@indigoai-us/hq-cli 5.345.144 → 5.345.145

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [5.345.145] — 2026-10-17
+- `hq core checkpoint`: the background checkpoint helper now fills in automatic
+  saves that were queued before it started. It writes its own report first,
+  then works through at most 5 queued saves per run; any extra queued saves go
+  back on the queue for the next run instead of being dropped. If a run is
+  stopped partway through its queued saves, the next run puts the ones it did
+  not finish back on the queue.
+- Outpost scheduled-job alerts now reach owners recorded by their Cognito user
+  id. `hq core job notify` used to pass the id to `hq dm`, which read it as a
+  channel name and failed with "No channel named …". It now sends to the email
+  `hq whoami --json` reports for that id (the signed-in person, or the person
+  an Outpost acts for), and logs a clear reason when it cannot match one.
+- `hq whoami --json` adds `sub`, `delegatedEmail` and `delegatedSub`.
+- `hq core jobs reconcile` matches company jobs owned by the Outpost owner's
+  email or id, and reaches the user systemd manager when it runs from a system
+  service with no login session (it used to fail with "Failed to connect to
+  bus: No medium found").
+- `hq members list --json` prints each member's person id (`person_id`, the `prs_` id that file and secret grants use), email, name, slug, role and membership key. `--pending --json` does the same for pending invites. `hq members list --ids` adds a PERSON_ID column to the table. The default table is unchanged.
+
 ## [5.345.144] — 2026-10-16
 - New `hq library add <file|url>...` uploads files or http(s) URLs straight to
   the company vault and writes only a `.hqcloud` placeholder into

package/dist/command-catalog.generated.d.ts

@@ -3586,6 +3586,14 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--pending";
             readonly description: "List pending invites instead of active members";
             readonly hidden: false;
+        }, {
+            readonly flags: "--ids";
+            readonly description: "Add a PERSON_ID column (the prs_ id used in grants and membership keys)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON, including each person id";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {

package/dist/command-catalog.generated.js

@@ -4333,6 +4333,16 @@ export const COMMAND_CATALOG = [
                         "flags": "--pending",
                         "description": "List pending invites instead of active members",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--ids",
+                        "description": "Add a PERSON_ID column (the prs_ id used in grants and membership keys)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON, including each person id",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []

package/dist/commands/core-checkpoint-native.d.ts

@@ -27,6 +27,14 @@ export declare const NO_BACKEND_RETRY_MS: number;
  * always releases the queue before the lock would be presumed abandoned.
  */
 export declare const SIBLING_MAX_RUNTIME_MS: number;
+/**
+ * Queued payloads one sibling run may process, across its launch claim and its
+ * own queue drain. Each one runs the full upgrade flow, so a 50-deep queue in
+ * one run outlasts SIBLING_MAX_RUNTIME_MS and the grok turn cap; the run is
+ * then killed with work half done. The launcher re-queues the overflow for the
+ * next sibling instead.
+ */
+export declare const MAX_QUEUED_PAYLOADS_PER_RUN = 5;
 type Backend = "claude" | "codex" | "grok" | "none";
 type SpawnableBackend = Exclude<Backend, "none">;
 /**
@@ -121,6 +129,28 @@ export declare function siblingLaunch(backend: SpawnableBackend, args: string[],
     command: string;
     args: string[];
 };
+/**
+ * Keep the oldest {@link MAX_QUEUED_PAYLOADS_PER_RUN} claimed payloads for this
+ * run and append the rest back to the queue, so a deep queue is worked off
+ * across several runs instead of being lost when one run hits its cap. The
+ * claim file is rewritten to hold only what this run owns.
+ */
+export declare function limitClaimedPayloads(entries: unknown[], claimPath: string, pendingPath: string, limit?: number): unknown[];
+/** Times one queued record may be recovered from a finished run before it is dropped. */
+export declare const MAX_CLAIM_RECOVERIES = 3;
+/**
+ * Put back the queued records a finished sibling claimed but never processed.
+ *
+ * A sibling stopped at its wall-clock or turn cap leaves its claim files
+ * (pending-claimed*.jsonl) in its run directory. A record whose thread file
+ * still exists at its thread_path was not upgraded (the sibling renames the
+ * -auto- file when it is done), so it is appended back to pending.jsonl for
+ * this launch to claim. Only runs whose process is gone are read, records
+ * already queued are not duplicated, and each record is recovered at most
+ * {@link MAX_CLAIM_RECOVERIES} times so one the sibling keeps skipping cannot
+ * cycle forever. Each claim file read is renamed to *.recovered.
+ */
+export declare function recoverOrphanedClaims(siblingRoot: string, pendingPath: string, liveRoot: string): number;
 /** Attach the native checkpoint command to the hidden `hq core` group. */
 export declare function registerCoreCheckpointCommand(core: Command, preResolvedHqRoot?: string): void;
 export {};

package/dist/commands/core-checkpoint-native.js

@@ -92,6 +92,14 @@ const SIBLING_LOCK_TTL_MS = 60 * 60 * 1000;
 export const SIBLING_MAX_RUNTIME_MS = 30 * 60 * 1000;
 /** Newest-wins cap so a wedged sibling cannot grow an unbounded queue. */
 const MAX_PENDING_PAYLOADS = 50;
+/**
+ * Queued payloads one sibling run may process, across its launch claim and its
+ * own queue drain. Each one runs the full upgrade flow, so a 50-deep queue in
+ * one run outlasts SIBLING_MAX_RUNTIME_MS and the grok turn cap; the run is
+ * then killed with work half done. The launcher re-queues the overflow for the
+ * next sibling instead.
+ */
+export const MAX_QUEUED_PAYLOADS_PER_RUN = 5;
 class CheckpointUsageError extends Error {
 }
 /**
@@ -202,16 +210,37 @@ report instead of guessing.
    skip silently on any failure. Hook or automation improvements go ONLY under
    personal/hooks/ as proposals.
 7. WRITE BOUNDS: you may write only under personal/, workspace/, and companies/<company>/ as constrained above. You must NEVER write into .claude/, core/, .agents/, .codex/, repos/, or anywhere outside the HQ root.
-8. Write <runDir>/report.md — full prose: what you read, what you changed
-   (paths), and what you skipped and why. List every policy or knowledge file
-   you amended, superseded, merged or deleted with the reason, so a human can
+8. Write <runDir>/report.md NOW, before you touch any queued payload — full
+   prose: what you read, what you changed (paths), and what you skipped and
+   why. List every policy or knowledge file you
+   amended, superseded, merged or deleted with the reason, so a human can
    audit and reverse it; a deletion you do not name in the report is a defect.
-   Then drain the queue: while
-   workspace/checkpoints/sibling/pending.jsonl exists and is non-empty, claim
+   The run can be stopped at its time or turn cap at any point after this, so
+   this run's own report must already exist.
+9. QUEUED PAYLOADS CLAIMED AT LAUNCH: the payload's pending_payloads array
+   holds checkpoints that were queued while an earlier sibling was busy; the
+   same records are in <runDir>/pending-claimed.jsonl. The launcher hands one
+   run at most <maxQueued> of them and has already put any others back in
+   workspace/checkpoints/sibling/pending.jsonl. For EACH record in
+   pending_payloads, in order, run steps 1-5 with that record as the payload:
+   upgrade the thread file named in its thread_path IN PLACE and drop -auto-
+   from its filename. If that -auto- file no longer exists, the record was
+   already processed; note it and move on. For a queued record, skip the
+   journal close in step 4 (it belongs to the parent session) and skip step 5b
+   (ontology); in steps 3 and 7, <company> means that record's own company, not
+   this run's. After EACH record, append one line to <runDir>/report.md naming
+   its thread and what you did, so a run stopped mid-queue shows how far it got.
+   If the array is empty, skip this step.
+10. Drain the queue, still within the same limit of <maxQueued> queued records
+   per run counted across step 9 and this step: while
+   workspace/checkpoints/sibling/pending.jsonl exists and is non-empty and you
+   have processed fewer than <maxQueued> queued records, claim
    it atomically by renaming it aside —
    mv workspace/checkpoints/sibling/pending.jsonl <runDir>/pending-claimed-N.jsonl
-   (N counting up from 2) — and process the claimed payloads with this same
-   flow. Repeat until a claim finds nothing left, then update the report.
+   (N counting up from 2) — and process its records as in step 9. When you
+   reach the limit, append every record of that claimed file you did not
+   process back to workspace/checkpoints/sibling/pending.jsonl (append with >>,
+   never overwrite) so the next sibling takes it, and record that in the report.
    NEVER read the queue and truncate it in place: a payload appended between
    your read and the truncate is lost, and its checkpoint is never enriched.
 `;
@@ -241,7 +270,8 @@ export function renderSiblingPrompt(runDir, payloadPath, options = {}) {
         .replaceAll("<ontologyStep>", () => ontologyStep)
         .replaceAll("<runDir>", () => runDir)
         .replaceAll("<payloadPath>", () => payloadPath)
-        .replaceAll("<hqRoot>", () => options.hqRoot ?? "");
+        .replaceAll("<hqRoot>", () => options.hqRoot ?? "")
+        .replaceAll("<maxQueued>", () => String(MAX_QUEUED_PAYLOADS_PER_RUN));
 }
 function collect(value, previous) {
     return [...previous, value];
@@ -1137,7 +1167,8 @@ function appendPending(pendingPath, payload) {
  * describes is never enriched. Renaming is atomic, so this run receives exactly
  * the file that existed at the moment of the claim while concurrent callers go
  * on appending to a fresh queue. The claimed file is left in the run directory
- * as an audit trail and as a recovery point if this sibling dies.
+ * as an audit trail and as a recovery point if this sibling dies: the next
+ * launch re-queues its unprocessed records through recoverOrphanedClaims.
  */
 function claimPending(pendingPath, claimPath) {
     try {
@@ -1162,6 +1193,124 @@ function claimPending(pendingPath, claimPath) {
     }
     return entries;
 }
+/**
+ * Keep the oldest {@link MAX_QUEUED_PAYLOADS_PER_RUN} claimed payloads for this
+ * run and append the rest back to the queue, so a deep queue is worked off
+ * across several runs instead of being lost when one run hits its cap. The
+ * claim file is rewritten to hold only what this run owns.
+ */
+export function limitClaimedPayloads(entries, claimPath, pendingPath, limit = MAX_QUEUED_PAYLOADS_PER_RUN) {
+    if (entries.length <= limit)
+        return entries;
+    const kept = entries.slice(0, limit);
+    const overflow = entries.slice(limit);
+    // Re-queue first: if the rewrite below fails, every record is still on disk.
+    fs.appendFileSync(pendingPath, overflow.map((entry) => `${JSON.stringify(entry)}\n`).join(""));
+    fs.writeFileSync(claimPath, kept.map((entry) => `${JSON.stringify(entry)}\n`).join(""));
+    return kept;
+}
+/** Times one queued record may be recovered from a finished run before it is dropped. */
+export const MAX_CLAIM_RECOVERIES = 3;
+/**
+ * Put back the queued records a finished sibling claimed but never processed.
+ *
+ * A sibling stopped at its wall-clock or turn cap leaves its claim files
+ * (pending-claimed*.jsonl) in its run directory. A record whose thread file
+ * still exists at its thread_path was not upgraded (the sibling renames the
+ * -auto- file when it is done), so it is appended back to pending.jsonl for
+ * this launch to claim. Only runs whose process is gone are read, records
+ * already queued are not duplicated, and each record is recovered at most
+ * {@link MAX_CLAIM_RECOVERIES} times so one the sibling keeps skipping cannot
+ * cycle forever. Each claim file read is renamed to *.recovered.
+ */
+export function recoverOrphanedClaims(siblingRoot, pendingPath, liveRoot) {
+    let runDirs;
+    try {
+        runDirs = fs.readdirSync(siblingRoot).filter((entry) => entry !== "pending.jsonl");
+    }
+    catch {
+        return 0;
+    }
+    const queuedThreads = new Set();
+    try {
+        for (const line of fs.readFileSync(pendingPath, "utf8").split("\n")) {
+            if (!line.trim())
+                continue;
+            try {
+                const threadPath = JSON.parse(line).thread_path;
+                if (typeof threadPath === "string")
+                    queuedThreads.add(threadPath);
+            }
