@indigoai-us/hq-cli 5.47.15 → 5.47.17

package/.github/workflows/publish.yml

@@ -104,8 +104,8 @@ jobs:
           fi
           export SENTRY_AUTH_TOKEN
           VER=$(jq -r .version package.json)
-          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/
+          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/ node_modules/@indigoai-us/hq-cloud/dist/
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: indigo-d0
-          SENTRY_PROJECT: hq
+          SENTRY_PROJECT: hq-cli

package/dist/commands/feedback.d.ts

@@ -9,6 +9,8 @@ export interface FeedbackSubmitOptions {
     body: string;
     company?: string;
     token: string;
+    /** S3 object keys of already-uploaded screenshots (see uploadScreenshots). */
+    screenshots?: string[];
 }
 export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
 export declare function submitFeedback(opts: FeedbackSubmitOptions): Promise<FeedbackResult>;

package/dist/commands/feedback.js

@@ -1,10 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee78c7b6-6e93-5217-8a1d-ddc51afcf9c3")}catch(e){}}();
 import * as fs from "node:fs";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 export const BODY_MAX_BYTES = 64 * 1024;
 export async function readBodyFile(bodyFile, stdin) {
     if (bodyFile === "-") {
@@ -25,6 +26,16 @@ export async function readBodyFile(bodyFile, stdin) {
     return fs.promises.readFile(bodyFile, "utf-8");
 }
 export async function submitFeedback(opts) {
+    // Validate the title locally, symmetric with the body check below. Commander's
+    // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
+    // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
+    // to nothing) passes the flag check, then the server rejects it with a 400
+    // "title (non-empty string) is required" that floods Sentry as a context-free
+    // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
+    // and the bad request never reaches the server.
+    if (opts.title.trim().length === 0) {
+        throw new Error("title must not be empty. Provide a short, non-whitespace title via --title.");
+    }
     if (opts.body.trim().length === 0) {
         throw new Error("body must not be empty. Provide at least one non-whitespace character.");
     }
@@ -42,6 +53,9 @@ export async function submitFeedback(opts) {
     if (opts.company) {
         requestBody.company = opts.company;
     }
+    if (opts.screenshots && opts.screenshots.length > 0) {
+        requestBody.screenshots = opts.screenshots;
+    }
     const res = await vaultApiFetch({
         token: opts.token,
         path: "/v1/feedback",
@@ -68,16 +82,24 @@ function registerSubcommand(feedbackCmd, type) {
         .requiredOption("--title <text>", "Short title for the report")
         .requiredOption("--body-file <path>", "Path to a markdown file with the body; use - to read from stdin")
         .option("--company <slug>", "Company slug to associate with the report")
+        .option("--screenshot <path>", `Attach a screenshot (repeatable, up to ${MAX_SCREENSHOTS}; .png/.jpg/.jpeg/.webp/.gif)`, (value, prev) => [...prev, value], [])
         .action(async (opts) => {
         try {
             const token = await ensureCognitoToken({ interactive: false });
             const body = await readBodyFile(opts.bodyFile);
+            // Validate + upload screenshots (direct-to-S3 via presigned PUT)
+            // before submitting, so the row references uploaded objects.
+            const screenshots = await uploadScreenshots({
+                paths: opts.screenshot ?? [],
+                token,
+            });
             const result = await submitFeedback({
                 type,
                 title: opts.title,
                 body,
                 company: opts.company,
                 token,
+                screenshots,
             });
             console.log(`Submitted: ${result.id}`);
         }
@@ -95,4 +117,4 @@ export function registerFeedbackCommand(program) {
     registerSubcommand(feedbackCmd, "feature");
 }
 //# sourceMappingURL=feedback.js.map
-//# debugId=3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4
+//# debugId=ee78c7b6-6e93-5217-8a1d-ddc51afcf9c3

package/dist/commands/files.d.ts

@@ -68,6 +68,25 @@ interface RunFilesDeleteParams {
     yes: boolean;
     companySlug: string | undefined;
 }
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export declare function stripRedundantCompanyScope(prefix: string): {
+    prefix: string;
+    strippedSlug: string;
+} | null;
 export declare function runFilesDelete(params: RunFilesDeleteParams, deps?: {
     confirm?: ConfirmFn;
 }): Promise<void>;

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5f5242f3-b24f-58b0-a3ee-381c42c755fc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import * as readline from "node:readline";
@@ -566,13 +566,47 @@ function printKeyPreview(resp) {
         console.log(chalk.dim(`    … and ${resp.matched - resp.keys.length} more`));
     }
 }
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export function stripRedundantCompanyScope(prefix) {
+    const m = /^companies\/([^/]+)(?:\/(.*))?$/.exec(prefix);
+    if (!m)
+        return null;
+    return { prefix: m[2] ?? "", strippedSlug: m[1] };
+}
 export async function runFilesDelete(params, deps = {}) {
     const confirm = deps.confirm ?? realConfirm;
+    // The vault is already company-scoped — a `companies/<slug>/` prefix is the HQ
+    // LOCAL tree layout, not a vault key, and the server 400s it (HQ-8F). Strip it
+    // here so a pasted local path is gracefully normalized to bucket-relative
+    // BEFORE the dry-run/preview (so the operator still sees the exact keys and
+    // confirms the right target). If stripping empties the prefix, the root-reject
+    // below catches it with a clear message.
+    const scope = stripRedundantCompanyScope(params.prefix);
+    if (scope) {
+        console.error(chalk.yellow(`Note: stripped redundant 'companies/${scope.strippedSlug}/' — the vault ` +
+            `is already company-scoped; using bucket-relative ` +
+            `'${scope.prefix || "(root)"}'.`));
+    }
+    const rawPrefix = scope ? scope.prefix : params.prefix;
     // Normalize exactly as the share/unshare/acl paths do (trailing `/` → `/*`),
     // then reject the root/empty prefix CLIENT-side so a typo never reaches the
     // server as a vault-wide delete. The server enforces this too (defense in
     // depth), but failing fast here is clearer and avoids a wasted round-trip.
-    const normalized = normalizeFilePrefix(params.prefix);
+    const normalized = normalizeFilePrefix(rawPrefix);
     if (normalized === "" || normalized === "*" || normalized === "/*") {
         console.error(chalk.red("Refusing to delete the vault root. Pass a bounded prefix (e.g. 'projects/foo/' or 'projects/foo/*') or an exact key."));
         process.exit(1);
@@ -648,4 +682,4 @@ export async function runFilesDelete(params, deps = {}) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=5f5242f3-b24f-58b0-a3ee-381c42c755fc
+//# debugId=bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6

package/dist/commands/people.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `hq people` — read a company's people (membership) records from the local HQ
+ * tree and search/resolve over them.
+ *
+ *   hq people list      [--company <slug>] [--json]
+ *   hq people search <keyword> [--company <slug>] [--json]
+ *   hq people resolve <name>   [--company <slug>] [--json]
+ *
+ * Source of truth is `companies/<company>/people/<person>/meta.yaml`. Every
+ * subcommand operates on exactly ONE company (the active company, or the one
+ * named by `--company`); nothing reads across company boundaries.
+ */
+import { Command } from "commander";
+/**
+ * Resolve the single company to operate on. Explicit `--company` always wins
+ * (after a path-safety check). Otherwise the active company is inferred from
+ * `companies/manifest.yaml`: if exactly one company exists it's used; if several
+ * do, the caller must disambiguate with `--company`.
+ */
+export declare function resolveCompanySlug(hqRoot: string, explicit: string | undefined): string;
+export declare function registerPeopleCommand(program: Command): void;
+//# sourceMappingURL=people.d.ts.map

package/dist/commands/people.js

@@ -0,0 +1,187 @@
+/**
+ * `hq people` — read a company's people (membership) records from the local HQ
+ * tree and search/resolve over them.
+ *
+ *   hq people list      [--company <slug>] [--json]
+ *   hq people search <keyword> [--company <slug>] [--json]
+ *   hq people resolve <name>   [--company <slug>] [--json]
+ *
+ * Source of truth is `companies/<company>/people/<person>/meta.yaml`. Every
+ * subcommand operates on exactly ONE company (the active company, or the one
+ * named by `--company`); nothing reads across company boundaries.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="076b7f64-6626-5733-8992-ab9361a3e31d")}catch(e){}}();
+import * as fs from "fs";
+import { Option } from "commander";
+import chalk from "chalk";
+import * as yaml from "js-yaml";
+import { findHqRoot } from "../utils/manifest.js";
+import { manifestPath } from "./cloud-provision.js";
+import { assertSafeCompanySlug, listCompanyPeople, searchPeople, resolveNameToEmail, companyPeopleDir, } from "../utils/people.js";
+/** Companies that still exist (anything not explicitly `status: archived`). */
+function activeCompanySlugs(manifest) {
+    const companies = manifest.companies ?? {};
+    return Object.entries(companies)
+        .filter(([, entry]) => (entry?.status ?? "active") !== "archived")
+        .map(([slug]) => slug)
+        .sort();
+}
+/**
+ * Resolve the single company to operate on. Explicit `--company` always wins
+ * (after a path-safety check). Otherwise the active company is inferred from
+ * `companies/manifest.yaml`: if exactly one company exists it's used; if several
+ * do, the caller must disambiguate with `--company`.
+ */
+export function resolveCompanySlug(hqRoot, explicit) {
+    if (explicit) {
+        assertSafeCompanySlug(explicit);
+        return explicit;
+    }
+    const mPath = manifestPath(hqRoot);
+    if (!fs.existsSync(mPath)) {
+        throw new Error("Could not determine the active company — companies/manifest.yaml not found. " +
+            "Re-run with --company <slug>.");
+    }
+    let manifest;
+    try {
+        manifest = yaml.load(fs.readFileSync(mPath, "utf-8"));
+    }
+    catch (err) {
+        throw new Error(`companies/manifest.yaml is malformed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const slugs = activeCompanySlugs(manifest ?? {});
+    if (slugs.length === 1)
+        return slugs[0];
+    if (slugs.length === 0) {
+        throw new Error("No companies found in companies/manifest.yaml — re-run with --company <slug>.");
+    }
+    throw new Error("Multiple companies found — re-run with --company <slug> to pick one:\n" +
+        slugs.map((s) => `  --company ${s}`).join("\n"));
+}
+/** Resolve the HQ root: explicit override (tests) → cwd walk-up. */
+function resolveHqRoot(opts) {
+    return opts.hqRoot ?? findHqRoot();
+}
+function printPeopleTable(people) {
+    const nameW = Math.max(4, ...people.map((p) => p.name.length));
+    const emailW = Math.max(5, ...people.map((p) => (p.email ?? "—").length));
+    const roleW = Math.max(4, ...people.map((p) => (p.role ?? "—").length));
+    console.log(chalk.bold([
+        "NAME".padEnd(nameW),
+        "EMAIL".padEnd(emailW),
+        "ROLE".padEnd(roleW),
+        "TYPE",
+    ].join("  ")));
+    for (const p of people) {
+        console.log([
+            p.name.padEnd(nameW),
+            (p.email ?? "—").padEnd(emailW),
+            (p.role ?? "—").padEnd(roleW),
+            p.type ?? "—",
+        ].join("  "));
+    }
+}
+function fail(message) {
+    console.error(chalk.red(message));
+    process.exit(1);
+}
+export function registerPeopleCommand(program) {
+    const people = program
+        .command("people")
+        .description("List, search, and resolve a company's people (from companies/<co>/people)")
+        .option("--company <slug>", "Company slug to scope to (defaults to the active company)")
+        // Hidden escape hatch for tests / non-standard layouts — point the reader at
+        // an explicit HQ tree root instead of walking up from cwd.
+        .addOption(new Option("--hq-root <path>", "Override the HQ tree root (advanced)").hideHelp());
+    people
+        .command("list")
+        .description("List all people recorded for the company")
+        .option("--json", "Output JSON instead of a table")
+        .action((opts) => {
+        try {
+            const scope = people.opts();
+            const hqRoot = resolveHqRoot(scope);
+            const slug = resolveCompanySlug(hqRoot, scope.company);
+            const records = listCompanyPeople(hqRoot, slug);
+            if (opts.json) {
+                console.log(JSON.stringify(records, null, 2));
+                return;
+            }
+            if (records.length === 0) {
+                console.log(chalk.gray(`No people recorded for '${slug}' (looked in ${companyPeopleDir(hqRoot, slug)}).`));
+                return;
+            }
+            printPeopleTable(records);
+        }
+        catch (err) {
+            fail(err instanceof Error ? err.message : String(err));
+        }
+    });
+    people
+        .command("search <keyword>")
+        .description("Keyword search over people names and emails")
+        .option("--json", "Output JSON instead of a table")
+        .action((keyword, opts) => {
+        try {
+            const scope = people.opts();
+            const hqRoot = resolveHqRoot(scope);
+            const slug = resolveCompanySlug(hqRoot, scope.company);
+            const matches = searchPeople(listCompanyPeople(hqRoot, slug), keyword);
+            if (opts.json) {
+                console.log(JSON.stringify(matches, null, 2));
+                return;
+            }
+            if (matches.length === 0) {
+                console.log(chalk.gray(`No people in '${slug}' match "${keyword}".`));
+                return;
+            }
+            printPeopleTable(matches);
+        }
+        catch (err) {
+            fail(err instanceof Error ? err.message : String(err));
+        }
+    });
+    people
+        .command("resolve <name>")
+        .description("Resolve a person name to their email address")
+        .option("--json", "Output JSON instead of plain text")
+        .action((name, opts) => {
+        try {
+            const scope = people.opts();
+            const hqRoot = resolveHqRoot(scope);
+            const slug = resolveCompanySlug(hqRoot, scope.company);
+            const result = resolveNameToEmail(listCompanyPeople(hqRoot, slug), name);
+            if (opts.json) {
+                console.log(JSON.stringify(result, null, 2));
+                if (result.status === "found")
+                    return;
+                process.exit(1);
+            }
+            switch (result.status) {
+                case "found":
+                    // Bare email on stdout so callers can capture it directly.
+                    console.log(result.email);
+                    return;
+                case "no_email":
+                    fail(`Found '${result.person.name}' in '${slug}' but no email is recorded for them.`);
+                    break;
+                case "ambiguous":
+                    console.error(chalk.yellow(`"${name}" matches ${result.matches.length} people in '${slug}' — be more specific:`));
+                    for (const m of result.matches) {
+                        console.error(`  ${m.name}${m.email ? ` <${m.email}>` : ""}`);
+                    }
+                    process.exit(1);
+                    break;
+                case "not_found":
+                    fail(`No person matching "${name}" found in '${slug}'.`);
+                    break;
+            }
+        }
+        catch (err) {
+            fail(err instanceof Error ? err.message : String(err));
+        }
+    });
+}
+//# sourceMappingURL=people.js.map
+//# debugId=076b7f64-6626-5733-8992-ab9361a3e31d

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d01cb1a1-b851-5ffe-9608-e505e55dcdc8")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3049e431-c5db-5430-90fe-82866c35e95b")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -251,6 +251,11 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
         if (!res.ok) {
             const body = (await res.json().catch(() => ({})));
             const message = extractApiMessage(body, res.statusText);
+            // High-security ("nuclear") refusal surfaced at the batch level (rather
+            // than per-name): point the caller at the proxy and never leak plaintext.
+            if (body.code === "high_security_denied" || body.highSecurity === true) {
+                throw new Error("A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.");
+            }
             if (res.status >= 400 &&
                 res.status < 500 &&
                 typeof body.code === "string") {
@@ -280,6 +285,15 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
             if (resolved.has(key))
                 continue;
             const err = errorsByName.get(key);
+            // High-security ("nuclear") secret: the server refuses to vend it on the
+            // local-injection (batch-load) path — per-name code `high_security_denied`,
+            // no plaintext returned. Every caller of loadRevealedSecrets injects or
+            // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+            // `secrets env`), so a high-security secret can NEVER be used here. Surface
+            // a clear, actionable error pointing at the proxy instead of a raw failure.
+            if (err?.code === "high_security_denied") {
+                throw new Error(`Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`);
+            }
             const reason = err?.code === "not_found"
                 ? "Secret not found"
                 : err?.code === "forbidden"
@@ -364,6 +378,15 @@ export function registerSecretsCommand(program) {
             });
             if (!res.ok) {
                 const body = (await res.json().catch(() => ({})));
+                // High-security ("nuclear") secret: the server refuses to reveal it on
+                // the local-injection path (403, no plaintext). Surface a clear,
+                // actionable error pointing the user at the proxy rather than a raw
+                // 4xx — the value can ONLY be used through the server-side proxy.
+                if (res.status === 403 && body.highSecurity === true) {
+                    console.error(chalk.red(`Secret '${name}' is high-security and cannot be revealed locally.`));
+                    console.error(chalk.dim("  It can only be used through the HQ secret proxy, which keeps the plaintext server-side."));
+                    process.exit(1);
+                }
                 console.error(chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
@@ -1125,4 +1148,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=d01cb1a1-b851-5ffe-9608-e505e55dcdc8
+//# debugId=3049e431-c5db-5430-90fe-82866c35e95b

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="964b8c71-056c-51fb-893a-d51f8f6ad5d9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aeb143c7-7e19-5999-b6cb-790fc79034cc")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -36,6 +36,7 @@ import { registerGroupGrantsCommand } from "./commands/group-grants.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerFilesBrowseCommands } from "./commands/files-browse.js";
 import { registerMembersCommand } from "./commands/members.js";
+import { registerPeopleCommand } from "./commands/people.js";
 import { registerDmCommand } from "./commands/dm.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
@@ -134,6 +135,9 @@ const filesCmd = registerFilesCommand(program);
 registerFilesBrowseCommands(filesCmd);
 // Membership management (subcommand group — hq members invite|list|revoke)
 registerMembersCommand(program);
+// People directory (subcommand group — hq people list|search|resolve), reading
+// the local companies/<co>/people store scoped to one company.
+registerPeopleCommand(program);
 registerDmCommand(program);
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
@@ -180,4 +184,4 @@ registerRescueCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=964b8c71-056c-51fb-893a-d51f8f6ad5d9
+//# debugId=aeb143c7-7e19-5999-b6cb-790fc79034cc

package/dist/run/hq-plugin.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="20ece834-f9b5-5295-8620-87eb4f13ba7c")}catch(e){}}();
 import { ResolutionError } from 'varlock/plugin-lib';
 import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, } from '../utils/secrets-cache.js';
 function normalizeCacheTtlMs(cacheTtlMs) {
@@ -59,6 +59,13 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
                     if (err.code === 'not_found') {
                         throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
                     }
+                    // High-security ("nuclear") secret: the server refuses to vend it on
+                    // the local-injection path. It can ONLY be used through the
+                    // server-side proxy, so `hq run` (which injects plaintext into the
+                    // child env) can never load it. Surface a clear, actionable error.
+                    if (err.code === 'high_security_denied') {
+                        throw new ResolutionError(`Secret "${secretName}" is high-security and cannot be injected locally — it can only be used via the HQ secret proxy (POST /secrets/{companyUid}/proxy/{path}), which keeps the plaintext server-side. Remove it from this schema's locally-injected vars.`);
+                    }
                     throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
                 }
                 // Sentinel-check style throughout: `readCache` returns `string | null`
@@ -158,4 +165,4 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     state.uid = uid;
 }
 //# sourceMappingURL=hq-plugin.js.map
-//# debugId=63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd
+//# debugId=20ece834-f9b5-5295-8620-87eb4f13ba7c

package/dist/sentry-dsn.generated.d.ts

@@ -1,2 +1,2 @@
-export declare const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+export declare const BUNDLED_DSN = "https://467061dc39fb64644f5640a82d8949cf@o4507292345892864.ingest.us.sentry.io/4511597516226560";
 //# sourceMappingURL=sentry-dsn.generated.d.ts.map

package/dist/sentry-dsn.generated.js

@@ -1,5 +1,5 @@
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="55f2362e-5cf7-5dac-b6a3-ef0f9ccde645")}catch(e){}}();
-export const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+export const BUNDLED_DSN = "https://467061dc39fb64644f5640a82d8949cf@o4507292345892864.ingest.us.sentry.io/4511597516226560";
 //# sourceMappingURL=sentry-dsn.generated.js.map
 //# debugId=55f2362e-5cf7-5dac-b6a3-ef0f9ccde645

package/dist/utils/feedback-diagnostics.d.ts

@@ -1,3 +1,4 @@
+import { type VersionInfo } from "./feedback-versions.js";
 export interface GitContext {
     branch: string | null;
     head: string | null;
@@ -6,6 +7,12 @@ export interface GitContext {
 }
 export interface DiagnosticsBlob {
     cliVersion: string;
+    /**
+     * The hq-cli, hq-core, and hq-sync versions from the submitter's
+     * environment. `cliVersion` above is retained for back-compat; new
+     * consumers should read `versions` (which carries core + sync too).
+     */
+    versions: VersionInfo;
     nodeVersion: string;
     os: {
         platform: string;

package/dist/utils/feedback-diagnostics.js

@@ -1,9 +1,10 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee39c63b-ddaa-553d-b5db-77633d323d88")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ae4c924b-fe3d-558c-8b44-e1bac1f5a73e")}catch(e){}}();
 import * as os from "os";
 import { execFileSync } from "child_process";
 import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
+import { collectVersions } from "./feedback-versions.js";
 const SECRET_FLAGS = new Set([
     "--token",
     "--secret",
@@ -79,6 +80,7 @@ function collectGitContext() {
 export function collectDiagnostics() {
     return {
         cliVersion: CLI_VERSION,
+        versions: collectVersions(),
         nodeVersion: process.version,
         os: {
             platform: os.platform(),
@@ -92,4 +94,4 @@ export function collectDiagnostics() {
     };
 }
 //# sourceMappingURL=feedback-diagnostics.js.map
-//# debugId=ee39c63b-ddaa-553d-b5db-77633d323d88
+//# debugId=ae4c924b-fe3d-558c-8b44-e1bac1f5a73e

package/dist/utils/feedback-screenshots.d.ts

@@ -0,0 +1,23 @@
+export declare const MAX_SCREENSHOTS = 5;
+export declare const MAX_SCREENSHOT_BYTES: number;
+export declare function contentTypeForPath(filePath: string): string;
+export interface ScreenshotInput {
+    path: string;
+    contentType: string;
+    bytes: Buffer;
+}
+/** Validate + read the given screenshot paths (count, type, existence, size). */
+export declare function loadScreenshots(paths: string[]): ScreenshotInput[];
+/**
+ * Validate the screenshot paths, request presigned PUT URLs from the feedback
+ * endpoint, upload each image direct to S3, and return the object keys to
+ * attach to the feedback submission. Returns [] for no screenshots.
+ *
+ * `fetchImpl` is injectable for tests; defaults to the global fetch.
+ */
+export declare function uploadScreenshots(opts: {
+    paths: string[];
+    token: string;
+    fetchImpl?: typeof fetch;
+}): Promise<string[]>;
+//# sourceMappingURL=feedback-screenshots.d.ts.map