@indigoai-us/hq-cli 5.345.80 → 5.345.82

package/dist/lib/storage-feature-flag.d.ts

@@ -0,0 +1,56 @@
+/**
+ * HQ Storage allowlist gate (hq-flags key `hq-storage`).
+ *
+ * Owner decision (Corey, 2026-10-11): "let's fully ship the storage feature
+ * but all behind a feature flag for indigo users only." That is an explicit
+ * hold on the default-on kill-switch rule
+ * (`indigo-feature-flags-default-on-as-fail-safes`): the registry row is
+ * `defaultValue: false` with a company override for Indigo, so this gate is
+ * an ALLOWLIST, not a kill switch. It therefore FAILS CLOSED: a missing,
+ * stale, discovered, archived or unreadable value means Storage is off.
+ *
+ * Who it is on for is decided by hq-pro's shared evaluator (person override,
+ * then company override by uid, then slug, then default), resolved
+ * server-side for the caller. A company override only fires when the read
+ * names that company, so the caller is "on" when the flag resolves true for
+ * any company they are an active member of. hq-pro refuses a resolve for a
+ * company the caller is not a member of, so the tenant boundary is the
+ * membership check on the server, never a local list.
+ *
+ * This module is the synchronous, cache-only half used to hide the command
+ * from root help. It reads only fresh persisted snapshots and never touches
+ * the network. The authoritative, live check that runs before any storage
+ * subcommand lives in `commands/storage-gate.ts`.
+ */
+import type { Command } from "commander";
+import { HQ_STORAGE_FLAG } from "./cli-flag-keys.js";
+export { HQ_STORAGE_FLAG };
+/** Machine-readable refusal code the desktop app keys on. */
+export declare const STORAGE_FEATURE_DISABLED_CODE = "feature_disabled";
+export declare const STORAGE_FEATURE_DISABLED_MESSAGE = "Storage tools aren't available on your account yet.";
+export interface StorageFlagCacheDeps {
+    env?: NodeJS.ProcessEnv;
+    /** Company uids whose persisted snapshots may be consulted. */
+    companyUids?: () => string[];
+    readCompanySnapshot?: (companyUid: string) => {
+        flags: Record<string, boolean>;
+    } | null;
+    readPersonSnapshot?: () => {
+        flags: Record<string, boolean>;
+    } | null;
+}
+/**
+ * True only when a fresh persisted snapshot already says `hq-storage` is on
+ * for this caller (person scope or one of their companies). Everything else,
+ * including any read error, is false.
+ */
+export declare function storageFeatureEnabledFromCache(deps?: StorageFlagCacheDeps): boolean;
+/** The JSON refusal printed on stdout for `--json` callers such as the desktop app. */
+export declare function storageFeatureDisabledJson(): string;
+/**
+ * Hide the catalog's `storage` root from root help unless the cached gate is
+ * on. Lives here, not in commands/storage-gate.ts, so the root-help path only
+ * loads this cache-only module.
+ */
+export declare function hideStorageInCatalog(program: Command, enabled?: () => boolean): void;
+//# sourceMappingURL=storage-feature-flag.d.ts.map

package/dist/lib/storage-feature-flag.js

@@ -0,0 +1,104 @@
+import { readLocalOverride } from "@indigoai-us/hq-flags-client";
+import { HQ_STORAGE_FLAG } from "./cli-flag-keys.js";
+import { readFlagSnapshotFile, readPersonFlagSnapshotFile } from "./flag-snapshot-file.js";
+import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
+import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
+import { resolveDefaultHqRoot } from "../utils/hq-root-resolver.js";
+export { HQ_STORAGE_FLAG };
+/** Machine-readable refusal code the desktop app keys on. */
+export const STORAGE_FEATURE_DISABLED_CODE = "feature_disabled";
+export const STORAGE_FEATURE_DISABLED_MESSAGE = "Storage tools aren't available on your account yet.";
+const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
+function knownCompanyUids(env) {
+    const uids = new Set();
+    try {
+        const context = resolveProcessFlagCompanyContext(env);
+        if (context.companyUid)
+            uids.add(context.companyUid);
+    }
+    catch {
+        // No context: fall through to the manifest.
+    }
+    try {
+        const manifest = readCompaniesManifestMap(resolveDefaultHqRoot({ env }));
+        for (const entry of Object.values(manifest ?? {})) {
+            const uid = entry?.cloud_uid;
+            if (typeof uid === "string" && COMPANY_UID_RE.test(uid.trim()))
+                uids.add(uid.trim());
+        }
+    }
+    catch {
+        // An unreadable manifest only means fewer cached snapshots to check.
+    }
+    return [...uids];
+}
+/**
+ * True only when a fresh persisted snapshot already says `hq-storage` is on
+ * for this caller (person scope or one of their companies). Everything else,
+ * including any read error, is false.
+ */
+export function storageFeatureEnabledFromCache(deps = {}) {
+    const env = deps.env ?? process.env;
+    try {
+        const local = readLocalOverride(HQ_STORAGE_FLAG, env);
+        if (local !== null)
+            return local;
+    }
+    catch {
+        // Treat a broken override like no override.
+    }
+    const on = (snapshot) => snapshot?.flags?.[HQ_STORAGE_FLAG] === true;
+    try {
+        if (on((deps.readPersonSnapshot ?? (() => readPersonFlagSnapshotFile({ env })))()))
+            return true;
+    }
+    catch {
+        // fail closed
+    }
+    const readCompany = deps.readCompanySnapshot ?? ((uid) => readFlagSnapshotFile(uid, { env }));
+    let uids = [];
+    try {
+        uids = (deps.companyUids ?? (() => knownCompanyUids(env)))();
+    }
+    catch {
+        return false;
+    }
+    for (const uid of uids) {
+        try {
+            if (on(readCompany(uid)))
+                return true;
+        }
+        catch {
+            // fail closed for this company
+        }
+    }
+    return false;
+}
+/** The JSON refusal printed on stdout for `--json` callers such as the desktop app. */
+export function storageFeatureDisabledJson() {
+    return JSON.stringify({
+        ok: false,
+        code: STORAGE_FEATURE_DISABLED_CODE,
+        message: STORAGE_FEATURE_DISABLED_MESSAGE,
+    });
+}
+/**
+ * Hide the catalog's `storage` root from root help unless the cached gate is
+ * on. Lives here, not in commands/storage-gate.ts, so the root-help path only
+ * loads this cache-only module.
+ */
+export function hideStorageInCatalog(program, enabled = storageFeatureEnabledFromCache) {
+    const storage = program.commands.find((command) => command.name() === "storage");
+    if (!storage)
+        return;
+    let visible = false;
+    try {
+        visible = enabled();
+    }
+    catch {
+        visible = false;
+    }
+    if (!visible)
+        storage._hidden = true;
+}
+//# sourceMappingURL=storage-feature-flag.js.map

package/dist/main.js

@@ -273,11 +273,22 @@ export async function runCli() {
         const registration = await registerCommandsWithRecovery({
             register: async () => {
                 const lazy = findLazyCommand(process.argv);
-                if (lazy) {
+                if (lazy?.name === "storage") {
+                    // HQ Storage is an allowlist gate (owner hold 2026-10-11, Indigo-only):
+                    // resolve it here, where awaiting is free, and fail closed.
+                    const gate = await import("./commands/storage-gate.js");
+                    if (await gate.storageFeatureEnabled())
+                        await lazy.register(program);
+                    else
+                        gate.registerStorageRefusal(program, process.argv);
+                }
+                else if (lazy) {
                     await lazy.register(program);
                 }
                 else {
                     registerCommandCatalog(program);
+                    const { hideStorageInCatalog } = await import("./lib/storage-feature-flag.js");
+                    hideStorageInCatalog(program);
                 }
             },
             argv: process.argv,

package/dist/utils/resident-package-preload.js

@@ -41,7 +41,7 @@ export const RESIDENT_PACKAGE_MODULES = {
     ],
     "bot-logs-follow": [],
     mcp: ["../lib/mcp/tools.js", "../lib/mcp/prompts.js", "../lib/anywhere-person-setting.js", "../utils/cognito-session.js", "@indigoai-us/hq-cloud", "../sentry.js", "../lib/doctor/client-health-reason-codes-flag.js", "@indigoai-us/hq-flags-client"],
-    childWrapper: ["../main.js", "../lib/service-manager/startup-migration.js"],
+    childWrapper: ["../main.js", "../lib/service-manager/startup-migration.js", "../commands/storage-gate.js", "../lib/storage-feature-flag.js"],
     coreJobRun: ["../commands/core-native-jobs-flag.js", "../commands/core-native-family-flag.js", "../lib/flag-registry.js", "../lib/flag-snapshot-file.js"],
     "daemon-call": ["../lib/daemon/protocol.js"],
     daemon: [
@@ -201,6 +201,8 @@ const LOADERS = {
     childWrapper: [
         () => import("../main.js"),
         () => import("../lib/service-manager/startup-migration.js"),
+        () => import("../commands/storage-gate.js"),
+        () => import("../lib/storage-feature-flag.js"),
     ],
     coreJobRun: [
         () => import("../commands/core-native-jobs-flag.js"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.80",
+  "version": "5.345.82",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -48,7 +48,7 @@
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@aws-sdk/dsql-signer": "^3.1146.0",
-    "@indigoai-us/hq-cloud": "~6.18.54",
+    "@indigoai-us/hq-cloud": "~6.18.61",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@modelcontextprotocol/sdk": "1.29.0",
     "@sentry/node": "^10.49.0",