@indigoai-us/hq-cli 5.241.0 → 5.243.0

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.243.0] — 2026-09-27
+### Added
+
+- `hq auth login` remembers the last provider used on this computer and shows the Cognito provider choice page on first login. Only the provider name is stored locally.
+
+### Changed
+
+- Internal: moved the accounts, sessions and questions subcommands out of src/commands/lanes.ts; no behaviour change
+
+### Fixed
+
+- Removed the unused `cli.network.force-ipv4` hq-flags lookup and forced IPv4
+  startup path. The existing Node family-attempt timeout remains unchanged.
+- `hq auth login` continues when it cannot read or save the remembered provider. It prints a dim warning with the state path and error code; a save failure does not turn a successful sign-in into a login failure.
+
+## [5.242.0] — 2026-09-27
+
+### Changed
+
+- Removed the completed `lanes.message-compaction-replay`,
+  `lanes.outpost-question-visibility`, and
+  `lanes.host-scoped-account-homes` gates. Their shipped behaviors now run
+  unconditionally.
+- Account-home login and `set-home` no longer require an unrelated active
+  company selection when `--company` is omitted; explicit `--company` values
+  remain validated.
+
+### Fixed
+
+- The `cli.install-path-compatibility` hq-flags key enables pnpm v11+ global-path recognition. On Windows, it also passes drive-path tarballs to tar by filename from the archive directory. The flag defaults to off.
+
 ## [5.241.0] — 2026-09-27
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -8447,7 +8447,7 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "Host key (defaults to this host's hostname)";
             }, {
                 readonly flags: "--company <slug|uid>";
-                readonly description: "Company scope for the host-account-home flag";
+                readonly description: "Company scope for account-home validation";
             }, {
                 readonly flags: "--json";
                 readonly description: "JSON on stdout (always)";
@@ -8473,7 +8473,7 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "Account home directory";
             }, {
                 readonly flags: "--company <slug|uid>";
-                readonly description: "Company scope for the host-account-home flag";
+                readonly description: "Company scope for account-home validation";
             }, {
                 readonly flags: "--device-auth";
                 readonly description: "Use Codex device authentication instead of localhost callback";

package/dist/command-catalog.generated.js

@@ -10929,7 +10929,7 @@ export const COMMAND_CATALOG = [
                             },
                             {
                                 "flags": "--company <slug|uid>",
-                                "description": "Company scope for the host-account-home flag"
+                                "description": "Company scope for account-home validation"
                             },
                             {
                                 "flags": "--json",
@@ -10963,7 +10963,7 @@ export const COMMAND_CATALOG = [
                             },
                             {
                                 "flags": "--company <slug|uid>",
-                                "description": "Company scope for the host-account-home flag"
+                                "description": "Company scope for account-home validation"
                             },
                             {
                                 "flags": "--device-auth",

package/dist/commands/auth.js

@@ -16,31 +16,70 @@
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
-import { cognitoConfigForLoginProvider } from "../utils/login-provider.js";
+import { resolveLoginProviderSelection, } from "../utils/login-provider.js";
+import { getLastLoginProviderStatePath, loadLastLoginProvider, storeLastLoginProvider, } from "../lib/auth-login-provider-state.js";
 import { callbackPortBusyGuidance, DEFAULT_CALLBACK_PORT, isCallbackPortBusy, } from "../utils/callback-port-busy.js";
-/**
- * Decode the (unverified) ID token payload for display purposes only.
- * The token was just returned by Cognito's token endpoint, so its contents
- * are trusted enough to print — we never use these claims for authorization.
- */
-function peekIdToken(idToken) {
+/** Decode token claims for local display and provider-memory purposes only. */
+function decodeIdTokenClaims(idToken) {
     try {
         const payload = idToken.split(".")[1];
         if (!payload)
-            return {};
+            return undefined;
         const pad = payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
         const normalized = payload.replace(/-/g, "+").replace(/_/g, "/") + pad;
         const decoded = JSON.parse(Buffer.from(normalized, "base64").toString("utf-8"));
-        return {
-            email: decoded.email,
-            sub: decoded.sub,
-            entityType: decoded["custom:entityType"],
-            entityUid: decoded["custom:entityUid"],
-        };
+        return decoded && typeof decoded === "object" && !Array.isArray(decoded)
+            ? decoded
+            : undefined;
     }
     catch {
-        return {};
+        return undefined;
+    }
+}
+function peekIdToken(idToken) {
+    const claims = decodeIdTokenClaims(idToken);
+    return {
+        email: typeof claims?.email === "string" ? claims.email : undefined,
+        sub: typeof claims?.sub === "string" ? claims.sub : undefined,
+        entityType: typeof claims?.["custom:entityType"] === "string"
+            ? claims["custom:entityType"]
+            : undefined,
+        entityUid: typeof claims?.["custom:entityUid"] === "string"
+            ? claims["custom:entityUid"]
+            : undefined,
+    };
+}
+function errorCode(error) {
+    if (error
+        && typeof error === "object"
+        && "code" in error
+        && typeof error.code === "string") {
+        return error.code;
     }
+    return "UNKNOWN";
+}
+function providerFromIdToken(idToken) {
+    const identities = decodeIdTokenClaims(idToken)?.identities;
+    if (!Array.isArray(identities))
+        return undefined;
+    const providers = new Set();
+    for (const identity of identities) {
+        if (!identity || typeof identity !== "object" || Array.isArray(identity))
+            continue;
+        const item = identity;
+        const providerName = typeof item.providerName === "string"
+            ? item.providerName
+            : item.providerType;
+        if (typeof providerName !== "string")
+            continue;
+        const normalized = providerName.trim().toLowerCase();
+        if (normalized === "google")
+            providers.add("google");
+        if (normalized === "microsoft" || normalized === "microsoftpersonal") {
+            providers.add("microsoft");
+        }
+    }
+    return providers.size === 1 ? providers.values().next().value : undefined;
 }
 /** Display label for the local machine identity (company agents). */
 function machineIdentityLabel() {
@@ -67,7 +106,25 @@ export function registerAuthCommands(program) {
             return;
         }
         try {
-            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
+            const canUseRememberedProvider = options.provider === undefined
+                && process.env.HQ_COGNITO_IDENTITY_PROVIDER === undefined;
+            let rememberedProvider;
+            if (canUseRememberedProvider) {
+                try {
+                    rememberedProvider = loadLastLoginProvider();
+                }
+                catch (error) {
+                    console.error(chalk.dim(`Could not read provider state at ${getLastLoginProviderStatePath()} (${errorCode(error)}). Continuing to the provider choice page.`));
+                }
+            }
+            const selection = resolveLoginProviderSelection(options.provider, process.env, rememberedProvider);
+            const tokens = await browserLogin(selection.config);
+            try {
+                storeLastLoginProvider(providerFromIdToken(tokens.idToken) ?? selection.providerToRemember);
+            }
+            catch (error) {
+                console.error(chalk.dim(`Could not save provider state at ${getLastLoginProviderStatePath()} (${errorCode(error)}). The provider choice was not saved.`));
+            }
             const who = peekIdToken(tokens.idToken).email ?? "HQ";
             console.log(chalk.green(`Signed in as ${who}`));
             console.log(chalk.dim(`  Token cached at ~/.hq/cognito-tokens.json (expires ${tokens.expiresAt})`));

package/dist/commands/lanes-accounts.d.ts

@@ -0,0 +1,25 @@
+import type { Ctx, LaneAccountsHandlerDeps } from "./lanes-shared.js";
+export declare function createLaneAccountsHandlers(deps: LaneAccountsHandlerDeps): {
+    runAccountsList: (ctx: Ctx, opts: {
+        provider?: string;
+    }) => Promise<void>;
+    runAccountsBalance: (ctx: Ctx, opts: {
+        provider?: string;
+        apply?: boolean;
+        json?: boolean;
+    }) => Promise<void>;
+    runAccountsLogin: (ctx: Ctx, providerRaw: string, accountId: string, opts: {
+        home?: string;
+        deviceAuth?: boolean;
+        company?: string;
+    }) => Promise<void>;
+    runAccountsSetHome: (ctx: Ctx, providerRaw: string, accountIdRaw: string, homeRaw: string, opts: {
+        host?: string;
+        company?: string;
+    }) => Promise<void>;
+    runAccountsEnable: (ctx: Ctx, providerRaw: string, accountId: string) => Promise<void>;
+    runAccountsDisable: (ctx: Ctx, providerRaw: string, accountId: string, opts: {
+        reason?: string;
+    }) => Promise<void>;
+};
+//# sourceMappingURL=lanes-accounts.d.ts.map