@indigoai-us/hq-cli 5.207.0 → 5.208.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.208.0] — 2026-09-26
+
+### Fixed
+
+- `hq lanes accounts set-home` and `login` accept `--company <slug|uid>` and
+  scope the host-account-home flag read to that company.
+- The `hq daemon` updater now installs new hq-cloud patch releases. It looks up the newest release in the bundled major version and installs that exact version. Before, `npm install` with a version range kept an installed copy that already matched the range, so the updater stayed on 6.18.1 after 6.18.2 was published. A failed lookup is reported as a failed update and installs nothing.
+
 ## [5.207.0] — 2026-09-26
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -8172,6 +8172,9 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [{
                 readonly flags: "--host <hostname>";
                 readonly description: "Host key (defaults to this host's hostname)";
+            }, {
+                readonly flags: "--company <slug|uid>";
+                readonly description: "Company scope for the host-account-home flag";
             }, {
                 readonly flags: "--json";
                 readonly description: "JSON on stdout (always)";
@@ -8195,6 +8198,9 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [{
                 readonly flags: "--home <path>";
                 readonly description: "Account home directory";
+            }, {
+                readonly flags: "--company <slug|uid>";
+                readonly description: "Company scope for the host-account-home flag";
             }, {
                 readonly flags: "--device-auth";
                 readonly description: "Use Codex device authentication instead of localhost callback";

package/dist/command-catalog.generated.js

@@ -10571,6 +10571,10 @@ export const COMMAND_CATALOG = [
                                 "flags": "--host <hostname>",
                                 "description": "Host key (defaults to this host's hostname)"
                             },
+                            {
+                                "flags": "--company <slug|uid>",
+                                "description": "Company scope for the host-account-home flag"
+                            },
                             {
                                 "flags": "--json",
                                 "description": "JSON on stdout (always)"
@@ -10601,6 +10605,10 @@ export const COMMAND_CATALOG = [
                                 "flags": "--home <path>",
                                 "description": "Account home directory"
                             },
+                            {
+                                "flags": "--company <slug|uid>",
+                                "description": "Company scope for the host-account-home flag"
+                            },
                             {
                                 "flags": "--device-auth",
                                 "description": "Use Codex device authentication instead of localhost callback"

package/dist/commands/lanes.d.ts

@@ -35,6 +35,8 @@ export interface LanesCommandDeps {
     now?: () => Date;
     hostname?: () => string;
     resolveCompany?: (company?: string) => Promise<LaneCompanyRef>;
+    /** Membership-backed explicit company selection for account-home writers. */
+    resolveActiveCompany?: (company: string) => Promise<LaneCompanyRef | null>;
     listOutpostIds?: () => Promise<string[]>;
     readOutpostIdentity?: () => OutpostIdentity;
     spawnLogin?: (opts: {

package/dist/commands/lanes.js

@@ -30,7 +30,9 @@ import { BALANCE_MOVABLE_STATES, CLAUDE_ACCOUNT_BALANCE_FLAG, accountLoadsForRep
 import { parseUserYaml } from "../utils/user-yaml-error.js";
 import { backfillOutpostIdentityMarker as backfillOutpostIdentityMarkerImpl, createOutpostIdentityMarkerIfMissing, validateOutpostIdentityId, } from "../lib/lanes/outpost-identity.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
-import { openMeshTransport } from "../lib/mesh/client.js";
+import { resolveActiveMembershipCompany } from "../lib/mesh/api.js";
+import { openMeshTransport, requireToken } from "../lib/mesh/client.js";
+import { CompanySelectionError } from "../utils/company-selection-error.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
@@ -88,11 +90,18 @@ function defaultLaneOutpostQuestionVisibilityEnabled(company, env) {
 function defaultLaneHostScopedAccountHomesEnabled(company, env) {
     return readLanesRegistryFlag(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, { company, env });
 }
-async function hostScopedAccountHomesEnabled(ctx) {
+async function hostScopedAccountHomesEnabled(ctx, company) {
     const localOverride = readLocalOverride(LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG, ctx.env);
     if (localOverride !== null)
         return localOverride;
-    return ctx.laneHostScopedAccountHomesEnabled(await ctx.resolveCompany());
+    return ctx.laneHostScopedAccountHomesEnabled(company ?? await ctx.resolveCompany());
+}
+async function resolveSelectedAccountHomeCompany(ctx, selector) {
+    const company = await ctx.resolveActiveCompany(selector);
+    if (!company) {
+        throw new CompanySelectionError(`No unique active company membership for ${selector}. Pass an active company UID with --company.`);
+    }
+    return company;
 }
 function withoutProviderHome(value) {
     if (Array.isArray(value))
@@ -158,6 +167,12 @@ async function defaultResolveCompany(company) {
     const { company: mesh } = await openMeshTransport({ company });
     return { slug: mesh.companySlug, uid: mesh.companyUid };
 }
+async function defaultResolveActiveCompany(company) {
+    const membership = await resolveActiveMembershipCompany(await requireToken(), company);
+    return membership
+        ? { slug: membership.companySlug, uid: membership.companyUid }
+        : null;
+}
 function defaultOutpostsClient() {
     return createOutpostsClient({
         transport: vaultApiFetch,
@@ -243,6 +258,7 @@ function resolveDeps(deps = {}) {
         now: deps.now ?? (() => new Date()),
         hostname: deps.hostname ?? (() => os.hostname()),
         resolveCompany: deps.resolveCompany ?? defaultResolveCompany,
+        resolveActiveCompany: deps.resolveActiveCompany ?? defaultResolveActiveCompany,
         listOutpostIds: deps.listOutpostIds ?? defaultListOutpostIds,
         readOutpostIdentity: deps.readOutpostIdentity ?? (() => readOutpostIdentity()),
         spawnLogin: deps.spawnLogin ?? defaultSpawnLogin,
@@ -7922,8 +7938,11 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     if (opts.home !== undefined && !requestedHome) {
         throw new LanesError("invalid_account_home", "--home must be a non-empty path", { provider, account: id });
     }
+    const company = opts.company !== undefined
+        ? await resolveSelectedAccountHomeCompany(ctx, opts.company)
+        : undefined;
     const hostScopedWriterEnabled = registeredAccount !== undefined && requestedHome !== undefined
-        ? await hostScopedAccountHomesEnabled(ctx)
+        ? await hostScopedAccountHomesEnabled(ctx, company)
         : false;
     const homeRaw = requestedHome ??
         (registeredAccount !== undefined
@@ -8017,7 +8036,10 @@ async function runAccountsLogin(ctx, providerRaw, accountId, opts) {
     printJson({ ok: true, action: "accounts.login", account: status });
 }
 async function runAccountsSetHome(ctx, providerRaw, accountIdRaw, homeRaw, opts) {
-    if (!(await hostScopedAccountHomesEnabled(ctx))) {
+    const company = opts.company !== undefined
+        ? await resolveSelectedAccountHomeCompany(ctx, opts.company)
+        : undefined;
+    if (!(await hostScopedAccountHomesEnabled(ctx, company))) {
         throw new LanesError("host_scoped_account_homes_disabled", "Setting a host-specific account home requires the lanes.host-scoped-account-homes flag", { flag: LANE_HOST_SCOPED_ACCOUNT_HOMES_FLAG });
     }
     const callerCwd = ctx.callerCwd();
@@ -8689,6 +8711,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<account-id>", "Existing account id")
         .argument("<path>", "Home directory for this host")
         .option("--host <hostname>", "Host key (defaults to this host's hostname)")
+        .option("--company <slug|uid>", "Company scope for the host-account-home flag")
         .option("--json", "JSON on stdout (always)")
         .action(wrap(async (provider, accountId, home, opts) => {
         await runAccountsSetHome(ctx, provider, accountId, home, opts);
@@ -8699,6 +8722,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .argument("<provider>", "claude | codex | grok")
         .argument("<account-id>", "Open-ended account id")
         .option("--home <path>", "Account home directory")
+        .option("--company <slug|uid>", "Company scope for the host-account-home flag")
         .option("--device-auth", "Use Codex device authentication instead of localhost callback")
         .action(wrap(async (provider, accountId, opts) => {
         await runAccountsLogin(ctx, provider, accountId, opts);

package/dist/lib/daemon/hq-cloud.d.ts

@@ -31,8 +31,21 @@ export interface HqCloudRunners {
     sessionHost: string | null;
 }
 export declare function hqCloudRunners(root: string, exists?: (p: string) => boolean): HqCloudRunners;
-/** Install the newest release of the bundled major version, never older than the bundled copy. */
-export declare function hqCloudInstallCommand(prefix: string, bundledVersion: string, platform?: NodeJS.Platform, pinnedVersion?: string): {
+/**
+ * Ask npm for every release of the bundled major version, no older than the
+ * bundled copy. The updater installs the newest one exactly: `npm install` with
+ * a range keeps an installed copy that already satisfies it, so a range alone
+ * never moves 6.18.1 to 6.18.2.
+ */
+export declare function hqCloudLatestCommand(bundledVersion: string, platform?: NodeJS.Platform): {
+    file: string;
+    args: string[];
+    shell: boolean;
+};
+/** The newest release in `npm view --json` output with the bundled major version, never older than it. */
+export declare function latestSameMajor(npmViewJson: string, bundledVersion: string): string | null;
+/** Install one exact hq-cloud version into the updater's folder. */
+export declare function hqCloudInstallCommand(prefix: string, version: string, platform?: NodeJS.Platform): {
     file: string;
     args: string[];
     shell: boolean;
@@ -48,6 +61,17 @@ export interface HqCloudUpdateOutcome {
     to: string | null;
     detail?: string;
 }
+export interface NpmRunResult {
+    status: number | null;
+    stdout?: string | null;
+    stderr?: string | null;
+    error?: Error;
+}
+export interface UpdateHqCloudDeps {
+    run?: (file: string, args: string[], shell: boolean, env: NodeJS.ProcessEnv) => NpmRunResult;
+    bundled?: HqCloudCopy | null;
+    platform?: NodeJS.Platform;
+}
 /** Install or update the updater's copy, as this (the login) user. */
-export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv): HqCloudUpdateOutcome;
+export declare function updateManagedHqCloud(daemonRoot: string, env: NodeJS.ProcessEnv, deps?: UpdateHqCloudDeps): HqCloudUpdateOutcome;
 //# sourceMappingURL=hq-cloud.d.ts.map

package/dist/lib/daemon/hq-cloud.js

@@ -61,18 +61,45 @@ export function hqCloudRunners(root, exists = fs.existsSync) {
         sessionHost: bin("outpost-session-host.js"),
     };
 }
-/** Install the newest release of the bundled major version, never older than the bundled copy. */
-export function hqCloudInstallCommand(prefix, bundledVersion, platform = process.platform, pinnedVersion) {
+/**
+ * Ask npm for every release of the bundled major version, no older than the
+ * bundled copy. The updater installs the newest one exactly: `npm install` with
+ * a range keeps an installed copy that already satisfies it, so a range alone
+ * never moves 6.18.1 to 6.18.2.
+ */
+export function hqCloudLatestCommand(bundledVersion, platform = process.platform) {
+    const plan = buildSpawnPlan("npm", ["view", `${HQ_CLOUD_PACKAGE}@^${bundledVersion}`, "version", "--json"], platform);
+    return { file: plan.cmd, args: plan.args, shell: plan.shell };
+}
+/** The newest release in `npm view --json` output with the bundled major version, never older than it. */
+export function latestSameMajor(npmViewJson, bundledVersion) {
+    const b = parseVersion(bundledVersion);
+    if (!b)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(npmViewJson);
+    }
+    catch {
+        return null;
+    }
+    const versions = typeof parsed === "string" ? [parsed] : Array.isArray(parsed) ? parsed : [];
+    let best = null;
+    for (const text of versions) {
+        if (typeof text !== "string" || !/^\d+\.\d+\.\d+$/.test(text))
+            continue;
+        const v = parseVersion(text);
+        if (v[0] !== b[0] || newer(b, v))
+            continue;
+        if (!best || newer(v, best.v))
+            best = { text, v };
+    }
+    return best?.text ?? null;
+}
+/** Install one exact hq-cloud version into the updater's folder. */
+export function hqCloudInstallCommand(prefix, version, platform = process.platform) {
     // npm is a .cmd on Windows and needs the shell, so every argument is quoted for it.
-    const plan = buildSpawnPlan("npm", [
-        "install",
-        "--prefix",
-        prefix,
-        "--no-audit",
-        "--no-fund",
-        "--omit=dev",
-        `${HQ_CLOUD_PACKAGE}@${pinnedVersion ?? `^${bundledVersion}`}`,
-    ], platform);
+    const plan = buildSpawnPlan("npm", ["install", "--prefix", prefix, "--no-audit", "--no-fund", "--omit=dev", `${HQ_CLOUD_PACKAGE}@${version}`], platform);
     return { file: plan.cmd, args: plan.args, shell: plan.shell };
 }
 export function readHqCloudCopy(root) {
@@ -99,10 +126,26 @@ export function currentHqCloud(daemonRoot) {
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
     return pickHqCloud(bundledHqCloud(), readHqCloudCopy(managedHqCloudRoot(daemonRoot)), (copy) => hqCloudRunners(copy.root).syncRunner !== null, pinnedVersion);
 }
+function runNpm(file, args, shell, env) {
+    return spawnSync(file, args, {
+        encoding: "utf8",
+        env,
+        timeout: 10 * 60_000,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        shell,
+    });
+}
+function npmFailure(r) {
+    const tail = `${r.stderr ?? ""}\n${r.stdout ?? ""}`.trim().split("\n").slice(-3).join(" ").slice(0, 400);
+    return tail || (r.error ? r.error.message : `npm exited ${r.status ?? "by signal"}`);
+}
 /** Install or update the updater's copy, as this (the login) user. */
-export function updateManagedHqCloud(daemonRoot, env) {
+export function updateManagedHqCloud(daemonRoot, env, deps = {}) {
+    const run = deps.run ?? runNpm;
+    const platform = deps.platform ?? process.platform;
     const pinnedVersion = readDaemonConfig(path.join(daemonRoot, "config.json")).hqCloudVersion;
-    const bundled = bundledHqCloud();
+    const bundled = deps.bundled !== undefined ? deps.bundled : bundledHqCloud();
     const from = currentHqCloud(daemonRoot)?.version ?? null;
     if (!bundled)
         return { ok: false, from, to: null, detail: "this CLI install has no bundled hq-cloud to match" };
@@ -113,19 +156,22 @@ export function updateManagedHqCloud(daemonRoot, env) {
     catch (err) {
         return { ok: false, from, to: null, detail: `could not create ${prefix}: ${err instanceof Error ? err.message : String(err)}` };
     }
-    const cmd = hqCloudInstallCommand(prefix, bundled.version, process.platform, pinnedVersion);
-    const r = spawnSync(cmd.file, cmd.args, {
-        encoding: "utf8",
-        env,
-        timeout: 10 * 60_000,
-        stdio: ["ignore", "pipe", "pipe"],
-        windowsHide: true,
-        shell: cmd.shell,
-    });
-    if (r.status !== 0) {
-        const tail = `${r.stderr ?? ""}\n${r.stdout ?? ""}`.trim().split("\n").slice(-3).join(" ").slice(0, 400);
-        return { ok: false, from, to: null, detail: tail || (r.error ? r.error.message : `npm exited ${r.status ?? "by signal"}`) };
+    let version = pinnedVersion;
+    if (!version) {
+        const view = hqCloudLatestCommand(bundled.version, platform);
+        const r = run(view.file, view.args, view.shell, env);
+        if (r.status !== 0)
+            return { ok: false, from, to: null, detail: `could not look up the newest hq-cloud: ${npmFailure(r)}` };
+        const latest = latestSameMajor(r.stdout ?? "", bundled.version);
+        if (!latest) {
+            return { ok: false, from, to: null, detail: `npm listed no hq-cloud release at or above ${bundled.version} in the same major version` };
+        }
+        version = latest;
     }
+    const cmd = hqCloudInstallCommand(prefix, version, platform);
+    const r = run(cmd.file, cmd.args, cmd.shell, env);
+    if (r.status !== 0)
+        return { ok: false, from, to: null, detail: npmFailure(r) };
     return { ok: true, from, to: currentHqCloud(daemonRoot)?.version ?? null };
 }
 //# sourceMappingURL=hq-cloud.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.207.0",
+  "version": "5.208.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {