient.createCompanyEntity).not.toHaveBeenCalled();
+    expect(vaultClient.getCompanyByUid).toHaveBeenCalledWith(entity.uid);
   });
 
   it("throws code 1 when entity has no bucketName (incomplete provisioning)", async () => {
@@ -727,7 +764,11 @@ describe("provisionCompany", () => {
       // bucketName intentionally absent
     };
     const vaultClient = makeVaultClient({
-      findCompanyBySlug: vi.fn().mockResolvedValue(entity),
+      // Same reuse-path mock shape as the idempotent-path test above.
+      checkSlugInMyNamespace: vi
+        .fn()
+        .mockResolvedValue({ available: false, conflictingCompanyUid: entity.uid }),
+      getCompanyByUid: vi.fn().mockResolvedValue(entity),
     });
     try {
       await provisionCompany({

package/src/commands/cloud-provision.ts

@@ -133,7 +133,32 @@ export interface VaultClient {
    * entity.
    */
   listMyPersonEntities(): Promise<VaultEntity[]>;
+  /**
+   * Legacy global-uniqueness lookup. Under the per-user-namespace model
+   * (hq-pro 2026-05-15) this can return any tenant's entity when more
+   * than one user holds the same slug, OR `null` when the caller doesn't
+   * have it but a different user does. Kept on the interface for any
+   * remaining callers, but `provisionCompany` now uses
+   * `checkSlugInMyNamespace` instead — same-slug-different-owner is
+   * legitimate and should NOT trigger reuse of the stranger's entity.
+   */
   findCompanyBySlug(slug: string): Promise<VaultEntity | null>;
+  /**
+   * Caller-scoped slug availability check via
+   * `GET /entity/check-slug/me?type=company&slug=...`. Returns
+   * `{available: true}` when the caller's namespace
+   * (owned ∪ active-member-of, soft-deleted excluded) doesn't hold the
+   * slug, or `{available: false, conflictingCompanyUid}` when it does
+   * — `provisionCompany` reuses the `conflictingCompanyUid` as the
+   * idempotent entity instead of creating a duplicate.
+   */
+  checkSlugInMyNamespace(slug: string): Promise<{
+    available: boolean;
+    conflictingCompanyUid?: string;
+  }>;
+  /** Fetch a company entity by uid. Used to materialize the entity
+   * after `checkSlugInMyNamespace` reports a same-namespace collision. */
+  getCompanyByUid(uid: string): Promise<VaultEntity>;
   createCompanyEntity(input: {
     slug: string;
     name: string;
@@ -302,7 +327,19 @@ export function ensureManifestEntryForProvision(
   if (expectedParent !== companiesDir) return;
   if (path.basename(expected) !== slug) return;
   const dir = companyDirPath(hqRoot, slug);
-  if (!fs.existsSync(dir)) return;
+  // Must be an actual directory, not a stray file. fs.existsSync returns true
+  // for regular files too — without this guard, auto-insert would fire on a
+  // file at `companies/<slug>`, provisionCompany would then create the vault
+  // entity and patch manifest.yaml before writeCompanyConfig's `mkdir -p .hq`
+  // exploded with ENOTDIR. statSync swallows the not-found case so a missing
+  // path is treated the same as before (no auto-insert).
+  let dirStat: fs.Stats;
+  try {
+    dirStat = fs.statSync(dir);
+  } catch {
+    return;
+  }
+  if (!dirStat.isDirectory()) return;
   const raw = fs.readFileSync(mPath, "utf-8");
   let parsed: unknown;
   try {
@@ -463,6 +500,45 @@ export function createDefaultVaultClient(
       }
       return data.entity;
     },
+    async checkSlugInMyNamespace(slug: string): Promise<{
+      available: boolean;
+      conflictingCompanyUid?: string;
+    }> {
+      const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(
+        slug,
+      )}`;
+      const res = await fetch(url, { method: "GET", headers });
+      if (!res.ok) {
+        const body = await safeBody(res);
+        throw new ProvisionError(
+          1,
+          `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`,
+        );
+      }
+      return (await res.json()) as {
+        available: boolean;
+        conflictingCompanyUid?: string;
+      };
+    },
+    async getCompanyByUid(uid: string): Promise<VaultEntity> {
+      const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
+      const res = await fetch(url, { method: "GET", headers });
+      if (!res.ok) {
+        const body = await safeBody(res);
+        throw new ProvisionError(
+          1,
+          `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`,
+        );
+      }
+      const data = (await res.json()) as { entity?: VaultEntity };
+      if (!data.entity) {
+        throw new ProvisionError(
+          1,
+          `Vault GET /entity/${uid} returned 200 with no entity body`,
+        );
+      }
+      return data.entity;
+    },
     async createCompanyEntity(input: {
       slug: string;
       name: string;
@@ -482,9 +558,15 @@ export function createDefaultVaultClient(
       });
       if (!res.ok) {
         const text = await safeBody(res);
-        // 409 means a concurrent client created it between our GET and POST —
-        // surface it as a vault error. The orchestrator is responsible for
-        // retrying GET if it wants idempotency on collisions.
+        // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+        // in their namespace (owned ∪ active-member-of). Under the
+        // per-user-namespace model this is the new same-user-collision
+        // signal — distinct from the legacy global EntityAlreadyExists.
+        // The CLI normally reaches `createCompanyEntity` only after
+        // `checkSlugInMyNamespace` reported `available: true`, so a
+        // 409 here means a race between the pre-check and the POST.
+        // Surface the response body verbatim so the caller can see the
+        // `code` + `conflictingCompanyUid` and resolve / retry.
         throw new ProvisionError(
           1,
           `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`,
@@ -588,12 +670,57 @@ export async function provisionCompany(
   }
   log(`pre-flight ok — caller has ${persons.length} person entity(ies)`);
 
