@indigoai-us/hq-cli 5.30.0 → 5.32.0

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d7693093-4011-58fa-b5be-805b5f9f5421")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="89e1a66a-6a45-56a3-847c-2f0beba1429b")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -23,11 +23,13 @@ import { registerPackageInstallCommand } from "./commands/pkg-install.js";
 import { registerPackageRemoveCommand } from "./commands/pkg-remove.js";
 import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
 import { registerPackageListCommand } from "./commands/pkg-list.js";
+import { registerPacksCommand } from "./commands/packs.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
 import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
+import { registerGroupGrantsCommand } from "./commands/group-grants.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerFilesBrowseCommands } from "./commands/files-browse.js";
 import { registerMembersCommand } from "./commands/members.js";
@@ -72,6 +74,11 @@ registerPackageInstallCommand(packagesCmd);
 registerPackageRemoveCommand(packagesCmd);
 registerPackageUpdateCommand(packagesCmd);
 registerPackageListCommand(packagesCmd);
+// Content-pack lifecycle (core/packages/hq-pack-*). Distinct from the registry
+// `packages` system above. Available as both `hq packages packs …` (grouped)
+// and `hq packs …` (top-level convenience).
+registerPacksCommand(packagesCmd);
+registerPacksCommand(program);
 // Top-level shortcuts for package commands
 // "hq install <slug>" = "hq packages install <slug>"
 // "hq remove <slug>"  = "hq packages remove <slug>"
@@ -104,6 +111,9 @@ registerSecretsCommand(program);
 registerRunCommand(program);
 // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
 registerGroupsCommand(program);
+// Cross-company group grants (subcommand group —
+// hq group-grants grant|revoke|outbound|inbound)
+registerGroupGrantsCommand(program);
 // Files ACL management (subcommand group — hq files share|unshare|acl)
 // `registerFilesCommand` returns the `files` group so we can attach the
 // browse-vs-sync subcommands (`hq files browse`/`cat`) onto the same group.
@@ -148,4 +158,4 @@ registerSignalsCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=d7693093-4011-58fa-b5be-805b5f9f5421
+//# debugId=89e1a66a-6a45-56a3-847c-2f0beba1429b

package/dist/utils/pack-contributions.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Content-pack contribution helpers -- the single source of truth (in TS) for
+ * the `contributes.* -> host-path` symlink mapping that `hq install` wires via
+ * `core/scripts/scan-packages.sh`.
+ *
+ * `pack-install.ts` only INSTALLS content packs (into `core/packages/<name>/`,
+ * tracked by filesystem presence -- there is no registry file). The list /
+ * update / uninstall lifecycle in `commands/packs.ts` needs to reason about the
+ * SAME mapping so it can report link health and cleanly un-wire a pack without
+ * leaving dangling symlinks. That mapping is duplicated today in two places:
+ *
+ *   - core/scripts/scan-packages.sh  (bash `case`, the wiring authority)
+ *   - pack-install.ts validateManifest's `subpaths` record (payload validation)
+ *
+ * This module re-encodes it once for TS callers. A parity test
+ * (`pack-contributions.test.ts`) asserts it matches scan-packages.sh's `case`
+ * arms so the three copies cannot drift.
+ */
+import type { PackManifest, PackContributeKey } from '../types.js';
+/** A single symlink a pack contributes: dst (host path) -> src (inside pack). */
+export interface WiredLink {
+    key: PackContributeKey;
+    item: string;
+    src: string;
+    dst: string;
+}
+export type LinkStatus = 'live' | 'broken' | 'missing' | 'foreign';
+/**
+ * Every symlink a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh.
+ */
+export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
+/** Classify a host path against the link that should own it. */
+export declare function linkStatus(link: WiredLink): LinkStatus;
+/** A content pack's manifest plus the install-time stamped source. */
+export interface InstalledPackManifest extends PackManifest {
+    source?: string;
+}
+export interface InstalledPack {
+    name: string;
+    dir: string;
+    manifest: InstalledPackManifest | null;
+    error?: string;
+}
+/** Absolute path to `<hqRoot>/core/packages`. */
+export declare function packagesDir(hqRoot: string): string;
+/** Read and shallowly validate a pack's package.yaml. */
+export declare function readPackManifest(packDir: string): {
+    manifest: InstalledPackManifest | null;
+    error?: string;
+};
+/**
+ * Walk `core/packages/<name>/package.yaml`. Skips the `.archive` dir, the bundled
+ * `README.md`, and any non-directory entry. Filesystem presence is the source
+ * of truth for installed content packs.
+ */
+export declare function listInstalledPacks(hqRoot: string): InstalledPack[];
+export interface UnwireResult {
+    unlinked: Array<{
+        key: PackContributeKey;
+        item: string;
+        dst: string;
+    }>;
+    skipped: Array<{
+        key: PackContributeKey;
+        item: string;
+        dst: string;
+        reason: 'foreign' | 'missing';
+    }>;
+}
+/**
+ * Remove only the host symlinks that resolve into THIS pack's directory
+ * (status `live` or `broken`). Foreign links and real files are left in place
+ * -- same collision philosophy as scan-packages.sh. This is what prevents an
+ * uninstall from leaving dangling symlinks behind.
+ */
+export declare function unwirePack(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): UnwireResult;
+export declare function readHqVersion(hqRoot: string): string | null;
+export interface CatalogEntry {
+    source: string;
+    description?: string;
+    conditional?: string;
+    auto_install?: boolean;
+}
+/** Read `recommended_packages` from core.yaml (the curated content-pack catalog). */
+export declare function readRecommendedPackages(hqRoot: string): CatalogEntry[];
+//# sourceMappingURL=pack-contributions.d.ts.map

package/dist/utils/pack-contributions.js

@@ -0,0 +1,239 @@
+/**
+ * Content-pack contribution helpers -- the single source of truth (in TS) for
+ * the `contributes.* -> host-path` symlink mapping that `hq install` wires via
+ * `core/scripts/scan-packages.sh`.
+ *
+ * `pack-install.ts` only INSTALLS content packs (into `core/packages/<name>/`,
+ * tracked by filesystem presence -- there is no registry file). The list /
+ * update / uninstall lifecycle in `commands/packs.ts` needs to reason about the
+ * SAME mapping so it can report link health and cleanly un-wire a pack without
+ * leaving dangling symlinks. That mapping is duplicated today in two places:
+ *
+ *   - core/scripts/scan-packages.sh  (bash `case`, the wiring authority)
+ *   - pack-install.ts validateManifest's `subpaths` record (payload validation)
+ *
+ * This module re-encodes it once for TS callers. A parity test
+ * (`pack-contributions.test.ts`) asserts it matches scan-packages.sh's `case`
+ * arms so the three copies cannot drift.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f5492359-fdf3-5e85-9a81-699c4cd68f6a")}catch(e){}}();
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'js-yaml';
+/**
+ * Map one contributes entry to its source/host paths. MUST stay in lockstep
+ * with scan-packages.sh:wire_one_package and pack-install.ts:validateManifest.
+ */
+function linkFor(hqRoot, packDir, key, item) {
+    let srcRel;
+    let dstRel;
+    switch (key) {
+        case 'workers':
+            srcRel = path.join('workers', item);
+            dstRel = path.join('core', 'workers', 'public', item);
+            break;
+        case 'knowledge':
+            srcRel = path.join('knowledge', item);
+            dstRel = path.join('core', 'knowledge', 'public', item);
+            break;
+        case 'skills':
+            srcRel = path.join('skills', item);
+            dstRel = path.join('.claude', 'skills', item);
+            break;
+        case 'commands':
+            srcRel = path.join('commands', `${item}.md`);
+            dstRel = path.join('.claude', 'commands', `${item}.md`);
+            break;
+        case 'hooks':
+            srcRel = path.join('hooks', `${item}.sh`);
+            dstRel = path.join('.claude', 'hooks', `${item}.sh`);
+            break;
+        case 'policies':
+            srcRel = path.join('policies', `${item}.md`);
+            dstRel = path.join('core', 'policies', `${item}.md`);
+            break;
+        case 'scripts':
+            srcRel = path.join('scripts', item);
+            dstRel = path.join('core', 'scripts', item);
+            break;
+    }
+    return {
+        key,
+        item,
+        src: path.join(packDir, srcRel),
+        dst: path.join(hqRoot, dstRel),
+    };
+}
+/**
+ * Every symlink a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh.
+ */
+export function contributionLinks(hqRoot, packDir, contributes) {
+    const links = [];
+    for (const [key, items] of Object.entries(contributes)) {
+        if (!Array.isArray(items))
+            continue;
+        for (const item of items) {
+            if (typeof item !== 'string' || item.length === 0)
+                continue;
+            links.push(linkFor(hqRoot, packDir, key, item));
+        }
+    }
+    return links;
+}
+/** Classify a host path against the link that should own it. */
+export function linkStatus(link) {
+    let st;
+    try {
+        st = fs.lstatSync(link.dst);
+    }
+    catch {
+        return 'missing';
+    }
+    if (!st.isSymbolicLink()) {
+        return 'foreign'; // a real file/dir occupies the slot -- not ours
+    }
+    let target;
+    try {
+        target = fs.readlinkSync(link.dst);
+    }
+    catch {
+        return 'foreign';
+    }
+    // scan-packages.sh writes the symlink target as the absolute `src` path, so a
+    // direct compare is correct. Resolve both to be robust to trailing slashes.
+    const resolvedTarget = path.resolve(path.dirname(link.dst), target);
+    if (path.resolve(link.src) !== resolvedTarget) {
+        return 'foreign'; // points at another pack / somewhere else
+    }
+    return fs.existsSync(link.src) ? 'live' : 'broken';
+}
+/** Absolute path to `<hqRoot>/core/packages`. */
+export function packagesDir(hqRoot) {
+    return path.join(hqRoot, 'core', 'packages');
+}
+/** Read and shallowly validate a pack's package.yaml. */
