@indigoai-us/hq-cli 5.345.5 → 5.345.6

package/CHANGELOG.md

@@ -2,7 +2,8 @@
 
 ## [Unreleased]
 
-## [5.345.5] — 2026-10-05
+## [5.345.6] — 2026-10-05
+- `hq mesh context default set <slug> --count-usage` now works for people signed in with a normal HQ account. It previously refused with "the signed-in person could not be determined". An opt-in saved by 5.344.0 is ignored; run the command again to opt in.
 - `hq daemon sync status` now identifies the executing runner and derives its hq-cloud version from the owner status or runner package when needed.
 
 ## [5.345.4] — 2026-10-05

package/dist/commands/login.js

@@ -9,7 +9,7 @@ import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
 import * as readline from "node:readline/promises";
 import { listActiveMembershipCompanies } from "../lib/mesh/api.js";
 import { retainUsageAttributionForPerson, setDefaultCompany } from "../lib/work-context/config.js";
-import { personUidFromTokens } from "../lib/work-context/person-identity.js";
+import { cognitoSubFromTokens } from "../lib/work-context/person-identity.js";
 import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
 import { workContextRoot } from "../lib/work-context/paths.js";
 function peekIdToken(idToken) {
@@ -66,7 +66,7 @@ export function registerLoginCommand(program) {
         try {
             // The usage-attribution opt-in belongs to the person who gave it. A
             // different (or unknown) account signing in on this OS user drops it.
-            retainUsageAttributionForPerson(personUidFromTokens(loadCachedTokens()), {
+            retainUsageAttributionForPerson(cognitoSubFromTokens(loadCachedTokens()), {
                 root: workContextRoot(),
             });
         }

package/dist/commands/mesh.js

@@ -20,7 +20,7 @@ import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.j
 import { createCandidatesFetcher, createMigratePoster, createOrganizePoster, createWorkSessionDeliverer, fetchCompanyLive, formatCompanyLiveTable, openMeshTransport, probeMigrationCapabilityForMemberships, requireToken, } from "../lib/mesh/client.js";
 import { clearDefaultCompany, effectiveUsageAttribution, isDefaultCompanyDisabled, readDeviceConfig, recordMigrationCapabilitySnapshot, setRepairHeldWithDefault, setDefaultCompany, setUsageAttribution, } from "../lib/work-context/config.js";
 import { ensureDefaultCompany } from "../lib/work-context/default-company.js";
-import { personUidFromTokens } from "../lib/work-context/person-identity.js";
+import { cognitoSubFromTokens } from "../lib/work-context/person-identity.js";
 import { DefaultCompanyUnavailableError, WorkContextError, } from "../lib/work-context/errors.js";
 import { isValidSessionId } from "../lib/mesh/live/session-identity.js";
 import { flushSessionEvents } from "../lib/mesh/live/flush.js";
@@ -1212,17 +1212,17 @@ export async function askYesNo(question, io = {}) {
         rl.close();
     }
 }
-/** The signed-in person's prs_ uid from the cached Cognito session, or null. */
-function currentPersonUid() {
+/** The signed-in person's Cognito sub from the cached session, or null. */
+function currentCognitoSub() {
     try {
-        return personUidFromTokens(loadCachedTokens());
+        return cognitoSubFromTokens(loadCachedTokens());
     }
     catch {
         return null;
     }
 }
-function usageAttributionJson(cfg, personUid) {
-    const effective = effectiveUsageAttribution(cfg, personUid);
+function usageAttributionJson(cfg, cognitoSub) {
+    const effective = effectiveUsageAttribution(cfg, cognitoSub);
     return { countUsage: effective !== null, usageAttribution: effective };
 }
 async function runContextDefaultGet(opts) {
@@ -1244,7 +1244,7 @@ async function runContextDefaultGet(opts) {
             needsChoice: !current && !disabled && memberships.length > 1,
             memberships,
             repairHeldWithDefault: cfg.repairHeldWithDefault === true,
-            ...usageAttributionJson(cfg, currentPersonUid()),
+            ...usageAttributionJson(cfg, currentCognitoSub()),
         }, null, 2));
         return;
     }
@@ -1257,7 +1257,7 @@ async function runContextDefaultGet(opts) {
         return;
     }
     console.log(`Default company: ${current.slug}${current.uid ? ` (${current.uid})` : ""} enabled=${current.enabled} source=${source}`);
-    console.log(effectiveUsageAttribution(cfg, currentPersonUid())
+    console.log(effectiveUsageAttribution(cfg, currentCognitoSub())
         ? usageCountedLine(current.slug)
         : usageNotCountedLine(current.slug));
 }
@@ -1269,8 +1269,8 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
         : opts.countUsage === false
             ? "opt-out"
             : "keep-if-same";
-    const personUid = currentPersonUid();
-    const priorOptIn = effectiveUsageAttribution(readDeviceConfig({ root }), personUid);
+    const cognitoSub = currentCognitoSub();
+    const priorOptIn = effectiveUsageAttribution(readDeviceConfig({ root }), cognitoSub);
     let token;
     try {
         token = await requireToken();
@@ -1311,7 +1311,7 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
             root,
             migrationCapability,
             usageAttribution: usageChoice,
-            personUid,
+            cognitoSub,
             validateMembership: async (candidate) => {
                 if (!token) {
                     throw new DefaultCompanyUnavailableError(`Cannot verify membership for company "${candidate}" (no Cognito session; offline or not logged in)`);
@@ -1340,7 +1340,7 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
                 ok: true,
                 config: configured,
                 migrationWarning,
-                ...usageAttributionJson(configured, personUid),
+                ...usageAttributionJson(configured, cognitoSub),
             }, null, 2));
             return;
         }
@@ -1352,8 +1352,8 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
             (() => isInteractiveTerminal()))();
         if (usageChoice === "keep-if-same" &&
             interactive &&
-            personUid &&
-            !effectiveUsageAttribution(configured, personUid) &&
+            cognitoSub &&
+            !effectiveUsageAttribution(configured, cognitoSub) &&
             stored?.uid?.startsWith("cmp_")) {
             console.error(usageOptInExplainer(company));
             let yes = false;
@@ -1364,9 +1364,9 @@ async function runContextDefaultSet(slug, opts, promptDeps = {}) {
                 yes = false;
             }
             if (yes)
-                configured = setUsageAttribution({ companyUid: stored.uid, personUid }, { root });
+                configured = setUsageAttribution({ companyUid: stored.uid, cognitoSub }, { root });
         }
-        console.log(effectiveUsageAttribution(configured, personUid)
+        console.log(effectiveUsageAttribution(configured, cognitoSub)
             ? usageCountedLine(company)
             : usageNotCountedLine(company));
         if (migrationWarning)
@@ -1503,7 +1503,7 @@ async function runContextDefaultClear(opts) {
     const hadOptIn = readDeviceConfig({ root }).usageAttribution !== undefined;
     const cfg = clearDefaultCompany({ root });
     if (opts.json) {
-        console.log(JSON.stringify({ ok: true, config: cfg, ...usageAttributionJson(cfg, currentPersonUid()) }, null, 2));
+        console.log(JSON.stringify({ ok: true, config: cfg, ...usageAttributionJson(cfg, currentCognitoSub()) }, null, 2));
         return;
     }
     console.log("Default company cleared.");

package/dist/lib/work-context/config.d.ts

@@ -56,15 +56,16 @@ export interface UsageAttributionOptIn {
     mode: "default-company";
     companyUid: string;
     /**
-     * The signed-in person who consented: the `custom:entityUid` claim (prs_...)
-     * of the cached Cognito person session. Consent never carries to another
-     * account on the same OS user.
+     * The signed-in person who consented: the Cognito `sub` claim of the cached
+     * person session. Consent never carries to another account on the same OS
+     * user. Older records that carry only `personUid` are treated as not opted
+     * in (fail closed).
      */
-    personUid: string;
+    cognitoSub: string;
     optedInAt: string;
 }
-/** A person principal uid, as carried in the `custom:entityUid` token claim. */
-export declare function isPersonUid(value: unknown): value is string;
+/** A Cognito `sub` claim: any non-empty string (after trimming). */
+export declare function isCognitoSub(value: unknown): value is string;
 /** How `setDefaultCompany` treats the usage-attribution opt-in. */
 export type UsageAttributionChoice = 
 /** Write an opt-in for the newly set company (requires its uid). */
@@ -113,10 +114,10 @@ export interface DeviceConfigDeps {
      */
     usageAttribution?: UsageAttributionChoice;
     /**
-     * The signed-in person (prs_...). Required to write an opt-in; an existing
+     * The signed-in person (Cognito `sub`). Required to write an opt-in; an existing
      * opt-in is kept only when it was given by this person.
      */
-    personUid?: string | null;
+    cognitoSub?: string | null;
 }
 /** Acquire an interprocess config lock; exported for direct lock regression tests. */
 export declare function acquireDeviceConfigLock(root: string, options?: {
@@ -130,7 +131,7 @@ export declare function sanitizeUsageAttribution(raw: unknown): UsageAttribution
  * default company, and given by the signed-in person. Mirrors the hq-cloud
  * reader. No signed-in person means no opt-in.
  */
-export declare function effectiveUsageAttribution(cfg: Pick<WorkContextDeviceConfig, "defaultCompany" | "usageAttribution">, personUid: string | null | undefined): UsageAttributionOptIn | null;
+export declare function effectiveUsageAttribution(cfg: Pick<WorkContextDeviceConfig, "defaultCompany" | "usageAttribution">, cognitoSub: string | null | undefined): UsageAttributionOptIn | null;
 /** Injection points for assertSafeConfigPath (tests only). */
 export interface SafeConfigPathIo {
     platform?: NodeJS.Platform;
@@ -162,14 +163,14 @@ export declare function setDefaultCompany(slug: string, deps: DeviceConfigDeps):
  */
 export declare function setUsageAttribution(optIn: {
     companyUid: string;
-    personUid: string;
+    cognitoSub: string;
 } | null, deps: Pick<DeviceConfigDeps, "root" | "now">): WorkContextDeviceConfig;
 /**
- * Drop the usage-attribution opt-in unless it was given by `personUid`. Called
+ * Drop the usage-attribution opt-in unless it was given by `cognitoSub`. Called
  * on login (identity may have changed) and logout (null: always drop). A
  * config with no opt-in, or one already matching, is left untouched.
  */
-export declare function retainUsageAttributionForPerson(personUid: string | null | undefined, deps: Pick<DeviceConfigDeps, "root" | "now">): boolean;
+export declare function retainUsageAttributionForPerson(cognitoSub: string | null | undefined, deps: Pick<DeviceConfigDeps, "root" | "now">): boolean;
 export declare function clearDefaultCompany(deps: DeviceConfigDeps): WorkContextDeviceConfig;
 /**
  * Read the persisted company mapping for a repo identity key (gap 4).

package/dist/lib/work-context/config.js

@@ -9,9 +9,9 @@ import { DefaultCompanyUnavailableError, UnsafeConfigPathError, WorkContextError
 import { workContextConfigPath } from "./paths.js";
 import { assertWindowsOwnerOnlyAcl } from "./windows-acl.js";
 const DEVICE_CONFIG_SCHEMA_VERSION = 1;
-/** A person principal uid, as carried in the `custom:entityUid` token claim. */
-export function isPersonUid(value) {
-    return typeof value === "string" && /^prs_[A-Za-z0-9]+$/.test(value);
+/** A Cognito `sub` claim: any non-empty string (after trimming). */
+export function isCognitoSub(value) {
+    return typeof value === "string" && value.trim().length > 0;
 }
 const CONFIG_LOCK_TIMEOUT_MS = 5_000;
 const CONFIG_LOCK_RETRY_MS = 10;
@@ -158,24 +158,24 @@ export function sanitizeUsageAttribution(raw) {
     if (v.mode !== "default-company")
         return undefined;
     const companyUid = typeof v.companyUid === "string" ? v.companyUid.trim() : "";
-    const personUid = typeof v.personUid === "string" ? v.personUid.trim() : "";
+    const cognitoSub = typeof v.cognitoSub === "string" ? v.cognitoSub.trim() : "";
     const optedInAt = typeof v.optedInAt === "string" ? v.optedInAt.trim() : "";
     if (!companyUid.startsWith("cmp_") ||
-        !isPersonUid(personUid) ||
+        !isCognitoSub(cognitoSub) ||
         !optedInAt ||
         !Number.isFinite(Date.parse(optedInAt))) {
         return undefined;
     }
-    return { mode: "default-company", companyUid, personUid, optedInAt };
+    return { mode: "default-company", companyUid, cognitoSub, optedInAt };
 }
 /**
  * The opt-in that is in effect: present, for the uid of the current enabled
  * default company, and given by the signed-in person. Mirrors the hq-cloud
  * reader. No signed-in person means no opt-in.
  */
-export function effectiveUsageAttribution(cfg, personUid) {
+export function effectiveUsageAttribution(cfg, cognitoSub) {
     const opt = cfg.usageAttribution;
-    if (!opt || !isPersonUid(personUid) || opt.personUid !== personUid)
+    if (!opt || !isCognitoSub(cognitoSub) || opt.cognitoSub !== cognitoSub)
         return null;
     const def = cfg.defaultCompany;
     if (!opt || !def || def.enabled !== true || def.source === "disabled")
@@ -332,27 +332,27 @@ export async function setDefaultCompany(slug, deps) {
             defaultCompany.uid = resolvedUid;
         const choice = deps.usageAttribution ?? "keep-if-same";
         let usageAttribution;
-        const personUid = isPersonUid(deps.personUid) ? deps.personUid : undefined;
+        const cognitoSub = isCognitoSub(deps.cognitoSub) ? deps.cognitoSub : undefined;
         if (choice === "opt-in") {
             if (!resolvedUid?.startsWith("cmp_")) {
                 throw new WorkContextError("UsageAttributionUnavailable", `Cannot count usage toward "${trimmed}": its company uid is unknown`);
             }
-            if (!personUid) {
+            if (!cognitoSub) {
                 throw new WorkContextError("UsageAttributionUnavailable", `Cannot count usage toward "${trimmed}": the signed-in person could not be determined`);
             }
             usageAttribution = {
                 mode: "default-company",
                 companyUid: resolvedUid,
-                personUid,
+                cognitoSub,
                 optedInAt: now().toISOString(),
             };
         }
         else if (choice === "keep-if-same") {
             usageAttribution =
                 resolvedUid &&
-                    personUid &&
+                    cognitoSub &&
                     prior.usageAttribution?.companyUid === resolvedUid &&
-                    prior.usageAttribution.personUid === personUid
+                    prior.usageAttribution.cognitoSub === cognitoSub
                     ? prior.usageAttribution
                     : undefined;
         }
@@ -388,13 +388,13 @@ export function setUsageAttribution(optIn, deps) {
                 def.source !== "chosen" ||
                 !def.uid?.startsWith("cmp_") ||
                 def.uid !== optIn.companyUid ||
-                !isPersonUid(optIn.personUid)) {
+                !isCognitoSub(optIn.cognitoSub)) {
                 throw new WorkContextError("UsageAttributionUnavailable", "Usage can only be counted toward a default company you chose on this device");
             }
             usageAttribution = {
                 mode: "default-company",
                 companyUid: def.uid,
-                personUid: optIn.personUid,
+                cognitoSub: optIn.cognitoSub,
                 optedInAt: now().toISOString(),
             };
         }
@@ -413,11 +413,11 @@ export function setUsageAttribution(optIn, deps) {
     });
 }
 /**
- * Drop the usage-attribution opt-in unless it was given by `personUid`. Called
+ * Drop the usage-attribution opt-in unless it was given by `cognitoSub`. Called
  * on login (identity may have changed) and logout (null: always drop). A
  * config with no opt-in, or one already matching, is left untouched.
  */
-export function retainUsageAttributionForPerson(personUid, deps) {
+export function retainUsageAttributionForPerson(cognitoSub, deps) {
     if (!fs.existsSync(workContextConfigPath(deps.root)))
         return false;
     return withDeviceConfigLock(deps.root, () => {
@@ -425,7 +425,7 @@ export function retainUsageAttributionForPerson(personUid, deps) {
         const opt = prior.usageAttribution;
         if (!opt)
             return false;
-        if (isPersonUid(personUid) && opt.personUid === personUid)
+        if (isCognitoSub(cognitoSub) && opt.cognitoSub === cognitoSub)
             return false;
         const now = deps.now ?? (() => new Date());
         const { usageAttribution: _dropped, ...rest } = prior;

package/dist/lib/work-context/person-identity.d.ts

@@ -2,14 +2,18 @@
  * Signed-in person identity for the usage-attribution opt-in.
  *
  * Source: the cached Cognito person session (`~/.hq/cognito-tokens.json`,
- * read through `loadCachedTokens`). The person uid is the `custom:entityUid`
- * claim of the ID token (falling back to the access token), and only a
- * `prs_` value counts. Agent (`agt_`) or unknown identities return null, so
- * no opt-in is written or kept for them. Claims are read without
- * verification; this decides only whether local consent belongs to the
- * account that is signed in, never authorization.
+ * read through `loadCachedTokens`). The identity key is the Cognito `sub`
+ * claim of the ID token (falling back to the access token); it must be a
+ * non-empty string. Human sessions carry no `custom:entityUid` claim (hq-pro
+ * sets it only on agent and outpost machine identities), so it is not used.
+ * An agent or outpost session has its own Cognito user and therefore a
+ * different `sub`, so it could never match a person's opt-in; a token that
+ * names a machine identity (`custom:entityType` agent/outpost, or a
+ * non-`prs_` `custom:entityUid`) is refused outright. Claims are read
+ * without verification; this decides only whether local consent belongs to
+ * the account that is signed in, never authorization.
  */
-export declare function personUidFromTokens(tokens: {
+export declare function cognitoSubFromTokens(tokens: {
     idToken?: string;
     accessToken?: string;
 } | null | undefined): string | null;

package/dist/lib/work-context/person-identity.js

@@ -2,14 +2,18 @@
  * Signed-in person identity for the usage-attribution opt-in.
  *
  * Source: the cached Cognito person session (`~/.hq/cognito-tokens.json`,
- * read through `loadCachedTokens`). The person uid is the `custom:entityUid`
- * claim of the ID token (falling back to the access token), and only a
- * `prs_` value counts. Agent (`agt_`) or unknown identities return null, so
- * no opt-in is written or kept for them. Claims are read without
- * verification; this decides only whether local consent belongs to the
- * account that is signed in, never authorization.
+ * read through `loadCachedTokens`). The identity key is the Cognito `sub`
+ * claim of the ID token (falling back to the access token); it must be a
+ * non-empty string. Human sessions carry no `custom:entityUid` claim (hq-pro
+ * sets it only on agent and outpost machine identities), so it is not used.
+ * An agent or outpost session has its own Cognito user and therefore a
+ * different `sub`, so it could never match a person's opt-in; a token that
+ * names a machine identity (`custom:entityType` agent/outpost, or a
+ * non-`prs_` `custom:entityUid`) is refused outright. Claims are read
+ * without verification; this decides only whether local consent belongs to
+ * the account that is signed in, never authorization.
  */
-import { isPersonUid } from "./config.js";
+import { isCognitoSub } from "./config.js";
 function claimsOf(token) {
     if (typeof token !== "string")
         return null;
@@ -26,13 +30,22 @@ function claimsOf(token) {
         return null;
     }
 }
-export function personUidFromTokens(tokens) {
+export function cognitoSubFromTokens(tokens) {
     if (!tokens)
         return null;
     for (const token of [tokens.idToken, tokens.accessToken]) {
-        const uid = claimsOf(token)?.["custom:entityUid"];
-        if (isPersonUid(uid))
-            return uid;
+        const claims = claimsOf(token);
+        if (!claims)
+            continue;
+        const entityType = claims["custom:entityType"];
+        const entityUid = claims["custom:entityUid"];
+        if (entityType === "agent" || entityType === "outpost")
+            return null;
+        if (typeof entityUid === "string" && !entityUid.startsWith("prs_"))
+            return null;
+        const sub = claims.sub;
+        if (isCognitoSub(sub))
+            return sub.trim();
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.5",
+  "version": "5.345.6",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {