@indigoai-us/hq-cli 5.345.191 → 5.345.193

package/dist/commands/sources.js

@@ -38,12 +38,15 @@ import { createClaudeSignalsPass } from "../lib/hot-channels/signals-pass.js";
 import { assertSafeSegment } from "../lib/hot-channels/landing.js";
 import { acquireSyncLock, SYNC_LOCK_BUSY_REASON } from "../lib/hot-channels/sync-lock.js";
 import { createBuiltinHotChannelRegistry } from "../lib/hot-channels/adapters/index.js";
+import { companyAdapterFlagReader, gateAdapters, readSignalsAdaptersCatalog, } from "../lib/signals/adapters-catalog.js";
 import { createSelectionLoader } from "../lib/hot-channels/selection.js";
 import { createPersonVaultReader } from "../lib/hot-channels/person-vault-reader.js";
 import { S3Client } from "@aws-sdk/client-s3";
 import { resolveCanonicalPersonUid } from "./cloud.js";
 import { botsRoot as defaultBotsRoot } from "../lib/bot/paths.js";
 import { ensureHotSignalSyncJob } from "../lib/bot/jobs/hot-signal-sync.js";
+import { companyOfHotSignalSyncJob, fleetCronOps } from "../lib/bot/fleet-cron.js";
+import { HQ_FLEET_RUNTIME_ENGINE_ID, readBotConfig } from "../lib/bot/config.js";
 import { findHotSignalSyncJobs, lastRunsPerAdapter, parseDailyAt, renderScheduleReport, rescheduleDaily, toJobView, } from "../lib/hot-channels/schedule.js";
 import { listActiveMembers } from "./members.js";
 import { runOnDemandSync, } from "../lib/hot-channels/run.js";
@@ -485,32 +488,78 @@ async function skippedReport(input, vaultRoot, personKey, personUid, now) {
         runId: line.runId,
         signInRequired: false,
         skipped: true,
+        personKey,
         outcomes: [],
         entries: [line],
         notices: [`Another hot-channel sync for ${input.company} is already running, so this one was skipped.`],
         exitCode: 0,
     };
 }
+/**
+ * One `gated` outcome per adapter the local gate turned off (yaml or company
+ * flag). With `--adapter`, only that adapter's. Nothing is fetched for them.
+ */
+function gatedAdapterOutcomes(registry, gating, wanted) {
+    const want = wanted?.toLowerCase();
+    const out = [];
+    for (const adapter of registry.list()) {
+        if (!(adapter.id in gating.skips))
+            continue;
+        const provider = adapter.tokenScope.provider || adapter.id;
+        if (want !== undefined && adapter.id !== want && provider.toLowerCase() !== want)
+            continue;
+        const flag = gating.offFlags[adapter.id];
+        out.push({
+            adapter: adapter.id,
+            provider,
+            connectionId: null,
+            appName: null,
+            status: "gated",
+            landed: 0,
+            duplicates: 0,
+            message: flag
+                ? `${adapter.id} is not enabled for this company (flag ${flag} is off)`
+                : `${adapter.id} is turned off in core/settings/signals-adapters.yaml`,
+        });
+    }
+    return out;
+}
 async function runLockedCompanySync(input, vaultRoot, personKey, author, session, lockHeld) {
     const deps = gatewaySyncDeps(session.token, session.companyUid);
-    // A fresh loader per run: selections are cached for this run only.
-    const selections = input.createSelections ? input.createSelections() : defaultSelections();
-    const report = await runOnDemandSync({
-        ...(selections ? { selections } : {}),
-        deps,
-        registry: input.registry ??
-            createBuiltinHotChannelRegistry({ vaultRoot, identities: await meetingIdentities(input, session, author.email) }),
-        vaultRoot,
-        personUid: author.userSub,
-        personKey,
-        ...(input.adapter !== undefined ? { adapter: input.adapter } : {}),
-        ...(input.now ? { now: input.now } : {}),
-        ...(input.trigger ? { trigger: input.trigger } : {}),
-        ...(input.catchUp === undefined ? {} : { catchUp: input.catchUp }),
-        ...(input.firstRun ? { firstRun: true } : {}),
-        ...(input.signalsGenerated ? { signalsGenerated: input.signalsGenerated } : {}),
-        beforeWrite: lockHeld,
-    });
+    const registry = input.registry ??
+        createBuiltinHotChannelRegistry({ vaultRoot, identities: await meetingIdentities(input, session, author.email) });
+    // The adapter gate for every caller: signals-adapters.yaml plus the company
+    // flags, read through hq-flags.
+    const gating = await gateAdapters(registry.list().map((a) => a.id), readSignalsAdaptersCatalog(input.hqRoot), input.isFlagOn ??
+        companyAdapterFlagReader(session.companyUid, session.token, { hqRoot: input.hqRoot, company: input.company }));
+    const gated = gatedAdapterOutcomes(registry, gating, input.adapter);
+    const onlyAdapters = (input.onlyAdapters ?? gating.enabled).filter((id) => gating.enabled.includes(id));
+    let report;
+    if (input.adapter !== undefined && gated.length > 0) {
+        // `--adapter` named an adapter the gate turned off: there is nothing to run.
+        report = { runId: null, signInRequired: false, personKey, outcomes: [], entries: [], notices: [], exitCode: 0 };
+    }
+    else {
+        // A fresh loader per run: selections are cached for this run only.
+        const selections = input.createSelections ? input.createSelections() : defaultSelections();
+        report = await runOnDemandSync({
+            ...(selections ? { selections } : {}),
+            deps,
+            registry,
+            vaultRoot,
+            personUid: author.userSub,
+            personKey,
+            ...(input.adapter !== undefined ? { adapter: input.adapter } : {}),
+            ...(input.onlyAdapters !== undefined || Object.keys(gating.skips).length > 0 ? { onlyAdapters } : {}),
+            ...(input.now ? { now: input.now } : {}),
+            ...(input.trigger ? { trigger: input.trigger } : {}),
+            ...(input.catchUp === undefined ? {} : { catchUp: input.catchUp }),
+            ...(input.firstRun ? { firstRun: true } : {}),
+            ...(input.signalsGenerated ? { signalsGenerated: input.signalsGenerated } : {}),
+            beforeWrite: lockHeld,
+        });
+    }
+    report.outcomes.push(...gated);
     if (input.signalsAlert) {
         const postCompanyChannel = input.signalsAlert.postCompanyChannel ??
             createSignalsAlertChannelPoster({ hqRoot: input.hqRoot, company: input.company, deps });
@@ -593,6 +642,55 @@ function renderSyncTable(company, report) {
     }
     return lines.join("\n");
 }
+function fleetBotsIn(root) {
+    let names;
+    try {
+        names = fs.readdirSync(root).sort();
+    }
+    catch {
+        return [];
+    }
+    const bots = [];
+    for (const botName of names) {
+        const config = readBotConfig(path.join(root, botName));
+        if (config && config.engine?.id === HQ_FLEET_RUNTIME_ENGINE_ID)
+            bots.push({ botName, agentUid: config.agentUid });
+    }
+    return bots;
+}
+function findFleetHotSignalSyncJob(root, company, opsFor) {
+    for (const bot of fleetBotsIn(root)) {
+        let ops;
+        let jobs;
+        try {
+            ops = opsFor(bot.agentUid);
+            jobs = ops.list();
+        }
+        catch {
+            continue;
+        }
+        const job = jobs.find((candidate) => companyOfHotSignalSyncJob(candidate) === company);
+        if (job)
+            return { botName: bot.botName, ops, job };
+    }
+    return null;
+}
+function fleetDailyAt(expr) {
+    const match = /^(\d{1,2}) (\d{1,2}) \* \* \*$/.exec((expr ?? "").trim());
+    return match ? `${match[2].padStart(2, "0")}:${match[1].padStart(2, "0")}` : null;
+}
+function fleetJobView(found) {
+    const expr = found.job.schedule?.expr ?? "";
+    return {
+        botName: found.botName,
+        jobId: found.job.id,
+        cron: expr,
+        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
+        dailyAt: fleetDailyAt(expr),
+        nextRunAt: found.job.next_run_at ?? null,
+        lastRunAt: found.job.last_run_at ?? null,
+    };
+}
 export class NoHotSignalSyncJobError extends Error {
     company;
     constructor(company) {
@@ -618,7 +716,22 @@ export async function runSchedule(options, overrides = {}) {
     // Validate before touching any job file.
     if (options.at !== undefined)
         parseDailyAt(options.at);
-    let found = findHotSignalSyncJobs(overrides.botsRoot ?? defaultBotsRoot(), company);
+    const botsRootDir = overrides.botsRoot ?? defaultBotsRoot();
+    const fleetFound = findFleetHotSignalSyncJob(botsRootDir, company, overrides.fleetOps ?? fleetCronOps);
+    if (fleetFound) {
+        if (options.at !== undefined) {
+            const { hour, minute } = parseDailyAt(options.at);
+            const updated = fleetFound.ops.reschedule(fleetFound.job.id, `${minute} ${hour} * * *`);
+            if (!updated)
+                throw new NoHotSignalSyncJobError(company);
+            fleetFound.job = updated;
+        }
+        return finishScheduleReport(options, overrides, company, fleetJobView(fleetFound), [], now);
+    }
+    if (options.at !== undefined && fleetBotsIn(botsRootDir).some((bot) => bot.botName === "setup")) {
+        throw new Error(`The setup bot runs on the HQ Fleet Runtime and has no hot-signal-sync job for ${company} yet. Start it once with \`hq bot start setup\` so it adds the job, then set the time again.`);
+    }
+    let found = findHotSignalSyncJobs(botsRootDir, company);
     if (options.at !== undefined) {
         if (found.length === 0) {
             // Setting a time turns the daily sync on: register it on the personal setup bot.
@@ -638,20 +751,19 @@ export async function runSchedule(options, overrides = {}) {
             throw new NoHotSignalSyncJobError(company);
         found = rescheduleDaily(found, options.at, now);
     }
+    return finishScheduleReport(options, overrides, company, found[0] ? toJobView(found[0], now) : null, found.slice(1).map((f) => f.botName), now);
+}
+async function finishScheduleReport(options, overrides, company, job, extraBots, now) {
     const email = overrides.email ?? resolveUploadAuthor()?.email;
     const lastRuns = email
         ? await lastRunsPerAdapter(path.join(options.hqRoot, "companies", company), audienceKey([email]), now)
         : [];
-    const report = {
-        company,
-        job: found[0] ? toJobView(found[0], now) : null,
-        lastRuns,
-    };
+    const report = { company, job, lastRuns };
     if (options.json) {
         process.stdout.write(JSON.stringify(report, null, 2) + "\n");
     }
     else {
-        process.stdout.write(renderScheduleReport(report, found.slice(1).map((f) => f.botName)) + "\n");
+        process.stdout.write(renderScheduleReport(report, extraBots) + "\n");
         if (!email)
             process.stdout.write("Sign in (hq login) to see recent runs.\n");
     }

package/dist/commands/staff/reset-test-account.d.ts

@@ -24,6 +24,12 @@ interface PlanCompany {
     slug: string;
     memberCount: number;
 }
+interface PlanCompanyHandoff {
+    companyUid: string;
+    companySlug: string;
+    toPersonUid: string;
+    toEmail: string;
+}
 interface Plan {
     target: {
         input: string;
@@ -32,6 +38,8 @@ interface Plan {
     personUid: string | null;
     cognitoUsers: PlanCognitoUser[];
     ownedCompanies: PlanCompany[];
+    /** Present only when the request opted in to the handoff. */
+    sharedCompanyHandoffs?: PlanCompanyHandoff[];
     personalVault: {
         bucketName: string | null;
         kmsKeyAlias: string | null;
@@ -89,6 +97,8 @@ export interface RunResetTestAccountParams {
     execute: boolean;
     /** Skip the typed-confirmation prompt on --execute (for scripts). */
     yes?: boolean;
+    /** Keep a company with real members and hand it to one, instead of refusing. */
+    handoffSharedCompanies?: boolean;
 }
 export interface RunResetTestAccountDeps {
     prompt?: ConfirmFn;

package/dist/commands/staff/reset-test-account.js

@@ -76,6 +76,13 @@ export function renderPlan(plan) {
         }
     }
     lines.push("");
+    if (plan.sharedCompanyHandoffs && plan.sharedCompanyHandoffs.length > 0) {
+        lines.push(chalk.bold("  Companies kept and handed over"));
+        for (const h of plan.sharedCompanyHandoffs) {
+            lines.push(`    handoff: ${h.companySlug} to ${h.toEmail}`);
+        }
+        lines.push("");
+    }
     lines.push(chalk.bold("  Personal vault"));
     lines.push(`    bucket:               ${plan.personalVault.bucketName ?? chalk.dim("(none)")}`);
     lines.push(`    kms alias:            ${plan.personalVault.kmsKeyAlias ?? chalk.dim("(none)")}`);
@@ -166,13 +173,17 @@ export async function runResetTestAccount(params, deps = {}) {
         throw new Error("reset-test-account requires a super-admin (staff) HQ session. " +
             "Sign in with an @getindigo.ai account and retry.");
     }
+    // Absent unless asked for, so the server's refusal stays the default.
+    const handoff = params.handoffSharedCompanies === true
+        ? { handoffSharedCompanies: true }
+        : {};
     // Dry-run first. The AC calls out "Without --execute, runs dry-run and
     // prints the plan" — so a bare invocation always ends here.
     const dryRunRes = await vaultApiFetch({
         token,
         path: "/v1/admin/test-account/reset",
         method: "POST",
-        body: { email, dryRun: true },
+        body: { email, dryRun: true, ...handoff },
     });
     const dryRunBody = await readBody(dryRunRes);
     if (!dryRunRes.ok) {
@@ -221,7 +232,7 @@ export async function runResetTestAccount(params, deps = {}) {
         token,
         path: "/v1/admin/test-account/reset",
         method: "POST",
-        body: { email, dryRun: false, confirmEmail },
+        body: { email, dryRun: false, confirmEmail, ...handoff },
     });
     const executeBody = await readBody(executeRes);
     // The handler answers 200 (all-ok) and 207 (best-effort partial). Anything
@@ -234,6 +245,9 @@ export async function runResetTestAccount(params, deps = {}) {
         throw new Error("server did not return an execute result");
     }
     console.log(renderExecuteSummary(result));
+    for (const h of plan.sharedCompanyHandoffs ?? []) {
+        console.log(`  handoff: ${h.companySlug} to ${h.toEmail}`);
+    }
     if (!result.ok) {
         // Non-zero exit so a scripted caller can react. The summary line above
         // already shows which step failed.
@@ -253,12 +267,14 @@ export function registerResetTestAccountCommand(staff, deps = {}) {
         .argument("<email>", "Designated test-account email (must be in the registry)")
         .option("--execute", "Actually delete artifacts. Prompts for a typed-email confirmation.")
         .option("-y, --yes", "Skip the typed-email confirmation prompt (still sends confirmEmail).")
+        .option("--handoff-shared-companies", "Keep a company with real members and hand it to one, instead of refusing the reset.")
         .action(async (email, opts) => {
         try {
             await runResetTestAccount({
                 email,
                 execute: opts.execute === true,
                 yes: opts.yes === true,
+                handoffSharedCompanies: opts.handoffSharedCompanies === true,
             }, deps);
         }
         catch (err) {