@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/commands/onboard-bot-membership.d.ts

@@ -1,32 +0,0 @@
-/**
- * A company created from a local bot's conversation is owned by the person
- * (the turn runs with the owner's sign-in), so the bot that helped create it
- * is not in it. The bot passes its own id along (HQ_BOT_AGENT_UID — an id,
- * never a credential), and `hq onboard create-company` adds that bot as a
- * member right after, so it can keep helping inside the new company.
- *
- * Best effort: a failure here never fails the company that was just created.
- */
-import { inviteMember } from "./members.js";
-export declare const HQ_BOT_AGENT_UID_ENV = "HQ_BOT_AGENT_UID";
-/** The bot to add to `companyUid`, or null when this is not a bot's turn. */
-export declare function botToAddAfterCreateCompany(env: NodeJS.ProcessEnv, companyUid: string | undefined): {
-    agentUid: string;
-    companyUid: string;
-} | null;
-export interface AddBotDeps {
-    invite: typeof inviteMember;
-    callerUid: (token: string) => Promise<string>;
-}
-/** Add the bot as a member. Returns a one-line outcome for the log; never throws. */
-export declare function addBotToNewCompany(input: {
-    agentUid: string;
-    companyUid: string;
-    token: string;
-}, deps?: AddBotDeps): Promise<{
-    ok: true;
-} | {
-    ok: false;
-    reason: string;
-}>;
-//# sourceMappingURL=onboard-bot-membership.d.ts.map

package/dist/commands/onboard-bot-membership.js

@@ -1,40 +0,0 @@
-/**
- * A company created from a local bot's conversation is owned by the person
- * (the turn runs with the owner's sign-in), so the bot that helped create it
- * is not in it. The bot passes its own id along (HQ_BOT_AGENT_UID — an id,
- * never a credential), and `hq onboard create-company` adds that bot as a
- * member right after, so it can keep helping inside the new company.
- *
- * Best effort: a failure here never fails the company that was just created.
- */
-import { getCallerPersonUid, inviteMember } from "./members.js";
-export const HQ_BOT_AGENT_UID_ENV = "HQ_BOT_AGENT_UID";
-const AGENT_UID_RE = /^agt_[A-Za-z0-9]{1,64}$/;
-/** The bot to add to `companyUid`, or null when this is not a bot's turn. */
-export function botToAddAfterCreateCompany(env, companyUid) {
-    const agentUid = env[HQ_BOT_AGENT_UID_ENV]?.trim() ?? "";
-    const company = companyUid?.trim() ?? "";
-    if (!AGENT_UID_RE.test(agentUid) || !company.startsWith("cmp_"))
-        return null;
-    return { agentUid, companyUid: company };
-}
-const defaultDeps = { invite: inviteMember, callerUid: getCallerPersonUid };
-/** Add the bot as a member. Returns a one-line outcome for the log; never throws. */
-export async function addBotToNewCompany(input, deps = defaultDeps) {
-    try {
-        const callerUid = await deps.callerUid(input.token);
-        await deps.invite({
-            target: input.agentUid,
-            role: "member",
-            sendEmail: false,
-            companyUid: input.companyUid,
-            callerUid,
-            token: input.token,
-        });
-        return { ok: true };
-    }
-    catch (err) {
-        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    }
-}
-//# sourceMappingURL=onboard-bot-membership.js.map

package/dist/commands/onboard-create-identity.d.ts

@@ -1,26 +0,0 @@
-/**
- * Who a new company is created for, when `hq onboard create-company` is run
- * without `--email` / `--person-name`.
- *
- * The signed-in account already carries both on its ID token. Asking the
- * person to type their own name again — which is what the setup bot had to do,
- * because `hq whoami` shows only the email — is a question HQ can answer
- * itself. Explicit flags still win.
- */
-export interface CreateCompanyIdentity {
-    email: string;
-    personName: string;
-}
-export type CreateCompanyIdentityResult = {
-    ok: true;
-    identity: CreateCompanyIdentity;
-} | {
-    ok: false;
-    message: string;
-};
-/** Pure: flags first, then the ID token's claims. */
-export declare function resolveCreateCompanyIdentity(flags: {
-    email?: string;
-    personName?: string;
-}, claims: Record<string, unknown>): CreateCompanyIdentityResult;
-//# sourceMappingURL=onboard-create-identity.d.ts.map

package/dist/commands/onboard-create-identity.js

@@ -1,23 +0,0 @@
-function text(value) {
-    return typeof value === "string" ? value.trim() : "";
-}
-/** Pure: flags first, then the ID token's claims. */
-export function resolveCreateCompanyIdentity(flags, claims) {
-    const email = text(flags.email) || text(claims.email);
-    const personName = text(flags.personName) ||
-        text(claims.name) ||
-        [text(claims.given_name), text(claims.family_name)].filter(Boolean).join(" ");
-    const missing = [];
-    if (!email)
-        missing.push("--email");
-    if (!personName)
-        missing.push("--person-name");
-    if (missing.length > 0) {
-        return {
-            ok: false,
-            message: `Your HQ sign-in does not say ${missing.length === 2 ? "your email or name" : missing[0] === "--email" ? "your email" : "your name"}. Pass ${missing.join(" and ")}.`,
-        };
-    }
-    return { ok: true, identity: { email, personName } };
-}
-//# sourceMappingURL=onboard-create-identity.js.map

package/dist/commands/outpost-pruner.d.ts

@@ -1,3 +0,0 @@
-import { Command } from "commander";
-export declare function registerOutpostPrunerCommand(lanes: Command): void;
-//# sourceMappingURL=outpost-pruner.d.ts.map

package/dist/commands/outpost-pruner.js

@@ -1,125 +0,0 @@
-import { spawnSync } from "node:child_process";
-import * as os from "node:os";
-import * as path from "node:path";
-import { outpostWorktreePrunerEnabled, OUTPOST_WORKTREE_PRUNER_FLAG } from "../lib/lanes/outpost-worktree-pruner-flag.js";
-import { OUTPOST_WORKTREE_PRUNER_DEFAULT_MIN_AGE_DAYS, runOutpostWorktreePruner, } from "../lib/lanes/outpost-worktree-pruner.js";
-import { defaultOutpostPrunerSystemdDir, installOutpostPrunerTimers, uninstallOutpostPrunerTimers, } from "../lib/lanes/outpost-pruner-install.js";
-import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
-function errorType(error) {
-    return error instanceof Error ? error.name : "UnknownError";
-}
-function printJson(value) {
-    process.stdout.write(`${JSON.stringify(value)}\n`);
-}
-function printErrorJson(event, error, fields = {}) {
-    printJson({ event, ...fields, error: errorType(error) });
-}
-function runSystemctl(binary, args) {
-    const result = spawnSync(binary, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    return {
-        status: result.status ?? 1,
-        stdout: result.stdout ?? "",
-        stderr: result.stderr ?? "",
-    };
-}
-function systemdRoot(option) {
-    return path.resolve(option ?? defaultOutpostPrunerSystemdDir(os.homedir()));
-}
-function skippedResult(trigger, minAgeDays, reason) {
-    return {
-        event: "outpost.worktree_pruner.run",
-        trigger,
-        dry_run: false,
-        feature_enabled: false,
-        skipped: reason,
-        flag: OUTPOST_WORKTREE_PRUNER_FLAG,
-        min_age_days: minAgeDays,
-        candidates: [],
-        removed: [],
-        kept: [],
-        bytes_freed: 0,
-        bytes_freed_basis: "statfs_available_byte_delta",
-        package_store: { attempted: false, reason: "not_run" },
-    };
-}
-export function registerOutpostPrunerCommand(lanes) {
-    const pruner = lanes
-        .command("outpost-pruner")
-        .description("Inspect, install, and run safe outpost worktree pruning");
-    pruner
-        .command("run")
-        .description("Run the guarded outpost worktree and user-cache cleanup")
-        .option("--trigger <kind>", "pressure | daily | manual", "manual")
-        .option("--min-age-days <days>", "Minimum age before cleanup (1–365 days)", (value) => Number(value), OUTPOST_WORKTREE_PRUNER_DEFAULT_MIN_AGE_DAYS)
-        .option("--dry-run", "List eligible worktrees without deleting files")
-        .action(async (options) => {
-        const trigger = options.trigger ?? "manual";
-        const minAgeDays = options.minAgeDays ?? OUTPOST_WORKTREE_PRUNER_DEFAULT_MIN_AGE_DAYS;
-        try {
-            if (!["pressure", "daily", "manual"].includes(trigger)) {
-                throw new TypeError("invalid trigger");
-            }
-            const featureEnabled = options.dryRun ? false : await outpostWorktreePrunerEnabled();
-            if (!options.dryRun && !featureEnabled) {
-                printJson(skippedResult(trigger, minAgeDays, "feature_flag_off"));
-                return;
-            }
-            const result = runOutpostWorktreePruner({
-                hqRoot: resolveLanesHqRoot(),
-                trigger,
-                dryRun: Boolean(options.dryRun),
-                featureEnabled,
-                minAgeDays,
-            });
-            printJson({ ...result, flag: OUTPOST_WORKTREE_PRUNER_FLAG });
-        }
-        catch (error) {
-            printErrorJson("outpost.worktree_pruner.run", error, {
-                trigger,
-                dry_run: Boolean(options.dryRun),
-            });
-            process.exitCode = 1;
-        }
-    });
-    pruner
-        .command("install")
-        .description("Write the pressure and daily systemd user timers")
-        .option("--systemd-root <path>", "Systemd user unit directory")
-        .option("--enable", "Enable both timers after writing the units")
-        .action((options) => {
-        try {
-            const result = installOutpostPrunerTimers({
-                systemdRoot: systemdRoot(options.systemdRoot),
-                hqRoot: resolveLanesHqRoot(),
-                home: os.homedir(),
-                enable: Boolean(options.enable),
-                runCommand: options.enable ? runSystemctl : undefined,
-            });
-            printJson(result);
-        }
-        catch (error) {
-            printErrorJson("outpost.worktree_pruner.install", error);
-            process.exitCode = 1;
-        }
-    });
-    pruner
-        .command("uninstall")
-        .description("Disable and remove the pressure and daily systemd user timers")
-        .option("--systemd-root <path>", "Systemd user unit directory")
-        .option("--disable", "Disable both timers before removing their units")
-        .action((options) => {
-        try {
-            const result = uninstallOutpostPrunerTimers({
-                systemdRoot: systemdRoot(options.systemdRoot),
-                disable: Boolean(options.disable),
-                runCommand: options.disable ? runSystemctl : undefined,
-            });
-            printJson(result);
-        }
-        catch (error) {
-            printErrorJson("outpost.worktree_pruner.uninstall", error);
-            process.exitCode = 1;
-        }
-    });
-}
-//# sourceMappingURL=outpost-pruner.js.map

package/dist/commands/personal-connector-settings-flag.d.ts

@@ -1,4 +0,0 @@
-export declare const CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG = "cli.personal-connector-settings";
-/** Keep company-shared connector storage unchanged until the flag is explicitly enabled. */
-export declare function personalConnectorSettingsEnabled(): boolean;
-//# sourceMappingURL=personal-connector-settings-flag.d.ts.map

package/dist/commands/personal-connector-settings-flag.js

@@ -1,7 +0,0 @@
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
-export const CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG = "cli.personal-connector-settings";
-/** Keep company-shared connector storage unchanged until the flag is explicitly enabled. */
-export function personalConnectorSettingsEnabled() {
-    return resolveProcessFlagGate(CLI_PERSONAL_CONNECTOR_SETTINGS_FLAG, { fallback: false }, () => false);
-}
-//# sourceMappingURL=personal-connector-settings-flag.js.map

package/dist/commands/personal-targeted-push-flag.d.ts

@@ -1,4 +0,0 @@
-export declare const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
-/** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
-export declare function personalTargetedPushPathsEnabled(): boolean;
-//# sourceMappingURL=personal-targeted-push-flag.d.ts.map

package/dist/commands/personal-targeted-push-flag.js

@@ -1,7 +0,0 @@
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
-export const CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG = "cli.personal-targeted-push-paths";
-/** The established full-scope behavior remains in force until an explicit hq-flags enablement. */
-export function personalTargetedPushPathsEnabled() {
-    return resolveProcessFlagGate(CLI_PERSONAL_TARGETED_PUSH_PATHS_FLAG, { fallback: false }, () => false);
-}
-//# sourceMappingURL=personal-targeted-push-flag.js.map

package/dist/commands/personal-targeted-push-paths.d.ts

@@ -1,3 +0,0 @@
-/** Resolve explicit --personal paths against the same roots as a full personal push. */
-export declare function resolveExplicitPersonalPushPaths(hqRoot: string, requestedPaths: readonly string[], cwd?: string): string[];
-//# sourceMappingURL=personal-targeted-push-paths.d.ts.map

package/dist/commands/personal-targeted-push-paths.js

@@ -1,67 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { computePersonalVaultPaths, matchPersonalVaultExclusion, } from "@indigoai-us/hq-cloud";
-function isWithin(parent, candidate) {
-    const relative = path.relative(parent, candidate);
-    return relative === "" ||
-        (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
-}
-function rejectPath(input, reason) {
-    throw new Error(`--personal cannot push path "${input}": ${reason}`);
-}
-/** Resolve explicit --personal paths against the same roots as a full personal push. */
-export function resolveExplicitPersonalPushPaths(hqRoot, requestedPaths, cwd = process.cwd()) {
-    let realRoot;
-    try {
-        realRoot = fs.realpathSync.native(hqRoot);
-    }
-    catch (error) {
-        const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
-        throw new Error(`--personal cannot resolve HQ root "${hqRoot}" (${code})`);
-    }
-    const allowedRoots = computePersonalVaultPaths(realRoot)
-        .map((allowedPath) => {
-        try {
-            return fs.realpathSync.native(allowedPath);
-        }
-        catch (error) {
-            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
-            throw new Error(`--personal personal-vault scope changed at "${allowedPath}" (${code})`);
-        }
-    })
-        .filter((allowedPath) => isWithin(realRoot, allowedPath));
-    const resolved = [];
-    for (const input of requestedPaths) {
-        const normalizedInput = path.resolve(cwd, input);
-        let realPath;
-        try {
-            realPath = fs.realpathSync.native(normalizedInput);
-        }
-        catch (error) {
-            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
-            rejectPath(input, `path cannot be resolved (${code})`);
-        }
-        if (!isWithin(realRoot, realPath)) {
-            rejectPath(input, "resolved path escapes the HQ root");
-        }
-        let isDirectory;
-        try {
-            isDirectory = fs.statSync(realPath).isDirectory();
-        }
-        catch (error) {
-            const code = error instanceof Error && "code" in error ? String(error.code) : "unavailable";
-            rejectPath(input, `path cannot be inspected (${code})`);
-        }
-        const relativePath = path.relative(realRoot, realPath).split(path.sep).join("/");
-        const exclusion = matchPersonalVaultExclusion(relativePath, isDirectory);
-        if (exclusion) {
-            rejectPath(input, `excluded by personal-vault rule ${exclusion.id}`);
-        }
-        if (!allowedRoots.some((allowedRoot) => isWithin(allowedRoot, realPath))) {
-            rejectPath(input, "resolved path is outside the personal-vault paths");
-        }
-        resolved.push(realPath);
-    }
-    return resolved;
-}
-//# sourceMappingURL=personal-targeted-push-paths.js.map

package/dist/commands/report.d.ts

@@ -1,19 +0,0 @@
-import { Command } from "commander";
-import { deployOrgContext, type ChannelReport, type ReportPatch } from "../lib/report-publish.js";
-type ReportPatchInput = ReportPatch | ((current: ChannelReport) => ReportPatch);
-/** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
-export declare function resolveReport(token: string, reportId: string, requestedChannelId?: string): Promise<ChannelReport>;
-export declare function patchReport(token: string, report: ChannelReport, patch: ReportPatchInput): Promise<ChannelReport>;
-/**
- * Subdomains to try, in order. The first is the report's own slug; the rest
- * are used only when an app the caller cannot see already holds it (for
- * example, one left by an earlier publish under a different account).
- */
-export declare function candidateSlugs(slug: string, attempts?: number): string[];
-export declare function findOrCreateApp(token: string, slug: string, org: ReturnType<typeof deployOrgContext>): Promise<{
-    id: string;
-    subdomain: string;
-}>;
-export declare function registerReportCommand(program: Command): void;
-export {};
-//# sourceMappingURL=report.d.ts.map