@indigoai-us/hq-cli 5.30.0 → 5.31.0

package/dist/commands/files-browse.js

@@ -34,7 +34,7 @@
  * methods and `grantPathToPrefix` from hq-cloud.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="73529786-7369-5356-a6a8-4d55bd553147")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cad165f9-6445-5434-969b-e0705274aa56")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -559,9 +559,12 @@ export function registerFilesBrowseCommands(filesCmd) {
         "bucket-relative (omit it to list the vault root). Mutually exclusive " +
         "with --company.")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .action(async (pathArg, options) => {
+        .action(async (pathArg, options, command) => {
         try {
-            if (options.personal && options.company) {
+            // `--company` is declared on the parent `files` group, so commander
+            // binds it there — read merged opts to see it from the subcommand.
+            const company = command.optsWithGlobals().company;
+            if (options.personal && company) {
                 throw new Error("--personal and --company are mutually exclusive. Pick one.");
             }
             const accessToken = await ensureCognitoToken();
@@ -594,12 +597,12 @@ export function registerFilesBrowseCommands(filesCmd) {
                     "browse your personal vault.");
             }
             // Resolve slug — CLI flag wins, otherwise parse from path arg.
-            const slug = options.company ?? parseCompanySlugFromPath(pathArg);
+            const slug = company ?? parseCompanySlugFromPath(pathArg);
             // If the user passed `--company` AND the path doesn't begin with
             // companies/<that-slug>/, refuse — we'd otherwise vend creds for
             // one company and list keys from another tree, which never makes
             // sense (defense in depth against operator typos).
-            if (options.company !== undefined) {
+            if (company !== undefined) {
                 const fromPath = (() => {
                     try {
                         return parseCompanySlugFromPath(pathArg);
@@ -608,8 +611,8 @@ export function registerFilesBrowseCommands(filesCmd) {
                         return undefined;
                     }
                 })();
-                if (fromPath && fromPath !== options.company) {
-                    throw new Error(`--company '${options.company}' disagrees with path slug '${fromPath}'.`);
+                if (fromPath && fromPath !== company) {
+                    throw new Error(`--company '${company}' disagrees with path slug '${fromPath}'.`);
                 }
             }
             // Confirm the slug resolves to a known membership — same pattern
@@ -644,9 +647,11 @@ export function registerFilesBrowseCommands(filesCmd) {
         .option("--personal", "Read from the caller's canonical personal vault. <path> is treated as " +
         "bucket-relative. Mutually exclusive with --company.")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .action(async (keyArg, options) => {
+        .action(async (keyArg, options, command) => {
         try {
-            if (options.personal && options.company) {
+            // `--company` is bound on the parent `files` group — read merged opts.
+            const company = command.optsWithGlobals().company;
+            if (options.personal && company) {
                 throw new Error("--personal and --company are mutually exclusive. Pick one.");
             }
             const accessToken = await ensureCognitoToken();
@@ -673,8 +678,8 @@ export function registerFilesBrowseCommands(filesCmd) {
                 }
                 return;
             }
-            const slug = options.company ?? parseCompanySlugFromPath(keyArg);
-            if (options.company !== undefined) {
+            const slug = company ?? parseCompanySlugFromPath(keyArg);
+            if (company !== undefined) {
                 const fromPath = (() => {
                     try {
                         return parseCompanySlugFromPath(keyArg);
@@ -683,8 +688,8 @@ export function registerFilesBrowseCommands(filesCmd) {
                         return undefined;
                     }
                 })();
-                if (fromPath && fromPath !== options.company) {
-                    throw new Error(`--company '${options.company}' disagrees with path slug '${fromPath}'.`);
+                if (fromPath && fromPath !== company) {
+                    throw new Error(`--company '${company}' disagrees with path slug '${fromPath}'.`);
                 }
             }
             await getCompanyUid(accessToken, slug);
@@ -710,21 +715,23 @@ export function registerFilesBrowseCommands(filesCmd) {
         .command("shared-with-me")
         .description("List the files/prefixes explicitly shared with you. Omit --company to roll up across every company you're a member of. Pure read — no download, no credentials vended. Owner/admin role-bypass access is NOT listed (only explicit grants).")
         .option("--company <slug>", "Scope to a single company (defaults to a cross-company roll-up).")
-        .action(async (options) => {
+        .action(async (options, command) => {
         try {
+            // `--company` is bound on the parent `files` group — read merged opts.
+            const company = command.optsWithGlobals().company;
             const accessToken = await ensureCognitoToken();
             const vaultConfig = buildVaultConfig(accessToken);
             const client = new VaultClient(vaultConfig);
             let companyUid;
-            if (options.company) {
+            if (company) {
                 // Confirm membership + resolve UID, same early-failure pattern as
                 // browse/cat. Roll-up mode skips this and fans out internally.
-                companyUid = await getCompanyUid(accessToken, options.company);
+                companyUid = await getCompanyUid(accessToken, company);
             }
             const rows = await runSharedWithMe({
                 vaultClient: client,
                 companyUid,
-                companySlug: options.company,
+                companySlug: company,
             });
             console.log(formatSharedWithMeTable(rows));
         }
@@ -738,9 +745,12 @@ export function registerFilesBrowseCommands(filesCmd) {
         .description("Search vault object keys (case-insensitive path/name match) under a company without downloading. Requires --company (or --personal). Content search is not supported in v1.")
         .option("--company <slug>", "Company slug to search.")
         .option("--personal", "Search the caller's canonical personal vault. Mutually exclusive with --company.")
-        .action(async (query, options) => {
+        .action(async (query, options, command) => {
         try {
-            if (options.personal && options.company) {
+            // `--company` is declared on the parent `files` group too, so commander
+            // binds it there; read the merged (global+local) opts to see it.
+            const company = command.optsWithGlobals().company;
+            if (options.personal && company) {
                 throw new Error("--personal and --company are mutually exclusive. Pick one.");
             }
             const accessToken = await ensureCognitoToken();
@@ -763,13 +773,13 @@ export function registerFilesBrowseCommands(filesCmd) {
                 console.log(formatBrowseTable(rows));
                 return;
             }
-            if (!options.company) {
+            if (!company) {
                 throw new Error("search: --company <slug> is required (or --personal to search your personal vault).");
             }
-            await getCompanyUid(accessToken, options.company);
+            await getCompanyUid(accessToken, company);
             const rows = await runSearch({
                 query,
-                companySlug: options.company,
+                companySlug: company,
                 vaultClient: client,
                 s3Factory: defaultS3Factory,
                 region: DEFAULT_COGNITO.region,
@@ -787,12 +797,14 @@ export function registerFilesBrowseCommands(filesCmd) {
         .option("--into <dir>", "Write into this directory instead of the in-place companies/<slug>/ location. No pin is registered.")
         .option("--company <slug>", "Company slug (defaults to the slug parsed from <path>).")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .action(async (pathArg, options) => {
+        .action(async (pathArg, options, command) => {
         try {
             const accessToken = await ensureCognitoToken();
             const client = new VaultClient(buildVaultConfig(accessToken));
-            const slug = options.company ?? parseCompanySlugFromPath(pathArg);
-            if (options.company !== undefined) {
+            // `--company` is bound on the parent `files` group — read merged opts.
+            const companyOpt = command.optsWithGlobals().company;
+            const slug = companyOpt ?? parseCompanySlugFromPath(pathArg);
+            if (companyOpt !== undefined) {
                 const fromPath = (() => {
                     try {
                         return parseCompanySlugFromPath(pathArg);
@@ -801,8 +813,8 @@ export function registerFilesBrowseCommands(filesCmd) {
                         return undefined;
                     }
                 })();
-                if (fromPath && fromPath !== options.company) {
-                    throw new Error(`--company '${options.company}' disagrees with path slug '${fromPath}'.`);
+                if (fromPath && fromPath !== companyOpt) {
+                    throw new Error(`--company '${companyOpt}' disagrees with path slug '${fromPath}'.`);
                 }
             }
             await getCompanyUid(accessToken, slug);
@@ -827,4 +839,4 @@ export function registerFilesBrowseCommands(filesCmd) {
     });
 }
 //# sourceMappingURL=files-browse.js.map
-//# debugId=73529786-7369-5356-a6a8-4d55bd553147
+//# debugId=cad165f9-6445-5434-969b-e0705274aa56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.30.0",
+  "version": "5.31.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/files-browse.test.ts

@@ -20,6 +20,7 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { Command } from "commander";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -1034,3 +1035,51 @@ describe("runGet", () => {
     ).rejects.toThrow(/No objects under/);
   });
 });
+
+// ── --company parent-binding (regression) ───────────────────────────────────
+//
+// The `files` parent group declares `--company`, so commander binds the flag
+// to the PARENT command, not the subcommand — `subcommand.opts().company` is
+// empty. The browse/cat/search/get/shared-with-me actions therefore resolve
+// it via `command.optsWithGlobals().company`. This guards that contract so a
+// future refactor doesn't silently regress `hq files <sub> ... --company X`
+// back to the swallowed-flag bug.
+
+describe("--company parent binding (optsWithGlobals)", () => {
+  it("a subcommand sees --company declared on the parent group", () => {
+    const program = new Command();
+    const files = program
+      .command("files")
+      .option("--company <slug>", "Company slug");
+    let seen: string | undefined = "UNSET";
+    files
+      .command("search <query>")
+      .option("--personal")
+      .action((_query: string, _options: unknown, command: Command) => {
+        seen = command.optsWithGlobals().company as string | undefined;
+      });
+    program.parse(
+      ["files", "search", "README", "--company", "indigo"],
+      { from: "user" } as never,
+    );
+    expect(seen).toBe("indigo");
+  });
+
+  it("documents the bug: subcommand-local opts.company is empty for a parent-bound flag", () => {
+    const program = new Command();
+    const files = program
+      .command("files")
+      .option("--company <slug>", "Company slug");
+    let local: string | undefined = "UNSET";
+    files
+      .command("search <query>")
+      .action((_query: string, options: { company?: string }) => {
+        local = options.company;
+      });
+    program.parse(
+      ["files", "search", "README", "--company", "indigo"],
+      { from: "user" } as never,
+    );
+    expect(local).toBeUndefined();
+  });
+});

package/src/commands/files-browse.ts

@@ -936,9 +936,12 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
       DEFAULT_HQ_ROOT,
     )
-    .action(async (pathArg: string | undefined, options: FilesBrowseCliOptions) => {
+    .action(async (pathArg: string | undefined, options: FilesBrowseCliOptions, command: Command) => {
       try {
-        if (options.personal && options.company) {
+        // `--company` is declared on the parent `files` group, so commander
+        // binds it there — read merged opts to see it from the subcommand.
+        const company = command.optsWithGlobals().company as string | undefined;
+        if (options.personal && company) {
           throw new Error(
             "--personal and --company are mutually exclusive. Pick one.",
           );
@@ -981,13 +984,13 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
         }
 
         // Resolve slug — CLI flag wins, otherwise parse from path arg.
-        const slug = options.company ?? parseCompanySlugFromPath(pathArg);
+        const slug = company ?? parseCompanySlugFromPath(pathArg);
 
         // If the user passed `--company` AND the path doesn't begin with
         // companies/<that-slug>/, refuse — we'd otherwise vend creds for
         // one company and list keys from another tree, which never makes
         // sense (defense in depth against operator typos).
-        if (options.company !== undefined) {
+        if (company !== undefined) {
           const fromPath = (() => {
             try {
               return parseCompanySlugFromPath(pathArg);
@@ -995,9 +998,9 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
               return undefined;
             }
           })();
-          if (fromPath && fromPath !== options.company) {
+          if (fromPath && fromPath !== company) {
             throw new Error(
-              `--company '${options.company}' disagrees with path slug '${fromPath}'.`,
+              `--company '${company}' disagrees with path slug '${fromPath}'.`,
             );
           }
         }
@@ -1060,9 +1063,11 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
       DEFAULT_HQ_ROOT,
     )
-    .action(async (keyArg: string, options: FilesCatCliOptions) => {
+    .action(async (keyArg: string, options: FilesCatCliOptions, command: Command) => {
       try {
-        if (options.personal && options.company) {
+        // `--company` is bound on the parent `files` group — read merged opts.
+        const company = command.optsWithGlobals().company as string | undefined;
+        if (options.personal && company) {
           throw new Error(
             "--personal and --company are mutually exclusive. Pick one.",
           );
@@ -1099,8 +1104,8 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
           return;
         }
 
