@indigoai-us/hq-cli 5.47.17 → 5.49.0

package/.github/workflows/ci.yml

@@ -5,29 +5,42 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: ubuntu-latest
+    name: build (node ${{ matrix.node-version }})
     strategy:
       fail-fast: false
       matrix:
         # 20 is the declared engines floor (package.json engines.node >=20),
-        # 22 is the current dev/publish baseline. Running the suite on 20
-        # enforces the floor so it stays real, not aspirational.
-        node-version: [20, 22]
-    name: build (node ${{ matrix.node-version }})
+        # 22 is the current dev/publish baseline.
+        node-version: ["20", "22"]
+    uses: indigoai-us/.github/.github/workflows/_node-ci.yml@main
+    with:
+      package-manager: pnpm
+      pnpm-version: "10"
+      node-version: ${{ matrix.node-version }}
+      run-build: true
+      run-lint: true
+      run-coverage: true
+    secrets: inherit
+
+  e2e:
+    name: e2e (node 22)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: "10"
       - uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: "22"
           cache: pnpm
-      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
-      # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with
-      # an empty BUNDLED_DSN. That's intentional — the DSN is publish-only.
-      - run: pnpm run build
-      - run: pnpm run typecheck
-      - run: pnpm test
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - run: pnpm test:e2e

package/.github/workflows/publish.yml

@@ -2,110 +2,35 @@ name: Publish to npm
 on:
   push:
     tags: ["v*"]
+  # Manual dry-run: validate the build/pack/smoke pipeline without publishing.
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry-run (validate build/pack/smoke; npm publish --dry-run, no Sentry upload)"
+        type: boolean
+        default: true
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - uses: actions/setup-node@v4
-        with:
-          # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
-          # token-exchange flow. See hq-cloud's publish.yml for the full
-          # rationale (npm 10.x produces masked-404 failures on publish PUT).
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-          cache: pnpm
-
-      - run: node --version && npm --version && pnpm --version
-      # Install with pnpm (supply-chain policy); npm publish keeps OIDC.
-      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
-
-      - name: Build
-        run: pnpm run build
-        env:
-          # generate-dsn.mjs fatals when GITHUB_JOB=publish and this var is
-          # missing. Set this as a repo secret to bundle a Sentry DSN into the
-          # published binary.
-          HQ_CLI_PUBLISH_SENTRY_DSN: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
-
-      # Inject Sentry debug IDs into compiled JS + map files. Must run after
-      # tsc and BEFORE publish so the installed binary carries the same debugId
-      # as the artifacts uploaded to Sentry, enabling debugId-based source-map
-      # resolution for globally-installed CLI users.
-      - name: Inject Sentry source map debug IDs
-        run: npx -y @sentry/cli@^2 sourcemaps inject dist/
-
-      # Pre-publish cross-package smoke test (Bug A guard).
-      #
-      # @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
-      # (^5.1.0). The smoke installs a freshly-packed tarball into an isolated
-      # tmpdir — outside this repo — so transitive @indigoai-us/* deps resolve
-      # from the npm registry, NOT from a local checkout. Booting `hq --version`
-      # then exercises the full module-load graph. If hq-cloud removed or
-      # renamed a symbol hq-cli imports, this catches it BEFORE the publish PUT.
-      #
-      # Bypass: set repo-or-workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1.
-      - name: Pre-publish smoke test
-        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH != '1' }}
-        run: bash .github/workflows/scripts/smoke-test-pkg.sh hq
-
-      - name: WARN — pre-publish smoke bypassed
-        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH == '1' }}
-        run: |
-          echo "::warning::WORKFLOW_ALLOW_BROKEN_PUBLISH=1 — pre-publish cross-package smoke test was BYPASSED. This release may ship a DOA package."
-
-      # Trusted-publisher OIDC; no NODE_AUTH_TOKEN. No --provenance (private
-      # repo limitation since npm 2026-05-10). Pre-release versions (with '-')
-      # get --tag rc to keep latest dist-tag pointing at stable releases only.
-      - name: Publish to npm
-        id: publish
-        run: |
-          NAME=$(jq -r .name package.json)
-          VER=$(jq -r .version package.json)
-          if npm view "$NAME@$VER" version >/dev/null 2>&1; then
-            echo "$NAME@$VER already on npm — skipping"
-          else
-            if echo "$VER" | grep -q '-'; then
-              npm publish --access public --tag rc
-            else
-              npm publish --access public
-            fi
-            echo "published=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      # Sentry sourcemap upload runs on every tag push regardless of whether
-      # this run was the one that actually published to npm. The previous
-      # `if: steps.publish.outputs.published == 'true'` gate made re-runs
-      # useless when only the Sentry upload failed — the publish step's
-      # short-circuit (`npm view @ver already published`) zeroed out the
-      # output, so the upload step was skipped on every re-run. dist/ is
-      # rebuilt by the Build + Inject steps each run, so the upload is
-      # always operating on fresh, debug-id-stamped artifacts.
-      - name: Upload sourcemaps to Sentry
-        run: |
-          # Defang paste-time whitespace in SENTRY_AUTH_TOKEN. Sentry's
-          # auth-header parser returns HTTP 401 "Token string should not
-          # contain spaces" when the secret has a trailing \n or any
-          # embedded whitespace — observed on the v5.25.0 release after a
-          # copy-paste into the GH repo secret carried a literal \n. `tr -d`
-          # is the cheap structural guard so the workflow doesn't blow up
-          # on the next dirty paste.
-          SENTRY_AUTH_TOKEN=$(printf %s "$SENTRY_AUTH_TOKEN" | tr -d '[:space:]')
-          if [ -z "$SENTRY_AUTH_TOKEN" ]; then
-            echo "::error::SENTRY_AUTH_TOKEN secret is empty (or all whitespace) after sanitization — cannot upload sourcemaps"
-            exit 1
-          fi
-          export SENTRY_AUTH_TOKEN
-          VER=$(jq -r .version package.json)
-          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/ node_modules/@indigoai-us/hq-cloud/dist/
-        env:
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_ORG: indigo-d0
-          SENTRY_PROJECT: hq-cli
+    uses: indigoai-us/.github/.github/workflows/_npm-publish.yml@main
+    with:
+      package-manager: pnpm
+      pnpm-version: "10"
+      node-version: "24"
+      build-command: "pnpm run build"
+      dsn-env-name: "HQ_CLI_PUBLISH_SENTRY_DSN"
+      sentry-inject-dir: "dist/"
+      smoke-test-arg: "hq"
+      sentry-release-prefix: "hq-cli"
+      sentry-upload-paths: "dist/ node_modules/@indigoai-us/hq-cloud/dist/"
+      sentry-org: "indigo-d0"
+      sentry-project: "hq-cli"
+      # Prerelease versions (e.g. 5.x.y-rc.0) ship to the rc dist-tag, not latest.
+      prerelease-dist-tag: "rc"
+      dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+    secrets:
+      sentry-dsn: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
+      sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}

package/dist/commands/meetings.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1c09963-744f-5033-9981-1ab6d37956e9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ae9ed929-9821-5f8b-bbbe-8f7b6105f5ad")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -207,6 +207,61 @@ export function registerMeetingsCommand(program) {
             process.exit(1);
         }
     });
+    // ── hq meetings set-company <id> ──────────────────────────────────
+    meetings
+        .command("set-company <meetingId>")
+        .description("Set or change the company a meeting is attributed to (use 'unknown' to clear)")
+        .option("--company <slug>", "Target company slug, or 'unknown'/'personal' to clear attribution")
+        .option("--no-series", "Apply only to this occurrence, not the whole recurring series")
+        .action(async (rawId, cmdOpts) => {
+        try {
+            const token = await ensureCognitoToken();
+            // `--company` is shared with the parent `meetings` command, so commander
+            // may bind it to either level depending on position — accept both.
+            const target = cmdOpts.company ?? meetings.opts().company;
+            if (!target) {
+                console.error(chalk.red("Error:"), "a target company is required: --company <slug> (or 'unknown'/'personal' to clear)");
+                process.exit(1);
+            }
+            // The bot record is person-keyed, so no company scope is needed to
+            // resolve the meeting id; pass an empty scope.
+            const meetingId = await resolveShortId(token, rawId, {});
+            const lc = target.toLowerCase();
+            const companyId = lc === "unknown" || lc === "personal"
+                ? "unknown"
+                : await getCompanyUid(token, target);
+            const applyToSeries = cmdOpts.series !== false;
+            const res = await vaultApiFetch({
+                token,
+                method: "POST",
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}/company`,
+                body: { companyId, applyToSeries },
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const data = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const where = companyId === "unknown" ? "unattributed (personal)" : companyId;
+            console.log(chalk.green(`\n✓ Meeting ${chalk.cyan(meetingId)} attributed to ${chalk.bold(where)}.`));
+            if (typeof data.occurrencesUpdated === "number" && data.occurrencesUpdated > 1) {
+                console.log(chalk.dim(`  Applied to ${data.occurrencesUpdated} meetings in this recurring series (including past occurrences).`));
+            }
+            else if (data.appliedToSeries) {
+                console.log(chalk.dim("  Future occurrences of this recurring series will inherit this attribution."));
+            }
+            if (typeof data.refiledCount === "number" && data.refiledCount > 0) {
+                console.log(chalk.dim(`  Refiled ${data.refiledCount} transcript${data.refiledCount === 1 ? "" : "s"} into the new company vault.`));
+            }
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     // ── hq meetings search <query> ─────────────────────────────────────
     meetings
         .command("search <query>")
@@ -371,4 +426,4 @@ export function registerMeetingsCommand(program) {
     });
 }
 //# sourceMappingURL=meetings.js.map
-//# debugId=e1c09963-744f-5033-9981-1ab6d37956e9
+//# debugId=ae9ed929-9821-5f8b-bbbe-8f7b6105f5ad

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aeb143c7-7e19-5999-b6cb-790fc79034cc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="60f911e0-ddd5-5a2d-91c7-18ba47457b57")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -180,8 +180,10 @@ registerRescueCommand(program);
         process.exitCode = 1;
     }
     finally {
+        // Release health: finalize the per-run session before the flush.
+        Sentry.endSession();
         await Promise.allSettled([refreshVersionCache(), Sentry.flush(2000)]);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=aeb143c7-7e19-5999-b6cb-790fc79034cc
+//# debugId=60f911e0-ddd5-5a2d-91c7-18ba47457b57

package/dist/sentry.js

@@ -1,16 +1,21 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="508ac88d-5683-5d1f-9857-80a8a74e03e2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a260ea42-f6d8-52d0-90c6-6e586de5efd6")}catch(e){}}();
 import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
 import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
+import { CLI_VERSION } from "./cli-version.js";
+import { getCachedSentryUser } from "./utils/sentry-identity.js";
 export function initSentry() {
     const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
     if (!dsn)
         return;
     Sentry.init({
         dsn,
-        release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+        // CLI_VERSION reads package.json at runtime; npm_package_version is only
+        // set under `npm run`, so an installed `hq` binary would always report
+        // 0.0.0 and never match the uploaded source maps.
+        release: `hq-cli@${CLI_VERSION}`,
         environment: process.env.HQ_CLI_ENV ?? "production",
         initialScope: {
             tags: { repo: "hq-cli" },
@@ -18,7 +23,16 @@ export function initSentry() {
         beforeSend,
         beforeBreadcrumb,
     });
+    // Attribute events to the logged-in HQ identity (best-effort; null when not
+    // logged in). A CLI process is one user, so global setUser is correct here.
+    const user = getCachedSentryUser();
+    if (user)
+        Sentry.setUser(user);
+    // Release health: one session per CLI run. Ended + flushed in index.ts's
+    // finally (covers every exit path). A captured error auto-marks the session
+    // "errored", so crash-free numbers per release stay accurate.
+    Sentry.startSession();
 }
 export { Sentry };
 //# sourceMappingURL=sentry.js.map
-//# debugId=508ac88d-5683-5d1f-9857-80a8a74e03e2
+//# debugId=a260ea42-f6d8-52d0-90c6-6e586de5efd6

package/dist/utils/sentry-identity.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Best-effort Sentry user from the cached HQ session, so CLI events are
+ * attributed to a user ("users affected" + per-user triage). Returns null when
+ * not logged in. A CLI process is single-user, so this is set once at init.
+ */
+export declare function getCachedSentryUser(): {
+    id?: string;
+    email?: string;
+    username?: string;
+} | null;
+//# sourceMappingURL=sentry-identity.d.ts.map

package/dist/utils/sentry-identity.js

@@ -0,0 +1,43 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1ca7cb4e-47e2-5cd0-a400-bbdaafa2b0d5")}catch(e){}}();
+import { loadCachedTokens, isMachineIdentity, loadMachineCreds, } from "@indigoai-us/hq-cloud";
+/** Decode the (untrusted) id-token payload — for attribution/display only. */
+function peekIdToken(idToken) {
+    try {
+        const payload = idToken.split(".")[1];
+        if (!payload)
+            return {};
+        const pad = payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
+        const normalized = payload.replace(/-/g, "+").replace(/_/g, "/") + pad;
+        const decoded = JSON.parse(Buffer.from(normalized, "base64").toString("utf-8"));
+        return { email: decoded.email, sub: decoded.sub };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Best-effort Sentry user from the cached HQ session, so CLI events are
+ * attributed to a user ("users affected" + per-user triage). Returns null when
+ * not logged in. A CLI process is single-user, so this is set once at init.
+ */
+export function getCachedSentryUser() {
+    try {
+        if (isMachineIdentity()) {
+            const username = loadMachineCreds()?.username;
+            return username ? { id: username, username } : null;
+        }
+        const cached = loadCachedTokens();
+        if (!cached)
+            return null;
+        const { email, sub } = peekIdToken(cached.idToken);
+        if (!sub && !email)
+            return null;
+        return { id: sub, email };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=sentry-identity.js.map
+//# debugId=1ca7cb4e-47e2-5cd0-a400-bbdaafa2b0d5

package/e2e/cli.test.ts

@@ -0,0 +1,93 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { afterEach, describe, expect, it } from "vitest";
+import { version } from "../package.json";
+
+const cliEntry = path.resolve("dist/index.js");
+const tempDirs: string[] = [];
+
+interface CliResult {
+  code: number | null;
+  stdout: string;
+  stderr: string;
+}
+
+function runHq(args: string[], options: { cwd?: string; env?: NodeJS.ProcessEnv } = {}) {
+  return new Promise<CliResult>((resolve, reject) => {
+    const child = spawn(process.execPath, [cliEntry, ...args], {
+      cwd: options.cwd,
+      env: {
+        ...process.env,
+        HQ_NO_UPDATE_CHECK: "1",
+        ...options.env,
+      },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve({ code, stdout, stderr }));
+  });
+}
+
+async function makeTempDir(prefix: string) {
+  const dir = await mkdtemp(path.join(tmpdir(), prefix));
+  tempDirs.push(dir);
+  return dir;
+}
+
+afterEach(async () => {
+  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
+});
+
+describe("built hq CLI", () => {
+  it("prints help from the built entrypoint", async () => {
+    const result = await runHq(["--help"]);
+
+    expect(result.code).toBe(0);
+    expect(result.stderr).toBe("");
+    expect(result.stdout).toContain("Usage: hq [options] [command]");
+    expect(result.stdout).toContain("HQ management CLI");
+    expect(result.stdout).toContain("whoami");
+  });
+
+  it("prints the package version from the built entrypoint", async () => {
+    const result = await runHq(["--version"]);
+
+    expect(result.code).toBe(0);
+    expect(result.stderr).toBe("");
+    expect(result.stdout.trim()).toBe(version);
+  });
+
+  it("reports logged-out state without network or credentials", async () => {
+    const home = await makeTempDir("hq-cli-e2e-home-");
+    const cwd = await makeTempDir("hq-cli-e2e-cwd-");
+
+    const result = await runHq(["whoami"], {
+      cwd,
+      env: {
+        HOME: home,
+        USERPROFILE: home,
+        XDG_CONFIG_HOME: path.join(home, ".config"),
+        XDG_CACHE_HOME: path.join(home, ".cache"),
+        HQ_MACHINE_IDENTITY: undefined,
+        HQ_MACHINE_CREDS: undefined,
+      },
+    });
+
+    expect(result.code).toBe(0);
+    expect(result.stderr).toBe("");
+    expect(result.stdout.trim()).toBe("Not logged in. Run 'hq login' to authenticate.");
+  });
+});

package/eslint.config.js

@@ -0,0 +1,37 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+const sourceFiles = ["src/**/*.ts"];
+const recommended = tseslint
+  .config(js.configs.recommended, ...tseslint.configs.recommended)
+  .map((config) => ({
+    ...config,
+    files: sourceFiles,
+  }));
+
+export default [
+  {
+    ignores: ["dist/**", "generated/**", "node_modules/**"],
+  },
+  ...recommended,
+  {
+    files: sourceFiles,
+    rules: {
+      "no-undef": "off",
+      "no-useless-assignment": "warn",
+      "no-useless-escape": "warn",
+      "prefer-const": "warn",
+      "preserve-caught-error": "off",
+      "@typescript-eslint/no-explicit-any": "warn",
+      "@typescript-eslint/no-require-imports": "warn",
+      "@typescript-eslint/no-unused-vars": [
+        "warn",
+        {
+          argsIgnorePattern: "^_",
+          caughtErrorsIgnorePattern: "^_",
+          varsIgnorePattern: "^_",
+        },
+      ],
+    },
+  },
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.17",
+  "version": "5.49.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -10,12 +10,15 @@
   "scripts": {
     "build": "node scripts/generate-dsn.mjs && tsc",
     "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
     "test": "vitest run",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "vitest": "vitest",
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.11.7",
+    "@indigoai-us/hq-cloud": "^6.11.14",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",
@@ -28,10 +31,14 @@
   },
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.1049.0",
+    "@eslint/js": "^10.0.1",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "@types/semver": "^7.5.8",
+    "@vitest/coverage-v8": "4.1.6",
+    "eslint": "^10.5.0",
     "typescript": "^5.7.0",
+    "typescript-eslint": "^8.61.1",
     "vitest": "^4.1.2"
   },
   "repository": {

package/src/commands/meetings.test.ts

@@ -0,0 +1,227 @@
+import { Command } from "commander";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    getCompanyUid: vi.fn(async (_token: string, slug: string) => `cmp_${slug}`),
+    vaultApiFetch: vi.fn(async () =>
+      new Response(JSON.stringify({ appliedToSeries: true }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }),
+    ),
+  };
+});
+
+import { registerMeetingsCommand } from "./meetings.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+
+let logSpy: MockInstance<typeof console.log>;
+let errSpy: MockInstance<typeof console.error>;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+  errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.exitOverride();
+  program.configureOutput({
+    writeOut: () => undefined,
+    writeErr: () => undefined,
+  });
+  registerMeetingsCommand(program);
+  return program;
+}
+
+function jsonRes(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+describe("meetings set-company", () => {
+  it("POSTs the resolved company id and applies to the recurring series by default", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: true }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    expect(getCompanyUid).toHaveBeenCalledWith("test-token", "acme");
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "cmp_acme", applyToSeries: true },
+    });
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("sends unknown without resolving a target company", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: true }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "unknown",
+    ]);
+
+    expect(getCompanyUid).not.toHaveBeenCalled();
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "unknown", applyToSeries: true },
+    });
+  });
+
+  it("sends applyToSeries false when --no-series is passed", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: false }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+      "--no-series",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "cmp_acme", applyToSeries: false },
+    });
+  });
+
+  it("prints the raw response when --json is passed", async () => {
+    const body = { meetingId: "meeting-123456", companyId: "cmp_acme" };
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes(body));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "--json",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    expect(logSpy).toHaveBeenCalledWith(JSON.stringify(body, null, 2));
+  });
+
+  it("prints recurring series and refiled transcript counts from the response", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        ok: true,
+        meetingId: "meeting-123456",
+        companyId: "cmp_acme",
+        seriesKey: "series-123",
+        appliedToSeries: true,
+        occurrencesUpdated: 3,
+        refiled: true,
+        refiledCount: 2,
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Applied to 3 meetings in this recurring series"),
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Refiled 2 transcripts into the new company vault."),
+    );
+  });
+
+  it("does not print multi-meeting or refile copy for a single occurrence without refiles", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        ok: true,
+        meetingId: "meeting-123456",
+        companyId: "cmp_acme",
+        seriesKey: null,
+        appliedToSeries: false,
+        occurrencesUpdated: 1,
+        refiled: false,
+        refiledCount: 0,
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    const output = logSpy.mock.calls.map(([line]) => String(line)).join("\n");
+    expect(output).not.toContain("Applied to 1 meetings");
+    expect(output).not.toContain("Refiled 0 transcripts");
+    expect(output).not.toContain("Future occurrences of this recurring series will inherit this attribution.");
+  });
+});

package/src/commands/meetings.ts

@@ -299,6 +299,76 @@ export function registerMeetingsCommand(program: Command): void {
       }
     });
 
+  // ── hq meetings set-company <id> ──────────────────────────────────
+
+  meetings
+    .command("set-company <meetingId>")
+    .description("Set or change the company a meeting is attributed to (use 'unknown' to clear)")
+    .option("--company <slug>", "Target company slug, or 'unknown'/'personal' to clear attribution")
+    .option("--no-series", "Apply only to this occurrence, not the whole recurring series")
+    .action(async (rawId: string, cmdOpts: { company?: string; series?: boolean }) => {
+      try {
+        const token = await ensureCognitoToken();
+        // `--company` is shared with the parent `meetings` command, so commander
+        // may bind it to either level depending on position — accept both.
+        const target = cmdOpts.company ?? (meetings.opts().company as string | undefined);
+        if (!target) {
+          console.error(
+            chalk.red("Error:"),
+            "a target company is required: --company <slug> (or 'unknown'/'personal' to clear)",
+          );
+          process.exit(1);
+        }
+
+        // The bot record is person-keyed, so no company scope is needed to
+        // resolve the meeting id; pass an empty scope.
+        const meetingId = await resolveShortId(token, rawId, {});
+
+        const lc = target.toLowerCase();
+        const companyId =
+          lc === "unknown" || lc === "personal"
+            ? "unknown"
+            : await getCompanyUid(token, target);
+
+        const applyToSeries = cmdOpts.series !== false;
+
+        const res = await vaultApiFetch({
+          token,
+          method: "POST",
+          path: `/v1/meetings/${encodeURIComponent(meetingId)}/company`,
+          body: { companyId, applyToSeries },
+        });
+        if (!res.ok) await handleApiError(res);
+        const data = (await res.json()) as {
+          appliedToSeries?: boolean;
+          occurrencesUpdated?: number;
+          refiled?: boolean;
+          refiledCount?: number;
+          [key: string]: unknown;
+        };
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(data, null, 2));
+          return;
+        }
+
+        const where = companyId === "unknown" ? "unattributed (personal)" : companyId;
+        console.log(chalk.green(`\n✓ Meeting ${chalk.cyan(meetingId)} attributed to ${chalk.bold(where)}.`));
+        if (typeof data.occurrencesUpdated === "number" && data.occurrencesUpdated > 1) {
+          console.log(chalk.dim(`  Applied to ${data.occurrencesUpdated} meetings in this recurring series (including past occurrences).`));
+        } else if (data.appliedToSeries) {
+          console.log(chalk.dim("  Future occurrences of this recurring series will inherit this attribution."));
+        }
+        if (typeof data.refiledCount === "number" && data.refiledCount > 0) {
+          console.log(chalk.dim(`  Refiled ${data.refiledCount} transcript${data.refiledCount === 1 ? "" : "s"} into the new company vault.`));
+        }
+        console.log();
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+
   // ── hq meetings search <query> ─────────────────────────────────────
 
   meetings

package/src/index.ts

@@ -218,6 +218,8 @@ registerRescueCommand(program);
     Sentry.captureException(err);
     process.exitCode = 1;
   } finally {
+    // Release health: finalize the per-run session before the flush.
+    Sentry.endSession();
     await Promise.allSettled([refreshVersionCache(), Sentry.flush(2000)]);
   }
 })();

package/src/sentry.ts

@@ -2,13 +2,18 @@ import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
 import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
+import { CLI_VERSION } from "./cli-version.js";
+import { getCachedSentryUser } from "./utils/sentry-identity.js";
 
 export function initSentry(): void {
   const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
   if (!dsn) return;
   Sentry.init({
     dsn,
-    release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+    // CLI_VERSION reads package.json at runtime; npm_package_version is only
+    // set under `npm run`, so an installed `hq` binary would always report
+    // 0.0.0 and never match the uploaded source maps.
+    release: `hq-cli@${CLI_VERSION}`,
     environment: process.env.HQ_CLI_ENV ?? "production",
     initialScope: {
       tags: { repo: "hq-cli" },
@@ -16,6 +21,14 @@ export function initSentry(): void {
     beforeSend,
     beforeBreadcrumb,
   });
+  // Attribute events to the logged-in HQ identity (best-effort; null when not
+  // logged in). A CLI process is one user, so global setUser is correct here.
+  const user = getCachedSentryUser();
+  if (user) Sentry.setUser(user);
+  // Release health: one session per CLI run. Ended + flushed in index.ts's
+  // finally (covers every exit path). A captured error auto-marks the session
+  // "errored", so crash-free numbers per release stay accurate.
+  Sentry.startSession();
 }
 
 export { Sentry };

package/src/utils/sentry-identity.ts

@@ -0,0 +1,45 @@
+import {
+  loadCachedTokens,
+  isMachineIdentity,
+  loadMachineCreds,
+} from "@indigoai-us/hq-cloud";
+
+/** Decode the (untrusted) id-token payload — for attribution/display only. */
+function peekIdToken(idToken: string): { email?: string; sub?: string } {
+  try {
+    const payload = idToken.split(".")[1];
+    if (!payload) return {};
+    const pad =
+      payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/") + pad;
+    const decoded = JSON.parse(
+      Buffer.from(normalized, "base64").toString("utf-8"),
+    ) as { email?: string; sub?: string };
+    return { email: decoded.email, sub: decoded.sub };
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Best-effort Sentry user from the cached HQ session, so CLI events are
+ * attributed to a user ("users affected" + per-user triage). Returns null when
+ * not logged in. A CLI process is single-user, so this is set once at init.
+ */
+export function getCachedSentryUser():
+  | { id?: string; email?: string; username?: string }
+  | null {
+  try {
+    if (isMachineIdentity()) {
+      const username = loadMachineCreds()?.username;
+      return username ? { id: username, username } : null;
+    }
+    const cached = loadCachedTokens();
+    if (!cached) return null;
+    const { email, sub } = peekIdToken(cached.idToken);
+    if (!sub && !email) return null;
+    return { id: sub, email };
+  } catch {
+    return null;
+  }
+}

package/test/helpers/vault-service-mock.ts

@@ -126,11 +126,15 @@ export function mockVaultService(opts: MockVaultOptions): () => void {
     // 404s, which the reader normalizes to NoSuchKey (the not-found path).
     if (method === "POST" && /\/v1\/files\/presign$/.test(url)) {
       const body = init?.body ? JSON.parse(init.body.toString()) : {};
-      const keys = (body.keys ?? []) as Array<{ key: string }>;
+      const keys = (body.keys ?? []) as Array<{ key: string; op?: string }>;
+      // Echo the requested op and omit `error` on success. hq-cloud >=6.11.x
+      // validates each presign result with a strict schema (op ∈ get|put|delete;
+      // error must be a string when present), so the older `error: null` +
+      // missing-op shape no longer passes.
       const results = keys.map((k) => ({
         key: k.key,
+        op: k.op ?? "get",
         url: `${PRESIGN_URL_HOST}/obj?key=${encodeURIComponent(k.key)}`,
-        error: null,
       }));
       return json({
         results,

package/vitest.e2e.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["e2e/**/*.test.ts"],
+  },
+});