@indigoai-us/hq-cli 5.35.1 → 5.35.2

package/src/commands/cloud-provision.ts

@@ -388,11 +388,20 @@ export interface ManifestCompanyEntry {
  * under the target slug. Read → mutate → temp-write → rename so concurrent
  * readers never see a partially-written file.
  *
- * Idempotent: if the values already match, this is a no-op (still rewrites
- * the file to canonical YAML, but the mutation is identical).
+ * Skip-if-unchanged: if the target slug already carries the exact
+ * `cloud_uid` + `bucket_name`, this is a true no-op — the file is left
+ * byte-for-byte intact (comments, ordering, and formatting preserved) and
+ * we return `false`. This matters because `yaml.dump` does NOT round-trip
+ * comments or the original layout: an unconditional rewrite re-canonicalises
+ * the manifest (stripping the `/newcompany` header comment, reflowing keys)
+ * on EVERY provision/Connect, even when nothing semantically changed. Each
+ * such rewrite is then pushed by the initial-sync step, so the
+ * comment-stripped local form perpetually diverges from any peer/cloud copy
+ * that still holds the commented form — manifesting as a recurring HQ Sync
+ * conflict loop on `companies/manifest.yaml` that re-fires every sync. Only
+ * writing when a value actually changes lets the two forms converge.
  *
- * Returns true if the file was written (always true in current impl —
- * reserved for future "skip if unchanged" optimization).
+ * Returns true if the file was written, false if it was already current.
  */
 export function patchManifest(
   hqRoot: string,
@@ -408,6 +417,14 @@ export function patchManifest(
   // Preserve null / object / unknown — promote null → {} so we can write keys.
   const entry: ManifestCompanyEntry =
     existing && typeof existing === "object" ? { ...existing } : {};
+
+  // No-op guard: both fields already match → leave the on-disk file (and its
+  // comments) untouched so a re-provision can't churn the manifest and seed a
+  // sync conflict loop.
+  if (entry.cloud_uid === cloudUid && entry.bucket_name === bucketName) {
+    return false;
+  }
+
   entry.cloud_uid = cloudUid;
   entry.bucket_name = bucketName;
   parsed.companies[slug] = entry;
@@ -757,9 +774,20 @@ export async function provisionCompany(
   const bucketName = entity.bucketName;
   const kmsKeyId = entity.kmsKeyId ?? null;
 
-  // Step 6: patch manifest atomically
-  patchManifest(options.hqRoot, options.slug, cloudUid, bucketName);
-  log(`patched companies/manifest.yaml`);
+  // Step 6: patch manifest atomically. Skip-if-unchanged returns false when
+  // the manifest already carries this slug's cloud_uid + bucket_name, so we
+  // report the honest outcome rather than always claiming a patch.
+  const manifestPatched = patchManifest(
+    options.hqRoot,
+    options.slug,
+    cloudUid,
+    bucketName,
+  );
+  log(
+    manifestPatched
+      ? `patched companies/manifest.yaml`
+      : `companies/manifest.yaml already current — left untouched`,
+  );
 
   // Step 7: write .hq/config.json atomically
   writeCompanyConfig(options.hqRoot, options.slug, {
@@ -821,7 +849,7 @@ export async function provisionCompany(
     vault_api_url: options.vaultApiUrl,
     kms_key_id: kmsKeyId,
     created_entity: createdEntity,
-    manifest_patched: true,
+    manifest_patched: manifestPatched,
     config_written: true,
     initial_sync: initialSync,
   };

package/src/commands/creators.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it, vi } from "vitest";
+import { runCreatorApply } from "./creators.js";
+
+function jsonResponse(status: number, body: unknown): Response {
+  return {
+    status,
+    json: async () => body,
+  } as unknown as Response;
+}
+
+describe("runCreatorApply", () => {
+  it("submits the application and reports the application id", async () => {
+    const post = vi
+      .fn()
+      .mockResolvedValue(
+        jsonResponse(202, { status: "request_received", applicationId: "capp_1" }),
+      );
+    const res = await runCreatorApply(
+      { reason: "I build automation skills" },
+      { getAccessToken: async () => "tok", post },
+    );
+    expect(res.message).toMatch(/submitted \(capp_1\)/);
+    expect(post).toHaveBeenCalledWith("tok", { reason: "I build automation skills" });
+  });
+
+  it("passes an optional handle through", async () => {
+    const post = vi.fn().mockResolvedValue(jsonResponse(202, { applicationId: "capp_2" }));
+    await runCreatorApply(
+      { reason: "pitch", handle: "  acme  " },
+      { getAccessToken: async () => "tok", post },
+    );
+    expect(post).toHaveBeenCalledWith("tok", { reason: "pitch", handle: "acme" });
+  });
+
+  it("treats a 409 / APPLICATION_PENDING as an already-pending message", async () => {
+    const post = vi
+      .fn()
+      .mockResolvedValue(jsonResponse(409, { code: "APPLICATION_PENDING", applicationId: "capp_3" }));
+    const res = await runCreatorApply(
+      { reason: "pitch" },
+      { getAccessToken: async () => "tok", post },
+    );
+    expect(res.message).toMatch(/already have a pending/i);
+  });
+
+  it("requires a non-empty reason", async () => {
+    const post = vi.fn();
+    await expect(
+      runCreatorApply({ reason: "   " }, { getAccessToken: async () => "tok", post }),
+    ).rejects.toThrow(/reason is required/i);
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  it("throws on a hard server error", async () => {
+    const post = vi.fn().mockResolvedValue(jsonResponse(500, { error: "boom" }));
+    await expect(
+      runCreatorApply({ reason: "pitch" }, { getAccessToken: async () => "tok", post }),
+    ).rejects.toThrow(/boom/);
+  });
+});

package/src/commands/creators.ts

@@ -0,0 +1,117 @@
+/**
+ * `hq creators apply` — apply for verified-creator access.
+ *
+ * Publishing to the marketplace is gated on verified-creator status. An
+ * unverified caller submits an application (a short pitch + optional desired
+ * handle); it is persisted server-side and an Indigo admin reviews it. On
+ * approval the caller becomes a verified creator and can `hq publish`.
+ *
+ * Wire contract (POST /v1/creators/request-access, authed):
+ *   body { reason: string, handle?: string }
+ *   202  { status, code, applicationId, requestAccessPath }
+ *   409  { code: "APPLICATION_PENDING", error, applicationId }  (already pending)
+ */
+import { Command } from "commander";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+
+export interface CreatorApplyOptions {
+  reason: string;
+  handle?: string;
+}
+
+export interface CreatorApplyDeps {
+  /** Resolve a non-expired access token (prompts login when interactive). */
+  getAccessToken: () => Promise<string>;
+  /** POST the application body to the vault API. */
+  post: (token: string, body: Record<string, unknown>) => Promise<Response>;
+}
+
+export interface CreatorApplyResult {
+  message: string;
+}
+
+/**
+ * Testable core. Submits the application and maps the server response to a
+ * single human-readable message. Throws on hard failures.
+ */
+export async function runCreatorApply(
+  opts: CreatorApplyOptions,
+  deps: CreatorApplyDeps,
+): Promise<CreatorApplyResult> {
+  const reason = opts.reason?.trim();
+  if (!reason) {
+    throw new Error(
+      'A reason is required — pass --reason "why you want to publish to the marketplace".',
+    );
+  }
+
+  const token = await deps.getAccessToken();
+  const body: Record<string, unknown> = { reason };
+  const handle = opts.handle?.trim();
+  if (handle) body.handle = handle;
+
+  const res = await deps.post(token, body);
+  const parsed = (await res
+    .json()
+    .catch(() => ({}))) as Record<string, unknown>;
+
+  if (res.status === 409 || parsed.code === "APPLICATION_PENDING") {
+    return {
+      message:
+        "You already have a pending creator application — an Indigo admin will review it.",
+    };
+  }
+  if (res.status < 200 || res.status >= 300) {
+    const msg =
+      (parsed.error as string) ?? (parsed.message as string) ?? `HTTP ${res.status}`;
+    throw new Error(`Creator application failed: ${msg}`);
+  }
+
+  const id =
+    typeof parsed.applicationId === "string" ? ` (${parsed.applicationId})` : "";
+  return {
+    message:
+      `Creator application submitted${id} — an Indigo admin will review it. ` +
+      "You'll be able to `hq publish` once approved.",
+  };
+}
+
+export function registerCreatorsCommand(program: Command): void {
+  const creators = program
+    .command("creators")
+    .description("Creator marketplace account");
+
+  creators
+    .command("apply")
+    .description(
+      "Apply for verified-creator access (required to publish packs)",
+    )
+    .requiredOption(
+      "--reason <reason>",
+      "Why you want to publish to the marketplace",
+    )
+    .option("--handle <handle>", "Desired creator handle (optional)")
+    .action(async (options: CreatorApplyOptions) => {
+      try {
+        const result = await runCreatorApply(
+          { reason: options.reason, handle: options.handle },
+          {
+            getAccessToken: () => ensureCognitoToken({ interactive: true }),
+            post: (token, body) =>
+              vaultApiFetch({
+                token,
+                path: "/v1/creators/request-access",
+                method: "POST",
+                body,
+              }),
+          },
+        );
+        console.log(chalk.green(result.message));
+      } catch (err) {
+        console.error(chalk.red((err as Error).message));
+        process.exitCode = 1;
+      }
+    });
+}

package/src/commands/login.ts

@@ -1,11 +1,11 @@
 /**
- * hq login — opens browser for Cognito auth via Google OAuth
+ * hq login — opens browser for Cognito auth.
  */
 
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
-import { DEFAULT_COGNITO } from '../utils/cognito-session.js';
+import { cognitoConfigForLoginProvider } from '../utils/login-provider.js';
 
 function peekIdToken(idToken: string): { email?: string; sub?: string } {
   try {
@@ -23,8 +23,12 @@ function peekIdToken(idToken: string): { email?: string; sub?: string } {
 export function registerLoginCommand(program: Command): void {
   program
     .command('login')
-    .description('Authenticate with HQ via Cognito (Google OAuth)')
-    .action(async () => {
+    .description('Authenticate with HQ via Cognito')
+    .option(
+      '--provider <provider>',
+      'OAuth provider to use: google, microsoft, or picker',
+    )
+    .action(async (options: { provider?: string }) => {
       try {
         const existing = loadCachedTokens();
         if (existing && !isExpiring(existing, 120)) {
@@ -34,7 +38,7 @@ export function registerLoginCommand(program: Command): void {
         }
 
         console.log('Opening browser for authentication...');
-        const tokens = await browserLogin(DEFAULT_COGNITO);
+        const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
         const who = peekIdToken(tokens.idToken).email ?? 'HQ';
         console.log(chalk.green(`Logged in as ${who}`));
       } catch (error) {

package/src/commands/marketplace-install.test.ts

@@ -38,6 +38,30 @@ vi.mock('node:readline', () => ({
   }),
 }));
 
+// Mock the public listings API so `defaultMarketplaceDeps().resolveListing` is
+// exercised against a controllable feed (BUG-1 exact-slug-match regression).
+// `publicResponder` is read at call time so each test can shape the response —
+// it receives the call options + a zero-based call index so a test can return a
+// different body for the browse call vs. the follow-up detail fetch.
+type PublicResponse = { ok: boolean; status: number; body: unknown };
+let publicResponder: (
+  opts: { path: string; query?: Record<string, string> },
+  call: number,
+) => PublicResponse = () => ({ ok: true, status: 200, body: { listings: [] } });
+const fetchPublicCalls: Array<{ path: string; query?: Record<string, string> }> = [];
+vi.mock('../utils/vault-api.js', () => ({
+  vaultApiFetchPublic: async (opts: { path: string; query?: Record<string, string> }) => {
+    const call = fetchPublicCalls.length;
+    fetchPublicCalls.push(opts);
+    const r = publicResponder(opts, call);
+    return {
+      ok: r.ok,
+      status: r.status,
+      json: async () => r.body,
+    } as unknown as Response;
+  },
+}));
+
 import {
   classify,
   parseMarketplaceSource,
@@ -45,6 +69,7 @@ import {
   fetchMarketplace,
   resolveLatestMarketplace,
   installPack,
+  defaultMarketplaceDeps,
   ArtifactVerificationError,
   type MarketplaceDeps,
   type MarketplaceListing,
@@ -412,3 +437,107 @@ describe('US-006 REGRESSION: legacy transports still dispatch + install unchange
     }
   });
 });
+
+// ---------------------------------------------------------------------------
+// BUG-1 — defaultMarketplaceDeps().resolveListing must EXACT-slug-match
+//
+// The browse handler historically ignored `?slug=` and only honored `?q=`
+// (fuzzy), so `?slug=tdd` returned ALL approved listings newest-first. The old
+// code took `listings[0]` → installed the NEWEST pack, not the requested slug
+// (verified live: `marketplace:tdd` installed hq-pack-review). resolveListing
+// must now exact-match `l.slug === slug` and throw when no exact match exists,
+// and must query with BOTH `slug` + `q` for forward/back compatibility.
+// ---------------------------------------------------------------------------
+
+describe('BUG-1 resolveListing exact-slug match (defaultMarketplaceDeps)', () => {
+  beforeEach(() => {
+    fetchPublicCalls.length = 0;
+    publicResponder = () => ({ ok: true, status: 200, body: { listings: [] } });
+  });
+
+  /** A browse-summary entry (id present, no URL — detail fetch mints it). */
+  function summary(slug: string, version: string, extra?: Record<string, unknown>) {
+    return { listingId: `lst_${slug}`, slug, version, status: 'approved', ...extra };
+  }
+
+  /** The `GET /v1/listings/{id}` detail the follow-up fetch returns. */
+  function detailBody(slug: string, version: string) {
+    return {
+      listing: {
+        id: `lst_${slug}`,
+        slug,
+        version,
+        downloadUrl: 'https://s3.example/presigned?sig=abc',
+        contentHash: 'a'.repeat(64),
+      },
+    };
+  }
+
+  it('returns the EXACTLY-slugged listing — NOT listings[0] — from a multi-pack feed', async () => {
+    // Server returns a slug-ignoring fuzzy feed newest-first: review is [0], the
+    // requested tdd is later. Old code returned review; the fix returns tdd.
+    publicResponder = (_opts, call) =>
+      call === 0
+        ? {
+            ok: true,
+            status: 200,
+            body: { listings: [summary('review', '3.0.0'), summary('tdd', '1.2.0')] },
+          }
+        : { ok: true, status: 200, body: detailBody('tdd', '1.2.0') };
+
+    const listing = await defaultMarketplaceDeps().resolveListing('tdd');
+
+    expect(listing.slug).toBe('tdd');
+    expect(listing.listingId).toBe('lst_tdd');
+    // The browse query carried BOTH slug (exact) and q (fuzzy fallback).
+    expect(fetchPublicCalls[0].query).toMatchObject({ slug: 'tdd', q: 'tdd' });
+  });
+
+  it('throws a clear error when NO exact-slug match exists (never installs a near-miss)', async () => {
+    // Feed contains only OTHER slugs — a slug-ignoring/fuzzy server response.
+    publicResponder = () => ({
+      ok: true,
+      status: 200,
+      body: { listings: [summary('review', '3.0.0'), summary('tdd-helper', '1.0.0')] },
+    });
+
+    await expect(defaultMarketplaceDeps().resolveListing('tdd')).rejects.toThrow(
+      /No marketplace listing found for slug "tdd"/,
+    );
+  });
+
+  it('with a pinned version, requires BOTH exact slug AND exact version', async () => {
+    publicResponder = (_opts, call) =>
+      call === 0
+        ? {
+            ok: true,
+            status: 200,
+            body: {
+              listings: [
+                summary('tdd', '2.0.0'),
+                summary('tdd', '1.5.0'),
+                summary('review', '9.9.9'),
+              ],
+            },
+          }
+        : { ok: true, status: 200, body: detailBody('tdd', '1.5.0') };
+
+    const listing = await defaultMarketplaceDeps().resolveListing('tdd', '1.5.0');
+
+    expect(listing.slug).toBe('tdd');
+    expect(listing.version).toBe('1.5.0');
+    expect(fetchPublicCalls[0].query).toMatchObject({ slug: 'tdd', q: 'tdd', version: '1.5.0' });
+  });
+
+  it('throws when the pinned version is absent even if the slug matches', async () => {
+    publicResponder = () => ({
+      ok: true,
+      status: 200,
+      body: { listings: [summary('tdd', '2.0.0'), summary('tdd', '1.5.0')] },
+    });
+
+    await expect(defaultMarketplaceDeps().resolveListing('tdd', '9.9.9')).rejects.toThrow(
+      /No marketplace listing found for slug "tdd"@9\.9\.9/,
+    );
+  });
+});

package/src/commands/pack-install.test.ts

@@ -307,6 +307,55 @@ describe('pack-install: install path layout', () => {
     });
   });
 
+  // ---- 7. hqCore host-version check is prerelease-tolerant -------------------
+  // BUGFIX: a prerelease host version (e.g. `15.0.9-beta.1`) was rejected by the
+  // `requires.hqCore` check because node-semver excludes prereleases from range
+  // matching by default. The fix passes `{ includePrerelease: true }` so a beta/rc
+  // HQ build can still install packs — while a genuinely-too-old host still fails.
+  describe('requires.hqCore prerelease tolerance', () => {
+    function writePackRequiring(range: string): string {
+      const dir = mkFakePackPayload({ 'knowledge/demo/README.md': '# demo' });
+      fs.writeFileSync(
+        path.join(dir, 'package.yaml'),
+        [
+          'name: hq-pack-test',
+          'version: 1.0.0',
+          "publisher: '@indigoai-us'",
+          'access: public',
+          'requires:',
+          `  hqCore: '${range}'`,
+          'contributes:',
+          '  knowledge:',
+          '    - demo',
+          '',
+        ].join('\n'),
+      );
+      return dir;
+    }
+
+    it('ACCEPTS a prerelease host version against a plain range (>=14.2.0)', () => {
+      const dir = writePackRequiring('>=14.2.0');
+      const m = validateManifest(dir, '15.0.9-beta.1');
+      expect(m.name).toBe('hq-pack-test');
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('still REJECTS a genuinely-too-old host (13.0.0 against >=14.2.0)', () => {
+      const dir = writePackRequiring('>=14.2.0');
+      expect(() => validateManifest(dir, '13.0.0')).toThrow(
+        /does not satisfy pack requirement/,
+      );
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    it('still ACCEPTS a normal (non-prerelease) host version', () => {
+      const dir = writePackRequiring('>=14.2.0');
+      const m = validateManifest(dir, '15.0.0');
+      expect(m.name).toBe('hq-pack-test');
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+  });
+
   it('stampInstallSource preserves a leading `---` document marker — no multi-doc YAML stream', () => {
     // Regression: prepending `source:` before a `---` would split the file
     // into two YAML documents, and single-doc `yaml.load` callers downstream

package/src/commands/pack-install.ts

@@ -402,9 +402,22 @@ export function defaultMarketplaceDeps(): MarketplaceDeps {
   return {
     resolveListing: async (slug, version) => {
       // Search by slug (public). The API returns approved listings only.
+      //
+      // BUGFIX: the browse handler historically IGNORED `?slug=` and only
+      // honored `?q=` (fuzzy), so `?slug=tdd` returned ALL approved listings
+      // newest-first — and blindly taking `listings[0]` then installed the
+      // newest pack, not the requested slug (e.g. `marketplace:tdd` installed
+      // hq-pack-review). We now (a) query with BOTH `slug` (exact, server-side
+      // filter being added in parallel) AND `q` (fuzzy fallback) so the right
+      // results come back whichever param the server honors, and (b) NEVER take
+      // `listings[0]` — we exact-match `l.slug === slug` among the results and
+      // throw a clear error if none matches, rather than installing the wrong
+      // pack.
+      const query: Record<string, string> = { slug, q: slug };
+      if (version) query.version = version;
       const res = await vaultApiFetchPublic({
         path: '/v1/listings',
-        query: version ? { slug, version } : { slug },
+        query,
       });
       if (!res.ok) {
         throw new Error(
@@ -415,12 +428,22 @@ export function defaultMarketplaceDeps(): MarketplaceDeps {
         listings?: RawListingSummary[];
       };
       const listings = body.listings ?? [];
-      const match = version
-        ? listings.find((l) => (l.version ?? l.latestVersion) === version)
-        : listings[0];
+      // Only consider listings whose slug EXACTLY matches the request — the
+      // fuzzy `q` search (and a slug-ignoring browse handler) can return
+      // unrelated packs, so an exact-slug filter is the safety floor.
+      const exact = listings.filter((l) => l.slug === slug);
+      let match: RawListingSummary | undefined;
+      if (version) {
+        // Pinned `marketplace:<slug>@<version>` → require an exact version too.
+        match = exact.find((l) => (l.version ?? l.latestVersion) === version);
+      } else {
+        // No pin → newest exact-slug match. The feed is newest-first, so the
+        // first exact-slug entry is the newest version of that slug.
+        match = exact[0];
+      }
       if (!match) {
         throw new Error(
-          `No approved marketplace listing found for "${slug}"${version ? `@${version}` : ''}.`,
+          `No marketplace listing found for slug "${slug}"${version ? `@${version}` : ''}.`,
         );
       }
       const id = match.listingId ?? match.id;
@@ -998,7 +1021,12 @@ export function validateManifest(
   if (!range || !semverValidRange(range)) {
     throw new Error(`requires.hqCore must be a valid semver range (got "${range}")`);
   }
-  if (hqVersion && !semverSatisfies(hqVersion, range)) {
+  // `includePrerelease` so a prerelease host version (e.g. `15.0.9-beta.1`)
+  // satisfies a plain range like `>=14.2.0`. By default node-semver excludes
+  // prereleases from range matching, which would wrongly reject every dogfooding
+  // beta/rc HQ build from installing packs. A genuinely-too-old host (e.g.
+  // `13.0.0`) still fails the range.
+  if (hqVersion && !semverSatisfies(hqVersion, range, { includePrerelease: true })) {
     throw new Error(
       `Host hqCore ${hqVersion} does not satisfy pack requirement ${range}`
     );

package/src/commands/publish.test.ts

@@ -166,6 +166,11 @@ describe('buildListingNotice', () => {
   it('maps 401/403 to an auth error', () => {
     expect(() => buildListingNotice(401, {}, 'hq-pack-demo', '1.0.0')).toThrow(/Not authorized|login/i);
   });
+  it('maps a 403 NOT_VERIFIED_CREATOR to the apply guidance', () => {
+    expect(() =>
+      buildListingNotice(403, { code: 'NOT_VERIFIED_CREATOR' }, 'hq-pack-demo', '1.0.0'),
+    ).toThrow(/hq creators apply/i);
+  });
   it('surfaces a generic server error body', () => {
     expect(() => buildListingNotice(500, { error: 'boom' }, 'hq-pack-demo', '1.0.0')).toThrow(/boom/);
   });

package/src/commands/publish.ts

@@ -315,6 +315,14 @@ export function buildListingNotice(
     );
   }
   if (status === 401 || status === 403) {
+    const code = typeof body.code === 'string' ? body.code : '';
+    if (code === 'NOT_VERIFIED_CREATOR') {
+      throw new Error(
+        'Only verified creators can publish to the marketplace. ' +
+          'Run `hq creators apply --reason "..."` to request verified-creator access; ' +
+          'an Indigo admin will review it.',
+      );
+    }
     throw new Error('Not authorized to publish — run `hq login` and ensure your creator account is verified.');
   }
   if (status < 200 || status >= 300) {

package/src/index.ts

@@ -25,6 +25,7 @@ import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
 import { registerPackageListCommand } from "./commands/pkg-list.js";
 import { registerPacksCommand } from "./commands/packs.js";
 import { registerPublishCommand } from "./commands/publish.js";
+import { registerCreatorsCommand } from "./commands/creators.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
@@ -108,6 +109,8 @@ registerPackageRemoveCommand(program);
 // "hq publish <skill-or-worker-path>" packages and submits a pack to the
 // marketplace via POST /v1/listings.
 registerPublishCommand(program);
+// `hq creators apply` — request verified-creator access (required to publish).
+registerCreatorsCommand(program);
 
 // Cloud sync subcommand group
 const syncCmd = program

package/src/utils/cognito-session.test.ts

@@ -50,10 +50,10 @@ describe("resolveDefaultHqRoot", () => {
     // companies/ already exists (we mkdir'd nested inside it)
 
     process.chdir(nested);
-    expect(resolveDefaultHqRoot()).toBe(hqDir);
+    expect(resolveDefaultHqRoot()).toBe(realpathSync(hqDir));
 
     process.chdir(hqDir);
-    expect(resolveDefaultHqRoot()).toBe(hqDir);
+    expect(resolveDefaultHqRoot()).toBe(realpathSync(hqDir));
   });
 
   it("priority 2: SKIPS a nested core/core.yaml without a sibling companies/ dir (Codex P2 on hq#146)", () => {
@@ -72,7 +72,7 @@ describe("resolveDefaultHqRoot", () => {
     process.chdir(cwdInsideCore);
     // Should walk PAST the inner core/core.yaml (no companies/ sibling) and
     // resolve to the real hqDir.
-    expect(resolveDefaultHqRoot()).toBe(hqDir);
+    expect(resolveDefaultHqRoot()).toBe(realpathSync(hqDir));
   });
 
   it("priority 3: falls back when neither $HQ_ROOT nor an HQ-root marker pair are found", () => {

package/src/utils/login-provider.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("./cognito-session.js", () => ({
+  DEFAULT_COGNITO: {
+    region: "us-east-1",
+    userPoolDomain: "vault-indigo-hq-prod",
+    clientId: "client-123",
+    port: 8765,
+    identityProvider: "Google",
+  },
+}));
+
+import {
+  cognitoConfigForLoginProvider,
+  parseLoginProvider,
+} from "./login-provider.js";
+
+describe("login provider helpers", () => {
+  it("preserves the default Cognito config when no provider is supplied", () => {
+    expect(cognitoConfigForLoginProvider(undefined).identityProvider).toBe("Google");
+  });
+
+  it("maps Microsoft to the Cognito MicrosoftPersonal IdP", () => {
+    expect(cognitoConfigForLoginProvider("microsoft").identityProvider).toBe(
+      "MicrosoftPersonal",
+    );
+  });
+
+  it("maps picker to no forced IdP", () => {
+    expect(cognitoConfigForLoginProvider("picker").identityProvider).toBeUndefined();
+  });
+
+  it("accepts provider values case-insensitively", () => {
+    expect(parseLoginProvider("Microsoft")).toBe("microsoft");
+  });
+
+  it("rejects unknown providers", () => {
+    expect(() => parseLoginProvider("github")).toThrow(
+      "Provider must be one of: google, microsoft, picker",
+    );
+  });
+});