@indigoai-us/hq-cli 5.16.0 → 5.17.0-sources-rc.1

package/dist/commands/sources.js

@@ -0,0 +1,250 @@
+/**
+ * `hq sources` subcommand group (US-006).
+ *
+ * Read-side surface over the sources written by sources-pipeline. Each
+ * invocation resolves a Cognito access token (or honors HQ_ACCESS_TOKEN),
+ * vends STS-scoped credentials via vault-service for the requested entity,
+ * and delegates to hq-cloud's listSources/getSource primitives.
+ *
+ * Subcommands:
+ *   hq sources list      List sources of a given channel for an entity.
+ *   hq sources get       Fetch one source by id.
+ *   hq sources channels  Print the canonical SOURCE_CHANNELS enum.
+ *   hq sources entities  List entities the caller has access to.
+ *
+ * Defaults:
+ *   --entity   falls back to .hq/config.json activeCompany (per sync.ts).
+ *   --format   'table' when stdout is a TTY, 'json' when piped.
+ *   --limit    50.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="df18b298-4724-5557-a579-edfa0f468361")}catch(e){}}();
+import * as fs from "node:fs";
+import * as path from "node:path";
+import chalk from "chalk";
+import { SOURCE_CHANNELS, assertSourceChannel, resolveEntity, listAvailableEntities, listSources, getSource, } from "@indigoai-us/hq-cloud";
+import { ensureCognitoToken, buildVaultConfig, DEFAULT_HQ_ROOT, } from "../utils/cognito-session.js";
+import { Sentry } from "../sentry.js";
+// ---------------------------------------------------------------------------
+// Access token resolution — honors HQ_ACCESS_TOKEN for tests + CI smoke
+// ---------------------------------------------------------------------------
+/**
+ * Returns a usable access token. Tests and CI smoke scripts can set
+ * HQ_ACCESS_TOKEN to bypass the interactive Cognito flow; otherwise we fall
+ * back to the cached/refresh/browser-login pipeline in cognito-session.ts.
+ */
+async function resolveAccessToken() {
+    if (process.env.HQ_ACCESS_TOKEN)
+        return process.env.HQ_ACCESS_TOKEN;
+    return ensureCognitoToken();
+}
+// ---------------------------------------------------------------------------
+// Entity resolution — flag → .hq/config.json activeCompany fallback
+// ---------------------------------------------------------------------------
+/**
+ * Read the active company slug from .hq/config.json (mirrors sync.ts /
+ * cloud.ts behaviour). Returns undefined when the file is missing or the
+ * key isn't set; never throws.
+ */
+function readActiveCompanySlug(hqRoot) {
+    const configPath = path.join(hqRoot, ".hq", "config.json");
+    if (!fs.existsSync(configPath))
+        return undefined;
+    try {
+        const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+        const slug = cfg.activeCompany;
+        return typeof slug === "string" && slug.length > 0 ? slug : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function requireEntitySlug(flag, hqRoot) {
+    const slug = flag ?? readActiveCompanySlug(hqRoot);
+    if (!slug) {
+        throw new Error("No entity specified. Pass --entity <slug> or run `hq sources entities` to see your options.");
+    }
+    return slug;
+}
+function defaultListFormat() {
+    return process.stdout.isTTY ? "table" : "json";
+}
+function defaultGetFormat() {
+    return process.stdout.isTTY ? "markdown" : "json";
+}
+// ---------------------------------------------------------------------------
+// Rendering helpers
+// ---------------------------------------------------------------------------
+function renderListTable(entries, includeFrontmatter) {
+    if (entries.length === 0)
+        return "(no sources)";
+    const rows = entries.map((e) => ({
+        sourceId: e.sourceId,
+        lastModified: e.lastModified.toISOString(),
+        size: String(e.size),
+        ...(includeFrontmatter
+            ? { title: typeof e.frontmatter?.title === "string" ? e.frontmatter.title : "" }
+            : {}),
+    }));
+    const headers = Object.keys(rows[0]);
+    const widths = headers.map((h) => Math.max(h.length, ...rows.map((r) => String(r[h]).length)));
+    const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+    const headerLine = headers.map((h, i) => pad(h, widths[i])).join("  ");
+    const sep = widths.map((w) => "-".repeat(w)).join("  ");
+    const body = rows
+        .map((r) => headers.map((h, i) => pad(String(r[h]), widths[i])).join("  "))
+        .join("\n");
+    return [headerLine, sep, body].join("\n");
+}
+async function runList(options) {
+    if (!options.type) {
+        throw new Error(`--type <channel> is required. Valid channels: ${SOURCE_CHANNELS.join(", ")}`);
+    }
+    // Throws InvalidSourceChannelError with the list of valid channels if not in enum.
+    assertSourceChannel(options.type);
+    const channel = options.type;
+    const slug = requireEntitySlug(options.entity, options.hqRoot);
+    const limit = options.limit ? Number.parseInt(options.limit, 10) : 50;
+    if (!Number.isFinite(limit) || limit <= 0) {
+        throw new Error(`--limit must be a positive integer (got '${options.limit}')`);
+    }
+    const format = options.format ?? defaultListFormat();
+    const accessToken = await resolveAccessToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const entity = await resolveEntity({ slug, vaultConfig });
+    const result = await listSources({
+        entity,
+        channel,
+        limit,
+        continuationToken: options.pageToken,
+        includeFrontmatter: options.includeFrontmatter,
+    });
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return;
+    }
+    process.stdout.write(renderListTable(result.entries, !!options.includeFrontmatter) + "\n");
+    if (result.nextToken) {
+        process.stdout.write(`\nNext page token: ${result.nextToken}\n`);
+    }
+}
+async function runGet(options) {
+    if (!options.type) {
+        throw new Error(`--type <channel> is required. Valid channels: ${SOURCE_CHANNELS.join(", ")}`);
+    }
+    if (!options.id) {
+        throw new Error("--id <sourceId> is required.");
+    }
+    assertSourceChannel(options.type);
+    const channel = options.type;
+    const slug = requireEntitySlug(options.entity, options.hqRoot);
+    const format = options.format ?? defaultGetFormat();
+    const accessToken = await resolveAccessToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const entity = await resolveEntity({ slug, vaultConfig });
+    const doc = await getSource({
+        entity,
+        channel,
+        sourceId: options.id,
+        includeRaw: options.includeRaw,
+    });
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(doc, null, 2) + "\n");
+        return;
+    }
+    // markdown: reconstruct frontmatter block + body so the output round-trips.
+    if (doc.frontmatter) {
+        const yamlLines = Object.entries(doc.frontmatter).map(([k, v]) => `${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
+        process.stdout.write(`---\n${yamlLines.join("\n")}\n---\n\n${doc.body}\n`);
+    }
+    else {
+        process.stdout.write(doc.body + "\n");
+    }
+}
+// ---------------------------------------------------------------------------
+// Subcommand: channels
+// ---------------------------------------------------------------------------
+function runChannels() {
+    const sorted = [...SOURCE_CHANNELS].sort();
+    process.stdout.write(sorted.join("\n") + "\n");
+}
+// ---------------------------------------------------------------------------
+// Subcommand: entities
+// ---------------------------------------------------------------------------
+async function runEntities(options) {
+    const format = options.format ?? defaultListFormat();
+    const accessToken = await resolveAccessToken();
+    const vaultConfig = buildVaultConfig(accessToken);
+    const entities = await listAvailableEntities({ vaultConfig });
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(entities, null, 2) + "\n");
+        return;
+    }
+    if (entities.length === 0) {
+        process.stdout.write("(no entities — your account has no active memberships)\n");
+        return;
+    }
+    const headers = ["slug", "role", "uid"];
+    const widths = headers.map((h, i) => Math.max(h.length, ...entities.map((e) => String([e.slug, e.role, e.uid][i]).length)));
+    const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+    const headerLine = headers.map((h, i) => pad(h, widths[i])).join("  ");
+    const sep = widths.map((w) => "-".repeat(w)).join("  ");
+    const body = entities
+        .map((e) => [e.slug, e.role, e.uid].map((cell, i) => pad(cell, widths[i])).join("  "))
+        .join("\n");
+    process.stdout.write([headerLine, sep, body].join("\n") + "\n");
+}
+// ---------------------------------------------------------------------------
+// Registration
+// ---------------------------------------------------------------------------
+/** Wrap an action so caught errors print red + capture to Sentry + exit 1. */
+function withErrorHandling(fn) {
+    return async (...args) => {
+        try {
+            await fn(...args);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(chalk.red(`✗ ${message}\n`));
+            Sentry.captureException(err);
+            process.exit(1);
+        }
+    };
+}
+export function registerSourcesCommand(program) {
+    const sources = program
+        .command("sources")
+        .description("Read sources (meetings, emails, etc.) from a vault entity");
+    sources
+        .command("list")
+        .description("List sources of a given channel for an entity")
+        .option("--entity <slug>", "Entity slug (defaults to .hq/config.json activeCompany)")
+        .option("--type <channel>", `Source channel: ${SOURCE_CHANNELS.join(" | ")}`)
+        .option("--limit <n>", "Max entries per page (default 50)")
+        .option("--page-token <token>", "Continuation token from a prior page")
+        .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
+        .option("--include-frontmatter", "Fetch + parse each entry's frontmatter (extra GETs)")
+        .option("--hq-root <path>", `Local HQ tree root (for .hq/config.json lookup; default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(withErrorHandling(async (options) => runList(options)));
+    sources
+        .command("get")
+        .description("Fetch a single source by id")
+        .option("--entity <slug>", "Entity slug (defaults to .hq/config.json activeCompany)")
+        .option("--type <channel>", `Source channel: ${SOURCE_CHANNELS.join(" | ")}`)
+        .option("--id <sourceId>", "Source id (filename minus .md)")
+        .option("--format <fmt>", "Output format: markdown | json (default: markdown for TTY, json piped)")
+        .option("--include-raw", "Also fetch the .raw.json sibling")
+        .option("--hq-root <path>", `Local HQ tree root (for .hq/config.json lookup; default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .action(withErrorHandling(async (options) => runGet(options)));
+    sources
+        .command("channels")
+        .description("Print the canonical source channels (one per line)")
+        .action(withErrorHandling(() => runChannels()));
+    sources
+        .command("entities")
+        .description("List entities (companies/personal) your account has access to")
+        .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
+        .action(withErrorHandling(async (options) => runEntities(options)));
+}
+//# sourceMappingURL=sources.js.map
+//# debugId=df18b298-4724-5557-a579-edfa0f468361

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="15889dc3-5d7e-5fb9-8df3-33d5aebdc945")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2fc192b3-daa6-5939-a152-1422a7908e87")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -30,6 +30,8 @@ import { registerFilesCommand } from "./commands/files.js";
 import { registerMembersCommand } from "./commands/members.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
+import { registerSourcesCommand } from "./commands/sources.js";
+import { registerSignalsCommand } from "./commands/signals.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
 import { CLI_VERSION } from "./cli-version.js";
@@ -105,6 +107,10 @@ registerOnboardCommand(program);
 registerFeedbackCommand(program);
 // Meetings (subcommand group — hq meetings list|get|search|transcript|notes)
 registerMeetingsCommand(program);
+// Sources read surface (subcommand group — hq sources list|get|channels|entities)
+registerSourcesCommand(program);
+// Signals read surface (subcommand group — hq signals list|get|types|entities)
+registerSignalsCommand(program);
 (async () => {
     try {
         Sentry.addBreadcrumb({
@@ -123,4 +129,4 @@ registerMeetingsCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=15889dc3-5d7e-5fb9-8df3-33d5aebdc945
+//# debugId=2fc192b3-daa6-5939-a152-1422a7908e87

package/dist/utils/cognito-session.d.ts

@@ -18,7 +18,7 @@
  *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
-import { type CognitoAuthConfig, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
+import { type CognitoAuthConfig, type ClientInfo, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
 export declare const DEFAULT_COGNITO: CognitoAuthConfig;
 export declare const DEFAULT_VAULT_API_URL: string;
 /**
@@ -58,6 +58,15 @@ export declare const DEFAULT_HQ_ROOT: string;
 export declare function ensureCognitoToken(options?: {
     interactive?: boolean;
 }): Promise<string>;
+/**
+ * The CLI's own ClientInfo. Resolved once at module load so every VaultClient
+ * built in this process stamps the same name/version onto its requests.
+ *
+ * `hqCoreVersion` is filled in lazily by walking up from cwd to find
+ * `core/core.yaml` — present only when the CLI is invoked from inside an
+ * hq-core checkout, so the server can see scaffold-generation skew.
+ */
+export declare const CLI_CLIENT_INFO: ClientInfo;
 /** Build a VaultServiceConfig with the given access token. */
 export declare function buildVaultConfig(authToken: string): VaultServiceConfig;
 /**

package/dist/utils/cognito-session.js

@@ -19,12 +19,13 @@
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6a8ac157-0903-513d-b4c5-45fb532b8026")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d16ef3c7-eead-5307-aaa7-ca5fc828102b")}catch(e){}}();
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import chalk from "chalk";
-import { loadCachedTokens, isExpiring, refreshTokens, browserLogin, } from "@indigoai-us/hq-cloud";
+import { loadCachedTokens, isExpiring, refreshTokens, browserLogin, detectHqCoreVersion, } from "@indigoai-us/hq-cloud";
+import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
@@ -124,12 +125,26 @@ export async function ensureCognitoToken(options = {}) {
     const tokens = await browserLogin(DEFAULT_COGNITO);
     return tokens.accessToken;
 }
+/**
+ * The CLI's own ClientInfo. Resolved once at module load so every VaultClient
+ * built in this process stamps the same name/version onto its requests.
+ *
+ * `hqCoreVersion` is filled in lazily by walking up from cwd to find
+ * `core/core.yaml` — present only when the CLI is invoked from inside an
+ * hq-core checkout, so the server can see scaffold-generation skew.
+ */
+export const CLI_CLIENT_INFO = {
+    name: CLI_NAME,
+    version: CLI_VERSION,
+    hqCoreVersion: detectHqCoreVersion(),
+};
 /** Build a VaultServiceConfig with the given access token. */
 export function buildVaultConfig(authToken) {
     return {
         apiUrl: DEFAULT_VAULT_API_URL,
         authToken,
         region: DEFAULT_COGNITO.region,
+        clientInfo: CLI_CLIENT_INFO,
     };
 }
 /**
@@ -155,4 +170,4 @@ export async function refreshCachedSession() {
     }
 }
 //# sourceMappingURL=cognito-session.js.map
-//# debugId=6a8ac157-0903-513d-b4c5-45fb532b8026
+//# debugId=d16ef3c7-eead-5307-aaa7-ca5fc828102b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.16.0",
+  "version": "5.17.0-sources-rc.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,18 +15,19 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@sentry/node": "^10.49.0",
-    "@indigoai-us/hq-cloud": "^5.1.0",
+    "@indigoai-us/hq-cloud": "^5.21.0",
     "@indigoai-us/hq-onboarding": "^0.1.0",
+    "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
     "open": "^10.1.0",
-    "simple-git": "^3.27.0",
     "semver": "^7.6.3",
+    "simple-git": "^3.27.0",
     "varlock": "1.0.0"
   },
   "devDependencies": {
+    "@aws-sdk/client-s3": "^3.1049.0",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "@types/semver": "^7.5.8",

package/scripts/smoke-sources-signals.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+#
+# smoke-sources-signals.sh — end-to-end verification of `hq sources` /
+# `hq signals` against a real vault bucket. Owned by US-008 of the
+# hq-cli-sources-signals PRD.
+#
+# Usage:
+#   # 1. Make sure you have a working Cognito session OR export a token:
+#   hq whoami            # interactive Cognito login if needed
+#   #   or: export HQ_ACCESS_TOKEN="$(...)"   # service-account JWT bypass
+#
+#   # 2. Run the smoke against an entity slug you have access to (default: indigo):
+#   ./scripts/smoke-sources-signals.sh              # uses ENTITY=indigo
+#   ENTITY=personal ./scripts/smoke-sources-signals.sh
+#
+# Behavior:
+#   Runs four CLI invocations, each asserted to exit 0 AND produce parseable
+#   JSON (where --format json is used). Stdout from each invocation is
+#   appended to a temp file; the script prints a summary table at the end.
+#
+# Exit codes:
+#   0  all four invocations succeeded and produced valid JSON
+#   1  one or more invocations failed (script aborts on first failure with set -e)
+#
+# Dependencies:
+#   - hq (built locally via `pnpm --filter @indigoai-us/hq-cli build`, or
+#     `npx @indigoai-us/hq-cli@rc ...` against a published rc)
+#   - jq (for JSON validation)
+#
+
+set -euo pipefail
+
+ENTITY="${ENTITY:-indigo}"
+LIMIT="${LIMIT:-5}"
+HQ_BIN="${HQ_BIN:-hq}"
+
+# Resolve workspace-local journal location for capturing output. The
+# operator running this script may redirect the script's stdout to a journal
+# file under companies/indigo/projects/hq-cli-sources-signals/journal/.
+SMOKE_TMP="$(mktemp -d -t hq-smoke-XXXXXX)"
+trap 'rm -rf "$SMOKE_TMP"' EXIT
+
+echo "==> hq sources/signals smoke for entity=$ENTITY limit=$LIMIT"
+echo "    binary: $HQ_BIN"
+echo "    tmpdir: $SMOKE_TMP"
+echo
+
+require_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "ERROR: required command '$1' not found in PATH" >&2
+    exit 1
+  fi
+}
+
+require_cmd "$HQ_BIN"
+require_cmd jq
+
+# --- 1. entities -----------------------------------------------------------
+echo "[1/4] hq sources entities"
+"$HQ_BIN" sources entities --format json > "$SMOKE_TMP/entities.json"
+jq -e 'type == "array"' "$SMOKE_TMP/entities.json" > /dev/null
+ENTITY_COUNT=$(jq 'length' "$SMOKE_TMP/entities.json")
+echo "      ok — $ENTITY_COUNT entity/entities visible"
+echo
+
+# --- 2. sources channels (no auth required) --------------------------------
+echo "[2/4] hq sources channels"
+"$HQ_BIN" sources channels > "$SMOKE_TMP/channels.txt"
+grep -qx 'meeting' "$SMOKE_TMP/channels.txt"
+grep -qx 'email' "$SMOKE_TMP/channels.txt"
+grep -qx 'slack' "$SMOKE_TMP/channels.txt"
+grep -qx 'linear' "$SMOKE_TMP/channels.txt"
+grep -qx 'notion' "$SMOKE_TMP/channels.txt"
+echo "      ok — all five canonical channels present"
+echo
+
+# --- 3. sources list --type meeting (the headline acceptance criterion) ---
+echo "[3/4] hq sources list --entity $ENTITY --type meeting --limit $LIMIT --format json"
+"$HQ_BIN" sources list \
+  --entity "$ENTITY" \
+  --type meeting \
+  --limit "$LIMIT" \
+  --format json > "$SMOKE_TMP/sources-list.json"
+jq -e '.entries | type == "array"' "$SMOKE_TMP/sources-list.json" > /dev/null
+SOURCE_COUNT=$(jq '.entries | length' "$SMOKE_TMP/sources-list.json")
+echo "      ok — $SOURCE_COUNT meeting source(s) listed"
+echo
+
+# --- 4. signals list --type action_item (the other headline) --------------
+echo "[4/4] hq signals list --entity $ENTITY --type action_item --limit $LIMIT --format json"
+"$HQ_BIN" signals list \
+  --entity "$ENTITY" \
+  --type action_item \
+  --limit "$LIMIT" \
+  --format json > "$SMOKE_TMP/signals-list.json"
+jq -e '.entries | type == "array"' "$SMOKE_TMP/signals-list.json" > /dev/null
+SIGNAL_COUNT=$(jq '.entries | length' "$SMOKE_TMP/signals-list.json")
+echo "      ok — $SIGNAL_COUNT action_item signal(s) listed"
+echo
+
+echo "==> SMOKE PASSED"
+echo "    entities=$ENTITY_COUNT  meeting_sources=$SOURCE_COUNT  action_item_signals=$SIGNAL_COUNT"
+echo "    raw outputs preserved in $SMOKE_TMP until process exit"

package/src/cli-version.ts

@@ -4,6 +4,10 @@ import path from "node:path";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const pkgPath = path.resolve(here, "..", "package.json");
-const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as { version: string };
+const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as {
+  name: string;
+  version: string;
+};
 
+export const CLI_NAME: string = pkg.name;
 export const CLI_VERSION: string = pkg.version;

package/src/commands/groups.ts

@@ -66,7 +66,7 @@ export function registerGroupsCommand(program: Command): void {
           if (res.status === 401) {
             console.error(chalk.red("Not authenticated — please run `hq login`"));
           } else if (res.status === 403) {
-            console.error(chalk.red("Not authorized — owner or admin role required"));
+            console.error(chalk.red("Not authorized — owner role required"));
           } else if (res.status === 409) {
             console.error(chalk.red(`Group already exists: ${groupId}`));
           } else if (res.status >= 500) {
@@ -110,7 +110,7 @@ export function registerGroupsCommand(program: Command): void {
           if (res.status === 401) {
             console.error(chalk.red("Not authenticated — please run `hq login`"));
           } else if (res.status === 403) {
-            console.error(chalk.red("Not authorized — owner or admin role required"));
+            console.error(chalk.red("Not authorized — owner role required"));
           } else if (res.status === 404) {
             console.error(chalk.red(`Group not found: ${groupId}`));
           } else if (res.status >= 500) {
@@ -160,7 +160,7 @@ export function registerGroupsCommand(program: Command): void {
           if (res.status === 401) {
             console.error(chalk.red("Not authenticated — please run `hq login`"));
           } else if (res.status === 403) {
-            console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+            console.error(chalk.red("Not authorized — owner role or group creator required"));
           } else if (res.status === 404) {
             // Server provides a helpful message (email not found vs group not found)
             console.error(chalk.red(err.error ?? `Not found`));
@@ -215,7 +215,7 @@ export function registerGroupsCommand(program: Command): void {
           if (res.status === 401) {
             console.error(chalk.red("Not authenticated — please run `hq login`"));
           } else if (res.status === 403) {
-            console.error(chalk.red("Not authorized — owner/admin role or group creator required"));
+            console.error(chalk.red("Not authorized — owner role or group creator required"));
           } else if (res.status === 404) {
             console.error(chalk.red(err.error ?? `Not found`));
           } else if (res.status >= 500) {

package/src/commands/meetings.ts

@@ -1,7 +1,7 @@
 import { Command } from "commander";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 
 interface MeetingListItem {
   meetingId: string;
@@ -210,7 +210,7 @@ export function registerMeetingsCommand(program: Command): void {
 
