@indigoai-us/hq-cli 5.345.134 → 5.345.136

package/dist/commands/core-checkpoint-native.js

@@ -8,11 +8,12 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { execFileSync, spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { toHqStateWriteError } from "../utils/hq-state-write-error.js";
 import { checkpointStampWriteErrorFor, isCheckpointStampWriteError, } from "../utils/checkpoint-stamp-write-error.js";
+import { isExecutableOnPath } from "../utils/resolve-executable.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 const DEFAULT_TRIGGER = "stop-gate";
 const BACKENDS = new Set(["auto", "claude", "codex", "grok", "none"]);
@@ -73,6 +74,14 @@ const BACKEND_SETTING = "HQ_CHECKPOINT_BACKEND";
 export const CRASHED_RUN_MAX_AGE_MS = 6 * 60 * 60 * 1000;
 /** A backend that cannot answer `--version` this fast is treated as broken. */
 const BACKEND_PROBE_TIMEOUT_MS = 10_000;
+/**
+ * After `--backend auto` finds no allowed backend, later checkpoints skip the
+ * PATH scan and `--version` probes for this long, unless PATH changes. Each
+ * probe is a child process, and on Windows each one could open a console
+ * window; a Stop hook that checkpoints every turn re-ran them every minute or
+ * two, all day, to reach the same answer (feedback_351a40d5).
+ */
+export const NO_BACKEND_RETRY_MS = 6 * 60 * 60 * 1000;
 /** A sibling still holding the lock after this long is treated as abandoned. */
 const SIBLING_LOCK_TTL_MS = 60 * 60 * 1000;
 /**
@@ -392,6 +401,7 @@ function readGitState(repoDir) {
         const read = (args) => execFileSync("git", ["-C", repoDir, ...args], {
             encoding: "utf8",
             stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
         }).trim();
         if (read(["rev-parse", "--is-inside-work-tree"]) !== "true")
             return null;
@@ -415,7 +425,7 @@ function readGitState(repoDir) {
 }
 function commitsSince(repoDir, initialCommit) {
     try {
-        const output = execFileSync("git", ["-C", repoDir, "log", "--no-decorate", "--pretty=format:%h: %s", `${initialCommit}..HEAD`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        const output = execFileSync("git", ["-C", repoDir, "log", "--no-decorate", "--pretty=format:%h: %s", `${initialCommit}..HEAD`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim();
         return output ? output.split("\n") : [];
     }
     catch {
@@ -590,17 +600,8 @@ function backendOnPath(name) {
     const pathValue = process.env.PATH;
     if (!pathValue)
         return false;
-    return pathValue.split(path.delimiter).some((directory) => {
-        if (!directory)
-            return false;
-        try {
-            fs.accessSync(path.join(directory, name), fs.constants.X_OK);
-            return true;
-        }
-        catch {
-            return false;
-        }
-    });
+    // PATHEXT-aware on Windows, where the binary is claude.exe, not claude.
+    return isExecutableOnPath(name, pathValue);
 }
 /**
  * An installed binary is not necessarily a working one: a partial install, a
@@ -613,6 +614,7 @@ function backendResponds(name) {
         execFileSync(name, ["--version"], {
             timeout: BACKEND_PROBE_TIMEOUT_MS,
             stdio: "ignore",
+            windowsHide: true,
         });
         return true;
     }
@@ -835,7 +837,43 @@ function backendSetting(liveRoot) {
     const lookup = settingsEnvValue(liveRoot, BACKEND_SETTING);
     return lookup.kind === "value" ? lookup.value.trim().toLowerCase() || undefined : undefined;
 }