-        const slug = options.company ?? parseCompanySlugFromPath(keyArg);
-        if (options.company !== undefined) {
+        const slug = company ?? parseCompanySlugFromPath(keyArg);
+        if (company !== undefined) {
           const fromPath = (() => {
             try {
               return parseCompanySlugFromPath(keyArg);
@@ -1108,9 +1113,9 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
               return undefined;
             }
           })();
-          if (fromPath && fromPath !== options.company) {
+          if (fromPath && fromPath !== company) {
             throw new Error(
-              `--company '${options.company}' disagrees with path slug '${fromPath}'.`,
+              `--company '${company}' disagrees with path slug '${fromPath}'.`,
             );
           }
         }
@@ -1150,23 +1155,25 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       "--company <slug>",
       "Scope to a single company (defaults to a cross-company roll-up).",
     )
-    .action(async (options: { company?: string }) => {
+    .action(async (options: { company?: string }, command: Command) => {
       try {
+        // `--company` is bound on the parent `files` group — read merged opts.
+        const company = command.optsWithGlobals().company as string | undefined;
         const accessToken = await ensureCognitoToken();
         const vaultConfig = buildVaultConfig(accessToken);
         const client = new VaultClient(vaultConfig);
 
         let companyUid: string | undefined;
-        if (options.company) {
+        if (company) {
           // Confirm membership + resolve UID, same early-failure pattern as
           // browse/cat. Roll-up mode skips this and fans out internally.
-          companyUid = await getCompanyUid(accessToken, options.company);
+          companyUid = await getCompanyUid(accessToken, company);
         }
 
         const rows = await runSharedWithMe({
           vaultClient: client,
           companyUid,
-          companySlug: options.company,
+          companySlug: company,
         });
 
         console.log(formatSharedWithMeTable(rows));
@@ -1189,9 +1196,12 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       "--personal",
       "Search the caller's canonical personal vault. Mutually exclusive with --company.",
     )
-    .action(async (query: string, options: FilesSearchCliOptions) => {
+    .action(async (query: string, options: FilesSearchCliOptions, command: Command) => {
       try {
-        if (options.personal && options.company) {
+        // `--company` is declared on the parent `files` group too, so commander
+        // binds it there; read the merged (global+local) opts to see it.
+        const company = command.optsWithGlobals().company as string | undefined;
+        if (options.personal && company) {
           throw new Error(
             "--personal and --company are mutually exclusive. Pick one.",
           );
@@ -1219,16 +1229,16 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
           return;
         }
 
-        if (!options.company) {
+        if (!company) {
           throw new Error(
             "search: --company <slug> is required (or --personal to search your personal vault).",
           );
         }
-        await getCompanyUid(accessToken, options.company);
+        await getCompanyUid(accessToken, company);
 
         const rows = await runSearch({
           query,
-          companySlug: options.company,
+          companySlug: company,
           vaultClient: client,
           s3Factory: defaultS3Factory,
           region: DEFAULT_COGNITO.region,
@@ -1261,13 +1271,15 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
       DEFAULT_HQ_ROOT,
     )
-    .action(async (pathArg: string, options: FilesGetCliOptions) => {
+    .action(async (pathArg: string, options: FilesGetCliOptions, command: Command) => {
       try {
         const accessToken = await ensureCognitoToken();
         const client = new VaultClient(buildVaultConfig(accessToken));
 
-        const slug = options.company ?? parseCompanySlugFromPath(pathArg);
-        if (options.company !== undefined) {
+        // `--company` is bound on the parent `files` group — read merged opts.
+        const companyOpt = command.optsWithGlobals().company as string | undefined;
+        const slug = companyOpt ?? parseCompanySlugFromPath(pathArg);
+        if (companyOpt !== undefined) {
           const fromPath = (() => {
             try {
               return parseCompanySlugFromPath(pathArg);
@@ -1275,9 +1287,9 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
               return undefined;
             }
           })();
-          if (fromPath && fromPath !== options.company) {
+          if (fromPath && fromPath !== companyOpt) {
             throw new Error(
-              `--company '${options.company}' disagrees with path slug '${fromPath}'.`,
+              `--company '${companyOpt}' disagrees with path slug '${fromPath}'.`,
             );
           }
         }