         if (opts.limit) query.limit = opts.limit;
         if (opts.next) query.nextToken = opts.next;
-        if (companySlug) query.companyId = companySlug;
+        if (companySlug) query.companyId = await getCompanyUid(token, companySlug);
 
         const res = await vaultApiFetch({ token, path: "/v1/meetings", query });
         if (!res.ok) await handleApiError(res);
@@ -250,7 +250,7 @@ export function registerMeetingsCommand(program: Command): void {
         const token = await ensureCognitoToken();
         const query: Record<string, string> = {};
         const companySlug = meetings.opts().company as string | undefined;
-        if (companySlug) query.companyId = companySlug;
+        if (companySlug) query.companyId = await getCompanyUid(token, companySlug);
 
         const meetingId = await resolveShortId(token, rawId, query);
         const res = await vaultApiFetch({
@@ -309,7 +309,7 @@ export function registerMeetingsCommand(program: Command): void {
         const token = await ensureCognitoToken();
         const params: Record<string, string> = { q: query };
         const companySlug = meetings.opts().company as string | undefined;
-        if (companySlug) params.companyId = companySlug;
+        if (companySlug) params.companyId = await getCompanyUid(token, companySlug);
 
         const res = await vaultApiFetch({
           token,
@@ -347,7 +347,7 @@ export function registerMeetingsCommand(program: Command): void {
         const token = await ensureCognitoToken();
         const query: Record<string, string> = {};
         const companySlug = meetings.opts().company as string | undefined;
-        if (companySlug) query.companyId = companySlug;
+        if (companySlug) query.companyId = await getCompanyUid(token, companySlug);
 
         const meetingId = await resolveShortId(token, rawId, query);
         const res = await vaultApiFetch({
@@ -403,7 +403,7 @@ export function registerMeetingsCommand(program: Command): void {
         const token = await ensureCognitoToken();
         const query: Record<string, string> = {};
         const companySlug = meetings.opts().company as string | undefined;
-        if (companySlug) query.companyId = companySlug;
+        if (companySlug) query.companyId = await getCompanyUid(token, companySlug);
 
         const meetingId = await resolveShortId(token, rawId, query);
         const res = await vaultApiFetch({

package/src/commands/members.test.ts

@@ -222,6 +222,47 @@ describe("inviteMember", () => {
       }),
     ).rejects.toBeInstanceOf(InviteHttpError);
   });
+
+  it("resolves the token when it is nested on the membership row", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        membership: {
+          role: "admin",
+          status: "pending",
+          inviteToken: "tok_nested",
+        },
+      }),
+    );
+
+    const result = await inviteMember({
+      target: "alice@example.com",
+      role: "admin",
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    expect(result.inviteToken).toBe("tok_nested");
+    expect(result.magicLink).toBe("hq://accept/tok_nested");
+  });
+
+  it("throws instead of emitting hq://accept/undefined when no token is present", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        membership: { role: "admin", status: "pending" },
+      }),
+    );
+
+    await expect(
+      inviteMember({
+        target: "alice@example.com",
+        role: "admin",
+        companyUid: "cmp_acme",
+        callerUid: "prs_admin",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/did not include an invite token/);
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -257,6 +298,21 @@ describe("listPendingInvites", () => {
       InviteHttpError,
     );
   });
+
+  it("returns [] for an empty invites array", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { invites: [] }));
+    await expect(listPendingInvites("test-token", "cmp_acme")).resolves.toEqual([]);
+  });
+
+  it("returns [] when invites is null", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { invites: null }));
+    await expect(listPendingInvites("test-token", "cmp_acme")).resolves.toEqual([]);
+  });
+
+  it("returns [] when the invites key is missing", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    await expect(listPendingInvites("test-token", "cmp_acme")).resolves.toEqual([]);
+  });
 });
 
 // ---------------------------------------------------------------------------