@indigoai-us/hq-cli 5.345.169 → 5.345.171

package/dist/commands/integrations-api.d.ts

@@ -161,7 +161,10 @@ export interface InstallInput {
         placement: "header";
         header: string;
     };
+    scope?: ConnectScope;
 }
+export type ConnectScope = "personal" | "company";
+export declare function scopeUnavailableMessage(scope: ConnectScope): string;
 export declare function installIntegration(token: string, companyUid: string, input: InstallInput): Promise<InstallResult>;
 export declare function uninstallIntegration(token: string, companyUid: string, target: {
     installationId: string;
@@ -227,6 +230,7 @@ export interface OAuthStartInput {
      * direct `mcpUrl` path.
      */
     scopes?: string[];
+    scope?: ConnectScope;
 }
 export declare function startOAuth(token: string, companyUid: string, input: OAuthStartInput): Promise<OAuthStartResult>;
 export declare function completeOAuth(token: string, companyUid: string, input: {

package/dist/commands/integrations-api.js

@@ -53,6 +53,22 @@ export async function discoverDocs(token, companyUid, docsUrl) {
         await raiseForResponse(res, "Failed to read that documentation page");
     return (await res.json());
 }
+export function scopeUnavailableMessage(scope) {
+    const flag = scope === "personal" ? "--personal" : "--company-owned";
+    return ("Personal and company integrations aren't turned on for this company yet. " +
+        `Run the command again without ${flag} to connect the usual way.`);
+}
+async function raiseForConnectResponse(res, fallback, scope) {
+    try {
+        return await raiseForResponse(res, fallback);
+    }
+    catch (error) {
+        if (scope && error instanceof IntegrationsCliError && error.status === 404 && !error.code) {
+            throw new IntegrationsCliError(scopeUnavailableMessage(scope), { expected: true, status: 404 });
+        }
+        throw error;
+    }
+}
 export async function installIntegration(token, companyUid, input) {
     const res = await vaultApiFetch({
         token,
@@ -62,7 +78,7 @@ export async function installIntegration(token, companyUid, input) {
     });
     if (!res.ok) {
         try {
-            await raiseForResponse(res, "Failed to connect the app");
+            await raiseForConnectResponse(res, "Failed to connect the app", input.scope);
         }
         catch (error) {
             if (error instanceof IntegrationsCliError &&
@@ -106,7 +122,7 @@ export async function startOAuth(token, companyUid, input) {
         body: { companyUid, ...input },
     });
     if (!res.ok)
-        await raiseForResponse(res, "Failed to start sign-in");
+        await raiseForConnectResponse(res, "Failed to start sign-in", input.scope);
     return (await res.json());
 }
 export async function completeOAuth(token, companyUid, input) {

package/dist/commands/integrations-connect.d.ts

@@ -27,7 +27,7 @@ import { type ResidentCommandLeaseOptions } from "../utils/resident-package-prel
 import { consoleOrigin } from "../utils/console-origin.js";
 export { consoleOrigin };
 import type { AdminConnection } from "./integrations-core.js";
-import { type InstallInput } from "./integrations-api.js";
+import { type ConnectScope, type InstallInput } from "./integrations-api.js";
 interface ConnectOptions {
     company?: string;
     entryId?: string;
@@ -54,7 +54,10 @@ interface ConnectOptions {
      * to a person and check `hq integrations list` afterwards.
      */
     linkOnly?: boolean;
+    personal?: boolean;
+    companyOwned?: boolean;
 }
+export declare function connectScopeFromOptions(opts: Pick<ConnectOptions, "personal" | "companyOwned">): ConnectScope | undefined;
 /**
  * Validate `--auth` against the supported enum, rejecting an unknown value
  * before anything is installed. A finite provider/runtime option must never be
@@ -69,7 +72,7 @@ export declare function shellQuote(value: string): string;
 /** Everything the connect verbs need to name one app to hq-pro. */
 interface ConnectTarget {
     /** Install/OAuth identity fields, exactly as hq-pro expects them. */
-    ref: Pick<InstallInput, "domain" | "query" | "catalogEntryId" | "discoveryReceiptId" | "mcpUrl" | "provider" | "displayName" | "docsUrl">;
+    ref: Pick<InstallInput, "domain" | "query" | "catalogEntryId" | "discoveryReceiptId" | "mcpUrl" | "provider" | "displayName" | "docsUrl" | "scope">;
     /** Best-known auth mode before hq-pro is asked; `undefined` = unknown. */
     authClass?: "none" | "key" | "oauth";
     /** Human label for prompts and success lines. */
@@ -109,6 +112,10 @@ export declare function bringYourOwnClientHandoff(target: ConnectTarget, opts: C
  * built, so the hint always names the URL Google will actually be sent.
  */
 export declare function googleClientTypeHint(clientId: string, authorizationUrl: string): string | null;
-export declare function findAlreadyConnected(connections: readonly AdminConnection[], app: string): AdminConnection | undefined;
+export interface ConnectOwnership {
+    scope: ConnectScope;
+    viewerPersonUid?: string;
+}
+export declare function findAlreadyConnected(connections: readonly AdminConnection[], app: string, ownership?: ConnectOwnership): AdminConnection | undefined;
 export declare function registerConnectCommands(integrations: Command): void;
 //# sourceMappingURL=integrations-connect.d.ts.map

package/dist/commands/integrations-connect.js

@@ -31,7 +31,7 @@ import { consoleOrigin } from "../utils/console-origin.js";
 export { consoleOrigin };
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, connectionDomain, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, connectionAccountLabel, connectionDomain, connectionOwnerLabel, fetchAdminSurface, printJson, revokedConnectionDetails, resolveConnection, } from "./integrations-core.js";
 import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBlueprint, startOAuth, } from "./integrations-api.js";
 import { OAUTH_LOOPBACK_TIMEOUT_CODE, startLoopbackListener, } from "./integrations-oauth.js";
 /** hq-pro's machine code for "this endpoint needs a browser sign-in". */
@@ -103,6 +103,19 @@ const BRING_YOUR_OWN_CLIENT_CODES = new Set([
     "OAUTH_REGISTRATION_UNSUPPORTED",
     "CLIENT_REGISTRATION_REFUSED",
 ]);
+export function connectScopeFromOptions(opts) {
+    if (opts.personal && opts.companyOwned) {
+        throw new IntegrationsCliError("--personal and --company-owned cannot be used together; pick one.", { expected: true });
+    }
+    if (opts.personal)
+        return "personal";
+    if (opts.companyOwned)
+        return "company";
+    return undefined;
+}
+function scopeFlag(scope) {
+    return scope === "personal" ? "--personal" : "--company-owned";
+}
 /**
  * Server-side limits, restated here so a typo fails in the terminal with a
  * sentence rather than as an opaque 400 three network hops away. Kept in step
@@ -758,6 +771,10 @@ async function consoleHandoff(target, opts) {
     if (opts.scopes) {
         console.error(chalk.yellow(`Note: --scopes cannot be carried into a console sign-in, so this connect will use ${target.label}'s default permissions.`));
     }
+    const scope = connectScopeFromOptions(opts);
+    if (scope) {
+        console.error(chalk.yellow(`Note: ${scopeFlag(scope)} cannot be carried into a console sign-in; choose who owns ${target.label} on the console page.`));
+    }
     if (url && opts.browser !== false)
         await open(url).catch((error) => warnBrowserOpenFailure(error));
     console.error(chalk.dim("When the browser says it connected, run `hq integrations list` to confirm."));
@@ -820,6 +837,9 @@ function byoClientCommand(target, opts) {
     // caller a line that reproduces the failure they are recovering from.
     if (opts.scopes)
         parts.push(`--scopes ${shellQuote(opts.scopes)}`);
+    const scope = connectScopeFromOptions(opts);
+    if (scope)
+        parts.push(scopeFlag(scope));
     return parts.join(" ");
 }
 /**
@@ -1035,6 +1055,7 @@ async function targetForAccessKeyConnect(token, companyUid, target, opts) {
     return {
         ref: {
             mcpUrl,
+            ...(target.ref.scope ? { scope: target.ref.scope } : {}),
             ...(opts.provider ? { provider: opts.provider } : blueprint.provider ? { provider: blueprint.provider } : {}),
             ...(opts.displayName
                 ? { displayName: opts.displayName }
@@ -1079,7 +1100,9 @@ function reportInstall(result, opts, expectedRevivedConnectionId) {
  * URL: hq-pro recognizes the domain and revives the revoked row in place.
  */
 async function connectApp(token, companyUid, app, opts, expectedRevivedConnectionId) {
-    const target = await resolveTarget(token, companyUid, app, opts, expectedRevivedConnectionId !== undefined);
+    const resolved = await resolveTarget(token, companyUid, app, opts, expectedRevivedConnectionId !== undefined);
+    const scope = connectScopeFromOptions(opts);
+    const target = scope ? { ...resolved, ref: { ...resolved.ref, scope } } : resolved;
     const authMode = opts.authHeader
         ? "key"
         : opts.auth ?? target.authClass;
@@ -1205,7 +1228,16 @@ function isSettledInstallation(connection) {
     const status = connection.installation?.status?.trim().toLowerCase();
     return status === undefined || status === "" || status === "installed";
 }
-export function findAlreadyConnected(connections, app) {
+function hasRequestedOwnership(connection, ownership) {
+    const ownerType = connection.ownerType;
+    if (ownership.scope === "personal") {
+        return (ownerType === "person" &&
+            Boolean(ownership.viewerPersonUid) &&
+            connection.ownerId === ownership.viewerPersonUid);
+    }
+    return ownerType === undefined || ownerType === "company" || ownerType === "legacy";
+}
+export function findAlreadyConnected(connections, app, ownership) {
     const want = app.trim().toLowerCase();
     if (want === "")
         return undefined;
@@ -1215,6 +1247,8 @@ export function findAlreadyConnected(connections, app) {
             return false;
         if (!isSettledInstallation(connection))
             return false;
+        if (ownership && !hasRequestedOwnership(connection, ownership))
+            return false;
         const domain = (connectionDomain(connection) ?? "").toLowerCase();
         if (domain === want || domain.endsWith(`.${want}`))
             return true;
@@ -1254,22 +1288,31 @@ async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
     // the deliberate "yes, add another one" escape hatch.
     if (!app || opts.force || opts.mcpUrl || opts.docsUrl || opts.entryId)
         return false;
+    const requestedScope = connectScopeFromOptions(opts);
     let connections;
     let viewer;
+    let personalConnect;
     try {
         const surface = await fetchAdminSurface(token, companyUid);
         connections = surface.connections ?? [];
         viewer = surface.viewer;
+        personalConnect = surface.capabilities?.personalConnect === true;
     }
     catch {
         // Never let this convenience check block a connect. If the list cannot be
         // read, fall through and let the real flow report whatever is wrong.
         return false;
     }
-    const existing = findAlreadyConnected(connections, app);
+    const scope = requestedScope ?? (personalConnect ? "personal" : undefined);
+    const ownership = scope
+        ? { scope, ...(viewer?.personUid ? { viewerPersonUid: viewer.personUid } : {}) }
+        : undefined;
+    const existing = findAlreadyConnected(connections, app, ownership);
     if (!existing)
         return false;
     const slug = bareProvider(existing.provider);
+    const owner = connectionOwnerLabel(existing);
+    const account = connectionAccountLabel(existing);
     if (opts.json) {
         printJson({
             ok: true,
@@ -1277,11 +1320,14 @@ async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
             provider: slug,
             connection: existing.id,
             ...(connectionDomain(existing) ? { domain: connectionDomain(existing) } : {}),
+            ...(existing.ownerType ? { ownerType: existing.ownerType } : {}),
+            ...(existing.accountLabel ? { accountLabel: existing.accountLabel } : {}),
         });
         return true;
     }
     const label = redactUrlsInText(existing.installation?.displayName ?? slug);
-    console.log(chalk.green(`${label} is already connected.`));
+    const detail = [owner, account].filter(Boolean).join(", ");
+    console.log(chalk.green(`${label} is already connected${detail ? ` (${detail})` : ""}.`));
     if (connectedBySomeoneElse(existing, viewer)) {
         // Members may add apps and reconnect their own, but replacing a connection
         // someone else created stays with an owner or admin: the server refuses
@@ -1291,7 +1337,7 @@ async function refuseIfAlreadyConnected(token, companyUid, app, opts) {
         return true;
     }
     console.log(chalk.dim(`  Sign in again:  hq integrations reconnect --provider ${slug}\n` +
-        `  Add a second:   hq integrations connect ${shellQuote(app)} --force`));
+        `  Add a second:   hq integrations connect ${shellQuote(app)}${requestedScope ? ` ${scopeFlag(requestedScope)}` : ""} --force`));
     return true;
 }
 export function registerConnectCommands(integrations) {
@@ -1425,8 +1471,11 @@ export function registerConnectCommands(integrations) {
         .option("--timeout <seconds>", "How long to wait for a browser sign-in (default 300)")
         .option("--link-only", "Print the sign-in link and exit without waiting; the sign-in finishes on the HQ console")
         .option("--force", "Connect again even if this app is already connected")
+        .option("--personal", "Connect it as your own personal connection (not --company <slug>, which picks the company)")
+        .option("--company-owned", "Connect it as a connection the whole company owns (needs permission to add company apps)")
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {
+        connectScopeFromOptions(opts);
         assertAuthMode(opts.auth);
         assertAuthHeader(opts.authHeader);
         if (opts.authHeader && opts.auth !== undefined && opts.auth !== "key") {
@@ -1453,6 +1502,8 @@ export function registerConnectCommands(integrations) {
         .option("--no-browser", "Print the sign-in URL instead of opening a browser")
         .option("--timeout <seconds>", "How long to wait for a browser sign-in (default 300)")
         .option("--connect", "For a revoked row, run `connect <domain>` to re-add and revive it")
+        .option("--personal", "With --connect: re-add it as your own personal connection")
+        .option("--company-owned", "With --connect: re-add it as a connection the whole company owns")
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {
         // Same validation as `connect`. Without it a typo like `--auth oauth2`
@@ -1460,11 +1511,19 @@ export function registerConnectCommands(integrations) {
         // silently reinstalls with auto-detection — the caller believes they
         // forced a mode that was never applied.
         assertAuthMode(opts.auth);
+        const scope = connectScopeFromOptions(opts);
+        if (scope && !opts.connect) {
+            throw new IntegrationsCliError(`${scopeFlag(scope)} only applies with --connect, when a revoked app is added again.`, { expected: true });
+        }
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connection = await resolveConnection(token, companyUid, app, opts, {
             allowSingleRevoked: Boolean(opts.connect),
         });
+        if (scope && connection.status !== "revoked") {
+            throw new IntegrationsCliError(`${scopeFlag(scope)} only applies when --connect adds a revoked app again; this one is ${connection.status}. ` +
+                "A reconnect keeps the connection's current owner.", { expected: true });
+        }
         if (connection.status === "revoked") {
             const details = revokedConnectionDetails(connection, opts.company);
             if (!opts.connect) {
@@ -1492,6 +1551,11 @@ export function registerConnectCommands(integrations) {
                 ...(connection.installation?.displayName
                     ? { displayName: connection.installation.displayName }
                     : {}),
+                ...(connection.ownerType === "company"
+                    ? { scope: "company" }
+                    : connection.ownerType === "person"
+                        ? { scope: "personal" }
+                        : {}),
             },
             ...(opts.auth ? { authClass: opts.auth } : {}),
             label: connection.installation?.displayName ?? bareProvider(connection.provider),

package/dist/commands/integrations-core.d.ts

@@ -74,7 +74,11 @@ export interface AdminConnection {
         grantCount?: number;
     };
     installation?: FactoryInstallation | null;
+    ownerType?: ConnectionOwnerType;
+    ownerId?: string;
+    accountLabel?: string;
 }
+export type ConnectionOwnerType = "person" | "company" | "legacy" | "invalid";
 /**
  * The actionable state returned instead of attempting to use a revoked
  * connection. Keep this machine-readable so commands and scripts get the same
@@ -111,6 +115,9 @@ export interface AdminSurface {
          */
         canAddIntegrations?: boolean;
     };
+    capabilities?: {
+        personalConnect?: boolean;
+    };
     connections: AdminConnection[];
     audit: AdminAuditEvent[];
 }
@@ -390,4 +397,20 @@ export declare function printIntegrationCallResultJson(value: unknown): void;
  * a user to fix something that is not broken.
  */
 export declare function printHealthNotice(connection: AdminConnection): void;
+export declare function connectionOwnerLabel(connection: Pick<AdminConnection, "ownerType">): string | undefined;
+export declare function connectionAccountLabel(connection: Pick<AdminConnection, "accountLabel">): string | undefined;
+export interface IntegrationAccountCandidate {
+    connectionId: string;
+    provider: string;
+    ownerType?: string;
+    accountLabel?: string;
+}
+export declare const ACCOUNT_REQUIRED_CODE = "AccountRequired";
+export declare const ACCOUNT_NOT_FOUND_CODE = "IntegrationAccountNotFound";
+export declare function accountSelectionMessage(code: typeof ACCOUNT_REQUIRED_CODE | typeof ACCOUNT_NOT_FOUND_CODE, candidates: readonly IntegrationAccountCandidate[], account?: string, rerun?: string): string;
+export declare function accountCandidateFor(connection: AdminConnection): IntegrationAccountCandidate;
+export declare function selectAccountConnections(connections: readonly AdminConnection[], opts: {
+    account: string;
+    provider?: string;
+}): AdminConnection[];
 //# sourceMappingURL=integrations-core.d.ts.map

package/dist/commands/integrations-core.js

@@ -397,6 +397,9 @@ export async function fetchAdminSurface(token, companyUid) {
     return {
         companyUid: data.companyUid ?? companyUid,
         ...(data.factoryEnabled !== undefined ? { factoryEnabled: data.factoryEnabled } : {}),
+        ...(data.capabilities && typeof data.capabilities === "object"
+            ? { capabilities: data.capabilities }
+            : {}),
         viewer: data.viewer ?? {
             personUid: "",
             role: "member",
@@ -717,6 +720,9 @@ export async function callGateway(token, params, idempotencyKey, method = "tools
         throw new IntegrationsCliError(`Integration gateway request failed (HTTP ${res.status}).`, { expected: isClientError(res.status), status: res.status, gatewaySubcommand });
     }
     if (terminalMessage?.error) {
+        const accountError = accountSelectionError(terminalMessage.error, typeof params.account === "string" ? params.account : undefined);
+        if (accountError)
+            throw accountError;
         const gatewayError = gatewayErrorDetails(terminalMessage.error);
         const invalidEnvelope = gatewayError.rpcCode === undefined && !gatewayError.message;
         const gatewayFailureCode = invalidEnvelope
@@ -890,4 +896,98 @@ export function printHealthNotice(connection) {
     if (notice.remediation)
         console.log(chalk.yellow(`  ${redactUrlsInText(notice.remediation)}`));
 }
+const OWNER_LABELS = {
+    person: "Personal",
+    company: "Company",
+    legacy: "Shared (legacy)",
+    invalid: "Unknown owner",
+};
+export function connectionOwnerLabel(connection) {
+    const ownerType = connection.ownerType;
+    return ownerType && Object.hasOwn(OWNER_LABELS, ownerType) ? OWNER_LABELS[ownerType] : undefined;
+}
+export function connectionAccountLabel(connection) {
+    if (typeof connection.accountLabel !== "string")
+        return undefined;
+    const cleaned = safeAppName(connection.accountLabel, "");
+    return cleaned ? redactUrlsInText(cleaned) : undefined;
+}
+export const ACCOUNT_REQUIRED_CODE = "AccountRequired";
+export const ACCOUNT_NOT_FOUND_CODE = "IntegrationAccountNotFound";
+function accountCandidatesFrom(value) {
+    if (!Array.isArray(value))
+        return [];
+    const candidates = [];
+    for (const item of value) {
+        const record = recordValue(item);
+        if (!record || typeof record.connectionId !== "string" || typeof record.provider !== "string")
+            continue;
+        candidates.push({
+            connectionId: record.connectionId,
+            provider: record.provider,
+            ...(typeof record.ownerType === "string" ? { ownerType: record.ownerType } : {}),
+            ...(typeof record.accountLabel === "string" ? { accountLabel: record.accountLabel } : {}),
+        });
+    }
+    return candidates;
+}
+function formatAccountCandidate(candidate) {
+    const id = safeAppName(candidate.connectionId, "?");
+    const owner = connectionOwnerLabel({ ownerType: candidate.ownerType });
+    const label = connectionAccountLabel({ accountLabel: candidate.accountLabel });
+    const details = [safeAppName(bareProvider(candidate.provider), "?"), owner, label].filter(Boolean).join(" · ");
+    return `  ${id}  ${details}`;
+}
+export function accountSelectionMessage(code, candidates, account, rerun = "Rerun with --account <connection id or account label>.") {
+    const headline = code === ACCOUNT_REQUIRED_CODE
+        ? `More than one account can run this. ${rerun}`
+        : account
+            ? `No account matches '${safeAppName(account, "?")}'. ${rerun}`
+            : "No account you can use has this tool.";
+    if (candidates.length === 0)
+        return headline;
+    return [headline, "Accounts:", ...candidates.map(formatAccountCandidate)].join("\n");
+}
+function accountSelectionError(error, account) {
+    const data = recordValue(recordValue(error)?.data);
+    const code = data?.code;
+    if (code !== ACCOUNT_REQUIRED_CODE && code !== ACCOUNT_NOT_FOUND_CODE)
+        return null;
+    return new IntegrationsCliError(accountSelectionMessage(code, accountCandidatesFrom(data?.candidates), account), {
+        expected: true,
+        code,
+    });
+}
+export function accountCandidateFor(connection) {
+    return {
+        connectionId: connection.id,
+        provider: connection.provider,
+        ...(connection.ownerType ? { ownerType: connection.ownerType } : {}),
+        ...(connection.accountLabel ? { accountLabel: connection.accountLabel } : {}),
+    };
+}
+function matchesProviderSelector(connection, provider) {
+    const want = provider.trim().toLowerCase();
+    const wantHumanSlug = humanSlug(provider);
+    const displayName = connection.installation?.displayName ?? "";
+    return (bareProvider(connection.provider).toLowerCase() === want ||
+        connection.provider.toLowerCase() === want ||
+        displayName.trim().toLowerCase() === want ||
+        (wantHumanSlug !== "" && humanSlug(displayName) === wantHumanSlug));
+}
+export function selectAccountConnections(connections, opts) {
+    const pool = connections.filter((connection) => connection.status !== "revoked" &&
+        (!opts.provider || matchesProviderSelector(connection, opts.provider)));
+    const want = opts.account.trim().toLowerCase();
+    const matches = pool.filter((connection) => connection.id.toLowerCase() === want ||
+        (typeof connection.accountLabel === "string" && connection.accountLabel.trim().toLowerCase() === want));
+    if (matches.length === 0) {
+        throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_NOT_FOUND_CODE, pool.map(accountCandidateFor), opts.account), { expected: true, code: ACCOUNT_NOT_FOUND_CODE });
+    }
+    const providers = new Set(matches.map((connection) => connection.provider));
+    if (providers.size > 1) {
+        throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_REQUIRED_CODE, matches.map(accountCandidateFor), opts.account, "Rerun with --provider <app> or --account <connection id>."), { expected: true, code: ACCOUNT_REQUIRED_CODE });
+    }
+    return matches;
+}
 //# sourceMappingURL=integrations-core.js.map

package/dist/commands/integrations-manage.js

@@ -17,7 +17,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, printHealthNotice, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, printHealthNotice, connectionAccountLabel, connectionOwnerLabel, fetchConnections, fetchAdminSurface, fetchAuditPage, AUDIT_PAGE_MAX, printJson, revokedConnectionDetails, resolveConnection, selectConnection, } from "./integrations-core.js";
 import { fetchPendingApprovals, getConnectionAccess, mutateConnectionAccess, purgeConnection, setReadSafe, terminalSafeText, uninstallIntegration, updateGovernance, } from "./integrations-api.js";
 const WRITE_POLICIES = ["auto-allow", "confirm", "deny"];
 const PERMISSIONS = ["read", "write", "admin"];
@@ -219,6 +219,13 @@ export function registerManageCommands(integrations) {
         if (install?.id)
             console.log(chalk.dim(`  installation: ${install.id}`));
         console.log(chalk.dim(`  status:      ${connection.status}`));
+        const owner = connectionOwnerLabel(connection);
+        if (owner) {
+            console.log(chalk.dim(`  owner:       ${owner}`));
+            const account = connectionAccountLabel(connection);
+            if (account)
+                console.log(chalk.dim(`  account:     ${account}`));
+        }
         if (connection.status === "revoked") {
             const details = revokedConnectionDetails(connection, opts.company);
             console.log(chalk.yellow(`  Revoked — ${details.reason}`));

package/dist/commands/integrations.js

@@ -56,7 +56,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, parseCallTimeoutMs, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, parseCallTimeoutMs, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, connectionAccountLabel, connectionOwnerLabel, selectAccountConnections, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, accountCandidateFor, accountSelectionMessage, ACCOUNT_REQUIRED_CODE, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
@@ -329,6 +329,26 @@ function approvalOutcomeFailed(row) {
     return ["failed", "write_unknown"].includes(row.status ?? "") ||
         ["failed", "unknown"].includes(row.outcome ?? "");
 }
+function selectToolConnection(connections, opts) {
+    if (opts.account === undefined) {
+        return { connection: selectConnection(connections, opts), accountMatches: [] };
+    }
+    if (opts.connection) {
+        throw new IntegrationsCliError("Use either --connection or --account, not both.", {
+            expected: true,
+        });
+    }
+    if (!opts.account.trim()) {
+        throw new IntegrationsCliError("--account was empty — pass a connection id or account label.", {
+            expected: true,
+        });
+    }
+    const accountMatches = selectAccountConnections(connections, {
+        account: opts.account,
+        ...(opts.provider ? { provider: opts.provider } : {}),
+    });
+    return { connection: accountMatches[0], accountMatches };
+}
 export function registerIntegrationsCommand(program) {
     const integrations = program
         .command("integrations")
@@ -375,7 +395,10 @@ export function registerIntegrationsCommand(program) {
             return;
         }
         for (const c of connections) {
+            const owner = connectionOwnerLabel(c);
             const flags = [
+                owner ?? null,
+                owner ? connectionAccountLabel(c) ?? null : null,
                 c.status,
                 c.writePolicy ? `writes: ${c.writePolicy}` : null,
                 c.installation?.status === "needs_credentials" ? "needs sign-in" : null,
@@ -397,13 +420,17 @@ export function registerIntegrationsCommand(program) {
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
         .option("--company <slug>", "Company slug, e.g. indigo")
+        .option("--account <id-or-label>", "Which account of the app: its connection id or account label")
         .option("--describe <tool>", "Print the full input schema for one tool")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connections = await fetchConnections(token, companyUid);
-        const connection = selectConnection(connections, opts);
+        const { connection, accountMatches } = selectToolConnection(connections, opts);
+        if (accountMatches.length > 1) {
+            throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_REQUIRED_CODE, accountMatches.map(accountCandidateFor), opts.account, "Rerun with --account <connection id>."), { expected: true, code: ACCOUNT_REQUIRED_CODE });
+        }
         if (reportRevokedConnection(connection, opts))
             return;
         let payload;
@@ -479,6 +506,7 @@ export function registerIntegrationsCommand(program) {
         .description("Call one of a connected app's tools (approval-gated when it changes things)")
         .option("--provider <slug>", "Connected app (e.g. linear)")
         .option("--connection <id>", "Connection id (acct_…)")
+        .option("--account <id-or-label>", "Which account of the app: its connection id or account label")
         .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--args <json>", "Tool arguments as a JSON object (default {}); use - to read the JSON from stdin")
         .option("--args-file <path>", "Read tool arguments from a JSON file (use - for stdin); avoids shell quoting of apostrophes and parentheses")
@@ -490,9 +518,23 @@ export function registerIntegrationsCommand(program) {
         const parsedArgs = await resolveCallArgs(opts);
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        const { connection, accountMatches } = selectToolConnection(await fetchConnections(token, companyUid), opts);
         if (reportRevokedConnection(connection, { ...opts, fail: true }))
             return;
+        const accountSelector = opts.account !== undefined &&
+            accountMatches.length !== 1 &&
+            (connection.ownerType === "person" || connection.ownerType === "company")
+            ? opts.account.trim()
+            : undefined;
+        if (accountSelector === undefined && accountMatches.length > 1) {
+            throw new IntegrationsCliError(accountSelectionMessage(ACCOUNT_REQUIRED_CODE, accountMatches.map(accountCandidateFor), opts.account, "Rerun with --account <connection id>."), { expected: true, code: ACCOUNT_REQUIRED_CODE });
+        }
+        const routing = accountSelector === undefined
+            ? { connectionId: connection.id }
+            : {};
+        const accountParams = accountSelector === undefined
+            ? {}
+            : { account: accountSelector, provider: connection.provider };
         const idempotencyKey = opts.idempotencyKey ?? `hq-cli-${randomUUID()}`;
         let gatewayParams;
         if (isBuiltInGatewayProvider(connection.provider)) {
@@ -506,7 +548,8 @@ export function registerIntegrationsCommand(program) {
                 companyUid,
                 acceptAsync: true,
                 name: tool,
-                arguments: { ...parsedArgs, companyUid, connectionId: connection.id, idempotencyKey },
+                ...accountParams,
+                arguments: { ...parsedArgs, companyUid, ...routing, idempotencyKey },
             };
         }
         else {
@@ -515,9 +558,10 @@ export function registerIntegrationsCommand(program) {
                 companyUid,
                 acceptAsync: true,
                 name: `${prefix}.mcp.tools.call`,
+                ...accountParams,
                 arguments: {
                     companyUid,
-                    connectionId: connection.id,
+                    ...routing,
                     toolName: tool,
                     arguments: parsedArgs,
                     idempotencyKey,

package/dist/commands/lanes-loop.d.ts

@@ -1,4 +1,5 @@
 import type { Ctx, LaneResumeOptions } from "./lanes-shared.js";
+import { LanesError } from "../lib/lanes/errors.js";
 import type { LaneRecord } from "../lib/lanes/types.js";
 /**
  * A loop lane that finished a phase and is waiting for its next envelope is
@@ -14,6 +15,25 @@ export declare function settleLoopLaneIdle(hqRoot: string, laneId: string): Lane
  * worker, so it is handed to resume as the `done` lane the phase left.
  */
 export declare function prepareIdleLoopLaneForResume(hqRoot: string, laneId: string): LaneRecord;
+/**
+ * LanesError codes from the resume admission path that mean admission could
+ * not run right now and a later admission can retry: the admission or store
+ * lock timed out (store_lock_timeout), the lane changed while admission was
+ * checked (lane_admission_conflict), or a lane record CAS miss
+ * (version_conflict). Any other resume error is permanent and is rethrown.
+ */
+export declare const TRANSIENT_LOOP_ADMISSION_ERRORS: ReadonlySet<string>;
+/**
+ * Park a loop phase whose resume was refused before an engine launched. The
+ * lane becomes `queued` with `admit_failed` and the error, and carries the
+ * phase as `pending_resume`, so admission can launch it later and the lane is
+ * never left looking active with no engine.
+ */
+export declare function deferRefusedLoopPhase(hqRoot: string, laneId: string, at: string, error: LanesError, phase: {
+    text: string;
+    sessionId: string | undefined;
+    workingDirectory: string;
+}): LaneRecord;
 export interface LoopControllerDeps {
     resumeLane(laneId: string, options: LaneResumeOptions): Promise<unknown>;
     interruptLane(laneId: string, reason: string, options: {