-  let entity = await vaultClient.findCompanyBySlug(options.slug);
+  // Per-user-namespace-aware reuse-or-create. Replaces the legacy
+  // global `findCompanyBySlug` lookup, which under the per-user model
+  // (hq-pro 2026-05-15) returns ANY tenant's entity when more than one
+  // user holds the same slug, OR null when a different user has it —
+  // both wrong for the CLI's "reuse mine, or create" intent.
+  //
+  // `--owner` override: `options.ownerUid`, when set, lets a caller
+  // create the entity under a DIFFERENT person's ownership (e.g. an
+  // admin provisioning on behalf of someone). `/entity/check-slug/me`
+  // answers about the CALLER's namespace, not the target owner's, so
+  // the pre-check is meaningless in that case. Codex P2 on PR 7
+  // flagged this. The gate: only run the namespace check when the
+  // owner is the caller (or defaulted to the caller — i.e. no
+  // --owner supplied). On override, fall through to
+  // `createCompanyEntity` and let the server's authoritative 409
+  // (which IS scoped to the target's namespace, per the
+  // callerIsOwner gate on POST /entity in hq-pro PR 67) surface any
+  // real conflict.
+  //
+  // `callerIsOwner` is `true` whenever `options.ownerUid` is unset
+  // (defaults to caller server-side) OR — when set — happens to
+  // match the caller's own person UID(s) from `listMyPersonEntities`.
+  const callerOwnedUids = new Set(persons.map((p) => p.uid));
+  const callerIsOwner =
+    !options.ownerUid || callerOwnedUids.has(options.ownerUid);
+
+  let entity: VaultEntity;
   let createdEntity = false;
-  if (entity) {
-    log(`reusing existing vault entity uid=${entity.uid}`);
+  if (callerIsOwner) {
+    const slugCheck = await vaultClient.checkSlugInMyNamespace(options.slug);
+    if (!slugCheck.available && slugCheck.conflictingCompanyUid) {
+      log(
+        `reusing existing vault entity uid=${slugCheck.conflictingCompanyUid} (slug already in caller's namespace)`,
+      );
+      entity = await vaultClient.getCompanyByUid(
+        slugCheck.conflictingCompanyUid,
+      );
+    } else {
+      log(`slug available in caller's namespace — creating vault entity`);
+      entity = await vaultClient.createCompanyEntity({
+        slug: options.slug,
+        name: options.name ?? options.slug,
+        ownerUid: options.ownerUid,
+      });
+      createdEntity = true;
+      log(`created vault entity uid=${entity.uid}`);
+    }
   } else {
-    log(`vault entity not found — creating`);
+    log(
+      `--owner ${options.ownerUid} differs from caller's person(s); skipping namespace pre-check (server authoritatively gates per-target-namespace)`,
+    );
     entity = await vaultClient.createCompanyEntity({
       slug: options.slug,
       name: options.name ?? options.slug,