@indigoai-us/hq-cli 5.242.0 → 5.244.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## [Unreleased]
 
+## [5.244.0] — 2026-09-27
+
+### Changed
+
+- The setup bot no longer posts "This one takes a minute. I'll reply here as
+  soon as it's done." when a step runs long. Other bots keep their notice.
+- After the bundled setup bot connects its first app, it says "Great, <Tool> is
+  connected" with a link to the company's integrations page on hq.computer.
+- The bundled setup bot invites teammates through the new-hire flow when HQ
+  has it, and tells the person to have the invitee check their spam folder.
+
+## [5.243.0] — 2026-09-27
+### Added
+
+- `hq auth login` remembers the last provider used on this computer and shows the Cognito provider choice page on first login. Only the provider name is stored locally.
+
+### Changed
+
+- Internal: moved the accounts, sessions and questions subcommands out of src/commands/lanes.ts; no behaviour change
+
+### Fixed
+
+- Removed the unused `cli.network.force-ipv4` hq-flags lookup and forced IPv4
+  startup path. The existing Node family-attempt timeout remains unchanged.
+- `hq auth login` continues when it cannot read or save the remembered provider. It prints a dim warning with the state path and error code; a save failure does not turn a successful sign-in into a login failure.
+
 ## [5.242.0] — 2026-09-27
 
 ### Changed
@@ -14,6 +40,10 @@
   company selection when `--company` is omitted; explicit `--company` values
   remain validated.
 
+### Fixed
+
+- The `cli.install-path-compatibility` hq-flags key enables pnpm v11+ global-path recognition. On Windows, it also passes drive-path tarballs to tar by filename from the archive directory. The flag defaults to off.
+
 ## [5.241.0] — 2026-09-27
 
 ### Fixed
@@ -1611,6 +1641,18 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- A bot whose agent home is on a network share can now mint a token. The
+  refresh lock was a POSIX hard-link lock, and CIFS/SMB shares — Azure Files
+  again — do not implement `link()` at all, so every mint failed with
+  ENOTSUP and took the whole probe down with it: no heartbeat ever posted
+  and the inbox poller retried and failed every 15 seconds. The lock now
+  falls back to an exclusive create, which gives the same guarantee and
+  works there. Contention still surfaces as EEXIST on both paths, so
+  stale-owner reclamation is unchanged, and a link that fails for any other
+  reason is still a real error.
+
 - `hq mesh daemon install` and `hq mesh daemon run` unload and remove the
   legacy `ai.getindigo.hq-work-mesh-listen` unit (LaunchAgent, systemd user
   unit, or Scheduled Task) so only the daemon subscribes. The daemon writes

package/assets/bot-workers/setup/skills/agents-and-team.md

@@ -114,16 +114,29 @@ console, and they sign in in the browser.
 
 ## Inviting a teammate
 
+Every invite runs through HQ's new-hire flow. Read
+`.claude/skills/new-hire/SKILL.md` in the HQ folder before the first invite and
+follow its steps: check `hq members list` first, set the role, invite, then
+the access that person needs (groups, shared apps and keys) and the
+acceptance follow-through. It is your playbook, not something to show them:
+ask its questions in plain words, one at a time, skip what setup has not
+created yet (groups, an onboarding packet), and never name the skill or its
+command. If that file is not in this HQ, the steps below are enough.
+
 1. Ask for one email and whether they should be a member or an admin
-   (member is the default; admins can only invite members).
+   (member is the default; admins can only invite members). If they already
+   said who, do not ask again.
 2. Confirm in one line that an invitation email will go to that address, and
    wait for yes.
-3. Run `hq members invite <email> --company <slug> --role member`.
+3. Send the invite the way the new-hire flow says
+   (`hq members invite <email> --company <slug> --role member`).
 4. Tell them what happens next: the teammate opens the email, signs in with
    Google or Microsoft, and gets the company in their own HQ, so their Claude
    Code or Codex knows the business from their first session. Say what they
-   will see that matters to this person (the connected calls, the client
-   homes).
+   will see that matters to this person (the client homes, and any app you
+   have shared with them; a connected app stays private to the person who
+   connected it until it is shared). Always add: "Tell them to check their
+   spam folder if the email doesn't show up in a few minutes."
 5. Check with `hq members list` (pending until they accept). If they never
    got it, `--resend` sends it again.
 

package/assets/bot-workers/setup/skills/your-business.md

@@ -142,6 +142,17 @@ the way a good engineer would, and then do it:
    what it means for their team (see "What HQ is" in your instructions). A
    connection is not done until this read works. Never say "connected",
    "done" or "everything is set up" before it does.
+6. **After the first connection only, say where connections live.** Once
+   the read works for the first app they connect, open your reply with the
+   confirmation and the link, in these words:
+   "Great, <Tool> is connected. You can see everything that's connected at
+   https://hq.computer/companies/<company-slug>/integrations, or ask me or
+   any other AI in HQ to connect another." Use the company's slug from the
+   Owner context (for a personal connection, the link is
+   https://hq.computer/personal/integrations). Then the real data from step
+   5 and the next question. Say this once in the whole setup. For every
+   later connection, skip it: show the real data from step 5 and move on.
+   Give the link again only if they ask where connections live.
 
 If a step needs something only they can do (an admin approval, a paid plan),
 say exactly what, record it in the progress note as waiting, and move on to

package/dist/commands/auth.js

@@ -16,31 +16,70 @@
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
-import { cognitoConfigForLoginProvider } from "../utils/login-provider.js";
+import { resolveLoginProviderSelection, } from "../utils/login-provider.js";
+import { getLastLoginProviderStatePath, loadLastLoginProvider, storeLastLoginProvider, } from "../lib/auth-login-provider-state.js";
 import { callbackPortBusyGuidance, DEFAULT_CALLBACK_PORT, isCallbackPortBusy, } from "../utils/callback-port-busy.js";
-/**
- * Decode the (unverified) ID token payload for display purposes only.
- * The token was just returned by Cognito's token endpoint, so its contents
- * are trusted enough to print — we never use these claims for authorization.
- */
-function peekIdToken(idToken) {
+/** Decode token claims for local display and provider-memory purposes only. */
+function decodeIdTokenClaims(idToken) {
     try {
         const payload = idToken.split(".")[1];
         if (!payload)
-            return {};
+            return undefined;
         const pad = payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
         const normalized = payload.replace(/-/g, "+").replace(/_/g, "/") + pad;
         const decoded = JSON.parse(Buffer.from(normalized, "base64").toString("utf-8"));
-        return {
-            email: decoded.email,
-            sub: decoded.sub,
-            entityType: decoded["custom:entityType"],
-            entityUid: decoded["custom:entityUid"],
-        };
+        return decoded && typeof decoded === "object" && !Array.isArray(decoded)
+            ? decoded
+            : undefined;
     }
     catch {
-        return {};
+        return undefined;
+    }
+}
+function peekIdToken(idToken) {
+    const claims = decodeIdTokenClaims(idToken);
+    return {
+        email: typeof claims?.email === "string" ? claims.email : undefined,
+        sub: typeof claims?.sub === "string" ? claims.sub : undefined,
+        entityType: typeof claims?.["custom:entityType"] === "string"
+            ? claims["custom:entityType"]
+            : undefined,
+        entityUid: typeof claims?.["custom:entityUid"] === "string"
+            ? claims["custom:entityUid"]
+            : undefined,
+    };
+}
+function errorCode(error) {
+    if (error
+        && typeof error === "object"
+        && "code" in error
+        && typeof error.code === "string") {
+        return error.code;
     }
+    return "UNKNOWN";
+}
+function providerFromIdToken(idToken) {
+    const identities = decodeIdTokenClaims(idToken)?.identities;
+    if (!Array.isArray(identities))
+        return undefined;
+    const providers = new Set();
+    for (const identity of identities) {
+        if (!identity || typeof identity !== "object" || Array.isArray(identity))
+            continue;
+        const item = identity;
+        const providerName = typeof item.providerName === "string"
+            ? item.providerName
+            : item.providerType;
+        if (typeof providerName !== "string")
+            continue;
+        const normalized = providerName.trim().toLowerCase();
+        if (normalized === "google")
+            providers.add("google");
+        if (normalized === "microsoft" || normalized === "microsoftpersonal") {
+            providers.add("microsoft");
+        }
+    }
+    return providers.size === 1 ? providers.values().next().value : undefined;
 }
 /** Display label for the local machine identity (company agents). */
 function machineIdentityLabel() {
@@ -67,7 +106,25 @@ export function registerAuthCommands(program) {
             return;
         }
         try {
-            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
+            const canUseRememberedProvider = options.provider === undefined
+                && process.env.HQ_COGNITO_IDENTITY_PROVIDER === undefined;
+            let rememberedProvider;
+            if (canUseRememberedProvider) {
+                try {
+                    rememberedProvider = loadLastLoginProvider();
+                }
+                catch (error) {
+                    console.error(chalk.dim(`Could not read provider state at ${getLastLoginProviderStatePath()} (${errorCode(error)}). Continuing to the provider choice page.`));
+                }
+            }
+            const selection = resolveLoginProviderSelection(options.provider, process.env, rememberedProvider);
+            const tokens = await browserLogin(selection.config);
+            try {
+                storeLastLoginProvider(providerFromIdToken(tokens.idToken) ?? selection.providerToRemember);
+            }
+            catch (error) {
+                console.error(chalk.dim(`Could not save provider state at ${getLastLoginProviderStatePath()} (${errorCode(error)}). The provider choice was not saved.`));
+            }
             const who = peekIdToken(tokens.idToken).email ?? "HQ";
             console.log(chalk.green(`Signed in as ${who}`));
             console.log(chalk.dim(`  Token cached at ~/.hq/cognito-tokens.json (expires ${tokens.expiresAt})`));

package/dist/commands/lanes-accounts.d.ts

@@ -0,0 +1,25 @@
+import type { Ctx, LaneAccountsHandlerDeps } from "./lanes-shared.js";
+export declare function createLaneAccountsHandlers(deps: LaneAccountsHandlerDeps): {
+    runAccountsList: (ctx: Ctx, opts: {
+        provider?: string;
+    }) => Promise<void>;
+    runAccountsBalance: (ctx: Ctx, opts: {
+        provider?: string;
+        apply?: boolean;
+        json?: boolean;
+    }) => Promise<void>;
+    runAccountsLogin: (ctx: Ctx, providerRaw: string, accountId: string, opts: {
+        home?: string;
+        deviceAuth?: boolean;
+        company?: string;
+    }) => Promise<void>;
+    runAccountsSetHome: (ctx: Ctx, providerRaw: string, accountIdRaw: string, homeRaw: string, opts: {
+        host?: string;
+        company?: string;
+    }) => Promise<void>;
+    runAccountsEnable: (ctx: Ctx, providerRaw: string, accountId: string) => Promise<void>;
+    runAccountsDisable: (ctx: Ctx, providerRaw: string, accountId: string, opts: {
+        reason?: string;
+    }) => Promise<void>;
+};
+//# sourceMappingURL=lanes-accounts.d.ts.map