@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/company-transfer.d.ts

@@ -38,15 +38,23 @@ import { type ActiveMember } from "./members.js";
  * confirmation prompt behind an injectable seam so tests can drive it.
  */
 /** The four write transitions the server accepts. */
-type TransferAction = "initiate" | "accept" | "decline" | "cancel";
+export declare const TRANSFER_ACTIONS: readonly ["initiate", "accept", "decline", "cancel"];
+export type TransferAction = (typeof TRANSFER_ACTIONS)[number];
 /**
  * Legal `--initiator-role` values. `owner` is deliberately absent: a handover
  * where the outgoing owner keeps `owner` is not a handover. `remove` is the
  * ONLY value that takes them off the company, and it can only ever arrive from
  * an explicit flag.
  */
-declare const INITIATOR_ROLE_VALUES: readonly ["admin", "member", "guest", "remove"];
+export declare const INITIATOR_ROLE_VALUES: readonly ["admin", "member", "guest", "remove"];
 export type InitiatorRoleFlag = (typeof INITIATOR_ROLE_VALUES)[number];
+/**
+ * What the SERVER falls back to when `initiatorRole` is absent. Mirrored here
+ * only so the confirmation preview can tell the operator what will happen; the
+ * CLI never puts this value on the wire, because sending it would defeat the
+ * point of leaving the field absent.
+ */
+export declare const DEFAULT_INITIATOR_ROLE = "admin";
 /** A response field's presence, kept separate from its value. */
 export interface WireRead<T = unknown> {
     present: boolean;
@@ -78,6 +86,19 @@ export interface TransferBodyParams {
     transferId?: string;
     reason?: string;
 }
+/**
+ * The wire prefix that turns `POST /membership/role` into a transfer request.
+ * Mirrors the server's `TRANSFER_ACTION_PREFIX` in `_ownership-transfer.ts`:
+ * a body whose `action` starts with `transfer-` is a transfer; anything else
+ * (including no `action` at all) is an ordinary role change.
+ */
+export declare const TRANSFER_ACTION_PREFIX = "transfer-";
+/**
+ * The query discriminator on `GET /membership/company/{companyUid}` that
+ * selects the transfer surface instead of the member roster. Mirrors the
+ * server's `TRANSFER_HISTORY_VIEW` (exact match on the server side).
+ */
+export declare const TRANSFER_HISTORY_VIEW = "transfers";
 /**
  * Build the `POST /membership/role` transfer body. The CLI-side `action`
  * ("initiate" | …) is prefixed to the wire discriminator ("transfer-initiate"
@@ -106,7 +127,7 @@ export declare function describeInitiatorOutcome(role: InitiatorRoleFlag | undef
  */
 export declare function describeEffects(rawEffects: unknown): string[];
 /** Injectable yes/no confirmation seam (stubbed in tests). */
-type ConfirmFn = (message: string) => Promise<boolean>;
+export type ConfirmFn = (message: string) => Promise<boolean>;
 /**
  * The real prompt. Refuses (rather than assuming yes) when stdin is not a TTY,
  * so a transfer can never be initiated or accepted by a pipeline that simply
@@ -124,6 +145,10 @@ export declare function realConfirm(message: string): Promise<boolean>;
  * who is already an active member.
  */
 export declare function matchMemberTarget(members: ActiveMember[], target: string): ActiveMember | undefined;
+export declare function resolveTargetPersonUid(token: string, companyUid: string, target: string): Promise<{
+    personUid: string;
+    label: string;
+}>;
 export interface TransferDeps {
     confirm?: ConfirmFn;
 }
@@ -157,5 +182,4 @@ export interface RunTransferStatusParams {
 /** `hq company transfer status` — the pending nomination plus the audit trail. */
 export declare function runCompanyTransferStatus(params: RunTransferStatusParams): Promise<void>;
 export declare function registerCompanyTransferCommand(company: Command, deps?: TransferDeps): void;
-export {};
 //# sourceMappingURL=company-transfer.d.ts.map

package/dist/commands/company-transfer.js

@@ -3,13 +3,57 @@ import * as readline from "node:readline";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
 import { listActiveMembers } from "./members.js";
+/**
+ * `hq company transfer` — company ownership handover (client-service-pack
+ * US-010). The server adds ZERO new API routes (vault-api-hq-prod sits at the
+ * 600-route quota), so the CLI half multiplexes onto two EXISTING routes:
+ *
+ *   - WRITES ride `POST /membership/role` with a body discriminator
+ *     `action: "transfer-initiate" | "transfer-accept" | "transfer-decline" |
+ *     "transfer-cancel"`. The ordinary role payload has never carried an
+ *     `action` field, so the shapes cannot collide.