+export function readPackManifest(packDir) {
+    const manifestPath = path.join(packDir, 'package.yaml');
+    if (!fs.existsSync(manifestPath)) {
+        return { manifest: null, error: 'package.yaml missing' };
+    }
+    try {
+        const parsed = yaml.load(fs.readFileSync(manifestPath, 'utf-8'));
+        if (!parsed || typeof parsed !== 'object') {
+            return { manifest: null, error: 'package.yaml is not a mapping' };
+        }
+        return { manifest: parsed };
+    }
+    catch (e) {
+        return { manifest: null, error: `package.yaml invalid: ${e.message}` };
+    }
+}
+/**
+ * Walk `core/packages/<name>/package.yaml`. Skips the `.archive` dir, the bundled
+ * `README.md`, and any non-directory entry. Filesystem presence is the source
+ * of truth for installed content packs.
+ */
+export function listInstalledPacks(hqRoot) {
+    const dir = packagesDir(hqRoot);
+    if (!fs.existsSync(dir))
+        return [];
+    const out = [];
+    for (const name of fs.readdirSync(dir).sort()) {
+        if (name.startsWith('.'))
+            continue; // .archive, .DS_Store, etc.
+        const packDir = path.join(dir, name);
+        let st;
+        try {
+            st = fs.statSync(packDir);
+        }
+        catch {
+            continue;
+        }
+        if (!st.isDirectory())
+            continue; // README.md and friends
+        const { manifest, error } = readPackManifest(packDir);
+        if (!manifest && !fs.existsSync(path.join(packDir, 'package.yaml'))) {
+            continue; // a plain dir that isn't a pack -- ignore silently
+        }
+        out.push({ name, dir: packDir, manifest, error });
+    }
+    return out;
+}
+/**
+ * Remove only the host symlinks that resolve into THIS pack's directory
+ * (status `live` or `broken`). Foreign links and real files are left in place
+ * -- same collision philosophy as scan-packages.sh. This is what prevents an
+ * uninstall from leaving dangling symlinks behind.
+ */
+export function unwirePack(hqRoot, packDir, contributes) {
+    const result = { unlinked: [], skipped: [] };
+    for (const link of contributionLinks(hqRoot, packDir, contributes)) {
+        const status = linkStatus(link);
+        if (status === 'live' || status === 'broken') {
+            try {
+                fs.unlinkSync(link.dst);
+                result.unlinked.push({ key: link.key, item: link.item, dst: link.dst });
+            }
+            catch {
+                result.skipped.push({
+                    key: link.key,
+                    item: link.item,
+                    dst: link.dst,
+                    reason: 'foreign',
+                });
+            }
+        }
+        else {
+            result.skipped.push({
+                key: link.key,
+                item: link.item,
+                dst: link.dst,
+                reason: status === 'missing' ? 'missing' : 'foreign',
+            });
+        }
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Host introspection: hqVersion + recommended_packages catalog
+// ---------------------------------------------------------------------------
+/** Locate core.yaml -- v14+ nests it under `core/`, older layouts at the root. */
+function coreYamlPath(hqRoot) {
+    const nested = path.join(hqRoot, 'core', 'core.yaml');
+    if (fs.existsSync(nested))
+        return nested;
+    const flat = path.join(hqRoot, 'core.yaml');
+    if (fs.existsSync(flat))
+        return flat;
+    return null;
+}
+export function readHqVersion(hqRoot) {
+    const p = coreYamlPath(hqRoot);
+    if (!p)
+        return null;
+    try {
+        const c = yaml.load(fs.readFileSync(p, 'utf-8'));
+        return c?.hqVersion ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read `recommended_packages` from core.yaml (the curated content-pack catalog). */
+export function readRecommendedPackages(hqRoot) {
+    const p = coreYamlPath(hqRoot);
+    if (!p)
+        return [];
+    try {
+        const c = yaml.load(fs.readFileSync(p, 'utf-8'));
+        const list = c?.recommended_packages;
+        return Array.isArray(list) ? list : [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=pack-contributions.js.map
+//# debugId=f5492359-fdf3-5e85-9a81-699c4cd68f6a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.30.0",
+  "version": "5.32.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/files-browse.test.ts

@@ -20,6 +20,7 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { Command } from "commander";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -1034,3 +1035,51 @@ describe("runGet", () => {
     ).rejects.toThrow(/No objects under/);
   });
 });
+
+// ── --company parent-binding (regression) ───────────────────────────────────
+//
+// The `files` parent group declares `--company`, so commander binds the flag
+// to the PARENT command, not the subcommand — `subcommand.opts().company` is
+// empty. The browse/cat/search/get/shared-with-me actions therefore resolve
+// it via `command.optsWithGlobals().company`. This guards that contract so a
+// future refactor doesn't silently regress `hq files <sub> ... --company X`
+// back to the swallowed-flag bug.
+
+describe("--company parent binding (optsWithGlobals)", () => {
+  it("a subcommand sees --company declared on the parent group", () => {
+    const program = new Command();
+    const files = program
+      .command("files")
+      .option("--company <slug>", "Company slug");
+    let seen: string | undefined = "UNSET";
+    files
+      .command("search <query>")
+      .option("--personal")
+      .action((_query: string, _options: unknown, command: Command) => {
+        seen = command.optsWithGlobals().company as string | undefined;
+      });
+    program.parse(
+      ["files", "search", "README", "--company", "indigo"],
+      { from: "user" } as never,
+    );
+    expect(seen).toBe("indigo");
+  });
+
+  it("documents the bug: subcommand-local opts.company is empty for a parent-bound flag", () => {
+    const program = new Command();
+    const files = program
+      .command("files")
+      .option("--company <slug>", "Company slug");
+    let local: string | undefined = "UNSET";
+    files
+      .command("search <query>")
+      .action((_query: string, options: { company?: string }) => {
+        local = options.company;
+      });
+    program.parse(
+      ["files", "search", "README", "--company", "indigo"],
+      { from: "user" } as never,
+    );
+    expect(local).toBeUndefined();
+  });
+});

package/src/commands/files-browse.ts

@@ -936,9 +936,12 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
       DEFAULT_HQ_ROOT,
     )
-    .action(async (pathArg: string | undefined, options: FilesBrowseCliOptions) => {
+    .action(async (pathArg: string | undefined, options: FilesBrowseCliOptions, command: Command) => {
       try {
-        if (options.personal && options.company) {
+        // `--company` is declared on the parent `files` group, so commander
+        // binds it there — read merged opts to see it from the subcommand.
+        const company = command.optsWithGlobals().company as string | undefined;
+        if (options.personal && company) {
           throw new Error(
             "--personal and --company are mutually exclusive. Pick one.",
           );
@@ -981,13 +984,13 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
         }
 
         // Resolve slug — CLI flag wins, otherwise parse from path arg.
-        const slug = options.company ?? parseCompanySlugFromPath(pathArg);
+        const slug = company ?? parseCompanySlugFromPath(pathArg);
 
         // If the user passed `--company` AND the path doesn't begin with
         // companies/<that-slug>/, refuse — we'd otherwise vend creds for
         // one company and list keys from another tree, which never makes
         // sense (defense in depth against operator typos).
-        if (options.company !== undefined) {
+        if (company !== undefined) {
           const fromPath = (() => {
             try {
               return parseCompanySlugFromPath(pathArg);
@@ -995,9 +998,9 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
               return undefined;
             }
           })();
-          if (fromPath && fromPath !== options.company) {
+          if (fromPath && fromPath !== company) {
             throw new Error(
-              `--company '${options.company}' disagrees with path slug '${fromPath}'.`,
+              `--company '${company}' disagrees with path slug '${fromPath}'.`,
             );
           }
         }
@@ -1060,9 +1063,11 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
       DEFAULT_HQ_ROOT,
     )
-    .action(async (keyArg: string, options: FilesCatCliOptions) => {
+    .action(async (keyArg: string, options: FilesCatCliOptions, command: Command) => {
       try {
-        if (options.personal && options.company) {
+        // `--company` is bound on the parent `files` group — read merged opts.
+        const company = command.optsWithGlobals().company as string | undefined;
+        if (options.personal && company) {
           throw new Error(
             "--personal and --company are mutually exclusive. Pick one.",
           );
@@ -1099,8 +1104,8 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
           return;
         }
 
-        const slug = options.company ?? parseCompanySlugFromPath(keyArg);
-        if (options.company !== undefined) {
+        const slug = company ?? parseCompanySlugFromPath(keyArg);
+        if (company !== undefined) {
           const fromPath = (() => {
             try {
               return parseCompanySlugFromPath(keyArg);
@@ -1108,9 +1113,9 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
               return undefined;
             }
           })();
-          if (fromPath && fromPath !== options.company) {
+          if (fromPath && fromPath !== company) {
             throw new Error(
-              `--company '${options.company}' disagrees with path slug '${fromPath}'.`,
+              `--company '${company}' disagrees with path slug '${fromPath}'.`,
             );
           }
         }
@@ -1150,23 +1155,25 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       "--company <slug>",
       "Scope to a single company (defaults to a cross-company roll-up).",
     )
-    .action(async (options: { company?: string }) => {
+    .action(async (options: { company?: string }, command: Command) => {
       try {
+        // `--company` is bound on the parent `files` group — read merged opts.
+        const company = command.optsWithGlobals().company as string | undefined;
         const accessToken = await ensureCognitoToken();
         const vaultConfig = buildVaultConfig(accessToken);
         const client = new VaultClient(vaultConfig);
 
         let companyUid: string | undefined;
-        if (options.company) {
+        if (company) {
           // Confirm membership + resolve UID, same early-failure pattern as
           // browse/cat. Roll-up mode skips this and fans out internally.
-          companyUid = await getCompanyUid(accessToken, options.company);
+          companyUid = await getCompanyUid(accessToken, company);
         }
 
         const rows = await runSharedWithMe({
           vaultClient: client,
           companyUid,
-          companySlug: options.company,
+          companySlug: company,
         });
 
         console.log(formatSharedWithMeTable(rows));
@@ -1189,9 +1196,12 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       "--personal",
       "Search the caller's canonical personal vault. Mutually exclusive with --company.",
     )
-    .action(async (query: string, options: FilesSearchCliOptions) => {
+    .action(async (query: string, options: FilesSearchCliOptions, command: Command) => {
       try {
-        if (options.personal && options.company) {
+        // `--company` is declared on the parent `files` group too, so commander
+        // binds it there; read the merged (global+local) opts to see it.
+        const company = command.optsWithGlobals().company as string | undefined;
+        if (options.personal && company) {
           throw new Error(
             "--personal and --company are mutually exclusive. Pick one.",
           );
@@ -1219,16 +1229,16 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
           return;
         }
 
-        if (!options.company) {
+        if (!company) {
           throw new Error(
             "search: --company <slug> is required (or --personal to search your personal vault).",
           );
         }
-        await getCompanyUid(accessToken, options.company);
+        await getCompanyUid(accessToken, company);
 
         const rows = await runSearch({
           query,
-          companySlug: options.company,
+          companySlug: company,
           vaultClient: client,
           s3Factory: defaultS3Factory,
           region: DEFAULT_COGNITO.region,
@@ -1261,13 +1271,15 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
       `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
       DEFAULT_HQ_ROOT,
     )
-    .action(async (pathArg: string, options: FilesGetCliOptions) => {
+    .action(async (pathArg: string, options: FilesGetCliOptions, command: Command) => {
       try {
         const accessToken = await ensureCognitoToken();
         const client = new VaultClient(buildVaultConfig(accessToken));
 
-        const slug = options.company ?? parseCompanySlugFromPath(pathArg);
-        if (options.company !== undefined) {
+        // `--company` is bound on the parent `files` group — read merged opts.
+        const companyOpt = command.optsWithGlobals().company as string | undefined;
+        const slug = companyOpt ?? parseCompanySlugFromPath(pathArg);
+        if (companyOpt !== undefined) {
           const fromPath = (() => {
             try {
               return parseCompanySlugFromPath(pathArg);
@@ -1275,9 +1287,9 @@ export function registerFilesBrowseCommands(filesCmd: Command): void {
               return undefined;
             }
           })();
-          if (fromPath && fromPath !== options.company) {
+          if (fromPath && fromPath !== companyOpt) {
             throw new Error(
-              `--company '${options.company}' disagrees with path slug '${fromPath}'.`,
+              `--company '${companyOpt}' disagrees with path slug '${fromPath}'.`,
             );
           }
         }