@indigoai-us/hq-cli 5.345.57 → 5.345.58

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## [Unreleased]
 
+## [5.345.58] — 2026-10-09
+- hq access now accepts `--as <member>` to view another member's access, read-only.
+
 ## [5.345.57] — 2026-10-09
 - Add `hq lanes create --loop` and `hq lanes enqueue` for persistent worker lanes that process FIFO phase envelopes, return generic results or section 8 handoffs, reuse sessions per story, retry one stall, and park a second stall for the senior. Loop behavior uses the default-on `lanes.conduct-loop` hq-flags kill switch. See `docs/lanes.md` for command output and exit codes.
 

package/dist/command-catalog.generated.d.ts

@@ -2871,6 +2871,10 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly flags: "--company <slug>";
         readonly description: "Company slug";
         readonly hidden: false;
+    }, {
+        readonly flags: "--as <person-uid>";
+        readonly description: "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)";
+        readonly hidden: false;
     }, {
         readonly flags: "--json";
         readonly description: "Print a single JSON object";

package/dist/command-catalog.generated.js

@@ -3462,6 +3462,11 @@ export const COMMAND_CATALOG = [
                 "description": "Company slug",
                 "hidden": false
             },
+            {
+                "flags": "--as <person-uid>",
+                "description": "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)",
+                "hidden": false
+            },
             {
                 "flags": "--json",
                 "description": "Print a single JSON object",

package/dist/commands/access.d.ts

@@ -135,6 +135,15 @@ export interface RunAccessResult {
     alreadyAskedAt?: string;
     requestNote?: string;
 }
+export interface AccessAsResult {
+    personUid: string;
+    company: string;
+    path: string;
+    permission: "read" | "write" | "admin" | null;
+    canRead: boolean;
+    roleBypass: boolean;
+    exitCode: 0 | 3;
+}
 export declare function outcomeExitCode(outcome: AccessOutcome): 0 | 2 | 3 | 4;
 export declare function formatAccessOutcome(result: RunAccessResult): string;
 export declare function resolveGrantor(tree: AccessAclTree | null, members: AccessMember[]): AccessGrantor | null;
@@ -149,6 +158,11 @@ export declare function resolveAccessCompany(target: string, opts?: {
     company?: string;
     hqRoot?: string;
 }): string | undefined;
+export declare function runAccessForPerson(rawPath: string, personUid: string, opts?: {
+    company?: string;
+    hqRoot?: string;
+}): Promise<AccessAsResult>;
+export declare function formatAccessForPerson(result: AccessAsResult): string;
 export declare function runAccessForPath(path: string, opts?: {
     company?: string;
     hqRoot?: string;

package/dist/commands/access.js

@@ -20,7 +20,7 @@ import * as readline from "node:readline";
 import { ListObjectsV2Command, } from "@aws-sdk/client-s3";
 import { DEFAULT_HQ_ROOT } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch, resolveCallerUid } from "../utils/vault-api.js";
-import { parseCompanySlugFromPath, resolveBrowseSession, makeCompanyPresignFactory, runGet, } from "./files-browse.js";
+import { parseCompanySlugFromPath, classifyAclSource, resolveBrowseSession, makeCompanyPresignFactory, runGet, toBucketRelative, } from "./files-browse.js";
 import { listJournals, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { listActiveMembers } from "./members.js";
 import { buildDmBody } from "./dm.js";
@@ -87,6 +87,10 @@ function normalizeTarget(raw, slug) {
         t = t.slice(anchor.length);
     return t;
 }
+function fileGrantCoversPath(grantPath, targetPath) {
+    return classifyAclSource(targetPath, [grantPath]) !== "role-bypass";
+}
+const FILE_PERMISSION_RANK = { read: 1, write: 2, admin: 3 };
 function httpStatusOf(err) {
     if (!err || typeof err !== "object")
         return undefined;
@@ -637,6 +641,7 @@ export function registerAccessCommand(program) {
         .command("access <path-or-query>")
         .description("Tell whether a vault file exists and whether you can read it. Never a bare not-found. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.")
         .option("--company <slug>", "Company slug")
+        .option("--as <person-uid>", "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)")
         .option("--json", "Print a single JSON object")
         .option("--no-fix", "Diagnose only: do not fetch, pin, or repair sync")
         .option("--yes", "Answer the one send-confirmation yes (hosts must pass this explicitly)")
@@ -650,6 +655,12 @@ Exit codes:
 `)
         .action(async (target, opts) => {
         try {
+            if (opts.as) {
+                const result = await runAccessForPerson(target, opts.as, opts);
+                console.log(opts.json ? JSON.stringify(result) : formatAccessForPerson(result));
+                process.exitCode = result.exitCode;
+                return;
+            }
             const result = await runAccessForPath(target, opts);
             process.exitCode = result.exitCode;
         }
@@ -669,6 +680,63 @@ export function resolveAccessCompany(target, opts) {
     const hqRoot = opts?.hqRoot ?? DEFAULT_HQ_ROOT;
     return opts?.company ?? slugFromTarget(target) ?? readActiveCompany(hqRoot);
 }
+export async function runAccessForPerson(rawPath, personUid, opts) {
+    const uid = personUid.trim();
+    if (!/^(?:prs|agt)_[A-Za-z0-9_-]+$/.test(uid)) {
+        throw new Error("Pass the person's exact prs_ or agt_ UID to --as.");
+    }
+    const pathSlug = slugFromTarget(rawPath);
+    if (opts?.company && pathSlug && opts.company !== pathSlug) {
+        throw new Error("The --company value does not match the company in the path.");
+    }
+    const company = resolveAccessCompany(rawPath, opts);
+    if (!company)
+        throw new Error("Pass --company <slug> or an anchored company path.");
+    const relativePath = normalizeTarget(rawPath, company);
+    if (!relativePath || relativePath.split(/[\\/]/).includes("..")) {
+        throw new Error("Pass a company-relative path without parent-directory segments.");
+    }
+    const { token } = await resolveBrowseSession();
+    const companyUid = await getCompanyUid(token, company);
+    const response = await vaultApiFetch({
+        token,
+        path: `/files/${encodeURIComponent(companyUid)}/members/${encodeURIComponent(uid)}/access`,
+        method: "GET",
+    });
+    if (!response.ok) {
+        if (response.status === 403) {
+            throw new Error("Only the person themself or a company owner/admin can check this access.");
+        }
+        if (response.status === 404) {
+            throw new Error("That person is not an active member of this company.");
+        }
+        throw new Error(`Member access check failed (${response.status}).`);
+    }
+    const projection = (await response.json());
+    if (projection.personUid !== uid || !projection.files) {
+        throw new Error("The member access response did not match the requested person.");
+    }
+    const roleBypass = projection.files.roleBypass === true;
+    const grants = Array.isArray(projection.files.grants) ? projection.files.grants : [];
+    const matchingPermissions = grants
+        .filter((grant) => typeof grant.path === "string" && typeof grant.permission === "string" &&
+        grant.permission in FILE_PERMISSION_RANK &&
+        fileGrantCoversPath(toBucketRelative(grant.path, company), relativePath))
+        .map((grant) => grant.permission);
+    const permission = roleBypass ? "admin" : matchingPermissions.reduce((best, candidate) => best === null || FILE_PERMISSION_RANK[candidate] > FILE_PERMISSION_RANK[best] ? candidate : best, null);
+    return {
+        personUid: uid,
+        company,
+        path: `companies/${company}/${relativePath}`,
+        permission,
+        canRead: permission !== null,
+        roleBypass,
+        exitCode: permission === null ? 3 : 0,
+    };
+}
+export function formatAccessForPerson(result) {
+    return `${result.personUid} has ${result.permission ?? "no access"} access to ${result.path}.`;
+}
 export async function runAccessForPath(path, opts) {
     const target = path;
     const hqRoot = opts?.hqRoot ?? DEFAULT_HQ_ROOT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.57",
+  "version": "5.345.58",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {