@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/dist/commands/secrets.js

@@ -72,7 +72,7 @@ import { fastFlagEnabledDefaultOn } from "../native-fast-route.js";
 import { MULTI_COMPANY_SESSION_LOCK_FLAG } from "../lib/cli-flag-keys.js";
 import { secretsExecChildExitCode } from "../utils/child-wrapper-exit.js";
 import { isPlanGateError } from "../utils/plan-gate-error.js";
-import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN, OUTPOST_UID_PATTERN, } from "./_patterns.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN, OUTPOST_UID_PATTERN, AGENT_UID_PATTERN, agentMachineEmail, agentUidFromMachineEmail, } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { formatApiKeyCapabilityDenial, peekHqApiKey, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
@@ -175,6 +175,18 @@ async function resolveSecretsTarget(capability, commandLabel, scopeOptions) {
         aclPath: (action) => action ? `${basePath}/acl/${action}` : `${basePath}/acl`,
     };
 }
+/**
+ * Shown when `secrets share` / `unshare` gets a 403. Changing a secret's
+ * grants needs admin on that secret, which is a separate check from read.
+ * The old "Not authorized to share this secret" text led people and agents to
+ * conclude the secret itself was locked to them, so this names the missing
+ * permission and says read access is unchanged.
+ */
+export const SECRET_SHARE_ADMIN_REQUIRED_MESSAGE = "You need admin permission on this secret to change who can see it. " +
+    "This does not affect read access: if you could read the secret before, you still can. " +
+    "Ask a company admin to change its sharing.";
+/** hq-pro 409 code: the path inherits access from a broader pattern ACL row. */
+const SECRET_ACL_COVERED_BY_BROADER_ROW_CODE = "ACL_COVERED_BY_BROADER_ROW";
 /**
  * Failure message for a secrets call. A 403 on an API-key route may carry
  * hq-pro's `{ granted, missing }` capability report — surface it verbatim so
@@ -303,7 +315,16 @@ export function parseSecretAclPrincipal(principal) {
         return { granteeType: "company-wide", granteeId: "" };
     }
     if (EMAIL_PATTERN.test(p)) {
-        return { granteeType: "email", granteeId: p.toLowerCase() };
+        const email = p.toLowerCase();
+        if (email.endsWith(AGENT_EMAIL_DOMAIN)) {
+            const agentUid = agentUidFromMachineEmail(email);
+            if (!agentUid) {
+                console.error(chalk.red(`Invalid principal '${principal}': a fleet agent machine email must be agt-<26-character ULID>${AGENT_EMAIL_DOMAIN}`));
+                return null;
+            }
+            return { granteeType: "email", granteeId: email, agentUid };
+        }
+        return { granteeType: "email", granteeId: email };
     }
     if (GROUP_ID_PATTERN.test(p)) {
         return { granteeType: "group", granteeId: p };
@@ -313,12 +334,71 @@ export function parseSecretAclPrincipal(principal) {
         // that this id is the company's active Outpost.
         return { granteeType: "person", granteeId: p };
     }
-    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a group id matching grp_<alphanumeric, underscore, hyphen>, or a company Outpost id (out_…)`));
+    if (AGENT_UID_PATTERN.test(p)) {
+        // /delegate passes the agt_… uid (feedback_68a50c16). The wire grantee is
+        // the agent's machine email; hq-pro canonicalizes it onto the agt_…
+        // principal for an active member of the company. `secrets share` checks
+        // that membership first (inactiveCompanyAgentReason), because for any
+        // other agent the server would store an inert email row and return 200.
+        return {
+            granteeType: "email",
+            granteeId: agentMachineEmail(p),
+            label: p,
+            agentUid: p,
+        };
+    }
+    if (/^agt_/i.test(p)) {
+        console.error(chalk.red(`Invalid principal '${principal}': a fleet agent uid must be agt_ followed by exactly 26 upper-case Crockford base32 characters (0-9, A-Z without I, L, O, U)`));
+        return null;
+    }
+    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, a group id matching grp_<alphanumeric, underscore, hyphen>, a fleet agent uid (agt_…) or its machine email (agt-…@agents.getindigo.ai), or a company Outpost id (out_…)`));
+    return null;
+}
+const AGENT_EMAIL_DOMAIN = "@agents.getindigo.ai";
+/** Agent membership states that can hold a secret grant. */
+function isActiveRosterAgent(agent) {
+    if (agent.entityStatus !== undefined && agent.entityStatus !== "active") {
+        return false;
+    }
+    if (agent.setupPhase === "deprovisioning" || agent.setupPhase === "deprovisioned") {
+        return false;
+    }
+    return !["archived", "deleted", "removed", "deprovisioned", "suspended", "inactive"].includes(String(agent.agentStatus ?? ""));
+}
+/**
+ * Refuse a share to a fleet agent that is not an active agent of this
+ * company. hq-pro turns the machine-email grantee into an agt_… grant only
+ * for an active member; for any other agent it stores an email row the agent
+ * can never use and still returns 200. Reads the company roster
+ * (`GET /v1/agents?companyUid=…`, the same call as `hq agents list`) before
+ * any write. Returns an error message, or null when the agent is active here.
+ */
+export async function inactiveCompanyAgentReason(token, companyUid, agentUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/agents",
+        query: { companyUid },
+    });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        return `Could not check that ${agentUid} is an agent of this company (${res.status} ${body.message ?? body.error ?? res.statusText}). Nothing was shared.`;
+    }
+    const data = (await res.json().catch(() => ({})));
+    const agent = (data.agents ?? []).find((a) => typeof a.uid === "string" && a.uid.toUpperCase() === agentUid.toUpperCase());
+    if (!agent) {
+        return `${agentUid} is not an agent of this company. Nothing was shared.`;
+    }
+    if (!isActiveRosterAgent(agent)) {
+        return `${agentUid} is not an active agent of this company. Nothing was shared.`;
+    }
     return null;
 }
 function describeSecretAclPrincipal(principal) {
-    return principal.granteeType === "company-wide"
-        ? "@all (entire company, including guests)"
+    if (principal.granteeType === "company-wide") {
+        return "@all (entire company, including guests)";
+    }
+    return principal.label
+        ? `${principal.label} (${principal.granteeId})`
         : principal.granteeId;
 }
 // Mirrors hq-pro's server-authoritative KNOWN_DESTINATION_REGISTRY
@@ -1040,11 +1120,12 @@ export function registerSecretsCommand(program) {
         .description("Manage approved scripts for script-locked secrets");
     script
         .command("approve <path>")
-        .description("Approve a script for a secret path")
+        .description("Approve a script for a secret path. Each --id holds one approval: approving an id that is already approved for a different path or hash fails unless --replace is given. To let the same script run from several machines, approve one HQ-relative --remote-path instead of one absolute path per machine.")
         .requiredOption("--id <scriptId>", "Stable script identifier")
         .requiredOption("--script <path>", "Path to the local script file")
         .option("--remote-path <path>", "Script path to approve instead of the local path. A path relative to the HQ root (for example companies/<co>/skills/<skill>/<file>) matches on every HQ root; an absolute path must match the runtime's path exactly")
         .option("--attestation <level>", "Attestation level", "self-asserted-hash")
+        .option("--replace", "Replace the approval already stored under this --id (a different path or hash). Without it the command fails and keeps the existing approval")
         .action(async (secretPath, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "script approve");
@@ -1074,10 +1155,19 @@ export function registerSecretsCommand(program) {
                     scriptPath: approvedPath,
                     sha256: usage.script?.sha256,
                     attestationLevel: usage.script?.attestationLevel,
+                    ...(opts.replace ? { replace: true } : {}),
                 },
             });
             if (!res.ok) {
                 const body = (await res.json().catch(() => ({})));
+                if (res.status === 409 && body.code === "script_id_exists") {
+                    // The server kept the existing approval. Say so, and show how to
+                    // proceed, instead of a bare "Failed to approve script".
+                    const existing = body.existing;
+                    console.error(chalk.red(`Script id '${opts.id}' is already approved for '${secretPath}'${existing?.scriptPath ? ` with path ${existing.scriptPath}` : ""}. The existing approval was kept.`));
+                    console.error(`Re-run with --replace to replace it, approve this script under a new --id, or approve one HQ-relative --remote-path (for example companies/<co>/skills/<skill>/<file>) so one approval matches on every machine.`);
+                    process.exit(1);
+                }
                 console.error(chalk.red(`Failed to approve script: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
@@ -1087,7 +1177,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Failed to approve script: the server did not store an active approval for '${opts.id}' on '${secretPath}'. If this id was revoked before, approve the script under a new --id and pass that id to --script-id.`));
                 process.exit(1);
             }
-            console.log(chalk.green(`Approved script '${opts.id}' for '${secretPath}' (path: ${approvedPath}).`));
+            console.log(chalk.green(`Approved script '${opts.id}' for '${secretPath}' (path: ${approvedPath})${opts.replace ? ", replacing the previous approval under that id" : ""}.`));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -1482,8 +1572,8 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("share <path>")
-        .description("Share a secret with an email address, group, company Outpost (out_…), or the entire company (@all)")
-        .requiredOption("--with <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to share with")
+        .description("Share a secret with an email address, group, fleet agent (agt_…), company Outpost (out_…), or the entire company (@all)")
+        .requiredOption("--with <principal>", "Email address, group id, agt_ fleet agent uid, out_ Outpost id, or @all (entire company) to share with")
         .option("--permission <level>", "Permission level: read | write | admin (required, except for a company Outpost, which can only be given read and defaults to it)")
         .action(async (path, opts) => {
         try {
@@ -1512,6 +1602,13 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const target = await resolveSecretsTarget("secrets:share", "secrets share", secrets.opts());
+            if (principal.agentUid) {
+                const reason = await inactiveCompanyAgentReason(target.token, target.companyUid, principal.agentUid);
+                if (reason) {
+                    console.error(chalk.red(reason));
+                    process.exit(1);
+                }
+            }
             const res = await vaultApiFetch({
                 token: target.token,
                 path: target.aclPath("grant"),
@@ -1533,12 +1630,15 @@ export function registerSecretsCommand(program) {
                 }
                 else if (res.status === 403) {
                     console.error(chalk.red(target.isApiKey
-                        ? formatApiKeyCapabilityDenial(body, "Not authorized to share this secret")
-                        : "Not authorized to share this secret"));
+                        ? formatApiKeyCapabilityDenial(body, SECRET_SHARE_ADMIN_REQUIRED_MESSAGE)
+                        : SECRET_SHARE_ADMIN_REQUIRED_MESSAGE));
                 }
                 else if (res.status === 404) {
                     console.error(chalk.red("ACL record not found for this path — has the secret been created?"));
                 }
+                else if (res.status === 409 && body.code === SECRET_ACL_COVERED_BY_BROADER_ROW_CODE) {
+                    console.error(chalk.red(body.error ?? "This secret takes its access from a broader ACL. Share that path instead."));
+                }
                 else if (res.status === 409) {
                     console.error(chalk.red("Concurrent modification — please retry"));
                 }
@@ -1560,7 +1660,7 @@ export function registerSecretsCommand(program) {
     secrets
         .command("unshare <path>")
         .description("Remove a grant from a secret")
-        .requiredOption("--from <principal>", "Email address, group id, out_ Outpost id, or @all (entire company) to remove")
+        .requiredOption("--from <principal>", "Email address, group id, agt_ fleet agent uid, out_ Outpost id, or @all (entire company) to remove")
         .action(async (path, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "unshare");
@@ -1590,8 +1690,8 @@ export function registerSecretsCommand(program) {
                 }
                 else if (res.status === 403) {
                     console.error(chalk.red(target.isApiKey
-                        ? formatApiKeyCapabilityDenial(body, "Not authorized to modify this secret's ACL")
-                        : "Not authorized to modify this secret's ACL"));
+                        ? formatApiKeyCapabilityDenial(body, SECRET_SHARE_ADMIN_REQUIRED_MESSAGE)
+                        : SECRET_SHARE_ADMIN_REQUIRED_MESSAGE));
                 }
                 else if (res.status === 404) {
                     console.log(chalk.green(`Grant already absent for '${path}' / ${describeSecretAclPrincipal(principal)}`));

package/dist/commands/signals.js

@@ -49,10 +49,20 @@ function readActiveCompanySlug(hqRoot) {
         return undefined;
     }
 }
-function requireEntitySlug(flag, hqRoot) {
-    const slug = flag ?? readActiveCompanySlug(hqRoot);
+/**
+ * `--company` is accepted as a synonym for `--entity`, matching `hq meetings`
+ * and `hq integrations`. Passing both with different values is an error.
+ */
+function pickEntityFlag(entity, company) {
+    if (entity !== undefined && company !== undefined && entity !== company) {
+        throw new Error(`--entity '${entity}' and --company '${company}' disagree. Pass one of them.`);
+    }
+    return entity ?? company;
+}
+function requireEntitySlug(options, hqRoot) {
+    const slug = pickEntityFlag(options.entity, options.company) ?? readActiveCompanySlug(hqRoot);
     if (!slug) {
-        throw new Error("No entity specified. Pass --entity <slug> or run `hq signals entities` to see your options.");
+        throw new Error("No entity specified. Pass --entity <slug> (or --company <slug>) or run `hq signals entities` to see your options.");
     }
     return slug;
 }
@@ -93,7 +103,7 @@ async function runList(options) {
     // Throws InvalidSignalTypeError with the list of valid types if not in enum.
     assertSignalType(options.type);
     const signalType = options.type;
-    const slug = requireEntitySlug(options.entity, options.hqRoot);
+    const slug = requireEntitySlug(options, options.hqRoot);
     const limit = options.limit ? Number.parseInt(options.limit, 10) : 50;
     if (!Number.isFinite(limit) || limit <= 0) {
         throw new Error(`--limit must be a positive integer (got '${options.limit}')`);
@@ -136,7 +146,7 @@ async function runGet(options) {
     }
     assertSignalType(options.type);
     const signalType = options.type;
-    const slug = requireEntitySlug(options.entity, options.hqRoot);
+    const slug = requireEntitySlug(options, options.hqRoot);
     const format = options.format ?? defaultGetFormat();
     const accessToken = await resolveAccessToken();
     const vaultConfig = buildVaultConfig(accessToken);
@@ -225,6 +235,7 @@ export function registerSignalsCommand(program) {
         .command("list")
         .description("List signals of a given type for an entity")
         .option("--entity <slug>", "Entity slug (defaults to .hq/config.json activeCompany)")
+        .option("--company <slug>", "Company slug; same as --entity")
         .option("--type <signalType>", `Signal type: ${SIGNAL_TYPES.join(" | ")}`)
         .option("--limit <n>", "Max entries per page (default 50)")
         .option("--page-token <token>", "Continuation token from a prior page")
@@ -236,6 +247,7 @@ export function registerSignalsCommand(program) {
         .command("get")
         .description("Fetch a single signal by id")
         .option("--entity <slug>", "Entity slug (defaults to .hq/config.json activeCompany)")
+        .option("--company <slug>", "Company slug; same as --entity")
         .option("--type <signalType>", `Signal type: ${SIGNAL_TYPES.join(" | ")}`)
         .option("--id <signalId>", "Signal id (filename minus .md)")
         .option("--format <fmt>", "Output format: markdown | json (default: markdown for TTY, json piped)")

package/dist/commands/skill.js

@@ -28,7 +28,7 @@ import { AuthError } from "../utils/auth-error.js";
 import { redactErrorText } from "../utils/redact-error-text.js";
 import { stampVaultAccessDenied, vaultAccessDeniedDiagnostics, } from "../utils/vault-access-denied-error.js";
 import { PlanGateError } from "../utils/plan-gate-error.js";
-import { createPlanLimitRefusalTracker, trackingProgressRecorder, } from "../lib/billing/plan-limit-refusals.js";
+import { createPlanLimitRefusalTracker, REFUSAL_FALLBACK_SENTENCE, trackingProgressRecorder, } from "../lib/billing/plan-limit-refusals.js";
 export const SKILL_UID_PATTERN = /^skl_[A-Za-z0-9]+$/;
 export const SKILL_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
@@ -54,16 +54,16 @@ async function defaultSyncFile(input) {
     };
 }
 /**
- * The upload of a stamped skill file was refused by a plan limit. Registration
+ * The upload of a stamped skill file was refused (new files paused). Registration
  * and the local stamp already succeeded, so say that on stderr, then return a
- * typed plan gate for main.ts to render (reason and upgrade link) and exit
+ * typed plan gate for main.ts to render (reason and billing link) and exit
  * non-zero. Never "Skill ready … Sync: complete".
  */
 function skillUploadRefused(skillUid, filePath, companySlug, refused) {
-    console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${filePath}', but the upload was refused by your plan limit.`));
+    console.warn(chalk.yellow(`⚠ Skill ${skillUid} is stamped locally at '${filePath}', but the upload was refused: new files are paused for this account.`));
     return new PlanGateError("PLAN_LIMIT_EXCEEDED", {
-        reason: `${refused.message ?? "New files are paused by your plan limit."} ` +
-            "The skill file was not uploaded. Once the limit is sorted, upload it with: " +
+        reason: `${refused.message ?? REFUSAL_FALLBACK_SENTENCE} ` +
+            "The skill file was not uploaded. Once uploads resume, upload it with: " +
             `hq sync push --company ${companySlug} '${filePath}'`,
         ...(refused.upgradeUrl ? { upgradeUrl: refused.upgradeUrl } : {}),
     });

package/dist/commands/staff/listings.d.ts

@@ -0,0 +1,41 @@
+import { Command } from "commander";
+/**
+ * `hq staff listings {queue|approve|reject}` — marketplace moderation from the
+ * CLI. Thin wrappers over the vault-service moderation routes:
+ *
+ *   GET  /v1/moderation/queue               (queue)
+ *   POST /v1/moderation/listings/{id}       (approve | reject, body { action, note? })
+ *
+ * Every `hq publish` lands as `pending_review` and stays off the public
+ * marketplace until a staff member decides it. Before this command the only
+ * way to decide was the GTM admin web page. The server owns authorization
+ * (`isStaffEmail` on the id_token's email claim) and the state machine
+ * (pending_review -> approved | rejected, optimistic lock, superseding older
+ * approved versions). The moderation gate reads the `email` claim, which only
+ * the id_token carries, so this file uses `ensureCognitoIdToken`.
+ */
+export interface QueueItem {
+    listingId: string;
+    type?: string;
+    status?: string;
+    creatorHandle?: string;
+    name?: string;
+    slug?: string;
+    version?: string;
+    summary?: string;
+    createdAt?: string;
+    injectionScan?: {
+        flagged?: boolean;
+        flags?: unknown[];
+    };
+}
+export declare function renderQueue(items: QueueItem[]): string;
+export declare function runListingsQueue(): Promise<void>;
+export interface RunDecisionParams {
+    listingId: string;
+    note?: string;
+}
+export declare function runApproveListing(params: RunDecisionParams): Promise<void>;
+export declare function runRejectListing(params: RunDecisionParams): Promise<void>;
+export declare function registerListingsCommand(staff: Command): Command;
+//# sourceMappingURL=listings.d.ts.map

package/dist/commands/staff/listings.js

@@ -0,0 +1,160 @@
+import chalk from "chalk";
+import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
+import { vaultApiFetch } from "../../utils/vault-api.js";
+import { callerEmailFromToken, isStaffEmail } from "./reset-test-account.js";
+// ── Rendering ───────────────────────────────────────────────────────────────
+function renderQueueLine(item) {
+    const pack = `${item.slug ?? item.name ?? "?"}@${item.version ?? "?"}`;
+    const creator = item.creatorHandle ? `@${item.creatorHandle}` : chalk.dim("(no handle)");
+    const flag = item.injectionScan?.flagged
+        ? chalk.yellow(`  flagged (${item.injectionScan.flags?.length ?? 0})`)
+        : "";
+    const when = item.createdAt ? chalk.dim(`  ${item.createdAt}`) : "";
+    return `  ${item.listingId}  ${pack.padEnd(28)}  ${(item.type ?? "").padEnd(6)}  ${creator}${when}${flag}`;
+}
+export function renderQueue(items) {
+    if (items.length === 0) {
+        return chalk.dim("\n(no listings waiting for review)");
+    }
+    const lines = [chalk.bold(`\nListings waiting for review (${items.length}, oldest first)`)];
+    for (const item of items)
+        lines.push(renderQueueLine(item));
+    lines.push(chalk.dim("\nApprove with `hq staff listings approve <id>`, reject with `hq staff listings reject <id> --note <reason>`."));
+    return lines.join("\n");
+}
+// ── Shared helpers ──────────────────────────────────────────────────────────
+async function readBody(res) {
+    try {
+        return (await res.json());
+    }
+    catch {
+        return {};
+    }
+}
+function renderApiError(status, body) {
+    const code = typeof body.code === "string" ? body.code : undefined;
+    const message = typeof body.error === "string" ? body.error : `request failed (${status})`;
+    return code ? `${code}: ${message}` : message;
+}
+/**
+ * Local staff preflight so a non-staff caller stops before the round trip.
+ * The server remains the authorization boundary.
+ */
+async function requireStaffIdToken() {
+    const token = await ensureCognitoIdToken();
+    const callerEmail = callerEmailFromToken(token);
+    if (!callerEmail || !isStaffEmail(callerEmail)) {
+        throw new Error("hq staff listings requires a staff HQ session (@getindigo.ai, @hqforwork.com or @vyg.ai). " +
+            "Sign in with a staff account and retry.");
+    }
+    return token;
+}
+const LISTING_ID_RE = /^lst_[0-9A-Za-z]+$/;
+function requireListingId(listingId) {
+    const id = listingId.trim();
+    if (!LISTING_ID_RE.test(id)) {
+        throw new Error(`"${listingId}" is not a listing id (expected lst_…). Run \`hq staff listings queue\` to see ids.`);
+    }
+    return id;
+}
+// ── Runners ─────────────────────────────────────────────────────────────────
+export async function runListingsQueue() {
+    const token = await requireStaffIdToken();
+    const res = await vaultApiFetch({ token, path: "/v1/moderation/queue", method: "GET" });
+    const parsed = await readBody(res);
+    if (!res.ok)
+        throw new Error(renderApiError(res.status, parsed));
+    const queue = parsed.queue;
+    if (!Array.isArray(queue))
+        throw new Error("server did not return a moderation queue");
+    console.log(renderQueue(queue));
+}
+async function decide(action, params) {
+    const id = requireListingId(params.listingId);
+    const token = await requireStaffIdToken();
+    const body = { action };
+    if (params.note !== undefined && params.note.trim().length > 0)
+        body.note = params.note.trim();
+    const res = await vaultApiFetch({
+        token,
+        path: `/v1/moderation/listings/${encodeURIComponent(id)}`,
+        method: "POST",
+        body,
+    });
+    const parsed = await readBody(res);
+    if (!res.ok) {
+        const msg = renderApiError(res.status, parsed);
+        if (res.status === 409) {
+            throw new Error(`${msg} (the listing is no longer pending, or someone decided it at the same time)`);
+        }
+        throw new Error(msg);
+    }
+    return parsed;
+}
+function labelOf(listing, fallbackId) {
+    if (!listing)
+        return fallbackId;
+    return `${listing.slug ?? listing.name ?? fallbackId}@${listing.version ?? "?"} (${listing.listingId ?? fallbackId})`;
+}
+export async function runApproveListing(params) {
+    const result = await decide("approve", params);
+    console.log(chalk.green(`\n✓ approved ${labelOf(result.listing, params.listingId)}`));
+    const superseded = result.superseded ?? [];
+    if (superseded.length > 0) {
+        console.log(chalk.dim(`  superseded older versions: ${superseded.join(", ")}`));
+    }
+    console.log(chalk.dim("  It is now live in the marketplace (the public pack page refreshes within ~10 minutes)."));
+}
+export async function runRejectListing(params) {
+    const result = await decide("reject", params);
+    console.log(chalk.yellow(`\n✗ rejected ${labelOf(result.listing, params.listingId)}`));
+}
+// ── Commander wiring ────────────────────────────────────────────────────────
+function fail(err) {
+    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+    process.exit(1);
+}
+export function registerListingsCommand(staff) {
+    const group = staff
+        .command("listings")
+        .description("Review marketplace listings waiting for approval (staff only). Wraps /v1/moderation.");
+    group
+        .command("queue")
+        .description("List published packs waiting for review, oldest first.")
+        .action(async () => {
+        try {
+            await runListingsQueue();
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    group
+        .command("approve")
+        .description("Approve a pending listing so it goes live (older approved versions are superseded).")
+        .argument("<listingId>", "Listing id from `hq staff listings queue` (lst_…)")
+        .option("--note <text>", "Reviewer note recorded on the listing")
+        .action(async (listingId, opts) => {
+        try {
+            await runApproveListing({ listingId, note: opts.note });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    group
+        .command("reject")
+        .description("Reject a pending listing.")
+        .argument("<listingId>", "Listing id from `hq staff listings queue` (lst_…)")
+        .requiredOption("--note <reason>", "Why it was rejected (recorded on the listing)")
+        .action(async (listingId, opts) => {
+        try {
+            await runRejectListing({ listingId, note: opts.note });
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    return group;
+}
+//# sourceMappingURL=listings.js.map

package/dist/commands/staff/reset-test-account.d.ts

@@ -76,8 +76,9 @@ interface ExecuteResult {
  * non-staff caller stops before the round trip; the server remains the
  * authorization boundary (this file could not enforce it if it wanted to).
  *
- * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
- * do not qualify.
+ * The domain list matches the server's `SUPER_ADMIN_DOMAINS` (getindigo.ai,
+ * hqforwork.com, vyg.ai). Exact domain match: `foo@getindigo.ai.evil.test`
+ * and `bar@xgetindigo.ai` do not qualify.
  */
 export declare function isStaffEmail(candidate: unknown): boolean;
 /** Pull the caller email out of a locally cached id_token. */

package/dist/commands/staff/reset-test-account.js

@@ -10,8 +10,9 @@ import { vaultApiFetch } from "../../utils/vault-api.js";
  * non-staff caller stops before the round trip; the server remains the
  * authorization boundary (this file could not enforce it if it wanted to).
  *
- * Exact suffix match. `foo@getindigo.ai.evil.test` and `bar@xgetindigo.ai`
- * do not qualify.
+ * The domain list matches the server's `SUPER_ADMIN_DOMAINS` (getindigo.ai,
+ * hqforwork.com, vyg.ai). Exact domain match: `foo@getindigo.ai.evil.test`
+ * and `bar@xgetindigo.ai` do not qualify.
  */
 export function isStaffEmail(candidate) {
     if (typeof candidate !== "string")
@@ -20,7 +21,7 @@ export function isStaffEmail(candidate) {
     if (parts.length !== 2 || parts[0].length === 0)
         return false;
     const domain = parts[1];
-    return domain === "getindigo.ai" || domain === "hqforwork.com";
+    return domain === "getindigo.ai" || domain === "hqforwork.com" || domain === "vyg.ai";
 }
 /** Pull the caller email out of a locally cached id_token. */
 export function callerEmailFromToken(token) {

package/dist/commands/whoami.js

@@ -123,7 +123,7 @@ export function registerWhoamiCommand(program) {
         .command('whoami')
         .description('Show the currently authenticated user')
         .option('--json', 'Output identity metadata as JSON (never tokens)')
-        .option('--company <slug>', 'Also report this company\'s workspace plan state (Starter nag)')
+        .option('--company <slug>', 'Also report this company\'s billing and usage notice')
         .action(async (opts) => {
         try {
             // Effective source (same as auth status / ensureCognitoToken): env

package/dist/hook-engine-path.js

@@ -18,7 +18,7 @@ export async function runHookEnginePath(args) {
             console.log('Usage: hq core hook-engine-path [--repair] [--for-registration]\nResolve and pin the installed native hook engine offline.\n--for-registration prints a path only when the launcher flag is enabled.');
             return;
         }
-        const { installHookEngine, hookEngineRequired, HOOK_ENGINE_REPAIR } = await import('./lib/hook-engine/resolve.js');
+        const { installHookEngine, hookEngineRequired, removeHookEnginePointer, verifyHookEngine, HOOK_ENGINE_REPAIR } = await import('./lib/hook-engine/resolve.js');
         if (args.includes('--for-registration')) {
             const { launcherEnabled } = await import('./lib/hook-engine/registration.js');
             if (!launcherEnabled()) {
@@ -27,8 +27,19 @@ export async function runHookEnginePath(args) {
             }
         }
         const binary = installHookEngine({ repair: args.includes('--repair') });
-        if (binary)
+        if (binary) {
+            // The printed path is one that runs and reports as an hq-hook engine.
+            // A binary that cannot answer its self-check must not be bridged, so the
+            // shell pointer is removed and the command exits non-zero.
+            const problem = verifyHookEngine(binary);
+            if (problem) {
+                removeHookEnginePointer();
+                console.error(`${problem}. Existing bash hooks remain active. Repair: ${HOOK_ENGINE_REPAIR}`);
+                process.exitCode = 1;
+                return;
+            }
             console.log(binary);
+        }
         else {
             console.error(`Native hook engine missing; ${hookEngineRequired() ? 'repair before running hooks' : 'existing bash hooks remain active'}. Repair: ${HOOK_ENGINE_REPAIR}`);
             process.exitCode = 1;