@indigoai-us/hq-cli 5.345.133 → 5.345.134

package/CHANGELOG.md

@@ -2,13 +2,20 @@
 
 ## [Unreleased]
 
+## [5.345.134] — 2026-10-15
+- `hq access --as <member>` now honors the most specific ACL row covering a path, so an empty folder lock reports no access instead of the write access of a broader grant. `hq access` also reports "no access" rather than "never created" when a caller cannot list a path that an ACL lock denies them.
+
 ## [5.345.133] — 2026-10-15
+- Pipeline loop lanes no longer hang after their first phase. 5.345.132 kept the lane running while its next phase resumed, which left the previous phase's watcher holding the lane, so the next phase's result was never recorded. That change is reverted; a loop lane may again show as done for a few seconds while its next phase starts.
+
+## [5.345.132] — 2026-10-14
+- A loop lane starting its next phase now stays running in `hq lanes status` and `hq lanes list` while the phase resumes, instead of showing done for several seconds.
+- Recognize Git Bash on Git for Windows 2.56+, which reports `MSYSTEM=UCRT64` instead of `MINGW64`, so delegate jq calls keep their byte-exact output and journal titles with newlines get a valid file name on Windows.
+
+## [5.345.131] — 2026-10-14
 - `hq lanes --account auto` and `hq capacity route` no longer refuse every signed-in account when the capacity collector is off or its readings are stale; those accounts are picked with unknown usage, below accounts with fresh headroom.
 - `hq lanes create` now resumes an earlier worker session only when the project, model, and effort match, and otherwise starts a fresh thread.
-- A loop lane starting its next phase now stays running in `hq lanes status` and `hq lanes list` while the phase resumes, instead of showing done for several seconds.
 - A loop lane waiting for its next phase now shows as running in `hq lanes status` and `hq lanes list`, and becomes done only after it is stopped.
-- Recognize Git Bash on Git for Windows 2.56+, which reports `MSYSTEM=UCRT64` instead of `MINGW64`, so delegate jq calls keep their byte-exact output and journal titles with newlines get a valid file name on Windows.
-- Pipeline loop lanes no longer hang after their first phase. 5.345.132 kept the lane running while its next phase resumed, which left the previous phase's watcher holding the lane, so the next phase's result was never recorded. That change is reverted; a loop lane may again show as done for a few seconds while its next phase starts.
 
 ## [5.345.130] — 2026-10-14
 - Add native TypeScript `hq core workflow run` orchestration with the bundled runner as its flag-off fallback.

package/dist/commands/access.d.ts

@@ -48,6 +48,8 @@ export interface AccessAclTree {
         updatedAt: string;
     } | null;
     effectivePermission: string | null;
+    /** Most-specific ACL row covering this prefix, including empty lock rows. */
+    coveringAclPath?: string | null;
 }
 export interface AccessMember {
     personUid: string;

package/dist/commands/access.js

@@ -91,6 +91,27 @@ function fileGrantCoversPath(grantPath, targetPath) {
     return classifyAclSource(targetPath, [grantPath]) !== "role-bypass";
 }
 const FILE_PERMISSION_RANK = { read: 1, write: 2, admin: 3 };
+function aclPatternSpecificity(pattern) {
+    if (pattern === "*" || pattern === "")
+        return [0, 0];
+    const glob = pattern.endsWith("/*");
+    const body = glob ? pattern.slice(0, -2) : pattern;
+    const segs = body.split("/").filter(Boolean).length;
+    return [segs, glob ? 0 : 1];
+}
+function pickMostSpecificCoveringRow(rows, targetPath, company) {
+    const covering = rows.filter((row) => fileGrantCoversPath(toBucketRelative(row.path, company), targetPath));
+    if (covering.length === 0)
+        return null;
+    covering.sort((a, b) => {
+        const [aSegs, aExact] = aclPatternSpecificity(toBucketRelative(a.path, company));
+        const [bSegs, bExact] = aclPatternSpecificity(toBucketRelative(b.path, company));
+        if (aSegs !== bSegs)
+            return bSegs - aSegs;
+        return bExact - aExact;
+    });
+    return covering[0] ?? null;
+}
 function httpStatusOf(err) {
     if (!err || typeof err !== "object")
         return undefined;
@@ -146,10 +167,13 @@ function treeIsEmpty(tree) {
 function aclDenied(tree) {
     if (!tree)
         return false;
+    const perm = tree.effectivePermission;
+    const denied = perm === null || perm === "none" || perm === "deny";
+    if (tree.coveringAclPath && denied)
+        return true;
     if (treeIsEmpty(tree))
         return false;
-    const perm = tree.effectivePermission;
-    return perm === null || perm === "none" || perm === "deny";
+    return denied;
 }
 /**
  * Build the result and record one cause-mix telemetry line. Every exit path
@@ -289,6 +313,18 @@ export async function runAccess(input) {
             }
             else if (fuzzy.length === 0) {
                 steps.push("list: 0 hits");
+                const tree = await deps.fetchAclTree(relative);
+                if (aclDenied(tree)) {
+                    steps.push("acl: deny");
+                    const result = finish("no-access", {
+                        path: anchored(relative) || input.target,
+                        company: slug,
+                        exists: true,
+                        steps,
+                    }, finishCtx);
+                    emit(input, result, log);
+                    return result;
+                }
                 const result = finish("never-existed", {
                     path: anchored(relative) || input.target,
                     company: slug,
@@ -632,7 +668,7 @@ async function promptPick(candidates) {
 function treeFromBody(body) {
     if (!body)
         return null;
-    if (treeIsEmpty(body))
+    if (treeIsEmpty(body) && !body.coveringAclPath)
         return null;
     return body;
 }
@@ -730,12 +766,25 @@ export async function runAccessForPerson(rawPath, personUid, opts) {
     }
     const roleBypass = projection.files.roleBypass === true;
     const grants = Array.isArray(projection.files.grants) ? projection.files.grants : [];
-    const matchingPermissions = grants
-        .filter((grant) => typeof grant.path === "string" && typeof grant.permission === "string" &&
-        grant.permission in FILE_PERMISSION_RANK &&
-        fileGrantCoversPath(toBucketRelative(grant.path, company), relativePath))
-        .map((grant) => grant.permission);
-    const permission = roleBypass ? "admin" : matchingPermissions.reduce((best, candidate) => best === null || FILE_PERMISSION_RANK[candidate] > FILE_PERMISSION_RANK[best] ? candidate : best, null);
+    const locks = Array.isArray(projection.files.locks) ? projection.files.locks : [];
+    const coveringRows = [];
+    for (const grant of grants) {
+        if (typeof grant.path === "string" &&
+            typeof grant.permission === "string" &&
+            grant.permission in FILE_PERMISSION_RANK) {
+            coveringRows.push({
+                path: grant.path,
+                permission: grant.permission,
+            });
+        }
+    }
+    for (const lock of locks) {
+        if (typeof lock.path === "string") {
+            coveringRows.push({ path: lock.path, permission: null });
+        }
+    }
+    const winner = pickMostSpecificCoveringRow(coveringRows, relativePath, company);
+    const permission = roleBypass ? "admin" : (winner?.permission ?? null);
     return {
         personUid: uid,
         company,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.133",
+  "version": "5.345.134",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {