@indigoai-us/hq-cli 5.50.1 → 5.51.0

package/dist/bin/hq-auth-refresh.d.ts

@@ -10,5 +10,5 @@
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
  */
-export {};
+import "../node-preflight.js";
 //# sourceMappingURL=hq-auth-refresh.d.ts.map

package/dist/bin/hq-auth-refresh.js

@@ -10,8 +10,11 @@
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
  */
+// MUST be first: guard the Node version before any dependency that needs a
+// Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="03d2c531-f620-5d93-a87b-9a87264ad77b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3c7e1b4e-66dc-5fe8-b828-cd3636df1fbb")}catch(e){}}();
+import "../node-preflight.js";
 import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
 initSentry();
@@ -38,4 +41,4 @@ initSentry();
     }
 })();
 //# sourceMappingURL=hq-auth-refresh.js.map
-//# debugId=03d2c531-f620-5d93-a87b-9a87264ad77b
+//# debugId=3c7e1b4e-66dc-5fe8-b828-cd3636df1fbb

package/dist/commands/members.d.ts

@@ -12,6 +12,22 @@ export interface PendingInvite {
     invitedBy: string;
     invitedAt: string;
 }
+/**
+ * An ACTIVE member of a company, as returned by
+ * `GET /membership/company/{companyUid}`. The server filters to
+ * `status: "active"` and enriches each row with resolved person metadata
+ * (`personEmail` / `personName` / `personSlug`) when available.
+ */
+export interface ActiveMember {
+    membershipKey: string;
+    personUid: string;
+    companyUid: string;
+    role: string;
+    status: string;
+    personEmail?: string;
+    personName?: string;
+    personSlug?: string;
+}
 export interface InviteOptions {
     target: string;
     role: string;
@@ -114,6 +130,7 @@ export declare class InviteHttpError extends Error {
 }
 export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+export declare function listActiveMembers(token: string, companyUid: string): Promise<ActiveMember[]>;
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="40f5379c-742e-5cd5-aba2-931856dc7dd3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8244d720-094e-5d4e-b813-75086ed0849d")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -196,6 +196,20 @@ export async function listPendingInvites(token, companyUid) {
     const data = (await res.json());
     return data?.pending ?? data?.invites ?? [];
 }
+export async function listActiveMembers(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/membership/company/${encodeURIComponent(companyUid)}`,
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
+    }
+    // Server schema: `{ members: [...] }` — active members only, enriched with
+    // resolved person metadata (personEmail / personName / personSlug).
+    const data = (await res.json());
+    return data?.members ?? [];
+}
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:
@@ -422,43 +436,66 @@ export function registerMembersCommand(program) {
     });
     members
         .command("list")
-        .description("List pending invites for the company")
-        .action(async () => {
+        .description("List the company's active members (use --pending for pending invites)")
+        .option("--pending", "List pending invites instead of active members")
+        .action(async (opts) => {
         try {
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            const invites = await listPendingInvites(token, companyUid);
-            if (invites.length === 0) {
-                console.log(chalk.gray("No pending invites for this company."));
+            if (opts.pending) {
+                // --pending: preserve the original pending-invites view verbatim.
+                const invites = await listPendingInvites(token, companyUid);
+                if (invites.length === 0) {
+                    console.log(chalk.gray("No pending invites for this company."));
+                    return;
+                }
+                const targetW = Math.max(6, ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length));
+                const roleW = Math.max(4, ...invites.map((i) => i.role.length));
+                const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
+                const keyW = Math.max(14, ...invites.map((i) => i.membershipKey.length));
+                console.log(chalk.bold([
+                    "TARGET".padEnd(targetW),
+                    "ROLE".padEnd(roleW),
+                    "INVITED_BY".padEnd(byW),
+                    "INVITED_AT",
+                    "MEMBERSHIP_KEY".padEnd(keyW),
+                ].join("  ")));
+                for (const inv of invites) {
+                    const target = inv.inviteeEmail ?? inv.personUid ?? "";
+                    console.log([
+                        target.padEnd(targetW),
+                        inv.role.padEnd(roleW),
+                        inv.invitedBy.padEnd(byW),
+                        shortDate(inv.invitedAt),
+                        inv.membershipKey.padEnd(keyW),
+                    ].join("  "));
+                }
+                return;
+            }
+            // Default: list ACTIVE members so their emails drop straight into
+            // `hq secrets share <path> --with <email>`.
+            const activeMembers = await listActiveMembers(token, companyUid);
+            if (activeMembers.length === 0) {
+                console.log(chalk.gray("No active members found for this company."));
                 return;
             }
-            const targetW = Math.max(6, ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length));
-            const roleW = Math.max(4, ...invites.map((i) => i.role.length));
-            const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
-            const keyW = Math.max(14, ...invites.map((i) => i.membershipKey.length));
-            console.log(chalk.bold([
-                "TARGET".padEnd(targetW),
-                "ROLE".padEnd(roleW),
-                "INVITED_BY".padEnd(byW),
-                "INVITED_AT",
-                "MEMBERSHIP_KEY".padEnd(keyW),
-            ].join("  ")));
-            for (const inv of invites) {
-                const target = inv.inviteeEmail ?? inv.personUid ?? "";
-                console.log([
-                    target.padEnd(targetW),
-                    inv.role.padEnd(roleW),
-                    inv.invitedBy.padEnd(byW),
-                    shortDate(inv.invitedAt),
-                    inv.membershipKey.padEnd(keyW),
-                ].join("  "));
+            const emailW = Math.max(5, ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length));
+            const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
+            console.log(chalk.bold(["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW), "NAME"].join("  ")));
+            for (const m of activeMembers) {
+                const email = m.personEmail ?? m.personUid;
+                const name = m.personName ?? m.personSlug ?? "";
+                console.log([email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "));
             }
+            console.log(chalk.gray("Share a secret with a member: hq secrets share <path> --with <email>"));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
                 const msg = err.status === 403
-                    ? "Not authorized — only admins and owners can list invites"
+                    ? opts.pending
+                        ? "Not authorized — only admins and owners can list invites"
+                        : "Not authorized — only company members can list members"
                     : formatInviteHttpError(err.status, err.message);
                 console.error(chalk.red(msg));
                 process.exit(1);
@@ -497,4 +534,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=40f5379c-742e-5cd5-aba2-931856dc7dd3
+//# debugId=8244d720-094e-5d4e-b813-75086ed0849d

package/dist/commands/onboard-warning.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Builds the static create-time warning surfaced by both `create-company` and
+ * `dry-run`, because users may accidentally create duplicate companies instead
+ * of joining the existing company they were invited to.
+ */
+export declare function buildCreateCompanyWarning(): string;
+//# sourceMappingURL=onboard-warning.d.ts.map

package/dist/commands/onboard-warning.js

@@ -0,0 +1,14 @@
+/**
+ * Builds the static create-time warning surfaced by both `create-company` and
+ * `dry-run`, because users may accidentally create duplicate companies instead
+ * of joining the existing company they were invited to.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="853f43ae-d902-54b9-9279-8a4b1d5f7693")}catch(e){}}();
+export function buildCreateCompanyWarning() {
+    return ("  This creates a NEW company that you own — it does NOT join an existing one.\n" +
+        "  If your company already uses HQ, do NOT create it again: ask your admin or owner to send you an invite, then accept it and run `hq sync` to pull the existing company.\n" +
+        "  Creating a same-named company makes a separate one you'd be alone in.\n");
+}
+//# sourceMappingURL=onboard-warning.js.map
+//# debugId=853f43ae-d902-54b9-9279-8a4b1d5f7693

package/dist/commands/onboard.js

@@ -19,13 +19,14 @@
  * browser-OAuth flow opens automatically.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="05a49c9b-23bc-5b96-b5e1-cc2e573b11c3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="235a4623-0834-5428-957c-0c8bbe96d089")}catch(e){}}();
 import chalk from "chalk";
 import { runOnboardCli, readCheckpoint } from "@indigoai-us/hq-onboarding";
 import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { createDefaultVaultClient } from "./cloud-provision.js";
 import { detectOnboardingIdentityMismatch } from "./onboard-identity-guard.js";
 import { planOnboardJoin } from "./onboard-join.js";
+import { buildCreateCompanyWarning } from "./onboard-warning.js";
 // ---------------------------------------------------------------------------
 // Command registration
 // ---------------------------------------------------------------------------
@@ -49,9 +50,7 @@ export function registerOnboardCommand(program) {
             console.log(`  Company:  ${options.name} (${options.slug})`);
             console.log(`  Person:   ${options.personName} <${options.email}>`);
             console.log(`  HQ root:  ${options.hqRoot}\n`);
-            console.log(chalk.gray("  This creates a NEW company you own. Joining a teammate's existing\n" +
-                "  company? Stop — accept your invite, then run `hq sync` to pull it.\n" +
-                "  Creating a same-named company leaves you alone in a separate one.\n"));
+            console.log(chalk.gray(buildCreateCompanyWarning()));
             const accessToken = await ensureCognitoToken();
             const result = await runOnboardCli({
                 mode: "create-company",
@@ -179,6 +178,7 @@ export function registerOnboardCommand(program) {
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .action(async (options) => {
         try {
+            console.log(chalk.gray(buildCreateCompanyWarning()));
             // No auth needed for dry-run — runOnboardCli handles this branch
             // without touching the vault-service.
             const result = await runOnboardCli({
@@ -198,4 +198,4 @@ export function registerOnboardCommand(program) {
     });
 }
 //# sourceMappingURL=onboard.js.map
-//# debugId=05a49c9b-23bc-5b96-b5e1-cc2e573b11c3
+//# debugId=235a4623-0834-5428-957c-0c8bbe96d089

package/dist/commands/pack-install.d.ts

@@ -259,6 +259,18 @@ export declare function verifyArtifact(input: VerifyArtifactInput): void;
  */
 export declare function validateMcpManifest(payloadDir: string, item: string): void;
 export declare function validateManifest(payloadDir: string, hqVersion: string | null): PackManifest;
+/**
+ * Enforce a pack's `requires.packs`: every named dependency MUST already be
+ * installed (and satisfy its optional semver RANGE) before we write anything.
+ *
+ * Installed packs are discovered by FILESYSTEM PRESENCE via `listInstalledPacks`
+ * — deliberately NOT `modules.yaml`, which `installPack` no longer writes under
+ * the v12+ layout (a modules.yaml-based check would silently ignore every modern
+ * pack). Throws on the first unmet dependency so the install aborts with NO
+ * partial state (it is called before installToPackages). No-op when
+ * `requires.packs` is absent/empty, keeping legacy packs unaffected.
+ */
+export declare function assertPackDependencies(hqRoot: string, pkg: PackManifest): void;
 /**
  * Derive the safe, auto-generated "get started" line for a freshly installed
  * pack from its `initialization.entrypoint` ONLY. PHASE 1 deliberately ignores

package/dist/commands/pack-install.js

@@ -34,7 +34,7 @@
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fbfbcf69-d410-51cb-ae59-886c451b3a55")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0ec07d3a-ee86-51fd-adbd-2608c620ae99")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -48,7 +48,7 @@ import semverValid from 'semver/functions/valid.js';
 import semverValidRange from 'semver/ranges/valid.js';
 import semverGt from 'semver/functions/gt.js';
 import { findHqRoot } from '../utils/manifest.js';
-import { readHqVersion, routeContribution } from '../utils/pack-contributions.js';
+import { readHqVersion, routeContribution, listInstalledPacks } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
 import { vaultApiFetchPublic } from '../utils/vault-api.js';
@@ -907,6 +907,32 @@ export function validateManifest(payloadDir, hqVersion) {
     if (hqVersion && !semverSatisfies(hqVersion, range, { includePrerelease: true })) {
         throw new Error(`Host hqCore ${hqVersion} does not satisfy pack requirement ${range}`);
     }
+    // 6b. requires.packs (M0) — OPTIONAL pack-to-pack dependencies. Absent → legacy
+    // behavior (hqCore is the only prerequisite). Present → a list of
+    // { name, version? } where `name` is a valid hq-pack name and `version` (if
+    // given) is a valid semver RANGE. SHAPE validation only (no filesystem) so a
+    // malformed dependency can't masquerade as valid; whether the named packs are
+    // actually INSTALLED is enforced at install time by assertPackDependencies
+    // (which needs hqRoot — a pure manifest validator doesn't have it).
+    const reqPacks = m.requires?.packs;
+    if (reqPacks !== undefined) {
+        if (!Array.isArray(reqPacks)) {
+            throw new Error('requires.packs must be a list of { name, version? } entries');
+        }
+        for (const dep of reqPacks) {
+            if (!dep || typeof dep !== 'object' || Array.isArray(dep)) {
+                throw new Error('requires.packs entries must be mappings with a name (and optional version)');
+            }
+            const d = dep;
+            if (typeof d.name !== 'string' || !/^hq-pack-[a-z0-9][a-z0-9-]*$/.test(d.name)) {
+                throw new Error(`requires.packs[].name "${d.name}" must match ^hq-pack-[a-z0-9][a-z0-9-]*$`);
+            }
+            if (d.version !== undefined &&
+                (typeof d.version !== 'string' || !semverValidRange(d.version))) {
+                throw new Error(`requires.packs entry for "${d.name}" has an invalid version range "${d.version}"`);
+            }
+        }
+    }
     // 7. contributes has at least one non-empty subfield
     const contributes = (m.contributes ?? {});
     const nonEmpty = Object.values(contributes).some((v) => Array.isArray(v) && v.length > 0);
@@ -1007,6 +1033,46 @@ export function validateManifest(payloadDir, hqVersion) {
     return m;
 }
 // ---------------------------------------------------------------------------
+// Pack-to-pack dependency pre-flight (M0)
+// ---------------------------------------------------------------------------
+/**
+ * Enforce a pack's `requires.packs`: every named dependency MUST already be
+ * installed (and satisfy its optional semver RANGE) before we write anything.
+ *
+ * Installed packs are discovered by FILESYSTEM PRESENCE via `listInstalledPacks`
+ * — deliberately NOT `modules.yaml`, which `installPack` no longer writes under
+ * the v12+ layout (a modules.yaml-based check would silently ignore every modern
+ * pack). Throws on the first unmet dependency so the install aborts with NO
+ * partial state (it is called before installToPackages). No-op when
+ * `requires.packs` is absent/empty, keeping legacy packs unaffected.
+ */
+export function assertPackDependencies(hqRoot, pkg) {
+    const deps = pkg.requires?.packs ?? [];
+    if (deps.length === 0)
+        return;
+    const installed = new Map();
+    for (const p of listInstalledPacks(hqRoot)) {
+        // Key on the manifest name when readable, else the directory name.
+        installed.set(p.manifest?.name ?? p.name, p.manifest?.version);
+    }
+    for (const dep of deps) {
+        if (dep.name === pkg.name) {
+            throw new Error(`Pack ${pkg.name} cannot list itself in requires.packs.`);
+        }
+        if (!installed.has(dep.name)) {
+            throw new Error(`Pack ${pkg.name} requires ${dep.name}, which is not installed. ` +
+                `Install it first, e.g.: hq install marketplace:${dep.name}`);
+        }
+        if (dep.version) {
+            const have = installed.get(dep.name);
+            if (!have || !semverSatisfies(have, dep.version, { includePrerelease: true })) {
+                throw new Error(`Pack ${pkg.name} requires ${dep.name} ${dep.version}, but ` +
+                    `${dep.name}${have ? ` ${have}` : ' (version unknown)'} is installed.`);
+            }
+        }
+    }
+}
+// ---------------------------------------------------------------------------
 // Post-install get-started line (US-005)
 // ---------------------------------------------------------------------------
 /**
@@ -1482,6 +1548,11 @@ export async function installPack(source, opts = {}) {
                 break;
         }
         const pkg = validateManifest(fetched.payloadDir, hqVersion);
+        // M0 — pack-to-pack dependency pre-flight. Runs BEFORE any prompts or writes
+        // so a missing/unsatisfied `requires.packs` aborts with no partial state, and
+        // before we bother the operator with hook/MCP trust prompts for a pack that
+        // can't install anyway.
+        assertPackDependencies(hqRoot, pkg);
         if (pkg.conditional) {
             const allowed = await confirmConditional(pkg, opts.allowHooks ?? false);
             if (!allowed) {
@@ -1558,4 +1629,4 @@ export async function installPack(source, opts = {}) {
     }
 }
 //# sourceMappingURL=pack-install.js.map
-//# debugId=fbfbcf69-d410-51cb-ae59-886c451b3a55
+//# debugId=0ec07d3a-ee86-51fd-adbd-2608c620ae99

package/dist/commands/packs.js

@@ -18,7 +18,7 @@
  * Spec: knowledge/public/hq-core/package-yaml-spec.md.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="570f7491-8d05-577c-8bae-6f6cf7dfb2ec")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="69746edd-f9d8-528e-8902-de799c58bd8a")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as readline from 'readline';
@@ -27,7 +27,7 @@ import chalk from 'chalk';
 import semverSatisfies from 'semver/functions/satisfies.js';
 import { findHqRoot } from '../utils/manifest.js';
 import { classify, resolveLatest, resolveLatestMarketplace, runScanPackages, installPack, } from './pack-install.js';
-import { contributionLinks, linkStatus, listInstalledPacks, readPackManifest, unwirePack, unwirePackMcp, readHqVersion, readRecommendedPackages, packagesDir, } from '../utils/pack-contributions.js';
+import { contributionLinks, linkStatus, listInstalledPacks, findDependentPacks, readPackManifest, unwirePack, unwirePackMcp, readHqVersion, readRecommendedPackages, packagesDir, } from '../utils/pack-contributions.js';
 function resolveRoot(opts) {
     return opts.hqRoot ? path.resolve(opts.hqRoot) : findHqRoot();
 }
@@ -278,6 +278,19 @@ async function runUninstall(name, opts) {
     if (!manifest) {
         warnings.push('package.yaml unreadable -- host symlinks could not be computed precisely; ran a re-scan to reconcile.');
     }
+    // 0. Dependents guard (M0): refuse to remove a pack that another installed pack
+    // lists in its `requires.packs`, unless --force. Filesystem presence is the
+    // source of truth (listInstalledPacks), consistent with the install-time
+    // assertPackDependencies check. Runs BEFORE any un-wiring so a blocked uninstall
+    // leaves the pack fully intact.
+    if (!opts.force) {
+        const dependents = findDependentPacks(listInstalledPacks(hqRoot), name);
+        if (dependents.length > 0) {
+            const who = dependents.map((p) => p.manifest?.name ?? p.name).join(', ');
+            throw new Error(`Cannot uninstall "${name}": required by ${who}. ` +
+                `Uninstall the dependent pack(s) first, or pass --force to override.`);
+        }
+    }
     // 1. Un-wire only our symlinks.
     const { unlinked, skipped } = unwirePack(hqRoot, packDir, contributes);
     // 1b. Un-register the pack's MCP (`wire: 'merge'`) servers — invisible to the
@@ -417,6 +430,7 @@ export function registerPacksCommand(parent) {
         .option('--hq-root <path>', 'HQ root (default: auto-detect)')
         .option('-y, --yes', 'Skip confirmation')
         .option('--no-archive', 'Delete instead of archiving')
+        .option('--force', 'Uninstall even if other installed packs require this one')
         .action(async (name, opts) => {
         try {
             if (!opts.yes) {
@@ -449,4 +463,4 @@ export function registerPacksCommand(parent) {
     });
 }
 //# sourceMappingURL=packs.js.map
-//# debugId=570f7491-8d05-577c-8bae-6f6cf7dfb2ec
+//# debugId=69746edd-f9d8-528e-8902-de799c58bd8a

package/dist/commands/people.d.ts

@@ -11,6 +11,16 @@
  * named by `--company`); nothing reads across company boundaries.
  */
 import { Command } from "commander";
+import { resolveNameToEmail, type PersonRecord } from "../utils/people.js";
+export type RefreshPeopleRoster = (hqRoot: string, companySlug: string) => Promise<void>;
+interface PeopleCommandDeps {
+    refreshRoster?: RefreshPeopleRoster;
+}
+interface PeopleLookupOpts {
+    localOnly?: boolean;
+    json?: boolean;
+}
+export declare function refreshPeopleRosterFromCloud(hqRoot: string, companySlug: string): Promise<void>;
 /**
  * Resolve the single company to operate on. Explicit `--company` always wins
  * (after a path-safety check). Otherwise the active company is inferred from
@@ -18,5 +28,20 @@ import { Command } from "commander";
  * do, the caller must disambiguate with `--company`.
  */
 export declare function resolveCompanySlug(hqRoot: string, explicit: string | undefined): string;
-export declare function registerPeopleCommand(program: Command): void;
+export declare function resolvePersonWithRosterFallback(input: {
+    hqRoot: string;
+    slug: string;
+    name: string;
+    opts?: PeopleLookupOpts;
+    refreshRoster?: RefreshPeopleRoster;
+}): Promise<ReturnType<typeof resolveNameToEmail>>;
+export declare function searchPeopleWithRosterFallback(input: {
+    hqRoot: string;
+    slug: string;
+    keyword: string;
+    opts?: PeopleLookupOpts;
+    refreshRoster?: RefreshPeopleRoster;
+}): Promise<PersonRecord[]>;
+export declare function registerPeopleCommand(program: Command, deps?: PeopleCommandDeps): void;
+export {};
 //# sourceMappingURL=people.d.ts.map

package/dist/commands/people.js

@@ -11,14 +11,31 @@
  * named by `--company`); nothing reads across company boundaries.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="076b7f64-6626-5733-8992-ab9361a3e31d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="79abc1f5-4f5a-5c95-b29b-10f04417355f")}catch(e){}}();
 import * as fs from "fs";
 import { Option } from "commander";
 import chalk from "chalk";
+import { VaultClient } from "@indigoai-us/hq-cloud";
 import * as yaml from "js-yaml";
 import { findHqRoot } from "../utils/manifest.js";
 import { manifestPath } from "./cloud-provision.js";
+import { DEFAULT_COGNITO, buildVaultConfig, ensureCognitoToken, } from "../utils/cognito-session.js";
+import { getCompanyUid } from "../utils/vault-api.js";
+import { createCompanyPresignClient, runGet } from "./files-browse.js";
 import { assertSafeCompanySlug, listCompanyPeople, searchPeople, resolveNameToEmail, companyPeopleDir, } from "../utils/people.js";
+export async function refreshPeopleRosterFromCloud(hqRoot, companySlug) {
+    const accessToken = await ensureCognitoToken();
+    const client = new VaultClient(buildVaultConfig(accessToken));
+    await getCompanyUid(accessToken, companySlug);
+    await runGet({
+        path: `companies/${companySlug}/people/`,
+        hqRoot,
+        companySlug,
+        vaultClient: client,
+        companyClient: ({ companyUid }) => createCompanyPresignClient({ token: accessToken, companyUid }),
+        region: DEFAULT_COGNITO.region,
+    });
+}
 /** Companies that still exist (anything not explicitly `status: archived`). */
 function activeCompanySlugs(manifest) {
     const companies = manifest.companies ?? {};
@@ -86,7 +103,39 @@ function fail(message) {
     console.error(chalk.red(message));
     process.exit(1);
 }
-export function registerPeopleCommand(program) {
+function logRefreshFailure(companySlug, err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(chalk.dim(`  Could not refresh people roster for '${companySlug}': ${message}`));
+}
+async function tryRefreshRoster(refreshRoster, hqRoot, slug) {
+    try {
+        await refreshRoster(hqRoot, slug);
+        return true;
+    }
+    catch (err) {
+        logRefreshFailure(slug, err);
+        return false;
+    }
+}
+export async function resolvePersonWithRosterFallback(input) {
+    const local = resolveNameToEmail(listCompanyPeople(input.hqRoot, input.slug), input.name);
+    if (local.status !== "not_found" || input.opts?.localOnly)
+        return local;
+    const refreshed = await tryRefreshRoster(input.refreshRoster ?? refreshPeopleRosterFromCloud, input.hqRoot, input.slug);
+    if (!refreshed)
+        return local;
+    return resolveNameToEmail(listCompanyPeople(input.hqRoot, input.slug), input.name);
+}
+export async function searchPeopleWithRosterFallback(input) {
+    const local = searchPeople(listCompanyPeople(input.hqRoot, input.slug), input.keyword);
+    if (local.length > 0 || input.opts?.localOnly)
+        return local;
+    const refreshed = await tryRefreshRoster(input.refreshRoster ?? refreshPeopleRosterFromCloud, input.hqRoot, input.slug);
+    if (!refreshed)
+        return local;
+    return searchPeople(listCompanyPeople(input.hqRoot, input.slug), input.keyword);
+}
+export function registerPeopleCommand(program, deps = {}) {
     const people = program
         .command("people")
         .description("List, search, and resolve a company's people (from companies/<co>/people)")
@@ -122,12 +171,19 @@ export function registerPeopleCommand(program) {
         .command("search <keyword>")
         .description("Keyword search over people names and emails")
         .option("--json", "Output JSON instead of a table")
-        .action((keyword, opts) => {
+        .option("--local-only", "Skip cloud fallback; search only the local people roster")
+        .action(async (keyword, opts) => {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
             const slug = resolveCompanySlug(hqRoot, scope.company);
-            const matches = searchPeople(listCompanyPeople(hqRoot, slug), keyword);
+            const matches = await searchPeopleWithRosterFallback({
+                hqRoot,
+                slug,
+                keyword,
+                opts,
+                refreshRoster: deps.refreshRoster,
+            });
             if (opts.json) {
                 console.log(JSON.stringify(matches, null, 2));
                 return;
@@ -146,12 +202,19 @@ export function registerPeopleCommand(program) {
         .command("resolve <name>")
         .description("Resolve a person name to their email address")
         .option("--json", "Output JSON instead of plain text")
-        .action((name, opts) => {
+        .option("--local-only", "Skip cloud fallback; resolve only from the local people roster")
+        .action(async (name, opts) => {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
             const slug = resolveCompanySlug(hqRoot, scope.company);
-            const result = resolveNameToEmail(listCompanyPeople(hqRoot, slug), name);
+            const result = await resolvePersonWithRosterFallback({
+                hqRoot,
+                slug,
+                name,
+                opts,
+                refreshRoster: deps.refreshRoster,
+            });
             if (opts.json) {
                 console.log(JSON.stringify(result, null, 2));
                 if (result.status === "found")
@@ -184,4 +247,4 @@ export function registerPeopleCommand(program) {
     });
 }
 //# sourceMappingURL=people.js.map
-//# debugId=076b7f64-6626-5733-8992-ab9361a3e31d
+//# debugId=79abc1f5-4f5a-5c95-b29b-10f04417355f

package/dist/commands/secrets-scope.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Pure helpers describing WHICH secrets scope a command acted on, so `set` and
+ * `list` can echo it. Users were setting a secret in one scope (personal vs a
+ * company, or company A vs B) and listing another, then seeing "no secrets" with
+ * no indication the scopes differed (feedback_70e059da).
+ */
+export interface SecretsScopeRef {
+    /** True when --personal was used (caller's personal vault). */
+    personal: boolean;
+    /** The slug the user passed via --company, if any. */
+    companySlug?: string;
+    /** Resolved entity uid: prs_* for personal, cmp_* for a company. */
+    companyUid: string;
+}
+/** Human label for a secrets scope: "your personal vault" or "company <slug-or-uid>". */
+export declare function describeSecretsScope(ref: SecretsScopeRef): string;
+export declare function formatSecretSaved(name: string, scope: string): string;
+export declare function formatSecretsListHeader(scope: string): string;
+export declare function formatSecretsListEmpty(scope: string): string;
+//# sourceMappingURL=secrets-scope.d.ts.map

package/dist/commands/secrets-scope.js

@@ -0,0 +1,19 @@
+/** Human label for a secrets scope: "your personal vault" or "company <slug-or-uid>". */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="718913a3-f80f-5bff-928e-a7aa9f51dd0d")}catch(e){}}();
+export function describeSecretsScope(ref) {
+    if (ref.personal)
+        return "your personal vault";
+    return `company ${ref.companySlug ?? ref.companyUid}`;
+}
+export function formatSecretSaved(name, scope) {
+    return `Secret '${name}' saved to ${scope}.`;
+}
+export function formatSecretsListHeader(scope) {
+    return `Secrets for ${scope}:`;
+}
+export function formatSecretsListEmpty(scope) {
+    return `No secrets found for ${scope}.`;
+}
+//# sourceMappingURL=secrets-scope.js.map
+//# debugId=718913a3-f80f-5bff-928e-a7aa9f51dd0d