+            catch {
+                // A torn line names no thread.
+            }
+        }
+    }
+    catch {
+        // No queue yet.
+    }
+    const recovered = [];
+    let count = 0;
+    for (const runDir of runDirs.sort()) {
+        const absolute = path.join(siblingRoot, runDir);
+        let claimFiles;
+        try {
+            claimFiles = fs.readdirSync(absolute).filter((entry) => /^pending-claimed(?:-\d+)?\.jsonl$/u.test(entry));
+        }
+        catch {
+            continue;
+        }
+        if (claimFiles.length === 0)
+            continue;
+        let pid = Number.NaN;
+        try {
+            pid = Number.parseInt(fs.readFileSync(path.join(absolute, "sibling.pid"), "utf8").trim(), 10);
+        }
+        catch {
+            // A run that never recorded a PID cannot still be running.
+        }
+        if (Number.isSafeInteger(pid) && pid > 0 && processAlive(pid))
+            continue;
+        for (const claimFile of claimFiles.sort()) {
+            const claimPath = path.join(absolute, claimFile);
+            let content;
+            try {
+                content = fs.readFileSync(claimPath, "utf8");
+            }
+            catch {
+                continue;
+            }
+            for (const line of content.split("\n")) {
+                if (!line.trim())
+                    continue;
+                let entry;
+                try {
+                    entry = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                const threadPath = entry.thread_path;
+                if (typeof threadPath !== "string" || !threadPath || queuedThreads.has(threadPath))
+                    continue;
+                if (!fs.existsSync(path.resolve(liveRoot, threadPath)))
+                    continue;
+                const attempts = typeof entry.claim_recoveries === "number" ? entry.claim_recoveries : 0;
+                if (attempts >= MAX_CLAIM_RECOVERIES)
+                    continue;
+                queuedThreads.add(threadPath);
+                recovered.push(`${JSON.stringify({ ...entry, claim_recoveries: attempts + 1 })}\n`);
+                count += 1;
+            }
+            // Re-queue before retiring the claim file, so a failure leaves the
+            // records on disk; a repeat read is deduplicated by thread_path above.
+            if (recovered.length > 0)
+                fs.appendFileSync(pendingPath, recovered.splice(0).join(""));
+            fs.renameSync(claimPath, `${claimPath}.recovered`);
+        }
+    }
+    return count;
+}
 async function startSibling(liveRoot, input, threadPath, backend) {
     const stateDir = path.join(liveRoot, "workspace", "orchestrator", "hook-state");
     const siblingRoot = path.join(liveRoot, "workspace", "checkpoints", "sibling");
@@ -1183,9 +1332,17 @@ async function startSibling(liveRoot, input, threadPath, backend) {
         printResult(`checkpoint: sibling busy — payload queued (${depth} pending)`);
         return;
     }
+    // Before this run's directory exists, so only earlier runs are read.
+    try {
+        recoverOrphanedClaims(siblingRoot, pendingPath, liveRoot);
+    }
+    catch {
+        // Recovery is best effort; the claim files stay on disk for the next launch.
+    }
     const runDir = path.join(siblingRoot, `${formatTimestamp(new Date())}-${summarySlug(input.summary ?? "checkpoint")}`);
     fs.mkdirSync(runDir, { recursive: true });
-    payload.pending_payloads = claimPending(pendingPath, path.join(runDir, "pending-claimed.jsonl"));
+    const claimPath = path.join(runDir, "pending-claimed.jsonl");
+    payload.pending_payloads = limitClaimedPayloads(claimPending(pendingPath, claimPath), claimPath, pendingPath);
     if (!payload.company) {
         let queued;
         try {

package/dist/commands/core-job-notify-native.js

@@ -195,6 +195,40 @@ function emailFromWhoami(output) {
     }
     return "";
 }
+const EMAIL_RECIPIENT = /^[^\s@]+@[^\s@]+$/;
+const COGNITO_SUB = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Outpost jobs may record `owner` as the owner's Cognito user id (the box's
+ * OUTPOST_USER_ID; the reconciler matches company jobs on it). `hq dm` cannot
+ * address a Cognito id: any token that is not an email or prs_/agt_ uid is
+ * treated as a channel name and bounces with "No channel named …". Map the id
+ * to the signed-in identity's email when `hq whoami --json` reports the same
+ * subject, directly or as the human an Outpost session acts for.
+ */
+function resolveCognitoOwner(owner, deps) {
+    if (!deps.commandExists("hq"))
+        return "";
+    let parsed;
+    try {
+        const raw = deps.run("hq", ["whoami", "--json"], { cwd: deps.cwd, env: deps.env, captureStdout: true }).stdout;
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return "";
+        parsed = value;
+    }
+    catch {
+        return "";
+    }
+    const target = owner.toLowerCase();
+    for (const [subKey, emailKey] of [["sub", "email"], ["delegatedSub", "delegatedEmail"]]) {
+        const sub = parsed[subKey];
+        const email = parsed[emailKey];
+        if (typeof sub === "string" && sub.toLowerCase() === target
+            && typeof email === "string" && EMAIL_RECIPIENT.test(email))
+            return email;
+    }
+    return "";
+}
 function normalizedEpoch(value) {
     if (!/^-?\d+$/.test(value))
         throw new Error(`invalid HQ_JOB_NOTIFY_NOW_EPOCH: ${value}`);
@@ -260,6 +294,17 @@ export function runJobNotify(argv, options = {}) {
         log("no owner recipient — cannot dm (logged only); never fails the job");
         deps.appendFile(deliveryLog, '{"delivered":false,"reason":"missing_owner"}\n');
     }
+    let recipient = owner;
+    const cognitoOwner = Boolean(owner) && COGNITO_SUB.test(owner);
+    if (cognitoOwner) {
+        recipient = resolveCognitoOwner(owner, deps);
+        if (recipient)
+            log(`owner ${owner} is a Cognito user id — delivering to ${recipient}`);
+        else {
+            log(`owner ${owner} is a Cognito user id that hq dm cannot address and hq whoami does not report it — set the job owner to an email or prs_ uid (logged only); never fails the job`);
+            deps.appendFile(deliveryLog, '{"delivered":false,"reason":"unresolved_owner_id"}\n');
+        }
+    }
     let previous = {};
     if (deps.exists(stateFile))
         previous = JSON.parse(deps.readFile(stateFile));
@@ -306,18 +351,22 @@ export function runJobNotify(argv, options = {}) {
         log("skip dm send — missing owner");
         deliverRc = 1;
     }
+    else if (!recipient) {
+        log("skip dm send — owner id has no dm recipient");
+        deliverRc = 1;
+    }
     else if (!dmBin) {
         log("skip dm send — hq CLI not found");
         deliverRc = 1;
     }
     else {
         const args = dmBin === "hq"
-            ? ["dm", owner, headline, "--details", details]
-            : [owner, headline, details];
+            ? ["dm", recipient, headline, "--details", details]
+            : [recipient, headline, details];
         deliverRc = deps.run(dmBin, args, { cwd: deps.cwd, env: deps.env, captureStdout: false, logPath: deliveryLog }).code;
         if (deliverRc === 0) {
             delivered = 1;
-            log(`dm delivered to ${owner} kind=${kind} job=${parsed.jobId}`);
+            log(`dm delivered to ${recipient} kind=${kind} job=${parsed.jobId}`);
         }
         else
             log(`dm delivery failed rc=${deliverRc} job=${parsed.jobId} (logged; not failing run)`);
@@ -344,6 +393,7 @@ export function runJobNotify(argv, options = {}) {
         delivered: delivered === 1,
         kind,
         owner,
+        ...(cognitoOwner ? { recipient: recipient || null } : {}),
         channel_unimplemented: channelUnimplemented === 1,
         deliver_rc: deliverRc,
     }, "compact"));

package/dist/commands/core-jobs-native.d.ts

@@ -15,6 +15,14 @@ export type ReconcileOptions = {
     fetcher?: typeof fetch;
     now?: () => Date;
 };
+/**
+ * A system unit with User=ec2-user (outpost-jobs-reconcile.service) or a cron
+ * job has no login session, so XDG_RUNTIME_DIR / DBUS_SESSION_BUS_ADDRESS are
+ * unset and `systemctl --user` fails with "Failed to connect to bus: No medium
+ * found" (feedback_6ce027d7). When the lingering user manager's runtime dir
+ * exists, point systemctl at it. Caller-provided values are kept.
+ */
+export declare function withUserBusEnvironment(env: NodeJS.ProcessEnv, uid: number | undefined, runtimeBase?: string, exists?: (file: string) => boolean): NodeJS.ProcessEnv;
 export declare function runReconcile(argv: string[], rootArg?: string, options?: ReconcileOptions): Promise<number>;
 export declare function registerCoreJobsNativeCommand(core: Command): void;
 export declare function rawArgumentsForCommand(command: Command, fallback: string[], raw?: string[]): string[];

package/dist/commands/core-jobs-native.js

@@ -379,9 +379,36 @@ Env / overrides (tests):
 
 Exit: 0 success; 1 partial failures; 2 usage/config.
 `;
-function commandResult(command, args) {
+/**
+ * A system unit with User=ec2-user (outpost-jobs-reconcile.service) or a cron
+ * job has no login session, so XDG_RUNTIME_DIR / DBUS_SESSION_BUS_ADDRESS are
+ * unset and `systemctl --user` fails with "Failed to connect to bus: No medium
+ * found" (feedback_6ce027d7). When the lingering user manager's runtime dir
+ * exists, point systemctl at it. Caller-provided values are kept.
+ */
+export function withUserBusEnvironment(env, uid, runtimeBase = "/run/user", exists = fs.existsSync) {
+    if (uid === undefined)
+        return env;
+    const next = { ...env };
+    if (!next.XDG_RUNTIME_DIR) {
+        const directory = path.posix.join(runtimeBase, String(uid));
+        if (!exists(directory))
+            return next;
+        next.XDG_RUNTIME_DIR = directory;
+    }
+    if (!next.DBUS_SESSION_BUS_ADDRESS && exists(path.posix.join(next.XDG_RUNTIME_DIR, "bus"))) {
+        next.DBUS_SESSION_BUS_ADDRESS = `unix:path=${next.XDG_RUNTIME_DIR}/bus`;
+    }
+    return next;
+}
+function schedulerCommandResult(command, args) {
+    const env = withUserBusEnvironment(process.env, typeof process.getuid === "function" ? process.getuid() : undefined, process.env.HQ_JOB_USER_RUNTIME_BASE || "/run/user");
+    return commandResult(command, args, env);
+}
+function commandResult(command, args, env = process.env) {
     const result = spawnSync(command, args, {
         encoding: "utf8",
+        env,
         stdio: ["ignore", "pipe", "pipe"],
     });
     return {
@@ -486,6 +513,11 @@ function resolveBoxOwners(options) {
                 email = shellText(record.email ?? user?.email);
                 add(email);
                 add(shellText(record.personUid ?? record.person_uid ?? record.uid));
+                // The person (or the human an Outpost session acts for) by Cognito
+                // id and email, so a job owner written either way matches the box.
+                add(shellText(record.sub));
+                add(shellText(record.delegatedEmail));
+                add(shellText(record.delegatedSub));
             }
             if (!email) {
                 const humanEmail = /.*Email:\s*(.*)/i.exec(who)?.[1]
@@ -757,7 +789,7 @@ function systemctlResult(args, dryRun, command, options) {
         return { status: 127, stdout: "", stderr: "scheduler stub was requested but no injected runner was supplied" };
     }
     try {
-        const runner = options.schedulerRunner ?? commandResult;
+        const runner = options.schedulerRunner ?? schedulerCommandResult;
         return runner(command, ["--user", ...args]);
     }
     catch (error) {

package/dist/commands/members.d.ts

@@ -145,6 +145,26 @@ export declare class InviteHttpError extends Error {
 }
 export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+/** JSON row for `hq members list --json`. `person_id` is the prs_/agt_ id grants use. */
+export declare function activeMemberJson(m: ActiveMember): {
+    person_id: string;
+    email: string | null;
+    name: string | null;
+    slug: string | null;
+    role: string;
+    status: string;
+    membership_key: string;
+};
+/** JSON row for `hq members list --pending --json`. */
+export declare function pendingInviteJson(inv: PendingInvite): {
+    person_id: string | null;
+    email: string | null;
+    role: string;
+    status: string;
+    invited_by: string;
+    invited_at: string;
+    membership_key: string;
+};
 export declare function listActiveMembers(token: string, companyUid: string): Promise<ActiveMember[]>;
 /**
  * Resolve a role-change target to an active membership key.

package/dist/commands/members.js

@@ -237,6 +237,30 @@ export async function listPendingInvites(token, companyUid) {
     const data = (await res.json());
     return data?.pending ?? data?.invites ?? [];
 }
+/** JSON row for `hq members list --json`. `person_id` is the prs_/agt_ id grants use. */
+export function activeMemberJson(m) {
+    return {
+        person_id: m.personUid,
+        email: m.personEmail ?? null,
+        name: m.personName ?? null,
+        slug: m.personSlug ?? null,
+        role: m.role,
+        status: m.status,
+        membership_key: m.membershipKey,
+    };
+}
+/** JSON row for `hq members list --pending --json`. */
+export function pendingInviteJson(inv) {
+    return {
+        person_id: inv.personUid ?? null,
+        email: inv.inviteeEmail ?? null,
+        role: inv.role,
+        status: inv.status,
+        invited_by: inv.invitedBy,
+        invited_at: inv.invitedAt,
+        membership_key: inv.membershipKey,
+    };
+}
 export async function listActiveMembers(token, companyUid) {
     const res = await vaultApiFetch({
         token,
@@ -750,6 +774,8 @@ export function registerMembersCommand(program) {
         .command("list")
         .description("List the company's active members (use --pending for pending invites)")
         .option("--pending", "List pending invites instead of active members")
+        .option("--ids", "Add a PERSON_ID column (the prs_ id used in grants and membership keys)")
+        .option("--json", "Print machine-readable JSON, including each person id")
         .action(async (opts) => {
         try {
             const token = (await resolveVaultCredential()).token;
@@ -758,6 +784,13 @@ export function registerMembersCommand(program) {
             if (opts.pending) {
                 // --pending: preserve the original pending-invites view verbatim.
                 const invites = await listPendingInvites(token, companyUid);
+                if (opts.json) {
+                    console.log(JSON.stringify({
+                        company_uid: companyUid,
+                        pending: invites.map(pendingInviteJson),
+                    }, null, 2));
+                    return;
+                }
                 if (invites.length === 0) {
                     console.log(chalk.gray("No pending invites for this company."));
                     return;
@@ -788,17 +821,33 @@ export function registerMembersCommand(program) {
             // Default: list ACTIVE members so their emails drop straight into
             // `hq secrets share <path> --with <email>`.
             const activeMembers = await listActiveMembers(token, companyUid);
+            if (opts.json) {
+                console.log(JSON.stringify({
+                    company_uid: companyUid,
+                    members: activeMembers.map(activeMemberJson),
+                }, null, 2));
+                return;
+            }
             if (activeMembers.length === 0) {
                 console.log(chalk.gray("No active members found for this company."));
                 return;
             }
             const emailW = Math.max(5, ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length));
             const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
-            console.log(chalk.bold(["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW), "NAME"].join("  ")));
+            const idW = Math.max(9, ...activeMembers.map((m) => m.personUid.length));
+            const header = ["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW)];
+            if (opts.ids)
+                header.push("PERSON_ID".padEnd(idW));
+            header.push("NAME");
+            console.log(chalk.bold(header.join("  ")));
             for (const m of activeMembers) {
                 const email = m.personEmail ?? m.personUid;
                 const name = m.personName ?? m.personSlug ?? "";
-                console.log([email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "));
+                const row = [email.padEnd(emailW), m.role.padEnd(roleW)];
+                if (opts.ids)
+                    row.push(m.personUid.padEnd(idW));
+                row.push(name);
+                console.log(row.join("  "));
             }
         }
         catch (err) {

package/dist/commands/whoami.js

@@ -153,6 +153,15 @@ export function registerWhoamiCommand(program) {
                     authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
                     tokenSource: machine ? 'machine' : 'person',
                     email: machine ? null : displayedIdentity.email ?? null,
+                    // Cognito subject of the person shown in `email` (null for machine
+                    // identities). Outpost jobs record owners by this id.
+                    sub: machine ? null : displayedIdentity.sub ?? null,
+                    // The human an Outpost session acts for, from the token's
+                    // delegated claims, for machine and person sources alike.
+                    delegatedEmail: identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined
+                        ? identity.delegatedEmail : null,
+                    delegatedSub: identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined
+                        ? identity.delegatedSub : null,
                     personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
                     agentUid,
                     username: machineCreds?.username ?? null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.144",
+  "version": "5.345.145",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {