@indigoai-us/hq-cli 5.311.2 → 5.311.3

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+## [5.311.3] — 2026-10-01
+- Match company file access checks against the company-anchored paths printed by `hq files browse`.
+- Record a placement resolved to the current host as local so the lane starts without dispatching back through Outpost pickup.
+
 ## [5.311.2] — 2026-10-01
 - Reduce fast-path startup work by loading network compatibility only on routes that need it.
 - Make envelope `next_check_at` an unconditional keep-alive hold and remove its completed rollout flag.

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -60,13 +60,31 @@ STATUS="$(jq -r '.status // empty' "$MANIFEST")"
 
 # File-ACL principals must be an email, grp_<id>, or @all — an agentUid is
 # NOT accepted by `hq files share`. For agent recipients, grants flow through
-# a deterministic per-agent delegation group (the /new-agent pattern):
-# grp_dlg-<uid tail>, containing exactly that agent.
+# a deterministic per-agent delegation group keyed by the full UID digest:
+# grp_dlg<first 32 SHA-256 hex characters>, containing exactly that agent.
+agent_group_id() {
+  local principal="$1" digest
+  if command -v sha256sum >/dev/null 2>&1; then
+    digest="$(printf '%s' "$principal" | sha256sum)"
+  elif command -v shasum >/dev/null 2>&1; then
+    digest="$(printf '%s' "$principal" | shasum -a 256)"
+  else
+    die "sha256 utility is required for agent delegation groups"
+  fi
+  printf 'grp_dlg%.32s' "$digest"
+}
+
 GRANT_PRINCIPAL="$PRINCIPAL"
 case "$PRINCIPAL" in
   agt_*)
     TAIL="$(printf '%s' "$PRINCIPAL" | tail -c 9 | tr '[:upper:]' '[:lower:]')"
-    GRANT_PRINCIPAL="grp_dlg-$TAIL"
+    LEGACY_GROUP="grp_dlg-$TAIL"
+    NEXT_GROUP="$(agent_group_id "$PRINCIPAL")"
+    RECORDED_GROUP="$(jq -r '.grantPrincipal // empty' "$MANIFEST")"
+    case "$RECORDED_GROUP" in
+      "$LEGACY_GROUP"|"$NEXT_GROUP") GRANT_PRINCIPAL="$RECORDED_GROUP" ;;
+      *) GRANT_PRINCIPAL="$NEXT_GROUP" ;;
+    esac
     ;;
 esac
 
@@ -133,12 +151,20 @@ done
 # --- 1b. agent recipients: ensure the delegation group exists + contains them
 
 if [ "$GRANT_PRINCIPAL" != "$PRINCIPAL" ]; then
-  # Both calls are idempotent-tolerated: an existing group / existing member
-  # is fine — the ACL read-back below is the arbiter of success.
+  # Group creation and add are idempotent-tolerated; confirm that the complete
+  # member list is exactly this agent before any file ACL is shared.
   hq groups create "$GRANT_PRINCIPAL" --name "Delegation: $DISPLAY" --company "$COMPANY" \
     || echo "hq-delegate-grant: group create reported an error (may already exist) — continuing" >&2
   hq groups add "$GRANT_PRINCIPAL" "$PRINCIPAL" --company "$COMPANY" \
     || echo "hq-delegate-grant: group add reported an error (may already be a member) — continuing" >&2
+  GROUP_MEMBERS="$(NO_COLOR=1 FORCE_COLOR=0 hq groups members "$GRANT_PRINCIPAL" --company "$COMPANY")" \
+    || die "could not verify delegation group membership"
+  MEMBER_IDS="$(printf '%s\n' "$GROUP_MEMBERS" | awk '
+    { gsub(/\033\[[0-9;]*m/, "", $0) }
+    /^PERSON_UID([[:space:]]|$)/ { collecting = 1; next }
+    collecting && NF { print $1 }
+  ')"
+  [ "$MEMBER_IDS" = "$PRINCIPAL" ] || die "delegation group membership does not exactly match recipient"
 fi
 
 # --- 2+3. exact structured read-back; never infer identity from a new row ---

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -93,7 +93,7 @@ if [ -f "$PRD_ABS" ] && jq -e . "$PRD_ABS" >/dev/null 2>&1; then
 fi
 
 GET_LINES="$(jq -r --arg co "$COMPANY" \
-  '.vaultPrefixes[] | "hq files get \(.prefix) --company \($co)"' "$MANIFEST")"
+  'def bashq: if test("^[A-Za-z0-9_./:@+-]+$") then . else @sh end; .vaultPrefixes[] | "hq files get \(.prefix | bashq) --company \($co | bashq)"' "$MANIFEST")"
 
 REPO_IS_NULL="$(jq -r 'if .repo == null then "yes" else "no" end' "$MANIFEST")"
 REPO_SECTION=""

package/assets/scaffold/core/scripts/hq-delegate-verify.sh

@@ -135,7 +135,7 @@ while [ "$i" -lt "$PREFIX_COUNT" ]; do
   if [ "$BROWSE_RC" -ne 0 ]; then
     echo "  FAIL  $PFX — browse errored (likely cause: the grant did not land, or the caller's session expired — re-run /hq-login and hq-delegate-grant.sh)"
     FAILED=1
-  elif [ -z "$(printf '%s' "$BROWSE_OUT" | tr -d '[:space:]')" ]; then
+  elif [ -z "$(printf '%s' "$BROWSE_OUT" | tr -d '[:space:]')" ] || [ "$(printf '%s' "$BROWSE_OUT" | tr -d '[:space:]')" = "Noobjectsunderthatprefix." ]; then
     echo "  FAIL  $PFX — reachable but EMPTY (likely cause: the dossier was never pushed to the vault — hq sync push companies/$COMPANY/... and re-run)"
     FAILED=1
   else
@@ -156,6 +156,31 @@ done
 # Browse each distinct parent at most once, and retry an empty result a few
 # times before trusting it. (Cache dir cleaned on exit.)
 REF_BROWSE_CACHE="$(mktemp -d)"
+listing_has_exact_key() {
+  local listing="$1" expected="$2"
+  printf '%s\n' "$listing" | awk -v expected="$expected" '
+    function exact_key(row, expected, modified, size) {
+      gsub(/\033\[[0-9;]*m/, "", row)
+      sub(/[[:space:]]+$/, "", row)
+      if (row !~ / +(shared-with-you|creator access — creator-only|role-bypass|personal-vault|private folder — children are creator-only)$/) return 0
+      sub(/ +(shared-with-you|creator access — creator-only|role-bypass|personal-vault|private folder — children are creator-only)$/, "", row)
+      modified = row
+      sub(/^.* +/, "", modified)
+      if (modified != "—" && modified !~ /^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]\.[0-9][0-9][0-9]Z$/) return 0
+      sub(/ +[^[:space:]]+$/, "", row)
+      sub(/[[:space:]]+$/, "", row)
+      size = row
+      sub(/^.* +/, "", size)
+      if (size !~ /^[0-9]+$/) return 0
+      sub(/ +[0-9]+$/, "", row)
+      sub(/[[:space:]]+$/, "", row)
+      return row == expected
+    }
+    NR > 2 && exact_key($0, expected) { found = 1 }
+    END { exit found ? 0 : 1 }
+  '
+}
+
 browse_parent() { # parent -> listing (memoized per run, retried on empty)
   local parent="$1" key out attempt
   key="$REF_BROWSE_CACHE/$(printf '%s' "$parent" | tr '/@:' '___')"
@@ -187,7 +212,7 @@ if [ "$REF_COUNT" -gt 0 ]; then
     # early match, which under `set -o pipefail` surfaces printf's SIGPIPE as a
     # non-zero pipeline and FALSE-FAILS a file that is genuinely present (it bit
     # exactly the referenced files that sort early in a large parent listing).
-    if [[ "$LISTING" == *"$BASE"* ]]; then
+    if listing_has_exact_key "$LISTING" "$kpath"; then
       echo "  pass  $REL"
     else
       echo "  FAIL  $REL — granted prefix is reachable but this referenced file is NOT in the vault (likely cause: it was never pushed — hq sync push $kpath --company $COMPANY and re-run)"

package/dist/commands/core-delegate-w1b.js

@@ -8,6 +8,7 @@ import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { commandExists, isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { ACL_SOURCE_DISPLAY_LABELS } from "../utils/files-browse-acl.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 const FLAG = "core-native-delegate";
 const ASSETS = {
@@ -113,6 +114,42 @@ function quoteBash(value) {
         return value;
     return `'${value.replaceAll("'", `'\\''`)}'`;
 }
+function delegationGroupId(principal) {
+    return "grp_dlg" + createHash("sha256").update(principal).digest("hex").slice(0, 32);
+}
+function stripAnsiSequences(value) {
+    const escape = String.fromCharCode(27);
+    return value.replace(new RegExp(`${escape}\\[[0-?]*[ -/]*[@-~]`, "g"), "");
+}
+function groupMemberIds(output) {
+    const plainOutput = stripAnsiSequences(output);
+    const lines = plainOutput.split(/\r?\n/);
+    const header = lines.findIndex((line) => /^PERSON_UID(?:\s|$)/.test(line.trimStart()));
+    if (header < 0)
+        return null;
+    return lines.slice(header + 1).filter((line) => line.trim() !== "")
+        .map((line) => line.trim().split(/\s{2,}/, 1)[0] ?? "");
+}
+function browseContainsExactKey(listing, expected) {
+    const lines = listing.split(/\r?\n/);
+    const aclLabels = Object.values(ACL_SOURCE_DISPLAY_LABELS);
+    return lines.slice(2).some((line) => {
+        const row = stripAnsiSequences(line).trimEnd();
+        const acl = aclLabels.find((label) => row.endsWith(label));
+        if (!acl)
+            return false;
+        const beforeAcl = row.slice(0, -acl.length).trimEnd();
+        const modifiedMatch = /^(.*) +(\S+)$/.exec(beforeAcl);
+        if (!modifiedMatch)
+            return false;
+        const modified = modifiedMatch[2] ?? "";
+        if (modified !== "—" && !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(modified))
+            return false;
+        const beforeModified = (modifiedMatch[1] ?? "").trimEnd();
+        const sizeMatch = /^(.*) +(\d+)$/.exec(beforeModified);
+        return (sizeMatch?.[1] ?? "").trimEnd() === expected;
+    });
+}
 function parseFlags(args, allowed) {
     const values = {};
     for (let i = 0; i < args.length;) {
@@ -379,8 +416,12 @@ function runGrant(args, context) {
     if (!principal)
         return fail("grant", "manifest has no to.principal");
     let grantPrincipal = principal;
-    if (principal.startsWith("agt_"))
-        grantPrincipal = `grp_dlg-${principal.slice(-9).toLowerCase()}`;
+    if (principal.startsWith("agt_")) {
+        const legacyGroup = "grp_dlg-" + principal.slice(-9).toLowerCase();
+        const nextGroup = delegationGroupId(principal);
+        const recordedGroup = text(getPath(manifest, "grantPrincipal"));
+        grantPrincipal = recordedGroup === legacyGroup || recordedGroup === nextGroup ? recordedGroup : nextGroup;
+    }
     if (status !== "building" && status !== "granted")
         return fail("grant", `manifest status is '${status}' — grants run from 'building' (or re-run from 'granted'), not from there`);
     const prefixes = list(getPath(manifest, "vaultPrefixes"));
@@ -431,6 +472,13 @@ function runGrant(args, context) {
         result = runHq(["groups", "add", grantPrincipal, principal, "--company", company], context, "inherit");
         if (result.code !== 0)
             err("hq-delegate-grant: group add reported an error (may already be a member) — continuing\n");
+        const members = subprocess("hq", ["groups", "members", grantPrincipal, "--company", company], context.cwd, { env: { NO_COLOR: "1", FORCE_COLOR: "0" } });
+        if (members.code !== 0)
+            return fail("grant", "could not verify delegation group membership");
+        const memberIds = groupMemberIds(members.stdout ?? "");
+        if (memberIds === null || memberIds.length !== 1 || memberIds[0] !== principal) {
+            return fail("grant", "delegation group membership does not exactly match recipient");
+        }
     }
     let expectedType = "";
     let expectedId = "";
@@ -794,7 +842,7 @@ function runSend(args, context) {
                 .map((entry, index) => `${index + 1}. **${text(getPath(entry, "id"))}: ${text(getPath(entry, "title"))}** — ${text(getPath(entry, "description"))}`)
                 .join("\n");
         }
-        const getLines = list(getPath(manifest, "vaultPrefixes", [])).map((entry) => `hq files get ${jqRawPath(entry, "prefix")} --company ${company}`).join("\n");
+        const getLines = list(getPath(manifest, "vaultPrefixes", [])).map((entry) => "hq files get " + quoteBash(jqRawPath(entry, "prefix")) + " --company " + quoteBash(company)).join("\n");
         let repoSection = "";
         const repoValue = getPath(manifest, "repo");
         if (repoValue !== null && repoValue !== undefined) {
@@ -824,7 +872,7 @@ function runSend(args, context) {
             body += `## The goal\n\n${goal}\n\n`;
         if (stateLine)
             body += `## Where things stand\n\n${stateLine}\n\n`;
-        body += `## Pull the files (on demand — no sync)\n\nRun these from your HQ root; each materializes exactly that path:\n\n\`\`\`bash\n${getLines}\n\`\`\`\n\nStart with the project dossier: \`companies/${company}/projects/${project}/\` now contains the PRD (\`prd.json\`), a full brief (\`README.md\` / the DM's details pane), and the delegation journal.\n\n`;
+        body += `## Pull the files (on demand — no sync)\n\nRun these from your HQ root; each materializes exactly that path locally:\n\n\`\`\`bash\n${getLines}\n\`\`\`\n\nStart with the project dossier: \`companies/${company}/projects/${project}/\` now contains the PRD (\`prd.json\`), a full brief (\`README.md\` / the DM's details pane), and the delegation journal.\n\n`;
         if (repoSection)
             body += `${repoSection}\n\n`;
         if (secretsSection)
@@ -1024,7 +1072,7 @@ function runVerify(args, context) {
                 out(`  FAIL  ${prefix} — browse errored (likely cause: the grant did not land, or the caller's session expired — re-run /hq-login and hq-delegate-grant.sh)\n`);
                 failed = true;
             }
-            else if (!combined.replace(/\s/g, "")) {
+            else if (!combined.replace(/\s/g, "") || combined.replace(/\s/g, "") === "Noobjectsunderthatprefix.") {
                 out(`  FAIL  ${prefix} — reachable but EMPTY (likely cause: the dossier was never pushed to the vault — hq sync push companies/${company}/... and re-run)\n`);
                 failed = true;
             }
@@ -1059,9 +1107,8 @@ function runVerify(args, context) {
                 const relative = reference.slice(`companies/${company}/`.length);
                 const separator = relative.lastIndexOf("/");
                 const parent = `${separator < 0 ? "." : relative.slice(0, separator)}/`;
-                const base = separator < 0 ? relative : relative.slice(separator + 1);
                 const listing = browseParent(parent);
-                if (listing.includes(base))
+                if (browseContainsExactKey(listing, reference))
                     out(`  pass  ${relative}\n`);
                 else {
                     out(`  FAIL  ${relative} — granted prefix is reachable but this referenced file is NOT in the vault (likely cause: it was never pushed — hq sync push ${reference} --company ${company} and re-run)\n`);

package/dist/commands/core-delegate.d.ts

@@ -23,6 +23,7 @@ export declare function subprocess(command: string, args: string[], cwd: string,
     stdinFd?: number;
     stderr?: "inherit" | "ignore" | "pipe";
     stdout?: "capture" | "inherit" | "ignore";
+    env?: NodeJS.ProcessEnv;
     maxBuffer?: number;
 }): CommandResult;
 type JsonRecord = Record<string, unknown>;

package/dist/commands/core-delegate.js

@@ -89,7 +89,7 @@ export function commandExists(name, cwd = process.cwd(), options = {}) {
 export function subprocess(command, args, cwd, options = {}) {
     const result = spawnSync(command, args, {
         cwd,
-        env: process.env,
+        env: { ...process.env, ...options.env },
         input: options.input,
         maxBuffer: options.maxBuffer,
         encoding: "buffer",

package/dist/commands/files-browse.d.ts

@@ -36,6 +36,9 @@
 import { Command } from "commander";
 import { ListObjectsV2Command, GetObjectCommand, type ListObjectsV2CommandOutput, type GetObjectCommandOutput } from "@aws-sdk/client-s3";
 import { VaultClient, type ExplicitGrant } from "@indigoai-us/hq-cloud";
+import { type AclSource } from "../utils/files-browse-acl.js";
+export { ACL_SOURCE_DISPLAY_LABELS, displayAclSource } from "../utils/files-browse-acl.js";
+export type { AclSource } from "../utils/files-browse-acl.js";
 /** STS-vended credential set the browse/cat path consumes. */
 export interface BrowseCredentials {
     accessKeyId: string;
@@ -121,7 +124,6 @@ export type CompanyBrowseClientFactory = (input: {
  *   - `private-folder`: this is the private folder row itself. Its children
  *      are creator-only, so it never covers a child key.
  */
-export type AclSource = "shared-with-you" | "creator" | "role-bypass" | "personal-vault" | "private-folder";
 export interface BrowseRow {
     key: string;
     size: number;
@@ -505,5 +507,4 @@ export declare function resolveBrowseSession(): Promise<{
 export declare function registerFilesBrowseCommands(filesCmd: Command, deps?: {
     personalS3Factory?: S3ClientFactory;
 }): void;
-export {};
 //# sourceMappingURL=files-browse.d.ts.map

package/dist/commands/files-browse.js

@@ -42,6 +42,8 @@ import { pipeline } from "node:stream/promises";
 import { S3Client, ListObjectsV2Command, GetObjectCommand, } from "@aws-sdk/client-s3";
 import { VaultClient, } from "@indigoai-us/hq-cloud";
 import { isPrivateFolderPattern } from "./_patterns.js";
+import { displayAclSource, } from "../utils/files-browse-acl.js";
+export { ACL_SOURCE_DISPLAY_LABELS, displayAclSource } from "../utils/files-browse-acl.js";
 import { DEFAULT_HQ_ROOT, DEFAULT_COGNITO, buildVaultConfig, } from "../utils/cognito-session.js";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { maxLength } from "../utils/table-width.js";
@@ -142,13 +144,6 @@ export function toBrowseGrantPattern(grantPath, slug) {
     const companyRelative = toBucketRelative(grantPath, slug);
     return companyRelative === "*" ? "" : companyRelative;
 }
-function displayAclSource(source) {
-    return source === "private-folder"
-        ? "private folder — children are creator-only"
-        : source === "creator"
-            ? "creator access — creator-only"
-            : source;
-}
 /**
  * Bright-line guard for `--out`: refuse to write any byte beneath
  * `<hqRoot>/companies/`. We do NOT enumerate `companies/manifest.yaml`

package/dist/commands/lanes.js

@@ -2962,6 +2962,7 @@ async function runCreate(ctx, opts) {
     const config = loadLanesConfig(hqRoot);
     let outpostId = opts.outpost?.trim() || undefined;
     let placementHostOverride;
+    let placementBalanceHostOverride;
     let autoPlacementChoice;
     let autoPlacementSkippedHosts = [];
     let placementMachineIdentity;
@@ -3013,12 +3014,14 @@ async function runCreate(ctx, opts) {
     if (placementToApply !== undefined) {
         const currentHost = laneHostFromCtx(ctx);
         if (placementToApply.kind === "local") {
-            placementHostOverride = currentHost;
+            placementBalanceHostOverride = currentHost;
+            placementHostOverride = { kind: "local", id: ctx.hostname() };
             outpostId = undefined;
         }
         else if (placementToApply.kind === "outpost") {
             if (currentHost.kind === "outpost" && currentHost.id === placementToApply.id) {
-                placementHostOverride = currentHost;
+                placementBalanceHostOverride = currentHost;
+                placementHostOverride = { kind: "local", id: ctx.hostname() };
                 outpostId = undefined;
             }
             else {
@@ -3275,7 +3278,7 @@ async function runCreate(ctx, opts) {
     const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
     let accountSelection;
     if (provider === "claude") {
-        const targetHost = placementHostOverride ?? (outpostId !== undefined
+        const targetHost = placementBalanceHostOverride ?? placementHostOverride ?? (outpostId !== undefined
             ? { kind: "outpost", id: outpostId }
             : laneHostFromCtx(ctx));
         balanceTargetHost = targetHost;

package/dist/utils/files-browse-acl.d.ts

@@ -0,0 +1,5 @@
+/** ACL source values and their stable labels in the hq files browse table. */
+export type AclSource = "shared-with-you" | "creator" | "role-bypass" | "personal-vault" | "private-folder";
+export declare const ACL_SOURCE_DISPLAY_LABELS: Readonly<Record<AclSource, string>>;
+export declare function displayAclSource(source: AclSource): string;
+//# sourceMappingURL=files-browse-acl.d.ts.map

package/dist/utils/files-browse-acl.js

@@ -0,0 +1,11 @@
+export const ACL_SOURCE_DISPLAY_LABELS = {
+    "shared-with-you": "shared-with-you",
+    creator: "creator access — creator-only",
+    "role-bypass": "role-bypass",
+    "personal-vault": "personal-vault",
+    "private-folder": "private folder — children are creator-only",
+};
+export function displayAclSource(source) {
+    return ACL_SOURCE_DISPLAY_LABELS[source];
+}
+//# sourceMappingURL=files-browse-acl.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.311.2",
+  "version": "5.311.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {