@indigoai-us/hq-cli 5.345.199 → 5.345.201

package/dist/lib/work-context/company.js

@@ -12,15 +12,14 @@
  *   4b. persisted per-repo company map (gap 4 — person "always ask per repo",
  *      remembered by repoIdentityKey; above the git-remote heuristic + device
  *      default, below the identity file so an agent box always wins)
- *   5. enabled device default
- *   6. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
+ *   5. exactly one deterministic mapping (cwd under companies/{slug}/ or repo remote)
  *
  * Prompt-text matching is never used.
- * Device default + conflicting deterministic evidence → company_conflict.
+ * Device defaults never attribute a session; explicit evidence is required.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getDefaultCompany, getRepoCompany } from "./config.js";
+import { getRepoCompany } from "./config.js";
 import { authoritativeCompanyFromState, readSessionState, } from "./state.js";
 /** Pointer to the US-017B correction client (never auto-switches). */
 const COMPANY_CORRECTION_PATH_PREFIX = "hq mesh context correct --session";
@@ -333,8 +332,7 @@ export function resolveCompany(input) {
             };
         }
     }
-    // 5 + 6. Device default vs deterministic evidence.
-    const deviceDefault = input.allowDeviceDefault === false ? null : getDefaultCompany({ root: input.root });
+    // Membership and device preferences are not session attribution evidence.
     const deterministic = resolveDeterministicCompany({
         cwd: input.cwd,
         hqRoot: input.hqRoot,
@@ -354,22 +352,6 @@ export function resolveCompany(input) {
             evidenceCompany: deterministicConflict.remote,
         };
     }
-    if (deviceDefault?.enabled && deviceDefault.slug) {
-        const def = {
-            slug: deviceDefault.slug,
-            uid: deviceDefault.uid,
-            source: "device_default",
-        };
-        if (deterministic &&
-            !sameCompany(def, deterministic)) {
-            return {
-                status: "company_conflict",
-                defaultCompany: def,
-                evidenceCompany: deterministic,
-            };
-        }
-        return { status: "resolved", company: def };
-    }
     if (deterministic) {
         return { status: "resolved", company: deterministic };
     }

package/dist/secrets-env-action.js

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { cognitoCachePrincipalUid } from "./utils/cognito-session.js";
+import { gatedInteractiveLogin } from "./utils/interactive-caller.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, removeCacheEntry, writeCache, } from "./utils/secrets-cache.js";
 import { computeSha256 } from "./utils/integrity.js";
 import { SECRET_NAME_PATTERN } from "./commands/_patterns.js";
@@ -21,10 +22,12 @@ const SECRET_LOAD_TIMEOUT_MS = 30_000;
  * stdin and stderr must be TTYs, and CI is always non-interactive.
  */
 export function secretsCredentialOptions() {
+    // The shared gate also refuses lanes, daemons, bot runtimes, launchd
+    // tasks, and HQ_NO_BROWSER_LOGIN children that happen to hold a TTY.
     return {
-        interactive: process.stdin.isTTY === true &&
+        interactive: gatedInteractiveLogin(process.stdin.isTTY === true &&
             process.stderr.isTTY === true &&
-            !process.env.CI,
+            !process.env.CI),
     };
 }
 export function scopeOpts(opts) {

package/dist/utils/cognito-callback-port.d.ts

@@ -4,6 +4,8 @@ export declare const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
 /** Ports registered as callback URLs on the HQ CLI Cognito app client. */
 export declare const REGISTERED_COGNITO_CALLBACK_PORTS: readonly number[];
 export type PortWarn = (message: string) => void;
+/** Test hook: forget that the stray-port warning was printed. */
+export declare function resetStrayPortWarningForTests(): void;
 /**
  * Resolve a callback port value, a string from the environment or a number,
  * to a registered port. Unset resolves to 8765 silently; an unregistered value

package/dist/utils/cognito-callback-port.js

@@ -11,18 +11,23 @@
 export const DEFAULT_COGNITO_CALLBACK_PORT = 8765;
 /** Ports registered as callback URLs on the HQ CLI Cognito app client. */
 export const REGISTERED_COGNITO_CALLBACK_PORTS = [8765, 3000, 53682];
-const warned = new Set();
+/** One stray-port warning per process: config and session both resolve the env value. */
+let warnedStrayPort = false;
 function defaultWarn(message) {
     console.error(message);
 }
-function warnOnce(key, message, warn) {
+function warnOnce(message, warn) {
     if (warn === defaultWarn) {
-        if (warned.has(key))
+        if (warnedStrayPort)
             return;
-        warned.add(key);
+        warnedStrayPort = true;
     }
     warn(message);
 }
+/** Test hook: forget that the stray-port warning was printed. */
+export function resetStrayPortWarningForTests() {
+    warnedStrayPort = false;
+}
 /**
  * Resolve a callback port value, a string from the environment or a number,
  * to a registered port. Unset resolves to 8765 silently; an unregistered value
@@ -35,7 +40,7 @@ export function resolveCognitoCallbackPort(raw, warn = defaultWarn) {
     const port = typeof raw === "number" ? raw : Number(raw.trim());
     if (REGISTERED_COGNITO_CALLBACK_PORTS.includes(port))
         return port;
-    warnOnce(String(raw), `hq: ignoring callback port ${String(raw)}: it is not a registered Cognito callback ` +
+    warnOnce(`hq: ignoring callback port ${String(raw)}: it is not a registered Cognito callback ` +
         `(${REGISTERED_COGNITO_CALLBACK_PORTS.join(", ")}). Using ${DEFAULT_COGNITO_CALLBACK_PORT}. ` +
         "Unset HQ_COGNITO_CALLBACK_PORT or set it to a registered port.", warn);
     return DEFAULT_COGNITO_CALLBACK_PORT;

package/dist/utils/cognito-config.js

@@ -4,7 +4,12 @@ export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT),
+    // Resolved on read, not at module load: main.ts imports this for every
+    // command, and a stray HQ_COGNITO_CALLBACK_PORT should warn only when a
+    // sign-in actually reads the port.
+    get port() {
+        return resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT);
+    },
     identityProvider: process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
         ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
         : "Google",

package/dist/utils/cognito-session.js

@@ -51,7 +51,12 @@ export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
     clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-    port: resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT),
+    // Resolved on read, not at module load: main.ts imports this for every
+    // command, and a stray HQ_COGNITO_CALLBACK_PORT should warn only when a
+    // sign-in actually reads the port.
+    get port() {
+        return resolveCognitoCallbackPort(process.env.HQ_COGNITO_CALLBACK_PORT);
+    },
     // Skip Cognito's Hosted UI — go straight to Google OAuth. The Cognito
     // /oauth2/authorize endpoint honors `identity_provider` and performs an
     // internal redirect, so the user never sees the (un-styleable) Hosted UI.

package/dist/utils/interactive-caller.d.ts

@@ -12,4 +12,12 @@ export type InteractiveCallerInput = {
 export declare function nonInteractiveReason(input?: InteractiveCallerInput): string | null;
 /** True only when a person is at a terminal and may complete a browser sign-in. */
 export declare function isInteractiveCaller(input?: InteractiveCallerInput): boolean;
+/**
+ * Gate a call site's request for an implicit browser sign-in. A command that
+ * asks for `interactive: true` gets it only when a person is at a terminal, so
+ * the same command run from a lane, daemon, bot, launchd task, or piped child
+ * fails with the `hq login` remedy instead of opening a sign-in tab. Explicit
+ * `false` stays false. `hq login` calls browserLogin directly and is not gated.
+ */
+export declare function gatedInteractiveLogin(requested?: boolean, input?: InteractiveCallerInput): boolean;
 //# sourceMappingURL=interactive-caller.d.ts.map

package/dist/utils/interactive-caller.js

@@ -67,4 +67,14 @@ export function nonInteractiveReason(input = {}) {
 export function isInteractiveCaller(input = {}) {
     return nonInteractiveReason(input) === null;
 }
+/**
+ * Gate a call site's request for an implicit browser sign-in. A command that
+ * asks for `interactive: true` gets it only when a person is at a terminal, so
+ * the same command run from a lane, daemon, bot, launchd task, or piped child
+ * fails with the `hq login` remedy instead of opening a sign-in tab. Explicit
+ * `false` stays false. `hq login` calls browserLogin directly and is not gated.
+ */
+export function gatedInteractiveLogin(requested = true, input = {}) {
+    return requested && isInteractiveCaller(input);
+}
 //# sourceMappingURL=interactive-caller.js.map

package/dist/utils/login-browser.js

@@ -15,7 +15,8 @@ export async function loginWithBrowserPreference(config, browser = true) {
     if (browser && !isHeadless())
         return browserLogin(withRegisteredCallbackPort(config));
     assertHumanLoginAllowed();
-    const port = config.port ?? 3000;
+    // The manual URL path builds the same redirect_uri, so it needs the same guard.
+    const port = withRegisteredCallbackPort(config).port ?? 3000;
     const redirectUri = `http://localhost:${port}/callback`;
     const base = `https://${config.userPoolDomain}.auth.${config.region}.amazoncognito.com`;
     const verifier = randomBytes(32).toString("base64url");

package/dist/utils/resident-package-preload.js

@@ -69,15 +69,22 @@ export const RESIDENT_PACKAGE_MODULES = {
         "../lib/first-sync-next-step.js",
         "@indigoai-us/hq-cloud",
         "../lib/lanes/reconcile.js",
+        "../utils/local-files-overview.js",
+        "../utils/vault-api.js",
+        "../commands/files-browse.js",
+        "@aws-sdk/client-s3",
+        "../commands/access.js",
+        "../commands/sources.js",
+        "../lib/hot-channels/adapters/index.js",
     ],
     "daemon-logs-follow": [],
     "mesh-daemon": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
-    "lanes-watch": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
-    "monitor-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
-    "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
+    "lanes-watch": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js", "../commands/lanes.js"],
+    "monitor-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js", "../commands/lanes.js"],
+    "monitor-run": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js"],
     "agents-message-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
     "integrations-oauth-wait": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud"],
-    "outpost-wait": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js"],
+    "outpost-wait": ["../commands/lanes.js", "../lib/plan-limit-nag.js", "../utils/plan-gate-error.js", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "open", "../utils/cognito-session.js", "../lib/first-sync-next-step.js", "@indigoai-us/hq-cloud", "../lib/lanes/reconcile.js", "../utils/local-files-overview.js", "../lib/flag-registry.js", "../utils/vault-api.js", "../commands/files-browse.js", "@aws-sdk/client-s3", "../commands/access.js", "../commands/sources.js", "../lib/hot-channels/adapters/index.js"],
     "secrets-sandbox": [],
     "pkg-update": ["../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client", "../utils/cognito-session.js", "@indigoai-us/hq-cloud"],
     "pack-install": [
@@ -252,6 +259,14 @@ const LOADERS = {
         () => import("../lib/first-sync-next-step.js"),
         () => import("@indigoai-us/hq-cloud"),
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
     ],
     "daemon-logs-follow": [],
     "mesh-daemon": [
@@ -283,6 +298,16 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
+        () => import("../commands/lanes.js"),
     ],
     "monitor-wait": [
         async () => {
@@ -299,6 +324,16 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
+        () => import("../commands/lanes.js"),
     ],
     "monitor-run": [
         () => import("../commands/lanes.js"),
@@ -316,6 +351,15 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
     ],
     "agents-message-wait": [
         async () => {
@@ -361,6 +405,15 @@ const LOADERS = {
         () => import("@indigoai-us/hq-cloud"),
         // The watcher admits queued lanes in-process after a lane exits.
         () => import("../lib/lanes/reconcile.js"),
+        // Source reports use the signals engine after a resident wait.
+        () => import("../utils/local-files-overview.js"),
+        () => import("../lib/flag-registry.js"),
+        () => import("../utils/vault-api.js"),
+        () => import("../commands/files-browse.js"),
+        () => import("@aws-sdk/client-s3"),
+        () => import("../commands/access.js"),
+        () => import("../commands/sources.js"),
+        () => import("../lib/hot-channels/adapters/index.js"),
     ],
     "secrets-sandbox": [],
     "pkg-update": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.199",
+  "version": "5.345.201",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -116,11 +116,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.199",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.199",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.199",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.199",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.199",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.199"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.201",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.201",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.201",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.201",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.201",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.201"
   }
 }