@indigoai-us/hq-cli 5.345.105 → 5.345.106

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.345.106] — 2026-10-12
+- On Windows, `hq core` converts Git Bash paths for commands that declare path operands. Direct calls use the same path rules as the former script wrappers.
+- `hq logout` now ends your session on the HQ server as well as on this
+  device, so a copied token file stops working. If the server can't be
+  reached, logout still signs you out locally and says the old session will
+  expire on its own.
+
 ## [5.345.105] — 2026-10-12
 - Session-start health no longer files leftover company journals that this
   repair pass did not refresh, including older hooks that only read

package/dist/commands/logout.d.ts

@@ -1,6 +1,11 @@
 /**
- * hq logout — clears cached Cognito session
+ * hq logout — ends the Cognito session on the server, then clears the cached
+ * session on this device.
+ *
+ * The refresh token is revoked first so a copied token file stops working.
+ * Local tokens are always deleted, even when the server can't be reached.
  */
 import { Command } from 'commander';
+export declare const REVOKE_FAILED_MESSAGE = "Signed out on this device. Couldn't reach HQ to end the session everywhere; it will expire on its own.";
 export declare function registerLogoutCommand(program: Command): void;
 //# sourceMappingURL=logout.d.ts.map

package/dist/commands/logout.js

@@ -1,10 +1,17 @@
 /**
- * hq logout — clears cached Cognito session
+ * hq logout — ends the Cognito session on the server, then clears the cached
+ * session on this device.
+ *
+ * The refresh token is revoked first so a copied token file stops working.
+ * Local tokens are always deleted, even when the server can't be reached.
  */
 import chalk from 'chalk';
 import { clearCachedTokens, loadCachedTokens } from '@indigoai-us/hq-cloud';
 import { retainUsageAttributionForPerson } from '../lib/work-context/config.js';
 import { workContextRoot } from '../lib/work-context/paths.js';
+import { DEFAULT_COGNITO } from '../utils/cognito-config.js';
+import { revokeRefreshToken } from '../utils/cognito-revoke.js';
+export const REVOKE_FAILED_MESSAGE = "Signed out on this device. Couldn't reach HQ to end the session everywhere; it will expire on its own.";
 export function registerLogoutCommand(program) {
     program
         .command('logout')
@@ -26,8 +33,17 @@ export function registerLogoutCommand(program) {
                 console.log(chalk.yellow('No cached HQ session'));
                 return;
             }
+            // Machine-minted sessions carry no refresh token; nothing to revoke.
+            const revoked = existing.refreshToken
+                ? (await revokeRefreshToken(existing.refreshToken, DEFAULT_COGNITO)).ok
+                : true;
             clearCachedTokens();
-            console.log(chalk.green('Logged out successfully'));
+            if (revoked) {
+                console.log(chalk.green('Logged out successfully'));
+            }
+            else {
+                console.log(chalk.yellow(REVOKE_FAILED_MESSAGE));
+            }
         }
         catch (error) {
             console.error(chalk.red('Logout failed:'), error instanceof Error ? error.message : 'Unknown error');

package/dist/fast-scaffold.d.ts

@@ -49,6 +49,19 @@ export type FastScaffoldScript = {
     /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
     requiresNodeNetworkCompatibility?: boolean;
 };
+/**
+ * CLI core-command registry metadata for MSYS path operands. The exact rules
+ * were read from hq-core-staging core/scripts/cli-hosted.yaml and
+ * lib/forwarder.sh at d8c3e3f0f6f50db72b81970f7868f7beb4c88d0c.
+ * Kept in this already-loaded registry module so hook fast-route graphs stay
+ * unchanged.
+ */
+export type CorePathOperandRule = "all-nonoptions" | "first-nonoption" | `position:${number}` | `options:${string}` | `comma:${string}`;
+export declare const CORE_COMMAND_PATH_OPERANDS: Readonly<Record<string, CorePathOperandRule>>;
+/** True when argv names a command that declares path operands. */
+export declare function coreCommandHasPathOperands(argv: readonly string[]): boolean;
+/** Apply the manifest's operand rule to a copied process.argv vector. */
+export declare function normalizeCorePathOperands(argv: readonly string[], platform?: NodeJS.Platform, convertPath?: (value: string) => string): string[];
 /** Family kill switches whose owner-approved default is enabled. */
 export declare const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS: readonly ["core-native-session", "core-native-hook-helpers", "core-native-policy", "core-native-utilities", "core-native-jobs", "core-native-ontology", "core-native-handoff", "core-native-delegate"];
 export declare function isDefaultOnFastFamily(flagKey: string): boolean;

package/dist/fast-scaffold.js

@@ -9,6 +9,142 @@
  * on every turn's Stop. The entrypoint routes eligible commands before loading
  * the graph, and this module holds the parser + table that routing needs.
  */
+export const CORE_COMMAND_PATH_OPERANDS = {
+    "audit-log": "comma:--files",
+    "codex-skill-bridge": "options:--root,--old-root",
+    "git-pack-extension-check": "options:--root",
+    "job notify": "options:--hq-root,--log-path",
+    "hq-status-summary": "options:--porcelain-file,--session-files-file",
+    "ontology-readme-drift": "options:--root",
+    "policy age-report": "options:--dir",
+    "policy retire": "options:--dir,--report-dir",
+    "policy frontmatter": "all-nonoptions",
+    "qmd-reindex-after-sync": "first-nonoption",
+    "refresh-vault-access": "options:--root",
+    "resize-screenshot": "position:0",
+    "token-usage-report": "options:--project-dir",
+    worktree: "options:--source",
+};
+/** True when argv names a command that declares path operands. */
+export function coreCommandHasPathOperands(argv) {
+    if (argv[2] !== "core")
+        return false;
+    const coreArgs = argv.slice(3);
+    if (coreArgs.some((value, index) => (value === "--hq-root" && coreArgs[index + 1]?.startsWith("/")) ||
+        (value.startsWith("--hq-root=") && value.slice("--hq-root=".length).startsWith("/")))) {
+        return true;
+    }
+    let commandStart = 3;
+    if (argv[commandStart] === "--hq-root")
+        commandStart += 2;
+    else if (argv[commandStart]?.startsWith("--hq-root="))
+        commandStart += 1;
+    return Object.keys(CORE_COMMAND_PATH_OPERANDS).some((name) => name.split(" ").every((part, index) => argv[commandStart + index] === part));
+}
+/** Apply the manifest's operand rule to a copied process.argv vector. */
+export function normalizeCorePathOperands(argv, platform = process.platform, convertPath = (value) => value) {
+    const normalized = [...argv];
+    if (platform !== "win32" || normalized[2] !== "core")
+        return normalized;
+    let commandStart = 3;
+    if (normalized[commandStart] === "--hq-root") {
+        const root = normalized[commandStart + 1];
+        if (root?.startsWith("/"))
+            normalized[commandStart + 1] = convertPath(root);
+        commandStart += 2;
+    }
+    else if (normalized[commandStart]?.startsWith("--hq-root=")) {
+        const value = normalized[commandStart].slice("--hq-root=".length);
+        if (value.startsWith("/"))
+            normalized[commandStart] = `--hq-root=${convertPath(value)}`;
+        commandStart += 1;
+    }
+    // Commander accepts the core group's root override after the subcommand too.
+    // Fast parsing defers that form, but normalize it before either route sees argv.
+    for (let index = commandStart; index < normalized.length; index += 1) {
+        const value = normalized[index];
+        if (value === "--")
+            break;
+        if (value === "--hq-root") {
+            index += 1;
+            if (normalized[index]?.startsWith("/"))
+                normalized[index] = convertPath(normalized[index]);
+        }
+        else if (value.startsWith("--hq-root=")) {
+            const root = value.slice("--hq-root=".length);
+            if (root.startsWith("/"))
+                normalized[index] = `--hq-root=${convertPath(root)}`;
+        }
+    }
+    const commandName = Object.keys(CORE_COMMAND_PATH_OPERANDS)
+        .sort((left, right) => right.split(" ").length - left.split(" ").length)
+        .find((name) => name.split(" ").every((part, index) => normalized[commandStart + index] === part));
+    if (!commandName)
+        return normalized;
+    const argsStart = commandStart + commandName.split(" ").length;
+    const args = normalized.slice(argsStart);
+    const convert = (index) => {
+        const value = args[index];
+        if (value?.startsWith("/"))
+            args[index] = convertPath(value);
+    };
+    const rule = CORE_COMMAND_PATH_OPERANDS[commandName];
+    if (rule === "all-nonoptions") {
+        args.forEach((value, index) => { if (!value.startsWith("--"))
+            convert(index); });
+    }
+    else if (rule === "first-nonoption") {
+        const index = args.findIndex((value) => !value.startsWith("--"));
+        if (index >= 0)
+            convert(index);
+    }
+    else if (rule.startsWith("position:")) {
+        convert(Number(rule.slice("position:".length)));
+    }
+    else if (rule.startsWith("options:")) {
+        const options = new Set(rule.slice("options:".length).split(","));
+        for (let index = 0; index < args.length; index += 1) {
+            const value = args[index];
+            if (options.has(value)) {
+                index += 1;
+                if (index < args.length)
+                    convert(index);
+            }
+            else {
+                const equalsAt = value.indexOf("=");
+                if (equalsAt >= 0 && options.has(value.slice(0, equalsAt)) && value.slice(equalsAt + 1).startsWith("/")) {
+                    args[index] = `${value.slice(0, equalsAt + 1)}${convertPath(value.slice(equalsAt + 1))}`;
+                }
+            }
+        }
+    }
+    else if (rule.startsWith("comma:")) {
+        const option = rule.slice("comma:".length);
+        for (let index = 0; index < args.length; index += 1) {
+            if (args[index] === option && index + 1 < args.length) {
+                index += 1;
+                args[index] = convertCommaPaths(args[index]);
+                break;
+            }
+            const prefix = `${option}=`;
+            if (args[index].startsWith(prefix)) {
+                const value = args[index].slice(prefix.length);
+                if (value.startsWith("/")) {
+                    args[index] = `${prefix}${convertCommaPaths(value)}`;
+                }
+                break;
+            }
+        }
+    }
+    normalized.splice(argsStart, args.length, ...args);
+    return normalized;
+    function convertCommaPaths(value) {
+        const parts = value.split(",");
+        while (parts.at(-1) === "")
+            parts.pop();
+        return parts.map((part) => part.startsWith("/") ? convertPath(part) : part).join(",");
+    }
+}
 /** Family kill switches whose owner-approved default is enabled. */
 export const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS = [
     "core-native-session",

package/dist/index.js

@@ -6,13 +6,23 @@ import "./node-network-compat-fast.js";
 import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
 // Dependency-light: a pure parser + table, no command graph. Safe to load on
 // every path (including --version) without reintroducing the heavy startup.
-import { isCommandHelpRequest, isFastCoreRequest, parseFastCore, parseSecretsEnvFastRequest, } from "./fast-scaffold.js";
+import { isCommandHelpRequest, isFastCoreRequest, parseFastCore, coreCommandHasPathOperands, normalizeCorePathOperands, parseSecretsEnvFastRequest, } from "./fast-scaffold.js";
 import { CLI_COMMAND_HELP_CATALOG_FLAG } from "./lib/cli-flag-keys.js";
 // Also dependency-light: registers a process-level rejection boundary; its only
 // heavy import (main.js) is lazy and reached only when a rejection fires.
 import { installProcessRejectionBoundary } from "./unhandled-rejection-boundary.js";
 import { installFastPathStreamErrorHandlers } from "./utils/fast-stream-errors.js";
 import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+function cygpathMixedPath(value) {
+    // Require only a Node builtin: the package supports Node releases before
+    // require(ESM) became available, and this runs in the synchronous dispatcher.
+    const { spawnSync } = createRequire(import.meta.url)("node:child_process");
+    const result = spawnSync("cygpath", ["-m", value], { encoding: "utf8" });
+    if (result.error?.code === "ENOENT")
+        return value;
+    return String(result.stdout ?? "").replace(/\n+$/u, "");
+}
 // Install BEFORE any dispatch so a floated rejection on ANY path (the command
 // graph or the fast-core forwarder) becomes a non-zero exit. @sentry/node's
 // onUnhandledRejection integration defaults to 'warn' — it captures but does
@@ -134,6 +144,10 @@ async function runNativeFastRouteWithRecovery(parsed) {
     }
 }
 function dispatchCliEntry() {
+    if (process.platform === "win32" && coreCommandHasPathOperands(process.argv)) {
+        // Keep cygpath off non-Windows and non-path command routes.
+        process.argv = normalizeCorePathOperands(process.argv, "win32", cygpathMixedPath);
+    }
     const versionRequest = isVersionRequest(process.argv);
     const helpRequest = !versionRequest && isCommandHelpRequest(process.argv);
     const parsedFastCore = versionRequest || helpRequest ? null : parseFastCore(process.argv);

package/dist/utils/cognito-config.d.ts

@@ -0,0 +1,5 @@
+import type { CognitoAuthConfig } from "@indigoai-us/hq-cloud";
+/** Lightweight Cognito and Vault defaults shared by startup-safe modules. */
+export declare const DEFAULT_COGNITO: CognitoAuthConfig;
+export declare const DEFAULT_VAULT_API_URL: string;
+//# sourceMappingURL=cognito-config.d.ts.map

package/dist/utils/cognito-config.js

@@ -0,0 +1,14 @@
+/** Lightweight Cognito and Vault defaults shared by startup-safe modules. */
+export const DEFAULT_COGNITO = {
+    region: process.env.AWS_REGION ?? "us-east-1",
+    userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
+    clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
+    port: process.env.HQ_COGNITO_CALLBACK_PORT
+        ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
+        : 8765,
+    identityProvider: process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
+        ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
+        : "Google",
+};
+export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
+//# sourceMappingURL=cognito-config.js.map

package/dist/utils/cognito-revoke.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Server-side revocation of a Cognito refresh token.
+ *
+ * `hq logout` calls this before it deletes the local token file so that a
+ * copied token file stops working too. Cognito's `/oauth2/revoke` endpoint on
+ * the hosted domain (the same domain the CLI already uses for `/oauth2/token`)
+ * revokes the refresh token and every access/ID token issued from it. The CLI
+ * app client is public (no client secret), so the body carries only the token
+ * and the client id.
+ *
+ * This never throws and never includes the token in its result: callers get a
+ * plain outcome they can print.
+ */
+export interface CognitoRevokeConfig {
+    region: string;
+    userPoolDomain: string;
+    clientId: string;
+}
+export type RevokeOutcome = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "network" | "timeout" | "rejected";
+    status?: number;
+};
+/** Upper bound on the revoke request so logout never hangs on a dead network. */
+export declare const REVOKE_TIMEOUT_MS = 5000;
+export declare function cognitoRevokeEndpoint(config: CognitoRevokeConfig): string;
+export declare function revokeRefreshToken(refreshToken: string, config: CognitoRevokeConfig, opts?: {
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<RevokeOutcome>;
+//# sourceMappingURL=cognito-revoke.d.ts.map

package/dist/utils/cognito-revoke.js

@@ -0,0 +1,42 @@
+/**
+ * Server-side revocation of a Cognito refresh token.
+ *
+ * `hq logout` calls this before it deletes the local token file so that a
+ * copied token file stops working too. Cognito's `/oauth2/revoke` endpoint on
+ * the hosted domain (the same domain the CLI already uses for `/oauth2/token`)
+ * revokes the refresh token and every access/ID token issued from it. The CLI
+ * app client is public (no client secret), so the body carries only the token
+ * and the client id.
+ *
+ * This never throws and never includes the token in its result: callers get a
+ * plain outcome they can print.
+ */
+/** Upper bound on the revoke request so logout never hangs on a dead network. */
+export const REVOKE_TIMEOUT_MS = 5_000;
+export function cognitoRevokeEndpoint(config) {
+    return `https://${config.userPoolDomain}.auth.${config.region}.amazoncognito.com/oauth2/revoke`;
+}
+export async function revokeRefreshToken(refreshToken, config, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const body = new URLSearchParams({ token: refreshToken, client_id: config.clientId });
+    try {
+        const response = await fetchImpl(cognitoRevokeEndpoint(config), {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? REVOKE_TIMEOUT_MS),
+        });
+        // Drain the body so the socket is released; its content is not needed.
+        await response.text().catch(() => undefined);
+        if (response.ok)
+            return { ok: true };
+        return { ok: false, reason: "rejected", status: response.status };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : "";
+        if (name === "TimeoutError" || name === "AbortError")
+            return { ok: false, reason: "timeout" };
+        return { ok: false, reason: "network" };
+    }
+}
+//# sourceMappingURL=cognito-revoke.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.105",
+  "version": "5.345.106",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {