@indigoai-us/hq-cli 5.345.159 → 5.345.161

package/dist/command-catalog.generated.js

@@ -1674,7 +1674,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "flags": "--company <slug>",
-                "description": "Also report this company's workspace plan state (Starter nag)",
+                "description": "Also report this company's billing and usage notice",
                 "hidden": false
             }
         ],
@@ -5517,6 +5517,32 @@ export const COMMAND_CATALOG = [
                     }
                 ],
                 "subcommands": []
+            },
+            {
+                "name": "assign",
+                "description": "Reassign a ticket to a person, including one another person has claimed",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <id>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "id",
+                        "required": true,
+                        "variadic": false,
+                        "description": "Feedback id (feedback_<uuid>)"
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--to <assignee>",
+                        "description": "New assignee: an email address or a prs_ uid",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
             }
         ]
     },
@@ -5533,7 +5559,7 @@ export const COMMAND_CATALOG = [
         "options": [
             {
                 "flags": "--company <slug>",
-                "description": "Company slug (for multi-company users)",
+                "description": "Company slug (defaults to the company this HQ session is bound to)",
                 "hidden": false
             },
             {
@@ -6624,6 +6650,11 @@ export const COMMAND_CATALOG = [
                         "description": "Read that app's client secret from stdin",
                         "hidden": false
                     },
+                    {
+                        "flags": "--scopes <list>",
+                        "description": "Permissions to request, space- or comma-separated (default: the permissions the app was approved for last time)",
+                        "hidden": false
+                    },
                     {
                         "flags": "--no-browser",
                         "description": "Print the sign-in URL instead of opening a browser",
@@ -6866,7 +6897,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--to <principal>",
-                        "description": "Email, uid, or `everyone`",
+                        "description": "Email, uid, vault group (grp_…), or `everyone`",
                         "hidden": false
                     },
                     {
@@ -6923,7 +6954,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--from <principal>",
-                        "description": "Email, uid, or `everyone`",
+                        "description": "Email, uid, vault group (grp_…), or `everyone`",
                         "hidden": false
                     },
                     {
@@ -7010,7 +7041,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--with <principal>",
-                        "description": "Email, uid, or `everyone`",
+                        "description": "Email, uid, vault group (grp_…), or `everyone`",
                         "hidden": false
                     },
                     {
@@ -7062,7 +7093,7 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--from <principal>",
-                        "description": "Email, uid, or `everyone`",
+                        "description": "Email, uid, vault group (grp_…), or `everyone`",
                         "hidden": false
                     },
                     {
@@ -10339,7 +10370,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "upgrade",
-                "description": "Open Stripe Checkout to upgrade a company on an earlier plan (usage-pricing companies have no plan to upgrade)",
+                "description": "Open the switch to usage pricing for a company on an earlier plan (usage-pricing companies have nothing to change)",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -10355,12 +10386,12 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--no-browser",
-                        "description": "Print the Stripe Checkout URL instead of opening it",
+                        "description": "Print the URL instead of opening it",
                         "hidden": false
                     },
                     {
                         "flags": "--json",
-                        "description": "Emit the Checkout URL as JSON",
+                        "description": "Emit the URL as JSON",
                         "hidden": false
                     }
                 ],
@@ -16486,6 +16517,11 @@ export const COMMAND_CATALOG = [
                 "helpText": [],
                 "arguments": [],
                 "options": [
+                    {
+                        "flags": "--refresh-flags",
+                        "description": "Refresh the offline session-start flag values from the registry",
+                        "hidden": false
+                    },
                     {
                         "flags": "--json",
                         "description": "JSON on stdout (always)",
@@ -16557,6 +16593,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -16636,6 +16677,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -16715,6 +16761,179 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--text <message>",
+                                "description": "Message text",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--text-file <path>",
+                                "description": "Read message text from a file",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--state <state>",
+                                "description": "Child state",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--note <note>",
+                                "description": "State note",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--timeout <seconds>",
+                                "description": "Wait timeout in seconds",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "ack",
+                        "description": "",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print JSON output (the default)",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--session-id <id>",
+                                "description": "Act as this session",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--link <id>",
+                                "description": "Conduct link id",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--child <name|all>",
+                                "description": "Child name or all children",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--name <name>",
+                                "description": "Child name",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--engine <engine>",
+                                "description": "Session engine",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--title <title>",
+                                "description": "Session title",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--host-session <id>",
+                                "description": "Host session id",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--text <message>",
+                                "description": "Message text",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--text-file <path>",
+                                "description": "Read message text from a file",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--state <state>",
+                                "description": "Child state",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--note <note>",
+                                "description": "State note",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--timeout <seconds>",
+                                "description": "Wait timeout in seconds",
+                                "hidden": false
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "capabilities",
+                        "description": "",
+                        "aliases": [],
+                        "hidden": false,
+                        "helpOption": true,
+                        "helpCommand": false,
+                        "usage": "[options]",
+                        "helpText": [],
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print JSON output (the default)",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--session-id <id>",
+                                "description": "Act as this session",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--link <id>",
+                                "description": "Conduct link id",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--child <name|all>",
+                                "description": "Child name or all children",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--name <name>",
+                                "description": "Child name",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--engine <engine>",
+                                "description": "Session engine",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--title <title>",
+                                "description": "Session title",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--host-session <id>",
+                                "description": "Host session id",
+                                "hidden": false
+                            },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -16794,6 +17013,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -16873,6 +17097,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -16952,6 +17181,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -17031,6 +17265,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -17110,6 +17349,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -17189,6 +17433,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -17268,6 +17517,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -17347,6 +17601,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Host session id",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--claims <ids>",
+                                "description": "Exact comma-separated recipient receipt IDs",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--text <message>",
                                 "description": "Message text",
@@ -17391,6 +17650,11 @@ export const COMMAND_CATALOG = [
                                 "description": "Hook event",
                                 "hidden": false
                             },
+                            {
+                                "flags": "--ack-mode <mode>",
+                                "description": "Internal explicit recipient acknowledgement",
+                                "hidden": false
+                            },
                             {
                                 "flags": "--json",
                                 "description": "JSON on stdout (always)",

package/dist/commands/access.d.ts

@@ -15,6 +15,7 @@
  */
 import { Command } from "commander";
 import { type CompanyBrowseClientFactory, type FilesBrowseVaultClient, type RunGetResult } from "./files-browse.js";
+import { type AclLock } from "./acl-lock.js";
 export type AccessOutcome = "never-existed" | "local" | "not-synced" | "no-access" | "ambiguous" | "pending-confirmation";
 export interface AccessAclTree {
     prefix: string;
@@ -145,6 +146,11 @@ export interface RunAccessResult {
     requestSentAt?: string;
     alreadyAskedAt?: string;
     requestNote?: string;
+    /**
+     * Most-specific ACL row covering the path when it has no grants. Broader
+     * grants (including a root `*` company-wide grant) do not apply.
+     */
+    lockedBy?: AclLock;
 }
 export interface AccessAsResult {
     personUid: string;

package/dist/commands/access.js

@@ -23,6 +23,7 @@ import { getCompanyUid, vaultApiFetch, resolveCallerUid } from "../utils/vault-a
 import { parseCompanySlugFromPath, classifyAclSource, resolveBrowseSession, makeCompanyPresignFactory, runGet, toBucketRelative, } from "./files-browse.js";
 import { listJournals, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { listActiveMembers } from "./members.js";
+import { aclLockedBy } from "./acl-lock.js";
 import { buildDmBody } from "./dm.js";
 import { peekIdToken } from "../utils/id-token.js";
 import { findRecentAccessRequest, formatTimeAgo, recordAccessRequest, } from "../utils/access-requests.js";
@@ -458,10 +459,23 @@ async function completeTarget(input, deps, located) {
     const { resolvedKey, directory, vendDenied, listDenied, verdict, steps } = located;
     const resolvedPath = `companies/${slug}/${resolvedKey}`;
     let noAccess = vendDenied || listDenied;
+    // Name the empty fencing row only when the tree denies access. A role
+    // bypass or creator grant still reads the same as the acl/resolve fast
+    // path, which never fetches the tree.
+    const lockRow = verdict.kind === "tree" && aclDenied(verdict.tree) ? aclLockedBy(verdict.tree) : null;
+    const lockedBy = lockRow
+        ? { ...lockRow, path: `companies/${slug}/${toBucketRelative(lockRow.path, slug)}` }
+        : undefined;
+    if (lockedBy) {
+        steps.push(lockedBy.readUnknown
+            ? `acl: locked by ${lockedBy.path} unless that row is open (it has no grants; broader grants such as * apply only if it is open)`
+            : `acl: locked by ${lockedBy.path} (that row has no grants and is not open; broader grants such as * do not apply)`);
+    }
     if (verdict.kind === "resolved") {
         steps.push(`acl: ${verdict.permission}`);
     }
-    else if (verdict.tree == null || treeIsEmpty(verdict.tree)) {
+    else if (verdict.tree == null ||
+        (treeIsEmpty(verdict.tree) && !verdict.tree.coveringAclPath)) {
         steps.push("acl: no record (membership-distributed)");
     }
     else if (aclDenied(verdict.tree)) {
@@ -687,6 +701,7 @@ async function completeTarget(input, deps, located) {
         ...(requestSentAt ? { requestSentAt } : {}),
         ...(alreadyAskedAt ? { alreadyAskedAt } : {}),
         ...(requestNote ? { requestNote } : {}),
+        ...(lockedBy ? { lockedBy } : {}),
     }, finishCtx);
     return result;
 }
@@ -834,6 +849,8 @@ function jsonPayload(result) {
         payload.requestSentAt = result.requestSentAt;
     if (result.alreadyAskedAt)
         payload.alreadyAskedAt = result.alreadyAskedAt;
+    if (result.lockedBy)
+        payload.lockedBy = result.lockedBy;
     return payload;
 }
 function emit(input, result, log) {

package/dist/commands/acl-lock.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Empty-row lock detection for ACL tree responses (feedback dd287b55).
+ *
+ * The server resolves a path against its most-specific matching FILE_ACL row
+ * (`coveringAclPath` on the ACL tree response). Enforcement (files-presign,
+ * files-list, content) runs resolveEffectivePermission in hq-pro-core
+ * src/tenant-contracts/acl-permission.ts with `unionGrants: true`: grants on
+ * every matching row are unioned, except that an EMPTY, NON-OPEN winning row
+ * fences the path and grants nothing (only the row's creator and the
+ * owner/admin role bypass keep access). An OPEN empty winning row is not a
+ * fence: it floors every member at read and broader grants still apply.
+ */
+export interface AclLockTree {
+    prefix: string;
+    direct: unknown[];
+    inherited: Array<{
+        sourcePrefix: string;
+    }>;
+    directRow: {
+        open: boolean;
+    } | null;
+    coveringAclPath?: string | null;
+}
+export interface AclLock {
+    /** Path of the empty most-specific row. */
+    path: string;
+    /**
+     * True when the row's `open` flag is unknown. The tree reports `open` only
+     * for the exact prefix row (directRow), not for ancestor rows. Such a row is
+     * a lock if it is not open; if it is open, broader grants still apply.
+     */
+    readUnknown: boolean;
+}
+/**
+ * The empty, non-open row that fences `tree.prefix`, or null when the
+ * most-specific row grants something, is open, or no row covers the path.
+ */
+export declare function aclLockedBy(tree: AclLockTree | null | undefined): AclLock | null;
+/** One-line description of the lock for human output. */
+export declare function describeAclLock(lock: AclLock, display: string): string;
+//# sourceMappingURL=acl-lock.d.ts.map

package/dist/commands/acl-lock.js

@@ -0,0 +1,28 @@
+/**
+ * The empty, non-open row that fences `tree.prefix`, or null when the
+ * most-specific row grants something, is open, or no row covers the path.
+ */
+export function aclLockedBy(tree) {
+    const covering = tree?.coveringAclPath;
+    if (!tree || typeof covering !== "string" || covering === "")
+        return null;
+    if (covering === tree.prefix) {
+        if (!tree.directRow || tree.directRow.open === true)
+            return null;
+        if (!Array.isArray(tree.direct) || tree.direct.length > 0)
+            return null;
+        return { path: covering, readUnknown: false };
+    }
+    const inherited = Array.isArray(tree.inherited) ? tree.inherited : [];
+    if (inherited.some((entry) => entry.sourcePrefix === covering))
+        return null;
+    return { path: covering, readUnknown: true };
+}
+/** One-line description of the lock for human output. */
+export function describeAclLock(lock, display) {
+    if (lock.readUnknown) {
+        return `Locked by ${display} unless that row is open: it has no grants, so grants on broader prefixes apply only if it is open.`;
+    }
+    return `Locked by ${display}: that ACL row has no grants and is not open, so grants on broader prefixes do not apply. Only the row's creator and the owner/admin role bypass have access.`;
+}
+//# sourceMappingURL=acl-lock.js.map

package/dist/commands/agent-enroll.d.ts

@@ -60,6 +60,8 @@ export declare function mapEnrollFailure(status: number, body: {
     attemptsRemaining?: unknown;
     upgradeUrl?: unknown;
     pricingPlan?: unknown;
+    usagePause?: unknown;
+    billingState?: unknown;
 }, headers?: {
     retryAfter?: string | null;
 }): EnrollError;

package/dist/commands/agent-enroll.js

@@ -21,7 +21,7 @@ import * as path from "node:path";
 import { CLI_VERSION } from "../cli-version.js";
 import { DEFAULT_VAULT_API_URL, personTokenCacheFile, } from "../utils/cognito-session.js";
 import { HQ_CLIENT_NAME } from "../utils/vault-api.js";
-import { isUsageOnly, pricingPlanFromBody, usageOnlyCardRequiredLines, } from "../lib/billing/usage-only.js";
+import { isUsageOnly, pricingPlanFromBody, usageOnlyCardRequiredLines, usagePauseFromBody, } from "../lib/billing/usage-only.js";
 import { queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, } from "../utils/cli-telemetry.js";
 import { networkTransportErrorCode } from "../utils/network-transport-error.js";
 import { canOfferTeamUpgrade, formatUpgradeRefusal, isPlanGateError, offerUpgradeLink, planGateErrorFromPayload, } from "../utils/plan-gate-error.js";
@@ -139,6 +139,11 @@ export function mapEnrollFailure(status, body, headers) {
         return new EnrollError(`This agent was revoked; its enrollment code no longer works. An admin must ` +
             `create a new external agent or rotate this one.${suffix}`, status, code);
     }
+    // US-024: a usage pause is the server's own answer: its message and link.
+    const usagePause = status === 402 ? usagePauseFromBody(body) : null;
+    if (usagePause) {
+        return new EnrollError(usagePause.message, status, code, usagePause.actionUrl);
+    }
     if ((status === 402 || code === "billing_required") &&
         isUsageOnly(pricingPlanFromBody(body))) {
         // Usage pricing (US-012): no paid plan to upgrade to. A company admin adds
@@ -146,8 +151,8 @@ export function mapEnrollFailure(status, body, headers) {
         return new EnrollError(usageOnlyCardRequiredLines("An external agent").join(" ") + suffix, status, code);
     }
     if (status === 402 || code === "billing_required") {
-        return new EnrollError(`External agents are available on paid HQ plans only. A company admin must ` +
-            `upgrade the plan (\`hq billing\` or the console billing page) before enrolling.${suffix}`, status, code, typeof body.upgradeUrl === "string" ? body.upgradeUrl : undefined);
+        return new EnrollError(`External agents need billing set up for this company. A company admin can ` +
+            `add a card with \`hq billing checkout\` or on the console Billing page, then enroll again.${suffix}`, status, code, typeof body.upgradeUrl === "string" ? body.upgradeUrl : undefined);
     }
     if (status === 429 || code === "rate_limited") {
         const retryAfter = headers?.retryAfter?.trim();
@@ -425,7 +430,7 @@ export function registerAgentEnrollCommand(agent) {
                     }
                     catch (openErr) {
                         const message = openErr instanceof Error ? openErr.message : String(openErr);
-                        console.error(chalk.dim(`Could not open the upgrade link automatically: ${message}`));
+                        console.error(chalk.dim(`Could not open the billing link automatically: ${message}`));
                     }
                 }
             }