-async function resolveBackend(requested, liveRoot, company) {
+function noBackendMarkerPath(liveRoot) {
+    return path.join(liveRoot, "workspace", "orchestrator", "hook-state", "checkpoint-no-backend.json");
+}
+function pathFingerprint() {
+    return createHash("sha256").update(process.env.PATH ?? "").digest("hex").slice(0, 16);
+}
+/** True while a recent "no allowed backend" result still holds for this PATH. */
+export function noBackendRecentlyFound(liveRoot, now = Date.now()) {
+    try {
+        const marker = JSON.parse(fs.readFileSync(noBackendMarkerPath(liveRoot), "utf8"));
+        if (typeof marker.at !== "number" || marker.path !== pathFingerprint())
+            return false;
+        return now - marker.at >= 0 && now - marker.at < NO_BACKEND_RETRY_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function recordNoBackend(liveRoot, now = Date.now()) {
+    try {
+        const marker = noBackendMarkerPath(liveRoot);
+        fs.mkdirSync(path.dirname(marker), { recursive: true });
+        fs.writeFileSync(marker, `${JSON.stringify({ at: now, path: pathFingerprint() })}\n`);
+    }
+    catch {
+        // Best effort: without the marker the next checkpoint probes again.
+    }
+}
+function clearNoBackend(liveRoot) {
+    try {
+        fs.rmSync(noBackendMarkerPath(liveRoot), { force: true });
+    }
+    catch {
+        // Best effort.
+    }
+}
+async function resolveBackend(requested, liveRoot, company, options = {}) {
     let value = assertKnownBackend(requested);
     if (value === "auto") {
         const setting = backendSetting(liveRoot);
@@ -849,12 +887,19 @@ async function resolveBackend(requested, liveRoot, company) {
     // An explicitly named backend is honoured as given; only `auto` shops around.
     if (value !== "auto")
         return value;
+    // A recent identical miss: skip the probes rather than spawn them again.
+    if (noBackendRecentlyFound(liveRoot))
+        return "none";
     const available = autoBackendPreference(await companyPrefersGrok(liveRoot, company)).filter((name) => backendOnPath(name) && backendResponds(name));
     if (available.length === 0) {
         printError("checkpoint: sibling skipped: no allowed backend available (claude, grok); " +
             `codex runs only with --backend codex or ${BACKEND_SETTING}=codex`);
+        if (!options.dryRun)
+            recordNoBackend(liveRoot);
         return "none";
     }
+    if (!options.dryRun)
+        clearNoBackend(liveRoot);
     const crashed = crashedBackends(path.join(liveRoot, "workspace", "checkpoints", "sibling"));
     // If every candidate failed last time, still try the preferred one: a stale
     // failure is a weaker signal than running no maintenance sibling at all.
@@ -1255,7 +1300,7 @@ async function runCheckpoint(options, command, group, preResolvedHqRoot) {
     const siblingOptOut = options.agent === false || !siblingEnabledBySetting(liveRoot);
     // Validated even when nothing will spawn, so `--backend bogus` is still an error.
     const requestedBackend = assertKnownBackend(options.backend);
-    const backend = siblingOptOut ? "none" : await resolveBackend(requestedBackend, liveRoot, input.company);
+    const backend = siblingOptOut ? "none" : await resolveBackend(requestedBackend, liveRoot, input.company, { dryRun: options.dryRun });
     const now = new Date();
     const threadId = `T-${formatTimestamp(now)}-auto-${summarySlug(input.summary)}`;
     const threadPath = path.join(liveRoot, "workspace", "threads", `${threadId}.json`);

package/dist/commands/core-handoff.d.ts

@@ -13,6 +13,8 @@ type HandoffContext = {
     now?: () => Date;
     /** Test-only override for the finalizer's historical fixed /tmp paths. */
     tmpDir?: string;
+    /** Builds the HQ-Fingerprint commit trailer value. Defaults to the offline builder. */
+    buildFingerprint?: (root: string) => string | null;
 };
 export declare function runHandoffFinalize(args: string[], context: HandoffContext): RunResult;
 export declare function runHandoffPost(args: string[], context: HandoffContext): RunResult | Promise<RunResult>;

package/dist/commands/core-handoff.js

@@ -14,6 +14,7 @@ import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
+import { fingerprintTrailerArgs, offlineFingerprint } from "../lib/fingerprint/offline.js";
 import { compactJson, isRecord, jqTruthy, prettyJson, runHandoffOpenSteps, shellDate, } from "./core-handoff-open-steps.js";
 export { runHandoffOpenSteps };
 const ASSETS = {
@@ -585,7 +586,8 @@ export function runHandoffFinalize(args, context) {
         if (probe.hasGit && staged > 0) {
             const pending = git(["diff", "--cached", "--name-only"], root).stdout.split(/\r?\n/).filter(Boolean);
             if (pending.length > 0) {
-                const committed = git(["commit", "-m", `checkpoint: handoff ${threadId}`], root);
+                const fingerprint = (context.buildFingerprint ?? ((hqRoot) => offlineFingerprint(hqRoot, process.env, "hq handoff", { readOnly: true })))(root);
+                const committed = git(["commit", "-m", `checkpoint: handoff ${threadId}`, ...fingerprintTrailerArgs(fingerprint)], root);
                 if (committed.code === 0) {
                     hqCommitted = true;
                     commitStatus = "committed";

package/dist/commands/core-pipeline-workflow-runner-native.js

@@ -340,18 +340,20 @@ function readSessionCompanySlugs(sid) {
     return [...new Set(slugs)];
 }
 function parentSessionId() {
-    return String(process.env.HQ_PARENT_SESSION_ID
-        || process.env.HQ_SESSION_ID
+    const own = process.env.HQ_SESSION_ID
         || process.env.CLAUDE_CODE_SESSION_ID
         || process.env.CLAUDE_SESSION_ID
         || process.env.CODEX_SESSION_ID
-        || process.env.CODEX_THREAD_ID
-        || '').replace(/\s+/g, '');
+        || process.env.CODEX_THREAD_ID;
+    // Inside a lane worker HQ_PARENT_SESSION_ID names the session that started
+    // the worker; the worker's own session is the parent of what it spawns.
+    const laneWorker = Boolean(process.env.HQ_LANE_ID?.trim()) && Boolean(own?.trim());
+    return String((laneWorker ? own : process.env.HQ_PARENT_SESSION_ID || own) || '').replace(/\s+/g, '');
 }
 function engineChildEnv() {
     const extra = {};
     const parent = parentSessionId();
-    if (!process.env.HQ_PARENT_SESSION_ID && parent)
+    if (parent && parent !== process.env.HQ_PARENT_SESSION_ID)
         extra.HQ_PARENT_SESSION_ID = parent;
     if (!process.env.HQ_SPAWN_COMPANY) {
         const capability = readSessionCompanyCapability(parent);

package/dist/commands/daemon.js

@@ -112,7 +112,9 @@ async function loadDefaults(over) {
         err: over.err ?? ((l) => console.error(l)),
         run,
         nodeBinary: over.nodeBinary ?? mesh.resolveAbsoluteNodeBinary(),
-        hqBinary: over.hqBinary ?? mesh.resolveHqBinary(),
+        // `node <hqBinary>` runs the task and every child service, so on Windows
+        // this must be the package's JS entry rather than the npm hq.cmd shim.
+        hqBinary: over.hqBinary ?? mesh.nodeRunnableHqEntry(mesh.resolveHqBinary(), platform),
         uid: over.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0),
         isRoot: over.isRoot ?? (typeof process.getuid === "function" && process.getuid() === 0),
         fileExists: over.fileExists ?? fs.existsSync,

package/dist/commands/fingerprint.d.ts

@@ -0,0 +1,10 @@
+import { Command } from "commander";
+/**
+ * The HQ root for `self`: HQ_ROOT, else the nearest ancestor of `cwd` (itself
+ * included) that holds `.claude` or `workers` and core/core.yaml. Null when
+ * there is none. Unlike findHqRoot it never falls back to `cwd`, so a commit
+ * in an unrelated repo does not create `.hq/` or session files there.
+ */
+export declare function findSelfHqRoot(env?: NodeJS.ProcessEnv, cwd?: string, existsSync?: (candidate: string) => boolean): string | null;
+export declare function registerFingerprintCommand(program: Command): void;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/commands/fingerprint.js

@@ -0,0 +1,191 @@
+/**
+ * hq fingerprint - print or resolve HQ session fingerprints.
+ *
+ *   hq fingerprint self [--json] [--offline] [--no-register]
+ *   hq fingerprint <value> [--json]
+ *
+ * `self` records the fingerprint with the hq-pro registry once per session
+ * after printing it (skipped with --no-register, --offline, and
+ * HQ_FINGERPRINT_OFFLINE=1). `<value>` checks local session records first and
+ * asks the registry only when none matches.
+ *
+ * Exit codes for `hq fingerprint <value>`: 0 found, 1 no fingerprint record,
+ * 2 not an HQ fingerprint. `self` exits 0 whether or not a value is built or
+ * registered.
+ *
+ * Outside an HQ tree (no HQ_ROOT and no ancestor with `.claude` or `workers`
+ * plus core/core.yaml) `self` prints a fingerprint with machine `-`, writes
+ * nothing, skips registration, and reports `reason: "no HQ root"` in --json.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { isFingerprint } from "../lib/fingerprint/format.js";
+import { resolveLocalFingerprint } from "../lib/fingerprint/resolve-local.js";
+import { buildSelfFingerprint, registerSelfFingerprint } from "../lib/fingerprint/self.js";
+import { findHqRoot } from "../utils/manifest.js";
+function hqRootFromEnv() {
+    return process.env.HQ_ROOT || findHqRoot();
+}
+/**
+ * The HQ root for `self`: HQ_ROOT, else the nearest ancestor of `cwd` (itself
+ * included) that holds `.claude` or `workers` and core/core.yaml. Null when
+ * there is none. Unlike findHqRoot it never falls back to `cwd`, so a commit
+ * in an unrelated repo does not create `.hq/` or session files there.
+ */
+export function findSelfHqRoot(env = process.env, cwd = process.cwd(), existsSync = fs.existsSync) {
+    const fromEnv = env.HQ_ROOT?.trim();
+    if (fromEnv)
+        return fromEnv;
+    let dir = path.resolve(cwd);
+    while (true) {
+        const marked = existsSync(path.join(dir, ".claude")) || existsSync(path.join(dir, "workers"));
+        if (marked && existsSync(path.join(dir, "core", "core.yaml")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+async function loadIdToken() {
+    const { loadCachedTokens } = await import("../utils/cognito-session.js");
+    return loadCachedTokens()?.idToken ?? null;
+}
+/** Asks the registry about a fingerprint with no local record. Never throws. */
+async function lookupRegistry(value) {
+    // Loaded here so a local hit never loads the registry client.
+    const registry = await import("../lib/fingerprint/registry-client.js");
+    let token;
+    try {
+        token = await loadIdToken();
+    }
+    catch (err) {
+        registry.appendFingerprintLog("lookup", `failed: could not read the cached token: ${err.name}`);
+        return null;
+    }
+    if (!token)
+        return null;
+    const result = await registry.lookupFingerprint(value, token);
+    if (!result.ok) {
+        registry.appendFingerprintLog("lookup", `failed: ${registry.describeFailure(result)} fingerprint=${value}`);
+        return null;
+    }
+    return result.found ? result.record : null;
+}
+export function registerFingerprintCommand(program) {
+    const fingerprint = program
+        .command("fingerprint")
+        .description("Print this session's HQ fingerprint, or resolve a fingerprint to its session")
+        .argument("[value]", "fingerprint value to resolve (hqfp1:...)")
+        .option("--json", "output JSON")
+        .action(async (value, opts) => {
+        if (!value) {
+            fingerprint.help();
+            return;
+        }
+        if (!isFingerprint(value)) {
+            process.stderr.write("not an HQ fingerprint\n");
+            process.exitCode = 2;
+            return;
+        }
+        const record = resolveLocalFingerprint(hqRootFromEnv(), value);
+        if (record) {
+            if (opts.json) {
+                process.stdout.write(`${JSON.stringify({ ...record, found: true })}\n`);
+                return;
+            }
+            const lines = [
+                `fingerprint: ${record.fingerprint}`,
+                `identity:    ${record.identityUid ?? "-"} (${record.identityKind ?? "unknown"})`,
+                `machine:     ${record.machineId ?? "-"} (${record.hostKind ?? "unknown"})`,
+                `session:     ${record.sessionId ?? "-"}`,
+                `company:     ${record.company ?? "-"}`,
+                `source:      ${record.source}`,
+            ];
+            process.stdout.write(`${lines.join("\n")}\n`);
+            return;
+        }
+        let remote = null;
+        try {
+            remote = await lookupRegistry(value);
+        }
+        catch (err) {
+            // lookupRegistry already turns request failures into null; this is a
+            // failure to load the client itself.
+            process.stderr.write(`hq fingerprint: registry lookup failed: ${err.message}\n`);
+        }
+        if (!remote) {
+            if (opts.json) {
+                process.stdout.write(`${JSON.stringify({ fingerprint: value, found: false })}\n`);
+            }
+            process.stderr.write("no fingerprint record\n");
+            process.exitCode = 1;
+            return;
+        }
+        if (opts.json) {
+            process.stdout.write(`${JSON.stringify({
+                fingerprint: value,
+                ...remote,
+                source: "registry",
+                label: remote.machineLabel,
+                firstSeenAt: remote.firstSeenAt,
+                found: true,
+            })}\n`);
+            return;
+        }
+        const identityName = remote.identityName ? `${remote.identityName} ` : "";
+        const machineLabel = remote.machineLabel ? `${remote.machineLabel} ` : "";
+        const lines = [
+            `fingerprint: ${value}`,
+            `identity:    ${identityName}(${remote.identityUid}, ${remote.identityKind})`,
+            `machine:     ${machineLabel}(${remote.hostKind})`,
+            `session:     ${remote.sessionId}`,
+            `company:     ${remote.companySlug}`,
+            `first seen:  ${remote.firstSeenAt}`,
+            `source:      registry`,
+        ];
+        process.stdout.write(`${lines.join("\n")}\n`);
+    });
+    fingerprint
+        .command("self")
+        .description("Print the fingerprint for the current HQ session")
+        .option("--json", "output JSON")
+        .option("--offline", "never make a network call (identity lookup or registration)")
+        .option("--no-register", "do not record this fingerprint with the HQ registry")
+        .action(async (_opts, cmd) => {
+        // The parent also defines --json and commander hands it to the parent,
+        // so read the merged options.
+        const opts = cmd.optsWithGlobals();
+        const offline = opts.offline === true || process.env.HQ_FINGERPRINT_OFFLINE === "1";
+        const foundRoot = findSelfHqRoot();
+        const noRoot = foundRoot === null;
+        const hqRoot = foundRoot ?? process.cwd();
+        // The commit-msg hook calls this on every commit, so it never throws
+        // and always exits 0.
+        let result;
+        let built = null;
+        try {
+            built = await buildSelfFingerprint({ hqRoot, offline, noRoot });
+            result = built;
+        }
+        catch (err) {
+            process.stderr.write(`hq fingerprint: ${err.message}\n`);
+            result = { fingerprint: null, reason: `could not build fingerprint: ${err.message}` };
+        }
+        if (opts.json) {
+            process.stdout.write(`${JSON.stringify(result)}\n`);
+        }
+        else if (result.fingerprint) {
+            process.stdout.write(`${result.fingerprint}\n`);
+        }
+        else {
+            process.stdout.write(`no fingerprint: ${result.reason ?? "unknown"}\n`);
+        }
+        // Registration runs after the output is written and reports only to
+        // ~/.hq/fingerprint.log; registerSelfFingerprint does not throw.
+        if (built?.fingerprint && !noRoot) {
+            await registerSelfFingerprint(built, { hqRoot, offline, register: opts.register !== false });
+        }
+    });
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/commands/integrations-core.d.ts

@@ -224,6 +224,28 @@ export declare function toolPrefixForProvider(provider: string): string;
  * projection over it.
  */
 export declare function fetchAdminSurface(token: string, companyUid: string): Promise<AdminSurface>;
+/** One page of the company's integration audit feed. */
+export interface AuditPage {
+    /**
+     * True when the server answered the paged audit view. False means an older
+     * server ignored `view=audit` and returned the full admin surface, whose
+     * audit feed is capped at the latest 50 events and has no cursor.
+     */
+    paged: boolean;
+    audit: AdminAuditEvent[];
+    nextCursor?: string;
+}
+/** Most rows the paged audit view returns per request. */
+export declare const AUDIT_PAGE_MAX = 100;
+/**
+ * Read one page of the audit feed via the admin route's paged view
+ * (`view=audit&limit=&cursor=`), newest first. Falls back to the surface's
+ * capped feed when the server does not know the view.
+ */
+export declare function fetchAuditPage(token: string, companyUid: string, opts: {
+    limit: number;
+    cursor?: string;
+}): Promise<AuditPage>;
 export declare function fetchConnections(token: string, companyUid: string): Promise<AdminConnection[]>;
 /**
  * One app the caller can use right now through the HQ gateway. Field names

package/dist/commands/integrations-core.js

@@ -352,6 +352,31 @@ export async function fetchAdminSurface(token, companyUid) {
         audit: data.audit ?? [],
     };
 }
+/** Most rows the paged audit view returns per request. */
+export const AUDIT_PAGE_MAX = 100;
+/**
+ * Read one page of the audit feed via the admin route's paged view
+ * (`view=audit&limit=&cursor=`), newest first. Falls back to the surface's
+ * capped feed when the server does not know the view.
+ */
+export async function fetchAuditPage(token, companyUid, opts) {
+    const limit = Math.max(1, Math.min(AUDIT_PAGE_MAX, Math.floor(opts.limit)));
+    const query = { companyUid, view: "audit", limit: String(limit) };
+    if (opts.cursor)
+        query.cursor = opts.cursor;
+    const res = await vaultApiFetch({ token, path: "/v1/integrations/admin", query });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to read integration activity");
+    const data = (await res.json());
+    const audit = Array.isArray(data.audit) ? data.audit : [];
+    if (data.view !== "audit")
+        return { paged: false, audit };
+    return {
+        paged: true,
+        audit,
+        ...(typeof data.nextCursor === "string" && data.nextCursor ? { nextCursor: data.nextCursor } : {}),
+    };
+}
 export async function fetchConnections(token, companyUid) {
     return (await fetchAdminSurface(token, companyUid)).connections;
 }

package/dist/commands/integrations-manage.d.ts

@@ -13,7 +13,7 @@
  *           and layered under the connection's write policy.
  */
 import { Command } from "commander";
-import { type GranteeType, type Permission, type WriteAllowlistGrant } from "./integrations-core.js";
+import { type AdminAuditEvent, type GranteeType, type Permission, type WriteAllowlistGrant } from "./integrations-core.js";
 interface Principal {
     granteeType: GranteeType;
     granteeId?: string;
@@ -46,5 +46,28 @@ export declare function mergeGrant(current: WriteAllowlistGrant[], toolName: str
  * dropped entirely rather than persisted as an empty rule.
  */
 export declare function removeGrant(current: WriteAllowlistGrant[], toolName: string, principal: Principal): WriteAllowlistGrant[] | null;
+/** Upper bound on audit pages one `hq integrations audit` run reads. */
+export declare const AUDIT_MAX_PAGES = 200;
+export interface CollectedAudit {
+    rows: AdminAuditEvent[];
+    /** False when the server only returned its capped surface feed. */
+    paged: boolean;
+    /** Rows in the surface feed (fallback path only), before filtering. */
+    feedSize: number;
+    /** More matching rows may exist past what was collected. */
+    more: boolean;
+    pageCapHit: boolean;
+}
+/**
+ * Page the audit feed (newest first) until `limit` rows match, the cursor runs
+ * out, a row is older than `sinceMs`, or AUDIT_MAX_PAGES pages were read.
+ * `provider` is matched client-side on the bare slug, so the qualified
+ * `factory:linear` form copied from JSON output matches bare stored rows.
+ */
+export declare function collectAuditRows(token: string, companyUid: string, opts: {
+    limit: number;
+    provider?: string;
+    sinceMs?: number;
+}): Promise<CollectedAudit>;
 export {};
 //# sourceMappingURL=integrations-manage.d.ts.map

package/dist/commands/integrations-manage.js

@@ -17,7 +17,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
 import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
 const PERMISSIONS = ["read", "write", "admin"];
@@ -520,30 +520,36 @@ export function registerManageCommands(integrations) {
         .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--provider <slug>", "Only this app")
         .option("--limit <n>", "How many events to show", "20")
+        .option("--since <iso>", "Only events at or after this ISO timestamp, e.g. 2026-10-01T00:00:00Z")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken();
-        const companyUid = await getCompanyUid(token, opts.company);
-        const surface = await fetchAdminSurface(token, companyUid);
         const limit = Number(opts.limit);
         if (!Number.isFinite(limit) || limit < 1) {
             throw new IntegrationsCliError("--limit must be a positive number.", { expected: true });
         }
-        // Normalize BOTH sides: `--provider` is routinely copied from JSON
-        // output, which carries the qualified `factory:linear` form, while every
-        // audit row is stored bare. Comparing them raw silently reports "no
-        // activity" for an app that has plenty.
-        const want = opts.provider ? bareProvider(opts.provider.trim()).toLowerCase() : undefined;
-        const rows = surface.audit
-            .filter((row) => !want || bareProvider(row.provider ?? "").toLowerCase() === want)
-            .slice(0, limit);
+        let sinceMs;
+        if (opts.since !== undefined) {
+            sinceMs = Date.parse(opts.since);
+            if (Number.isNaN(sinceMs)) {
+                throw new IntegrationsCliError("--since must be an ISO timestamp, e.g. 2026-10-01T00:00:00Z.", { expected: true });
+            }
+        }
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const result = await collectAuditRows(token, companyUid, {
+            limit: Math.floor(limit),
+            provider: opts.provider,
+            sinceMs,
+        });
+        const { rows } = result;
         if (opts.json) {
             printJson(rows);
+            if (result.pageCapHit)
+                console.error(auditPageCapNote());
             return;
         }
         if (rows.length === 0) {
             console.log("No recorded activity yet.");
-            return;
         }
         for (const row of rows) {
             const who = row.memberOrAgentName ?? row.memberOrAgent;
@@ -551,10 +557,21 @@ export function registerManageCommands(integrations) {
             if (row.reason)
                 console.log(chalk.dim(`    ${redactUrlsInText(row.reason)}`));
         }
-        // hq-pro caps its own feed at 50 events; say so rather than letting a
-        // truncated list read as "that is everything that ever happened".
-        if (surface.audit.length > rows.length) {
-            console.log(chalk.dim(`\nShowing ${rows.length} of ${surface.audit.length} recent events.`));
+        if (!result.paged) {
+            // An older hq-pro ignores view=audit and returns its surface feed,
+            // capped at 50 events; say so rather than letting a truncated list
+            // read as "that is everything that ever happened".
+            if (result.feedSize > rows.length && rows.length > 0) {
+                console.log(chalk.dim(`\nShowing ${rows.length} of ${result.feedSize} recent events.`));
+            }
+            console.log(chalk.dim("This server returns only the latest 50 events."));
+            return;
+        }
+        if (result.pageCapHit) {
+            console.log(chalk.dim(`\n${auditPageCapNote()}`));
+        }
+        else if (result.more && rows.length > 0) {
+            console.log(chalk.dim(`\nShowing ${rows.length} events. Raise --limit or use --since to see more.`));
         }
     });
     integrations
@@ -757,4 +774,62 @@ export function removeGrant(current, toolName, principal) {
     }
     return removed ? next : null;
 }
+/** Upper bound on audit pages one `hq integrations audit` run reads. */
+export const AUDIT_MAX_PAGES = 200;
+function auditPageCapNote() {
+    return `Stopped after reading ${AUDIT_MAX_PAGES} pages of activity; narrow the search with --since or --provider.`;
+}
+/**
+ * Page the audit feed (newest first) until `limit` rows match, the cursor runs
+ * out, a row is older than `sinceMs`, or AUDIT_MAX_PAGES pages were read.
+ * `provider` is matched client-side on the bare slug, so the qualified
+ * `factory:linear` form copied from JSON output matches bare stored rows.
+ */
+export async function collectAuditRows(token, companyUid, opts) {
+    const want = opts.provider ? bareProvider(opts.provider.trim()).toLowerCase() : undefined;
+    const matches = (row) => !want || bareProvider(row.provider ?? "").toLowerCase() === want;
+    const tooOld = (row) => {
+        if (opts.sinceMs === undefined)
+            return false;
+        const at = Date.parse(row.timestamp);
+        return !Number.isNaN(at) && at < opts.sinceMs;
+    };
+    const rows = [];
+    let cursor;
+    for (let page = 0; page < AUDIT_MAX_PAGES; page += 1) {
+        const remaining = opts.limit - rows.length;
+        // With a provider filter most rows may not match, so read full pages.
+        const pageLimit = want ? AUDIT_PAGE_MAX : Math.min(AUDIT_PAGE_MAX, remaining);
+        const res = await fetchAuditPage(token, companyUid, { limit: pageLimit, cursor });
+        if (!res.paged) {
+            if (page > 0)
+                return { rows, paged: true, feedSize: 0, more: false, pageCapHit: false };
+            const fallback = res.audit.filter((row) => !tooOld(row) && matches(row));
+            return {
+                rows: fallback.slice(0, opts.limit),
+                paged: false,
+                feedSize: res.audit.length,
+                more: fallback.length > opts.limit,
+                pageCapHit: false,
+            };
+        }
+        for (let i = 0; i < res.audit.length; i += 1) {
+            const row = res.audit[i];
+            if (tooOld(row))
+                return { rows, paged: true, feedSize: 0, more: false, pageCapHit: false };
+            if (!matches(row))
+                continue;
+            if (rows.length >= opts.limit) {
+                return { rows, paged: true, feedSize: 0, more: true, pageCapHit: false };
+            }
+            rows.push(row);
+        }
+        if (!res.nextCursor)
+            return { rows, paged: true, feedSize: 0, more: false, pageCapHit: false };
+        if (rows.length >= opts.limit)
+            return { rows, paged: true, feedSize: 0, more: true, pageCapHit: false };
+        cursor = res.nextCursor;
+    }
+    return { rows, paged: true, feedSize: 0, more: true, pageCapHit: true };
+}
 //# sourceMappingURL=integrations-manage.js.map