+ *   - The READ rides `GET /membership/company/{companyUid}?view=transfers`;
+ *     without that exact `view` value the route returns the member roster as
+ *     before.
+ *
+ * TWO-PARTY BY CONSTRUCTION. `initiate` NOMINATES; it does not transfer
+ * anything. Ownership moves only when the nominee runs `accept`. The four write
+ * transitions (initiate / accept / decline / cancel) all multiplex through one
+ * POST with an explicit `action`, matching the server's route shape.
+ *
+ * ABSENT-FIELD DISCIPLINE (policy `hq-absent-field-never-means-constraining-value`).
+ * This flow spans two repos that deploy in EITHER order, so absence is load
+ * bearing in both directions and is handled in both directions here:
+ *
+ *   - REQUESTS: a flag the operator did not pass is OMITTED from the body — it
+ *     is never defaulted to a value on the wire. `--initiator-role` unset sends
+ *     no `initiatorRole` at all, so the server applies its own reversible
+ *     "keep them as admin" default; the CLI can therefore never turn silence
+ *     into `remove`. Same for `--transfer-id` (absent = "the pending one").
+ *   - RESPONSES: fields are read with presence and value SEPARATELY
+ *     ({@link readWireField}), because an OLDER server omits fields a newer CLI
+ *     knows about. An absent `effects.initiator` renders as "not reported",
+ *     never as "removed" — the CLI must not narrate a destructive outcome it
+ *     was never actually told about.
+ *
+ * Conventions mirror `company.ts` / `files.ts`: ensureCognitoToken() →
+ * getEntityUid() → vaultApiFetch() → error-check → chalk output, with the
+ * confirmation prompt behind an injectable seam so tests can drive it.
+ */
+/** The four write transitions the server accepts. */
+export const TRANSFER_ACTIONS = [
+    "initiate",
+    "accept",
+    "decline",
+    "cancel",
+];
 /**
  * Legal `--initiator-role` values. `owner` is deliberately absent: a handover
  * where the outgoing owner keeps `owner` is not a handover. `remove` is the
  * ONLY value that takes them off the company, and it can only ever arrive from
  * an explicit flag.
  */
-const INITIATOR_ROLE_VALUES = [
+export const INITIATOR_ROLE_VALUES = [
     "admin",
     "member",
     "guest",
@@ -21,7 +65,7 @@ const INITIATOR_ROLE_VALUES = [
  * CLI never puts this value on the wire, because sending it would defeat the
  * point of leaving the field absent.
  */
-const DEFAULT_INITIATOR_ROLE = "admin";
+export const DEFAULT_INITIATOR_ROLE = "admin";
 /**
  * Read a field off a server response reporting presence and value SEPARATELY.
  *
@@ -76,13 +120,13 @@ export function parseInitiatorRole(raw) {
  * a body whose `action` starts with `transfer-` is a transfer; anything else
  * (including no `action` at all) is an ordinary role change.
  */
-const TRANSFER_ACTION_PREFIX = "transfer-";
+export const TRANSFER_ACTION_PREFIX = "transfer-";
 /**
  * The query discriminator on `GET /membership/company/{companyUid}` that
  * selects the transfer surface instead of the member roster. Mirrors the
  * server's `TRANSFER_HISTORY_VIEW` (exact match on the server side).
  */
-const TRANSFER_HISTORY_VIEW = "transfers";
+export const TRANSFER_HISTORY_VIEW = "transfers";
 /**
  * Build the `POST /membership/role` transfer body. The CLI-side `action`
  * ("initiate" | …) is prefixed to the wire discriminator ("transfer-initiate"
@@ -245,7 +289,7 @@ export function matchMemberTarget(members, target) {
         m.personName?.toLowerCase() === needle ||
         m.personUid?.toLowerCase() === needle);
 }
-async function resolveTargetPersonUid(token, companyUid, target) {
+export async function resolveTargetPersonUid(token, companyUid, target) {
     const trimmed = target.trim();
     if (PERSON_UID_PATTERN.test(trimmed) || AGENT_UID_PATTERN.test(trimmed)) {
         return { personUid: trimmed, label: trimmed };

package/dist/commands/company.js

@@ -2,7 +2,6 @@ import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
 import { registerCompanyTransferCommand } from "./company-transfer.js";
-import { describeRefreshOutcome, refreshCheckpointGateSetting, } from "./core-checkpoint-gate-setting.js";
 /**
  * Parse a `--flag <true|false>` string into a boolean, or throw. Commander
  * passes the raw string; we validate strictly so a typo never silently writes
@@ -29,12 +28,10 @@ export function registerCompanyCommand(program) {
     settings
         .command("set")
         .description("Set per-company settings (PUT /company-settings). Require at least one " +
-        "of --crm-enabled / --ontology-enabled / --accounting-enabled / " +
-        "--checkpoint-gate-enabled.")
+        "of --crm-enabled / --ontology-enabled / --accounting-enabled.")
         .option("--crm-enabled <true|false>", "Enable/disable the native CRM for this company")
         .option("--ontology-enabled <true|false>", "Enable/disable the ontology gardener for this company")
         .option("--accounting-enabled <true|false>", "Enable/disable the accounting pack for this company")
-        .option("--checkpoint-gate-enabled <true|false>", "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn")
         .action(async (opts) => {
         try {
             const companySlug = company.opts().company;
@@ -44,9 +41,8 @@ export function registerCompanyCommand(program) {
             }
             if (opts.crmEnabled === undefined &&
                 opts.ontologyEnabled === undefined &&
-                opts.accountingEnabled === undefined &&
-                opts.checkpointGateEnabled === undefined) {
-                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled."));
+                opts.accountingEnabled === undefined) {
+                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled."));
                 process.exit(1);
             }
             const body = {};
@@ -59,9 +55,6 @@ export function registerCompanyCommand(program) {
             if (opts.accountingEnabled !== undefined) {
                 body.accountingEnabled = parseBoolFlag(opts.accountingEnabled, "--accounting-enabled");
             }
-            if (opts.checkpointGateEnabled !== undefined) {
-                body.checkpointGateEnabled = parseBoolFlag(opts.checkpointGateEnabled, "--checkpoint-gate-enabled");
-            }
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, { companySlug });
             body.companyUid = companyUid;
@@ -85,62 +78,6 @@ export function registerCompanyCommand(program) {
                 .map(([k, v]) => `${k}=${v}`)
                 .join(", ");
             console.log(chalk.green(`Company settings updated for ${companySlug}: ${applied}`));
-            if (body.checkpointGateEnabled !== undefined) {
-                // Update this machine's Stop gate cache now instead of waiting up to
-                // ten minutes. Other machines pick the change up on their next refresh.
-                try {
-                    const outcome = await refreshCheckpointGateSetting(companySlug);
-                    console.log(chalk.dim(describeRefreshOutcome(outcome)));
-                }
-                catch {
-                    // The setting is saved; the cache refreshes on the next Stop.
-                }
-            }
-        }
-        catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
-        }
-    });
-    settings
-        .command("get")
-        .description("Show whether the checkpoint Stop gate is on for this company " +
-        "(GET /company-settings/checkpoint-gate; any member may read it).")
-        .option("--json", "Print the result as JSON")
-        .action(async (opts) => {
-        try {
-            const companySlug = company.opts().company;
-            if (!companySlug) {
-                console.error(chalk.red("Error: --company <slug> is required."));
-                process.exit(1);
-            }
-            const token = await ensureCognitoToken();
-            const companyUid = await getEntityUid(token, { companySlug });
-            const res = await vaultApiFetch({
-                token,
-                path: "/company-settings/checkpoint-gate",
-                query: { companyUid },
-            });
-            const resBody = (await res.json().catch(() => ({})));
-            if (!res.ok) {
-                if (res.status === 403) {
-                    console.error(chalk.red("Requires membership of this company to read its settings."));
-                    process.exit(1);
-                }
-                console.error(chalk.red(`Failed to read company settings: ${resBody.error ?? res.statusText}`));
-                process.exit(1);
-            }
-            const enabled = resBody.checkpointGateEnabled;
-            if (typeof enabled !== "boolean") {
-                console.error(chalk.red("Failed to read company settings: no checkpointGateEnabled in the response."));
-                process.exit(1);
-            }
-            if (opts.json) {
-                console.log(JSON.stringify({ company: companySlug, checkpointGateEnabled: enabled }));
-            }
-            else {
-                console.log(`checkpointGateEnabled=${enabled}`);
-            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));

package/dist/commands/core-checkpoint.d.ts

@@ -36,21 +36,19 @@ export declare const CHECKPOINT_REPLY_REMINDER: string;
  * demands the findings), so the conditional half still points there.
  */
 export declare const CHECKPOINT_IDLE_REPLY_REMINDER: string;
-export declare function renderSiblingPrompt(runDir: string, payloadPath: string, options?: {
-    company?: string | null;
-    hqRoot?: string;
-}): string;
+/**
+ * Kept in TypeScript rather than in a bundled asset: it is an instruction to
+ * a locally-installed agent, not a scaffold script that should be packaged.
+ */
+export declare const SIBLING_PROMPT_TEMPLATE = "You are the HQ checkpoint sibling \u2014 a background maintenance agent for this\nHQ install. Your parent session's state is in <payloadPath>. Work\nquietly and do not ask questions; if something is ambiguous, record it in the\nreport instead of guessing.\n\n1. Read the payload. If it lists a transcript path that exists, read its tail (~400 lines)\n   both for session context and to extract additional reusable learnings/insights\n   the parent did not pass explicitly. Never quote secrets\n   or tokens from the transcript. If .claude/skills/checkpoint/SKILL.md exists\n   under this HQ root, read it and follow it wherever it goes beyond these instructions;\n   the write bounds below always win over the skill text.\n2. Upgrade the thread file named in the payload IN PLACE: verify/repair its\n   JSON; fill git.remote_url, git.initial_commit, git.commits_made, and\n   git.knowledge_repos by scanning core/knowledge/public/*,\n   core/knowledge/private/*, personal/knowledge/*, and companies/*/knowledge\n   for symlinks or directories containing .git, recording dirty repositories\n   as {\"<name>\": {\"commit\": \"<short>\", \"dirty\": true}}. Fill worker,\n   next_steps, and insights; set type to \"checkpoint\"; then rename the file to\n   drop -auto- from its filename. Use the renamed path in every reference you\n   write afterwards.\n3. For every explicit or transcript-derived learning that is a reusable rule,\n   FIRST search the existing policies for one the learning refines, contradicts\n   or duplicates. Then take exactly one of these actions and name it in the\n   report \u2014 the policy set is curated, not append-only:\n   - AMEND an existing policy in place when the learning sharpens it, narrows\n     its scope, or adds a case, and the rule as written is still correct.\n   - SUPERSEDE it when the learning contradicts it: rewrite the rule to what is\n     now true and record inside the file what changed and why.\n   - MERGE near-duplicates into the single best-named file, then delete the\n     files you merged away.\n   - CREATE a new policy only when no existing policy covers the rule.\n   Follow core/knowledge/public/hq-core/policies-spec.md. Write under\n   personal/policies/ or, only when the payload names a company and the rule is\n   company-specific, companies/<company>/policies/.\n   DELETION BOUNDS: delete a policy only as the MERGE or SUPERSEDE step above,\n   only inside those two directories, and never one whose body marks it HARD \u2014\n   if a hard policy now looks wrong, leave it untouched and flag it in the\n   report for a human to decide. Never delete a file you have not read.\n   Apply the same curation to durable facts (not rules) under\n   personal/knowledge/ or companies/<company>/knowledge/: correct a stale fact\n   in place rather than appending a second, contradictory copy of it.\n   Store up to two explicit or transcript-derived insights per\n   core/knowledge/public/hq-core/insights-spec.md when present, otherwise\n   workspace/insights/.\n4. Close an active session journal fail-soft with\n   bash .claude/skills/_shared/journal.sh close \"<project_dir>\" \"<one-line synthesis>\".\n   Write a legacy checkpoint JSON under workspace/checkpoints/<id>.json with\n   id, created_at, summary, files, and next_steps for backward compatibility.\n5. Update workspace/threads/recent.md and regenerate\n   workspace/threads/INDEX.md. For each company whose knowledge path appears\n   in files_touched, regenerate companies/<company>/knowledge/INDEX.md under\n   core/knowledge/public/hq-core/index-md-spec.md. Mechanical index generation\n   is allowed for those companies, but knowledge/policy content writes remain\n   restricted to the payload's named company.\n6. Run .claude/skills/document-release/SKILL.md best-effort when it exists;\n   skip silently on any failure. Hook or automation improvements go ONLY under\n   personal/hooks/ as proposals.\n7. WRITE BOUNDS: you may write only under personal/, workspace/, and companies/<company>/ as constrained above. You must NEVER write into .claude/, core/, .agents/, .codex/, repos/, or anywhere outside the HQ root.\n8. Write <runDir>/report.md \u2014 full prose: what you read, what you changed\n   (paths), and what you skipped and why. List every policy or knowledge file\n   you amended, superseded, merged or deleted with the reason, so a human can\n   audit and reverse it; a deletion you do not name in the report is a defect.\n   Then drain the queue: while\n   workspace/checkpoints/sibling/pending.jsonl exists and is non-empty, claim\n   it atomically by renaming it aside \u2014\n   mv workspace/checkpoints/sibling/pending.jsonl <runDir>/pending-claimed-N.jsonl\n   (N counting up from 2) \u2014 and process the claimed payloads with this same\n   flow. Repeat until a claim finds nothing left, then update the report.\n   NEVER read the queue and truncate it in place: a payload appended between\n   your read and the truncate is lost, and its checkpoint is never enriched.\n";
+export declare function renderSiblingPrompt(runDir: string, payloadPath: string): string;
 export type WriteStampsOptions = {
     /**
      * Filesystem seam (default the real `node:fs`); injected in tests to force a
      * permission errno so the HqStateWriteError conversion can be proven without a
      * real unwritable path.
      */
-    fs?: Pick<typeof fs, "mkdirSync" | "writeFileSync" | "renameSync" | "unlinkSync">;
-    /** Runtime seam for proving the Windows-only atomic path without host assumptions. */
-    platform?: NodeJS.Platform;
-    /** Synchronous delay seam for the bounded Windows lock retry. */
-    waitForRetry?: (delayMs: number) => void;
+    fs?: Pick<typeof fs, "mkdirSync" | "writeFileSync">;
 };
 export declare function writeStamps(liveRoot: string, sessionId: string | undefined, options?: WriteStampsOptions): string[];
 /**
@@ -58,17 +56,9 @@ export declare function writeStamps(liveRoot: string, sessionId: string | undefi
  * claude session keeps using claude and a codex session keeps using codex
  * (same-engine continuity), then the fallback priority claude -> codex -> grok
  * for whatever the caller is not. Deterministic and env-only, so it is unit
- * tested directly. `preferGrok` (the company's grok-backend flag) puts grok
- * ahead of that order and leaves the rest as the fallback.
- */
-export declare function autoBackendPreference(preferGrok?: boolean): SpawnableBackend[];
-/**
- * Whether the payload company's last ontology plan recorded
- * checkpoint.ontology.grok-backend as on. Reads only the local state file the
- * detached sibling writes, so a foreground checkpoint never waits on the flag
- * registry; a flag change takes effect from the checkpoint after the next plan.
+ * tested directly.
  */
-export declare function companyPrefersGrok(liveRoot: string, companySlug: string | null | undefined): boolean;
+export declare function autoBackendPreference(): SpawnableBackend[];
 export declare function siblingArgs(backend: SpawnableBackend, prompt: string): string[];
 /** Attach the native checkpoint command to the hidden `hq core` group. */
 export declare function registerCoreCheckpointCommand(core: Command): void;