@indigoai-us/hq-cli 5.345.139 → 5.345.140

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## [Unreleased]
 
+## [5.345.140] — 2026-10-16
+- `hq auth status` now reports the machine token cache when HQ runs under a machine identity (fleet agents and other machine sign-ins). Before, it read only the person token file and reported "no cached session yet" on a machine that held a valid machine session, even though `hq auth refresh` had just renewed it.
+
 ## [5.345.139] — 2026-10-15
 - `hq storage offload` and `hq storage fetch` no longer fail about 15 to 25 minutes into a run. Personal and company
   vault credentials are now re-vended before they expire, for the whole run and in the middle of a multipart upload.

package/dist/commands/auth.js

@@ -21,7 +21,7 @@ import { open, realpath } from "node:fs/promises";
 import path from "node:path";
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
-import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, } from "../utils/cognito-session.js";
+import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, loadMachineCachedTokens, } from "../utils/cognito-session.js";
 // Static (node builtins only): a lazy import here would need a resident
 // preload entry for the auth-login path.
 import * as tokenKeychain from "../utils/token-keychain.js";
@@ -358,7 +358,11 @@ export function registerAuthCommands(program) {
         // the person cache rejected (transient refresh errors still report person).
         const tokenSource = resolveCognitoTokenSource();
         const machine = tokenSource === "machine";
-        const cached = loadCachedTokens();
+        // Machine tokens live in the daemon state dir, never ~/.hq. Reading the
+        // person cache here reported "no cached session" on agent boxes whose
+        // machine cache was valid, and could show a stale person session as the
+        // machine one.
+        const cached = machine ? loadMachineCachedTokens() : loadCachedTokens();
         if (!cached) {
             if (machine) {
                 // No cached session yet, but machine creds mint one on demand —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.139",
+  "version": "5.345.140",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {